Cloud-based media library management for Web and mobile applications - <AUTHOR> http://cloudinary.com/blog/cloud_based_media_library_management_for_web_and_mobile_applications

<comment><AUTHOR> This blog post introduces Cloudinary's new cloud-based media library and transformation management UI. Whether you are are developing in Rails, PHP, Django, .NET or other frameworks, you can use this new library to browse through all user uploaded images, perform manual image uploads and use the visual interactive interface to generate image transformations that matches your websites' graphic design.</comment>


Oberon-2, a hi-performance alternative to C++ (1996) - <AUTHOR> http://www.modulaware.com/mdltws.htm

<comment><USER2> I dont exactly remember who said it, perhaps Andrei Alexandrescu, that only a few other than Nicholas Wirth epitomizes this drive to perfect something with a persistent passion. Throwing away valiant efforts and starting from the beginning again and again. He designed Algol(W), Pascal, Modula, Modula-2, Oberon..Oberon-2. I know none of these languages enough to know how much their feature sets overlap, but it indeed seems exceptional

<comment><USER3> Algol(W) comes from the messy world of Algol standardization, has its tails in the early days of mainframe programming, before structured programming was fully crystallized, and the modern epoch.

Pascal is a clean up of the early Algol efforts, with committee-designs removed for the service of CS students. What remained is an excellent academic language that increasingly had to bow to industry pressures to be "C-like". Original Pascal was compiled to byte-code, often interpreted, but by the 80s many Pascals had inline assembly language extensions, OS-specific hooks and other artifacts of systems programming.

Modula is a much as Wirth's as type-theorists who really created its foundations, it's far bigger than a one man effort. Modula also saw tremendous funding & industry support, until it was "eclipsed" by Ada.

Oberon is the Scheme-sized Algol dialect. It's a tiny little programming language, with its own tiny graphical operating system, tiny compiler, etc. Closest thing to an "AlgolM" (I'm sure he took more than a hint from the Lisp school.) Oberon is his meditation on the sublime .. something for future generations. I would love to see an _Oberon Laptop Per Child_.

<comment><USER4> Re OLPC: The Ceres computers built at ETH by N. Wirth between 1985 and 1990 came close. They weren't laptops, but had been designed from the ground up (i.e. hardware, operating system, programming language) to be fully understandable and teachable. The OS was booted from ROM and took only a few seconds to show up on the screen. Project Oberon was documented in the book [http://www.inf.ethz.ch/personal/wirth/books/ProjectOberon.pd...](http://www.inf.ethz.ch/personal/wirth/books/ProjectOberon.pdf)

</comment></comment></comment><comment><USER5> "What are Go's ancestors?

Go is mostly in the C family (basic syntax), with significant input from the Pascal/Modula/Oberon family (declarations, packages), plus some ideas from languages inspired by Tony Hoare's CSP, such as Newsqueak and Limbo (concurrency). However, it is a new language across the board. In every respect the language was designed by thinking about what programmers do and how to make programming, at least the kind of programming we do, more effective, which means more fun. " source: <http://golang.org/doc/go_faq.html>

</comment><comment><USER5> Maybe you want to try the lightweight Windows-GUI-IDE "BlackBox Component Builder" by Oberon microsystems AG, Zurich (Switzerland), based on "Component Pascal" (AFAIK an improved Oberon-2 descendant). Latest downloadable version is 1.6RC6 see <http://www.oberon.ch/blackbox.html>

</comment><comment><USER6> Speaking of Oberon, I always thought the Oberon operating system was kind of interesting, especially its GUI.

<http://en.wikipedia.org/wiki/Oberon_(operating_system)>

<comment><AUTHOR> PDF: Oberon – The Overlooked Jewel <http://www.ics.uci.edu/~franz/Site/pubs- pdf/BC03.pdf>

Google site search for HN for Oberon os: [https://www.google.com/search?&q=oberon+os+site%3Anews.y...](https://www.google.com/search?&q=oberon+os+site%3Anews.ycombinator.com)

</comment></comment><comment><USER4> To build native Windows applications in Oberon 2 (later extended and renamed to Component Pascal) check the free and open source BlackBox IDE and runtime environment developed by Oberon microsystems <http://oberon.ch/blackbox.html#Free_Download>

</comment><comment><USER7> If you want to play with the current version, try: <http://www.oberon.ethz.ch/downloads/index> I am fascinated with languages old and new and might well give this one a shot just to see what is going on. Note that the above is current, not 1996...

<comment><USER8> I believe all those are versions of Oberon-the-operating-system. For playing with the language, I'd rather have a stand-alone compiler...

<comment><USER9> <http://spivey.oriel.ox.ac.uk/corner/Oxford_Oberon-2_compiler> is one I know of...</comment></comment></comment>


Clang builds a working Linux Kernel - <AUTHOR> http://lists.cs.uiuc.edu/pipermail/cfe-dev/2010-October/011711.html <comment><USER2> Cool but somewhat unpractical option: soon it might be possible to boot an optimized kernel from source, like <http://bellard.org/tcc/tccboot.html>

<comment><USER3> Right. Except that was last updated 6 years ago.

<comment><USER2> Exactly, with Clang/LLVM it would be possible to have the same thing with a modern, cross-platform frontend/backend!</comment></comment></comment>


The Soccket Is An Electricity-Generating Soccer Ball For The Developing World - <AUTHOR> http://techcrunch.com/2013/02/28/the-soccket-is-an-electricity-generating-soccer-ball-for-the-developing-world/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Techcrunch+%28TechCrunch%29&utm_content=Google+Reader <comment><AUTHOR> This is a favorite of mine, awesome example of innovative discovery of unused energy!</comment>


Redis 2.2.3 released - <AUTHOR> https://github.com/antirez/redis/raw/2.2/00-RELEASENOTES

<comment><USER2> A heads-up for anyone upgrading - 2.2.4 is now released.

        Warning, going to release 2.2.4 in seconds as I decided
        to change the semantics of OBJECT command to avoid
        problems in the future.

<https://twitter.com/#!/antirez/status/55621384126201856>

<comment><USER3> True, the change is really minimal, but will prevent some incompatibility in the future. Btw 2.2.4 already released.

The change is about the return of the "OBJECT encoding" command against a sorted set. Since sorted sets have no special encoding yet (the special internal encoding Redis uses to save space for small lists, sets, ...) 2.2.3 used to return "raw". But since Pieter Noordhuis coded an awesome patch to bring specially encoded sorted sets to us, and a few cool guys are testing it since weeks with no problems, I think that we'll soon get it merged in the 2.2 branch.

When we'll have specially encoded sorted sets OBJECT encoding against a sorted set will return either "skiplist" or "ziplist", so I modified the return value to return just "skiplist" now. So after the merge everything will still be compatible.

A lot of words for a simple change, but semantics is important!

</comment></comment><comment><USER4> Can someone explain why they feel this should be on the front page? It's just a minor release fixing a few bugs.

<comment><USER3> I honestly agree... better to take HN front page space for major releases and other important news about open source software, so that there is more space for all the rest. So thanks for posting this on Hacker News, but probably who is interested in knowing about minor releases is already following me on twitter. Next time I'll try to be more informative writing a blog post that announces the new release with some fresh information about development or about what you can do with the new features (for instance the OBJECT command) so that it is more interesting to have it in the front page for some time.</comment></comment>


Curious how bitcoin works? Bitfloor founder spells it out on video ( 28:08) - <AUTHOR> http://5in5nyc.com/2012/06/20/5in5nyc-ep-07-10gen-friends-mongodb-bitfloor-nextbigsound-crowdtap-art-sy/ <comment><USER2> The Udacity "Applied Cryptography" course covers Bitcoin at the end of Unit 6. Here are the videos:

<http://www.youtube.com/watch?v=CdsS8jFVv2c>

<http://www.youtube.com/watch?v=zJxVXyvccgI>

<http://www.youtube.com/watch?v=4UF9zYU0jZI>

<http://www.youtube.com/watch?v=JRPu-vUdJU0>

They range from under two minutes to a bit over 3 minutes.

PS: that course is excellent. If you are at all interested in cryptography, I highly recommend it.

<comment><USER3> What did you like about it?

<comment><USER2> Several things. The instructor, David Evans of the University of Virginia, has a really infections goofy enthusiasm that keeps your interest. He covered a good range of topics, with a nice mix of practical, historical, and theoretical. Here's very short summary from the syllabus:

Unit 1: Perfect Ciphers. What makes certain ciphers perfect, how the Lorenz Cipher was broken

Unit 2: Symmetric Encryption. Sending messages when two people share a secret

Unit 3: Key Exchange. Technics to establish a shared secret

Unit 4: Asymmetric Encryption. Exchanging information using public key cryptosystems

Unit 5: Public Key Protocols. Encrypted key exchange, certificates, secure commerce

Unit 6: Using Cryptographic Primitives. How cryptography can be useful for anonymizing communication, voting, and digital cash

Unit 7: Secure Computation. Computing without exposing data

In a little more detail:

Unit 1 introduced the subject, covering OTP and giving an interesting historical account of the Lorenz cipher and the development of Colossus.

Unit 2 talked about Kolmogorov complexity, randomness, PRNGs, block cipher modes, hash function, password storage.

Unit 3 was about key exchange, mostly Diffie Hellman.

Unit 4 covered asymmetric systems, concentrating on RSA.

Unit 5 covered EKE, ssh, TLS, and certificates.

Unit 6 covered traffic analysis, onion routing, TOR, voting (Mixnet), centralized digital cash (based on blind signatures and an identity list scheme to deanonymize double spenders), decentralized digital cash (Bitcoin).

Unit 7 covered secure computation. In particular the garbled circuit protocol to let Alice and Bob evaluate a logic circuit together without revealing their inputs to each other.

Each unit had around 5 or 6 homework problems. Most were multiple choice, but there were several that involved programming.

There were also several optional challenge problems. These were instructive and a lot of fun. Here is a description of the challenge problems:

From unit 1: We were given two bit strings of the same length, about 700 bits each, and told they were the result of running two messages encoded as 7-bit ASCII through a one time pad, where the operator goofed and used the same pad for both messages. Figure out the messages.

From unit 2: we were given a list of 126 32-bit numbers, and asked to figure out the next number. Based on the material in unit 2, it was obvious this was supposed to be a weak PRNG. It turned out to be weaker then they intended--it was periodic with period 64, making it easy to solve the challenge by inspection.

From unit 3: we were given the public information from a Diffie-Hellman key exchange between Alice and Bob, AND we were told the number of multiplications that were required when Alice computed the shared key from the her secret and the data from Bob. Our task was to decrypt the message that Alice and Bob then exchanged.

From unit 4: we were given 16 separate public RSA keys, and for each we were given the cipher text of a message encrypted with that key. Our challenge was to find the plain text. This was a particularly fun challenge. I'll describe it in more detail later.

From unit 5: this was a simplified version of the BEAST attack from last year against SSL. They set up a server that operated as follows:

* It contained a secret message, M.

* We could open a session, and receive a session token.

* We could then send the server a message. The server takes our message, appends its secret message, encrypts the result with AES in CBC mode, and sends the cipher text back to us. For a given session, the server uses a fixed key, and the IV each time is the last block of the cipher text from the previous exchange.

Our task: find out M.

The final challenge was released with the final exam. Alice and Bob wish to communicate, but need our help. They each have a server. There are four commands we can do via CGI on their server:

* Open a session. That gets us a token and half of a Diffie-Hellman exchange to establish a key for that session.

* Send half of a Diffie-Hellman exchange.

* Get a message from the server.

* Send a message to the server.

We were given the URLs for the servers. Our initial task was to connect to both, establish sessions, and relay the Diffie-Hellman parameters between them, and then use get and sent to pass any messages between them.

A lot of people were a bit puzzled by this, as there were no instructions included on how to submit your answer, and since we had no idea HOW Alice and Bob are using the key they establish via DH, we can't really do a man-in-the- middle and spy on their messages. All we can do is watch the cipher text...and that turned out to be useful, because soon after they start talking, Alice would send this, in plain text:

> Eve: I need your help. My friends Alex and Betty are also using Diff ie > Hellman to exchange a key and then send encrypted messages. I think that > Betty and Bob have a hint; can you find it for me? I've given you the > information I know about their system: [http://cs387.udacity- > extras.appspot.com/pdf/final_challenge....](http://cs387.udacity- > extras.appspot.com/pdf/final_challenge.pdf). Hopefully you can find a way to > break it. Alex is also trying to help me. Can you arrange for him and I to > exchange messages? Thanks so much for your help.

Aha. That document explained how they were using the key. Now we had enough to man-in-the-middle everyone and read all the messages. What we found then was quite interesting.

Bob had a message he didn't know what to do with. Betty offered to help. Bob encrypted the message and sent it to Betty. Alex and Alice know about this, and want to know the content of the message.

Alex tells Alice that Bob has a PRNG he likes to use for OTP keys, and that he thinks Bob's PRNG is similar to A5.1 GSM. Also, Alex has a file with 1000 bits from Bob's PRNG, and he sends the URL to Alice.

Alex asks Bob if Bob is "still using that PRNG?", and Bob says "Yes; but I was only able to use one LFSR".

With this and some Googling, the diligent student can figure out Bob's PRNG, decrypt the message Bob sent to Betty, and then start a session with Alice as Eve (instead of as someone Eve is trying to impersonate). Alice asks what Eve has found. Eve can give Alice the message. Alice understands it, and tells Eve what to do to get credit for the challenge.

I think it is toss up whether that challenge or the RSA breaking challenge was more interesting.

For the RSA challenge, one message fell very fast because it was a short message and had no padding, and the public exponent was 3, and m^3 was less than n, so taking a simple integer cube root broke it. The message was "Chinese Remainder Theorem". Another also fell to taking a cube root, although this was a little tricker because m^3 was > n, but it was less than 2n.

That first message was a hint, and it turned out that there were 3 where the same message, without padding, had been encrypted with three different keys, all with exponent 3. An application of CRT broke those 3. The message of those was a recommendation to read a particular blog entry at "Freedom to Tinker" which talked about Lenstra et al's recent paper on low entropy in public keys.

Taking that as a hint and checking for pairs of moduli that are not relatively prime gave a factor of two of the keys. The message from one of these linked to this: <http://pastebin.com/hNz9gZbe> and asked what could go wrong? At that URL, you'll find some code to generate an RSA modulus, but it is doing a very bad thing with its random number generation, and it turns out that there are only about 32000 possible moduli that it can generate.

Brute force checking all of those breaks two more. One of those gives a message that talks about Fermat being a smart guy who might have some hints about factoring. As this hint suggests, a couple of the moduli turn out to have p and q that aren't too far apart, and so are easily factored.

<comment><USER3> That sounds really fun. We build an internal application (which I was going to release publicly but instead keep rewriting and rewriting because I don't trust my code enough) that does a lot of this, but at much more nitty-gritty level (ie, use inference techniques to figure out block cipher modes, that sort of thing). If you're ever interested in more challenges like this, drop me a line; I have 'em.

(I watched some of the video stuff last night, and I agree, he's really engaging; moreso than Dan Boneh was for the Stanford crypto course).

How good was the block cipher coverage? Did you end up understanding what you might look for if you had to break someone else's (say) CTR mode stream encryptor, that kind of stuff?

<comment><USER2> There was not a lot of low level stuff on block ciphers. In an early unit, he said that while it is interesting to go into how block ciphers work at the low level, he was going to omit that to get on to application of cryptography (I believe the official title of the course is "Applied Cryptograph"). He emphasized that very very few people should be designing their own block ciphers or doing their own implementation of existing designs--almost everyone should be using a library implementation that has been well tested by experts.

I haven't taken the Stanford course (I'd like to--but my schedule has just not worked out to allow it yet), but I did go look at the slides from a few of the lectures there and it appeared that they go into more detail at the lower level on ciphers and hashes. I got the impression that the Stanford course and the Udacity course would compliment each other quite a bit.

As far as breaking someone's encryptor goes, there would be some mention of how things could be exploited if the thing you were attacking had certain flaws, usually as motivation to explain why things were done a certain way. E.g., if you don't have a random nonce here, someone will be able to do this and that will reveal something about your plaintext...that kind of thing.

For the specific example of trying to break someone's system that is using a block cipher in CTR mode to make a stream encryptor, I think a student finished the Udacity course and did well would know enough to:

(1) recognize that CTR mode is essentially using the block cipher to generate the key for a OTP, so flipping bits in the ciphertext flips the corresponding bits in the decrypted plaintext. Hence, if the attacker can find out through some means enough information about the structure of the messages so as to predict what is in the plaintext (account number to receive the deposit, for instance) he can make meaningful changes (assuming the system does not include some kind of check on the message integrity).

(2) recognize that if the key and counter sequence are ever reused the consequences are essentially the same as reusing a OTP key, and so focus on how the keys and counters are being initialized.

</comment></comment></comment></comment></comment><comment><USER4> The video isn't loading for me; is there a mirror kicking around?</comment>


Controlling the TP-LINK HS100 Wi-Fi smart plug (2017) - <AUTHOR> https://blog.georgovassilis.com/2016/05/07/controlling-the-tp-link-hs100-wi-fi-smart-plug/ <comment><AUTHOR> The TP-LINK HS100 firmware is the basis for a wide range of Wifi power sockets. We discuss how we reverse-engineered the communication protocol and wrote a shell script which can switch the plug on and off.

<comment><USER2> thanks! just bought one hs110 and was in serious tinkering needs ;-)

</comment></comment><comment><USER3> Cool! I used a HS100 controlled from a Node.js library someone made to set up a wifi connectivity test rig [https://github.com/balena-io- playground/connectivity-test](https://github.com/balena-io- playground/connectivity-test) This was testing the wifi disconnect/reconnect stability of an OS (or alternatively the unplug/replug stability of a computer board + OS).

Here's the Node package I used: [https://www.npmjs.com/package/tplink- smarthome-api](https://www.npmjs.com/package/tplink-smarthome-api) it could be made into a cool little CLI as well I guess.

HS100 is quite good, though after running/controlling it for a while, do end up sometimes in a case when it says its socket is off (LED shows that too), but the item plugged in is clearly powered. .. Kinda "you had one job...." situation. It doesn't happen too often, but enough to be careful about, if you switch it a lot.

</comment><comment><USER4> Tasmota is probably _the_ open source firmware for smart switches. have used it for dozens of devices..

[https://github.com/arendst/Sonoff-Tasmota](https://github.com/arendst/Sonoff- Tasmota)

<comment><USER5> esphomelib.com is gaining a lot of traction too, for ease of use, update, and integration with HomeAssistant.

</comment></comment><comment><USER6> Anyone interested in this kind of local control should check out the Home Assistant project: [https://www.home-assistant.io](https://www.home- assistant.io)

It allows you to corral all these IoT devices through a massive library of open source component plugins. From there you can send control out to Amazon, Google, or Apple, or just keep control local through the web UI.

</comment><comment><USER7> In case you want to control your HS100 from Apple Homekit, I recently wrote a small tool that you can run in your local netrwork: [https://github.com/thomersch/tplink- homekit](https://github.com/thomersch/tplink-homekit)

</comment><comment><USER8> I recently used this[1] node package for the same end.

With that I can cron my Christmas lighting. Pretty cool.

[1] [https://github.com/konsumer/tplink- lightbulb](https://github.com/konsumer/tplink-lightbulb)

</comment><comment><USER9> There's now a pyhs100 library/utility that works pretty nicely out of the box.

[https://github.com/GadgetReactor/pyHS100](https://github.com/GadgetReactor/pyHS100)

<comment><USER10> "At the moment only switching the state of the LED is implemented. Feel free to submit patches as pull requests for further features!"

<comment><USER11> That refers to features that are specific to the plug. On/off and energy meter functions are generic across the family of devices, so are also supported on the HS100.

(Context: I wrote the initial support for bulbs in this module, the plug support already existed)

<comment><USER10> The way the hole text is written, and even your response, makes still not clear for somebody not involved in the project what actually works, so please take that as a hint for somehow presenting the information that you have so that the others can easily understand it. I know it's a small thing directed to maybe a small number of potential users, but maybe you still lose someone valuable due to the confusion.

By just reading what's there it gives the impression that, surprisingly, that project has _less_ basic functionality than the bash script.

</comment></comment></comment></comment><comment><USER12> Would be cool to use this to manage power consumption of a home computer cluster. Turning off spare nodes when you're not home/not using them would probably save a lot of power.

<comment><AUTHOR> I use FHEM ([https://fhem.de/](https://fhem.de/)) to run a periodic ARP scan for "known" mobile wlan. Once the last one logs off the wlan, FHEM switches secondary power sources and lights off after 15 minutes. When the devices log back in and there is insufficient natural lighting, it switches the lights back on.

Another, unrelated, automation step we implemented is an app checking alarms on our smartphones. When an alarm goes off, FHEM runs a script which switches lights on and reads aloud (with Festival) breaking news, the weather forecast and any interruptions on our daily commute.

</comment></comment><comment><USER13> here are an endless number of smart plugs that let you remotely turn an outlet on and off, but those plugs usually accept just one single cable. So to address bigger needs, Kasa is introducing an entire smart power strip that allows you to individually control all six of its power sockets.

<comment><USER14> I'm installing a similar enterprise version of this tomorrow. [1]

It's a 10 plug power strip. It's got an ethernet connection with a WebUI and each outlet is individually switchable. There are two independant input power cords, and it switches automatically if one side fails (UPS dies). Really cool. Need to reboot the NAS, but it's frozen? Remote power cycle it!

1: [https://www.cyberpowersystems.com/product/pdu/pdu15sw10atnet...](https://www.cyberpowersystems.com/product/pdu/pdu15sw10atnet/)</comment></comment>


Show HN: Occent – The fuzzy lifelogging "smart" nano-diary - <AUTHOR> https://itunes.apple.com/app/occent/id1164502525?ls=1&mt=8 <comment><AUTHOR> If you've got any interest you can read a bit about what it is here...

[https://medium.com/@OccentApp/code- sorrow-5cffcae76fb1#.nl3s...](https://medium.com/@OccentApp/code- sorrow-5cffcae76fb1#.nl3sc1ts0)</comment>


Automated Voice Recognition Typewriter - <AUTHOR> https://www.youtube.com/watch?v=rNSCL4YOd5E <comment> amar-singh Hi,

Till now I haven't heard anything like this. It will save lots of time as we don't have check for errors and also writing speed will increase. This would be a great innovation.</comment>


Ask HN: with a failing OAuth 2.0 standard, what is a newish auth provider to do? - <AUTHOR>

I'm dealing with potentially adding Auth API to an app, where much of its use will be internal for now. I have some setup with OAuth 2, but with the recent talk of how much of a mess it is, I'm reconsidering. What is one to do with a new app, that wants to provide intelligent, connectable Authentication over API? <comment><USER2> Redhat is _very_ strongly pushing WebSSO as the next best thing for single sign on and simple/secure authentication. Conceptually, it beats OAuth. We shall see if it gains traction: <http://websso.github.com>

<comment><USER3> This looks quite useable from a client-end developer-level given the RESTful nature of the draft description, I look forward to seeing some provider implementation code. <https://github.com/webSSO/internetDraft></comment></comment>


Google bidding to keep Alan Turing's papers in Bletchley Park - <AUTHOR> http://googleblog.blogspot.com/2010/11/preserving-alan-turings-papers-at.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+blogspot%2FMKuf+%28Official+Google+Blog%2 <comment><USER2> The link returned a 400 error for me. Got rid of some cruft in the URL.

[http://googleblog.blogspot.com/2010/11/preserving-alan- turin...](http://googleblog.blogspot.com/2010/11/preserving-alan-turings- papers-at.html)

<comment><AUTHOR> Ugh, I thought I had stripped the URL of all the UTM gook. Could a mod please update the link?

</comment></comment><comment><USER3> 'Turing papers could be saved after auction fail'

[http://www.theregister.co.uk/2010/11/23/turing_papers_not_so...](http://www.theregister.co.uk/2010/11/23/turing_papers_not_sold)</comment>


Request For Startup: Solving Consumer Backups - <AUTHOR> http://pedrocr.net/text/solving-backups/

<comment><USER2> Lucky you, someone made it! ;) Check out <http://www.aerofs.com>

<comment><AUTHOR> I had seen that a while ago and it does seem promising. But I didn't see that they supplied the cloud backup and restore part of it.</comment></comment>


Ask HN: Are there any languages that implemented all the best features? - <AUTHOR> There are many different bad designs in programming languages. i was wondering which language has implemented most the best programming language features from different languages. <comment><USER2> Oz attempts to be multiparadigm; I liked their taxonomy but haven't tried the language itself.

(still waiting for "ADD ONE TO COBOL GIVING COBOL", myself)

</comment><comment><USER3> perl6 is such a eierlegendewollmilchsau. oops, now called raku

<comment><USER4> For the German colloquialism challenged (adapted from a GT translation):

An egg-laying wool milk sow is a colloquial expression that describes something (a thing, person or problem solution) that "only has advantages, satisfies all needs, meets all requirements"

<comment><USER3> This is an image of this animal [http://bleaklow.com/images/2003/p6_cover.gif](http://bleaklow.com/images/2003/p6_cover.gif)

I also have a similar pic for pony, which is actually performant, and not designed by committee.</comment></comment></comment>


Uber app can secretly record your iPhone screen thanks to special 'entitlement' - <AUTHOR> https://thenextweb.com/apple/2017/10/06/report-uber-can-spy-on-iphone-users-with-ios-11s-screen-recording-feature/ <comment><USER2> Earlier discussion:

[https://news.ycombinator.com/item?id=15411533](https://news.ycombinator.com/item?id=15411533)

</comment><comment><USER3> Interesting that this is being framed as an Uber transgression when Apple should take the rap for even creating this permission in the first place.

<comment><USER4> I'd say the permission is valid (seems to be direct fb access or something similar), but should be allowed only in very specific cases

<comment><USER5> >I'd say the permission is valid (seems to be direct fb access or something similar), but should be allowed only in very specific cases

Maybe, but then the user should explictly authorize it AND it should be optional, if this is not the case, then it should not exist.

In any case, it does sound a bit shady that such permission exists at all and - according to the article - Apple "can decide" who can use it.

It seems like there are "class A" and "class B" developers rated by Apple and given (or denied) this "permission".

</comment></comment></comment><comment><USER6> According to the update at the end of the article, Uber says they only used this API to render maps in an early version of their Apple watch app and they haven't been using it at all for some time. They claim they are working with Apple to get this entitlement removed.

<comment><USER7> 1\. Yes and I believe them (not). They will. Now. That they got busted. Red handed. Again.

2\. They can't catch a break!! (but they try really hard to be on the news with news of sexual harassment, actively identifying and avoiding authorities, trying to cover up rapes, spying on drivers and clients)(that's a good rap sheet)

<comment><USER8> It seems legitimate.

You also seem to irattionally hate Uber.

<comment> jon-wood It does seem legitimate, but I'm not sure the hatred of Uber is really irrational - they've got a terrible record for shady behaviour, which is going to influence people's opinion of them when something like this comes up.

</comment></comment></comment></comment><comment><USER9> Apple letting a (morally corrupt) third party violate your privacy.

And some people still think the government/NSA does somehow not have complete access to your data?

</comment><comment><USER10> Stuff like that is a bit at odds with the pro-privacy marketing that Apple has been pushing recently. Guess it shows how important certain high-profile apps are for smartphone ecosystems when Uber even got Apple to give them access to features like that.

</comment><comment><USER11> I just uninstalled it. I do too many confidential things on my phone to even let this be a possibility. That's too bad because I was an avid Uber user. I hope they can shed some light on this and say it's fixed (and verified).

<comment><USER12> I guess you can still use m.uber.com

<comment><USER11> Thanks for sharing that. I wasn't aware

</comment></comment></comment><comment><USER13> On a similar topic, how does the facebook app on android suggest me pictures taken with the camera on the phone, when neither it nor any of the facebook infrastructure apps have any permissions on accessing local media?

<comment><USER14> What version of the app and Android are you running? I'm on Android 8.0 and just double checked, the second I turn off the storage permission, Facebook can no longer suggest or access any images on my device.

<comment><USER13> Oops I'm a dumbass scaremongerer it seems - indeed I did have 'storage' still checked despite thinking I had everything disabled! Sorry!

</comment></comment></comment><comment><USER15> For the first time I tried to install the Uber app last weekend when I needed a taxi in a country where Uber is present.

I then found out that the Uber iOS app is larger than 150MB (!).

I couldn't come up with a reason why the App would need to be that ridiculously huge except for spying frameworks so I did not download it. There were taxis waiting less than 30m away anyway.

I'm glad I have not sold my soul to Uber ;-)

<comment><USER16> Spying frameworks wouldn't be responsible for taking so much space, usually the largest files in mobile apps are the assets (sounds, videos, images, etc.) and not code, code is actually quite minimal.

So yup, your assumption is probably very wrong. And I'm not an Uber user (exactly for privacy and ethical reasons).

<comment><USER17> Don't iOS apps also have all resources embedded regardless of the device? Like high res retina icons are in the app even though you are using an iPhone 4 or whatever. That would also explain the larger app size.

<comment><USER18> Not since iOS9...</comment></comment></comment></comment>


On the Conceptuality Interpretation of Quantum and Relativity Theories - <AUTHOR> https://arxiv.org/abs/1711.09668 <comment><AUTHOR> If you find it fascinating and prefer some light introduction to the area, I would recommend the book by the (first two) authors: "Universal Measurements: How To Free Three Birds In One Move" [https://books.google.com/books?id=7O2tDgAAQBAJ](https://books.google.com/books?id=7O2tDgAAQBAJ)

Note that the book focuses on the idea of universal measurement. On the topic of this paper, there is also 1 hour long video by Prof. Bianchi which I found very good to accompany the paper: [https://www.youtube.com/watch?v=-SteQN1A33M](https://www.youtube.com/watch?v=-SteQN1A33M)</comment>


Google Trends Electionland - <AUTHOR> http://electionlandtrends.appspot.com/ <comment><USER2> Apparently a bunch of states (23?) are using a software system called Interstate Crosscheck to look for "double voters".

> Election officials in more than two dozen states have compiled lists of > citizens whom they allege could be registered in more than one state – thus > potentially able to cast multiple ballots – and eligible to be purged from > the voter rolls.

The problem is that it often only uses a persons name as a singular data point. So if a person votes with the same first/last name as another person in another state, it's possible that vote could be wiped out. It was even matching names even though there were differences in middle names or had Jr/Sr at the end.

The journalist, Greg Palast, who investigated this back in 2014 has been doing radio circuits again recently saying that it's still being used in a bunch of states. Not sure about the validity of this since there hasn't been much reporting elsewhere on this. He seems to be the only one talking about it. And googling 'Interstate Crosscheck' only brings up his articles and democrat superpac websites.

[http://projects.aljazeera.com/2014/double- voters/index.html](http://projects.aljazeera.com/2014/double- voters/index.html)

[http://www.rollingstone.com/politics/features/the-gops- steal...](http://www.rollingstone.com/politics/features/the-gops-stealth-war- against-voters-w435890)

<comment><USER3> Interesting. I'm registered in 3 states (I always kinda assumed registering in a new state unregistered you in another) and my wife is registered in 2. I wonder if my name is on that list. Damn even the criteria they use doesn't technically have to be unique; it's possible to have the same name, DOB and last 4 digits of a SSN (though that's likely incredibly rare but still the possibility is theoretically there).

I feel as if our entire election and voting process needs a `re-write`.

<comment><USER4> > I feel as if our entire election and voting process needs a `re-write`.

I'm not American, but in my opinion this should have been the the major issue in this election. All the tripe about email servers and orange-tinted buffoons seems designed purely to prevent people considering this.

May I humbly suggest two things: first, you swap the right to bear arms for the right to hold citizen's initiated referendums. As I understand it, the second amendment was designed to prevent government tyranny, but it's obviously not working and causes a LOT of collateral damage.

Second, somehow beef up your fourth estate. Citizens need reliable information that is not tainted by political or corporate agendas. I have no idea how to do this, but you are a resourceful people.

<comment><USER5> > May I humbly suggest two things: first, you swap the right to bear arms for > the right to hold citizen's initiated referendums.

Most states have them, and they're pretty terrible. Get 51% of those of your fellow citizens who bother to show up to support it, and a referendum can rewrite any law — worse, an amendment can write anything into the state constitution.

Our problem at the moment is that we're too much a democracy and too little a republic.

> Second, somehow beef up your fourth estate.

I think that the media — particularly their coverage of the primaries — bear a great deal of the blame for today. Making them stronger would exacerbate that.

</comment></comment></comment></comment><comment><USER6> It's pretty but what is this really telling us? There's a 126% increase in searchers for "Voter intimidation" in Hoback, Wyoming. OK, so does that mean that someone's being intimidated? Planning to intimidate? Curious about the news? Does a "126% increase" mean there were 7 searches today instead of just 4?

<comment><USER7> It's meaningless.

Near Seattle there are trends reported for "voter intimidation" and "long wait times" and "voting machine problems."

Those trends make no sense for a region that votes by mail.

<comment><USER8> The reports of "voter intimidation" on the electionlandstrends map matches the boundary of this racial demographic map.

[http://www.censusscope.org/us/map_nhwhite.gif](http://www.censusscope.org/us/map_nhwhite.gif)

Here's those two maps combined:

[http://i.imgur.com/eKT5s0h.png](http://i.imgur.com/eKT5s0h.png)

<comment><USER7> [https://xkcd.com/1138/](https://xkcd.com/1138/)

<comment><USER8> Yeah but the maps I'm showing don't follow general population density so the point being made by this comic doesn't apply in this instance.

<comment><USER9> Unless I'm reading something on your graph incorrectly it's almost perfectly correlated with Martha Stewart Living subscribers. Looks like it applies almost exactly to me.

<comment><USER8> Well I already did the work I'm willing to do on my end. Further research would obviously have to take in to consideration deviations from general population density, but just looking at the map, there's a lot of voter intimidation being reported in the south that clearly has nothing to do with population density.

Also, there's no correlation with voter intimidation and population density for cities in the midwest.

So I guess it's just my word and my graph against your word and, well, nothing else. So you better get to work!

<comment><USER10> I'm not sure why you're pretending that it should be someone else's job to prove the point you're trying to make. You threw up a graph which looks identical to a population-density graph and are pretending you gave us evidence of your assertion.

<comment><USER8> No, I'm saying that he has to provide a better refutation of my point.

I do not agree that the graphs look identical.

What point am I trying to make, BTW?

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> I just had to vote "provisional" myself (Palm Beach County).

I have a feeling there is going to be a lot of fraud reports against the Florida Board of Elections. We registered almost 2 weeks before our Oct 11 deadline, yet neither my wife nor I were in their system - we received no mail or anything from the BoE.

My vote, I'm absolutely certain now, will be thrown in the trash. Even if it isn't, the election will be over by the time it's "counted".

Think I'm simply spreading FUD? Take a look at the 2004 Florida general election... this state's election board is wholly corrupted.

<comment><USER12> Why isn't eligibility automatic? Whether state of federal, doesn't the government already know whether or not you qualify to vote?

<comment><USER13> That would make rational sense, but strangely no.

Unfortunately the US is setup in such a way so that individual states get to decide who is eligible to vote. This is a state right defined in the constitution[0].

In practice the vast majority of states have similar voting requirements. But because, in theory, they could all differ then no unified automated system is possible, it would have to be per-state.

Of course individual states could create an automatic voter registration system, and I believe some have/do. But a lot of other states are actively trying to disenfranchise the poor, young, or minorities who would benefit the most from automatic registration.

Ultimately voting and voter registration needs to be handled by a non-partisan organisation within states. But considering it would take partisan politicians to set up such a non-partisan organisation, it has little chance of happening.

[0] [http://blog.constitutioncenter.org/2014/08/constitution- chec...](http://blog.constitutioncenter.org/2014/08/constitution-check-who- decides-who-gets-to-vote/)

<comment><USER14> In PA, when you change your address with PennDOT (who runs our DMV), there is a checkbox to update your voter registration. It's not the most obvious connection, but it seems to work pretty well.

</comment></comment></comment></comment><comment><USER15> A 100% increase in searches for "voter intimidation" in my city (Seattle) is interesting. I'd love additional context on who is searching for that (i.e. is it the intimidators or the fearful?)

Nonetheless, this seems like the beginning of an interesting tool. What would it take to do some sort of fuzzy matching on related searches, like broken voting machines for voting machine problems? I suppose you could wait for a related term to breach a threshold and begin tracking it with related terms.

<comment><USER16> Given that Washington State is all mail-in, I doubt we're seeing a lot of actual voter intimidation! I'm also in Seattle, and dropped my ballot off at one of three drop-off points. There were some nice people in smocks there who thanked me for voting.

<comment><USER17> This. I don't understand the whole going to a location to vote on two dozen things that I probably don't know well enough versus reading a pamphlet and taking an hour or so to fill it out at my leisure.

Seriously why do we have voting places anymore? Just do it all by mail.

<comment><USER18> _I don 't understand the whole going to a location to vote on two dozen things that I probably don't know well enough versus reading a pamphlet and taking an hour or so to fill it out at my leisure._

You're doing it wrong. Before you go to vote, do all of that stuff you listed after the word "versus". Instead of marking a ballot, just write it down on a piece of paper. Bring that paper with you when you vote. Worked well for me during 30 years of going to a polling place.

Me, as a Washington resident, I miss going to the polling place. I dunno, I just liked the whole physical process of going to our designated place, mingling with my neighbors and fellow citizens...and going into work late because you wouldn't dare ding me for voting. Because you don't hate democracy...do you? Now voting is just more paperwork I have to do, along with rebalancing my 401K and filling out those insurance forms I've been putting off.

</comment></comment></comment></comment><comment><USER19> So far all of these just look like population maps of the US, skewed by time zone.

Basically if it's a heavily populated area that is awake, then the dots are big.

Maybe as the day goes on it will level out to more interesting insights?

<comment><USER20> A population density overlay would have been helpful as would a voting trend by state or even by municipality or district to understand if there are any statistically relevant discrepancies. That said, I suspect the point of this tool is to lower the barriers to voting to allow everyone's vote to be collected.

</comment></comment><comment><USER21> The UI on this app is spectacular actually . I want to sit down with the team that wrote it and just ask questions for days.

<comment><USER22> Performance is poor on my older laptop. Maybe I'm getting to the point where web devs should leave me in the dust, but, it's also a shame to waste resources on newer systems. I suspect the problem is that it's built on React, which struggles with large data sets.

If the team is reading this, I'd bring up a point made on the Netflix dev blog: the key to great React perf is doing the expensive stuff outside of React. Do it low-level, stitch it in with lifecycle callbacks. You can end up keeping most of your code in React's world, while fixing most of the performance problem.

</comment></comment><comment><USER23> Google did something similar for the flu without any significant result[0]. Did things improved ?

[0] [https://www.wired.com/2015/10/can-learn-epic-failure- google-...](https://www.wired.com/2015/10/can-learn-epic-failure-google-flu- trends/)

</comment><comment><USER24> On days like this I'm glad I live in Oregon. Honestly it's the only sane and responsible way to vote.

<comment><USER25> Forgive my ignorance, but how do you vote in Oregon?

<comment><USER24> You don't get the option to vote in person. We don't even have voter booths.

Instead, the state mails you a voter guide and a ballot that you fill out in the convenience of your own home. This allows you to review the candidates and new proposed bills line by line.

Once filled out you simply drop it off at one of the hundreds of drop-off locations and you're done (or mail it in if you have time). This can all be done weeks ahead of November 8th.

<comment><USER26> And what if an intimidating person in your household has strong opinions about how you should mark that ballot?

<comment><USER27> There is always going to be some potential for that. "Take a picture of how you voted or I'll beat you" would work fine even with polling places, although it'd be a little trickier.

The system saves a ton of money and time, and we have record numbers of voters in Oregon this year.

<comment><USER28> Taking photos of your ballot is actually illegal in my state. (MS) Presumably for this very reason.

<comment><USER27> Sure, but if the ballot booth provides real privacy... it's not hard to do. It's also a common method of proving you voted a certain way in order to sell your vote.

Or hey, you can just peer over their shoulder:

[https://twitter.com/Gabbienain/status/796031055715246080](https://twitter.com/Gabbienain/status/796031055715246080)

<comment><USER29> This morning when I voted I was surprised that it was hardly a "booth". It had sides to the screen to attempt to block it from view, but it you turn your head you could see the screen next to you - and their screen.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER30> I'm a bit peeved polls didn't open until 9AM in New Rockford ND when the state (and a fair number of farmers) said they would open at 7AM. Wonder what that would be on Google's chart.

<comment><USER31> "Long Wait Times"?

<comment><USER30> I suppose two hours could be considered that. Its still harvest for a lot of these folks so this is a not good thing. Lot of farmers were getting a full mad on as I went back to my car. I'm not very fond of being late to work, but I would not have made it back in time tonight.

</comment></comment></comment><comment><USER32> Sortof OT: I was also interested in election trends. While Google is focusing on real-time search trends regarding voting, I looked at meme trends leading up to the election. There are interesting trends in the amount of attention different candidate memes received over time. It will be interesting to see whether the attention received by candidates is translated into votes, today.

Here's the working paper: [http://iandennismiller.github.io/election- memes](http://iandennismiller.github.io/election-memes)

EDIT: quick link to viz: [http://imgur.com/S6nHNLT](http://imgur.com/S6nHNLT)

<comment><USER33> They missed out on not including Reddit in the social networks. Reddit seemed like meme-central this election for Sanders and Trump.

<comment><USER34> Too many CTR shills on reddit

<comment><USER35> How do you distinguish between legitimate Hillary supporters, and CTR shills?

</comment></comment></comment></comment><comment><USER36> This is pretty, but it's all statistical outliers; every highlighted spot is a small city where random fluctuations above a low baseline are most likely to generate seemingly-impressive spikes in query volume.

<comment><USER37> like Austin, Phoenix, and San Francisco?

</comment></comment><comment><USER38> This is cool, but seems to me to be very especially vulnerable to the Observer Effect. Any fluctuation in these search terms that shows up here will cause people to try and find out more by searching for those terms themselves. What may have started out as random noise gets fed through a feedback loop and amplified, while not necessarily being signal.

I saw an increase in searches for voter intimidation near where I live. I immediately went to DuckDuckGo, and "!n voter intimidation". Now I'm part of the problem, apparently :)

</comment><comment><USER39> What's the visualisation library they're using here? Looks great (I'm _guessing_ D3, but it's hard to break through the webpack file to figure it out).

<comment><USER40> React + d3 + Canvas + More. Disclaimer: I helped build it.

<comment><USER41> You might consider including the BSD licenses those projects were published under in your minified JavaScript file. Is this project's source code published anywhere?

<comment><USER40> Thanks for the heads up. Our deploy process was stripping out all the attributions :(. This has been fixed and they are back in now. Regrettably the project's source is not currently available.

<comment><USER41> Awesome! Thanks for working on this project.

</comment></comment></comment></comment></comment><comment><USER42> I wish this were normalized by electoral college size, it would go part-way to normalizing by population but also be normalized with respect to impact on outcome.

</comment><comment><USER43> There's also this:

[https://usaelectionmonitor.ushahidi.io/views/map](https://usaelectionmonitor.ushahidi.io/views/map)

Article:

[http://qz.com/825442/kenyas-crisis-mapping-startup- ushahidi-...](http://qz.com/825442/kenyas-crisis-mapping-startup-ushahidi- will-monitor-the-us-presidential-election/)

</comment><comment><USER44> I love the American elections! The data, the coverage, the websites, the data- driven-campaigning... all of it.

I mean, I'm glad I don't live there and have to choose between these disasters of candidates and see either of them hand over the control of the world to Asia... but I do love the elections as a platform!

</comment><comment> vhost- Nothing in Oregon because we all sent our ballots in a week or two ago. Interesting viz to see.

</comment><comment><USER45> Particularly intersting is the 'inactive voter status' band along the cotton belt (a region of African Americans in the southern sates where the voting rights act was recently repealed). Yet no such searches in KS, CO, NE, WY etc.

</comment><comment><USER46> Here's what I wanna know - what has been the increase (or decrease) in voter intimidation this year versus 2012.

</comment><comment><USER47> While we're on the subject of voter intimidation, there has been constant intimidation of Trump supporters throughout this whole campaign[0]. And at the same time, Democrats had a deliberate campaign to incite Trump supporters to violence[1] although this required provoking them by infiltrating their private events, while Trump supporters were harassed and abused on the streets.

Progressives have this insane argument that goes that violence and intimidation against Trump supporters is actually ok and not contrary to our deepest values, because it is done by private citizens and not the government.

[0] [https://www.youtube.com/watch?v=VUBpRexwiPg](https://www.youtube.com/watch?v=VUBpRexwiPg)

[1] [http://www.breitbart.com/big- government/2016/10/17/exclusive...](http://www.breitbart.com/big- government/2016/10/17/exclusive-okeefe-video-sting-exposes-bird-dogging- democrats-effort-to-incite-violence-at-trump-rallies/)

</comment><comment><USER48> This is part of the larger Electionland project, involving over 1000 journalists & journalism students. [https://projects.propublica.org/electionland/](https://projects.propublica.org/electionland/)

</comment><comment><USER49> As someone trying to inspect dots, it's very annoying to me that the detail windows pop up and can block other dots. I'm not sure how you'd stop this but I found this very clunky to use. I'm also not sure if it offers anything useful...

</comment><comment><USER50> Is this kind of realtime data publicly available in any form?

</comment><comment><USER51> Just curious, for such a big system, how the quality of such a large service system is assured? Even just for a single state.

</comment><comment><USER52> I like how Alaska is so chill.

<comment><USER53> I think you know this, but they're all still sleeping.

<comment><USER52> They are either still sleeping or chill lol.

</comment></comment></comment><comment><USER54> How is measured intimidation?

<comment><USER55> by searching "voter intimidation"

</comment></comment><comment><USER56> Geographic profile maps which are basically just population maps. [https://xkcd.com/1138/](https://xkcd.com/1138/)

</comment><comment><USER57> it looks like google wrote their own visualization js library?

</comment><comment><USER58> This would be more accurate and real-time if it were built on Twitter. Unfortunately, Twitter's API is a flaming mound of excrement.

</comment><comment><USER59> So cool.

</comment><comment><USER60> Obligatory. [1]

[1] [https://xkcd.com/1138/](https://xkcd.com/1138/)

<comment><USER61> Why are xkcd mentions on HN always prefixed with Obligatory?

<comment><USER62> "Obligatory xkcd reference", based on the idea that there are so many xkcd comics, at least one of them will be relevant to any given thread.

<comment><USER63> [https://relevantxkcd.appspot.com/](https://relevantxkcd.appspot.com/)

</comment></comment></comment></comment><comment><USER64> I just really want to know how many estimated ppl voted for each candidate in each state. Couldn't they just extrapolate that based on search/browsing history (IE. if someone visited BreitBart, they're probably voting for Trump, if someone visited 538, most likely Clinton)

<comment><USER38> I would think that's extremely unreliable. If it was true, it would be really bad. I want to know what Trump and Clinton are saying regardless of who I vote for. I visit BreitBart but voted for relatively few Republicans. I think one of the main problems with our political process is that our news feeds are turning into echo chambers, polarizing everyone who doesn't go out of their way to really think critically and expand their horizons.</comment></comment>


Beyond Bootcamp: Interview Week Prep Guide - <AUTHOR> Hi folks!
I've written a book I'm giving away for free to developers who are preparing for an interview. I'm sharing it with you today.
Heads up: this is not a technical book. In the book, you will go through a series of exercises that will prepare you mentally and emotionally, and help you uncover your strengths and personal objectives. Then, you'll connect those to the company you are interviewing with.
The project was launched on ProductHunt today: https://www.producthunt.com/search?q=beyond%20bootcamp&all=true
I'm using the search URL because apparently upvoting from a direct link doesn't help the project spread.
I'd be happy to answer questions, and I look forward to feedback and positive stories about your successful interviews in the future. <comment><USER2> Don't manipulate votes on Product Hunt by attempting to link to a search page instead of the project itself.</comment>


Privacy Pass - <AUTHOR> https://support.cloudflare.com/hc/en-us/articles/115001992652-Can-I-use-Privacy-Pass-with-Cloudflare- <comment><USER2> I don't know how Cloudflare can on one hand fight for net neutrality [1] and on the other hand play such an active role in creating a "two-class" Internet. I understand that spamming and DoS attacks are a real problem and that they provide a solution for this e.g. using CAPTCHAs, I just think their approach will lead to a world where your IP address (and thus often your country) decides more and more how easy or hard it is to browse large parts of the Internet. Not sure how to solve this in a better way but I really don't like what they're doing here considering their recent VPN/DNS efforts, which (IMHO) seem to be part of a long-term strategy to create a "fast-track" Cloudflare- powered Internet (for those who can afford it).

1: [https://blog.cloudflare.com/battleforthenet/](https://blog.cloudflare.com/battleforthenet/)

<comment><USER3> Net neutrality is the principle that _Internet service providers_ should treat all Internet communications equally. Cloudfare is not an ISP.

Web service like Hacker News don't have any obligation to provide everyone equal access to their site. Cloudfare works for the web services. As a web service provider, you don't have, nor should you have, any obligation to provide equal access to anyone.

<comment><USER4> > Hacker News don't have any obligation to provide everyone equal access to > their site.

i disagree. Net neutrality to me also means that a site like HN should serve all customers coming to the site the same, and not discriminate against TOR users or VPN users, or users from a certain IP range, or users with different/non-standard user-agent headers.

<comment><USER3> > Net neutrality to me also means that

I don't see how individual inserting his own meaning to well defined terms adds anything positive to the.

If you encounter term you don't understand, you look it up and don't try to make up your own definition. There is no disagreement of what the term means in a way you insist.

</comment></comment></comment></comment><comment><USER5> This is so annoying. E.g. it's not unusual to surf the web with Laptop on mobile connection in Philippines but then you get all this CAPTCHAs on all Cloudflare sites with the standard configuration.

Actually this is the biggest reason I don't like Cloudflare. They are discriminating some second/third world countries and if you don't travel much and check websites you will never know.

Many websites owners are also not aware of this issue with Cloudflare. Discriminating traffic like this should at least be an optional opt-in in Cloudflare and not standard.

<comment><USER6> I think the discrimination against third-world countries are justified as that's the main source of clickspamming and like factories.

<comment><USER7> Are people actually downvoting this comment just because it's not politically correct?

I mean, you could argue that it's not fair to discriminate entire countries because of the lax abuse policy of their ISPs, but the comment is correct: that's the reason those countries are discriminated against in this context.

<comment><USER8> I didn't downvote but I don't believe the claim was 100% factual. Cloudflare has always been horrible with dealing with shared IP's even if the users are all legitmate non-malicious. I once worked in an office with a single shared IP for ~200 people and we got constantly captcha-blocked by Cloudflared websites. It was also a problem with google but it was less prevalent and their captcha system was less annoying than Cloudlfare's.

When I was a sysadmin for a few admittedly-not-highly-popular websites, there were definitely more unwelcome bot traffic from US and EU IP's than there were from any 3rd world countries.

I also don't agree that social media "like-factories" should be a concern for Cloudflare at all. Even if they are truly a concern; social media "like- factories" are probably human-operated on third-world countries or bots that are likely running from developed world servers with access to cheaper bandwidth and IP's.

<comment><USER6> This is more insightful than anything else in the comment chain that was spawned from my GP. My opinion on the 'justifiable' end has shifted a bit, thanks!

</comment></comment></comment></comment></comment><comment><USER9> When you do encounter CAPTCHAs, try out Buster [0]. It passes the CAPTCHA by solving the audio challenge using speech recognition APIs.

Google does block people from accessing the audio challenge [1] in some cases, so make sure to check if you can access the audio challenge even before installing the extension by clicking on the headphone icon within the challenge widget.

Enable user input simulation from the extension's options and install the client app to reduce the chance of a temporary block while using the extension.

If you're on Chrome, there is a pending update (0.5.2) that switches to the Wit Speech API (demo) service by default, verify that you're using the correct service by visiting the extension's options to avoid any errors.

Please open an issue if you have experience with image recognition and you'd like to contribute towards a mode that would solve the visual challege, or assist users by suggesting image tiles to select.

[0] [https://github.com/dessant/buster](https://github.com/dessant/buster)

[1] [https://github.com/w3c/apa/issues/25](https://github.com/w3c/apa/issues/25)

<comment><USER10> Isn't this ruining the feature for people who are forced to use the accessibility feature?

They'll improve the captcha just like they did with the basic obscured text to now making the user do image recognition for them and people who really need the accessibility won't have it that easy any more.

I don't feel like that's a nice thing to do.

<comment><USER9> Google blocks people with disabilities from accessing the audio challenge, please see the second link in my original post for details. This project, while in the early stages, aims to bring attention to the human cost of the reCAPTCHA service, and helps those who can no longer cope with that cost.

<comment><USER10> Thanks for clearing that up, I missed the second link while browsing on mobile.

</comment></comment></comment></comment><comment><USER11> I suggest the link be changed to [https://www.petsymposium.org/2018/files/papers/issue3/popets...](https://www.petsymposium.org/2018/files/papers/issue3/popets-2018-0026.pdf), because there's serious misunderstanding in the comments.

\- This is not made by Cloudflare, Cloudflare is just the first to support it.

\- This does not tie anything to your IP address, this introduces an alternative to tying things to your IP address.

\- This does not implement more granular tracking IDs, it implements unlinkable one-time tokens.

\- This does not further Tor user blocking/inconveniencing, they're who it was made for.

</comment><comment><USER12> Privacy Pass doesn't help when various desktop and mobile app developers host their APIs behind Cloudflare. Users end up with timeouts or other error messages that have don't mention anything about being blocked by Cloudflare.

</comment><comment><USER13> Sounds like we're getting ever close to requiring identification before being allowed to use the Internet. Such a law would be vehemently opposed I'm sure, the question is whether we mind if a company does it and offers it "voluntarily" for those first blocked by said company.

</comment><comment><USER14> To clarify a few things:

PrivacyPass is a third-party extension that allows a user to receive anonymous tokens that can't be tied back to them: [https://privacypass.github.io/](https://privacypass.github.io/)

CloudFlare supports that third-party extension so visitors can see fewer challenges.

</comment><comment><USER15> I like cloudflare, but it seems like we're putting more and more trust in them. Not sure if that's good.

<comment><USER16> This. We're centralizing all the websites to flow in the hands of one player who can decide who can or cannot access a website, not to mention the fact that they have the capability to know who accesses which website across a larger and larger portion of the net. De facto we're giving them the keys to the internet. But who's them? And who will it be in the future?

I understand that they offer cheap solutions to very real problems, but we keep making the same mistake we made with Google and other tech giants. While they are acting in a commendable way now, I fear for how much influence they'll have when they will inevitably drop their "Don't be evil".

<comment><USER17> To me, another company needs to step up and try to compete in the same sector. The problem is that the alternatives, like Sucuri and Stackpath that are reasonably cheap are _terrible_. I deal with both on a day to day and it's horrendous to deal with :/.

</comment></comment></comment><comment><USER18> This seems like a play taken directly from the United States TSA/DHS with their global entry/pre-check 'services' which only exist to track people at a more granular level.

</comment><comment><USER19> I don't understand what is the motivation to block Tor or VPNs if there is no large volumes of traffic from specific IP. Does Cloudflare dislike anonymous users?

Also, did you see the permission list for a Firefox extension? [1] It says "Access your data for all websites".

[1] [https://addons.mozilla.org/en-US/firefox/addon/privacy- pass/](https://addons.mozilla.org/en-US/firefox/addon/privacy-pass/)

<comment><USER20> That permission is required for a vast set of features in chrome and Firefox extensions because of how poorly the chrome extension API was designed. So while it indeed has that permission, there are lots of things it could be doing with it that don't impact your data at all. You'd have to audit the code.

</comment></comment><comment><USER21> So "Privacy" Pass effectively generates a unique token for every user? That results in trivial tracking again, one of the main points of using VPNs, Tor or whatever.

<comment><USER14> The tokens can't be correlated with a user.

<comment><USER22> From the linked page "Privacy Pass uses elliptic curve cryptography to generate 'anonymous' tokens after a single CAPTCHA page is solved."

In any case - privacy implications aside - having to install an extension to get around their risk assessment algorithm going wrong seems like placing the burden in very much the wrong place.

edit: was wrong about who created the extension

<comment><USER14> PrivacyPass is not their thing:

[https://privacypass.github.io/](https://privacypass.github.io/)

They run a service that shows high-risk visitors (or whom they deem high-risk) a challenge. They support a third-party extension that lets you vouch for yourself on other websites anonymously. The alternative is that they _don 't_ support it.

The other things they do are debatable, but this is a good thing.

<comment><USER22> Oh, thanks for pointing that out, totally missed that part! In that case, at least it's anonymous, yeah.

<comment><USER14> Yeah, in my view, it's nice that they're supporting a published way of anonymously vouching for myself. Maybe it's less than awesome that every visitor from Romania (as an arbitrary example) is considered a criminal, but supporting PrivacyPass is a nice move.

</comment></comment></comment></comment></comment></comment><comment><USER23> I wish all Chromium plugins had such good plugin content overview, saves a lot of time if you want to review what you install.

[https://github.com/privacypass/challenge-bypass- extension](https://github.com/privacypass/challenge-bypass-extension)

</comment><comment><USER24> This add-on isn't new. Why now?

[https://notabug.org/themusicgod1/cloudflare- tor](https://notabug.org/themusicgod1/cloudflare-tor)

</comment><comment><USER25> How the f __* does this even help at all when Google reCaptcha already "ghost- blocks" bad ips as well?

</comment><comment><USER26> getting closer everyday to a global "login" to access the internet

</comment><comment><USER27> this is TSA level thievery -- first organize security theater in form of "protection" and then charge money to be able to avoid that. Pathetic.

<comment><USER28> There isnt any money involved. Did you read this?</comment></comment>


Ask HN: What was your best passive income in 2017? - <AUTHOR> Any side projects, Game, OSS, Hacks. <comment><USER2> I got like $10 for the whole year selling books with literally only the poop and alien emoji in them. Pretty sure it's just book reselling bots though, but I can't be sure.

<comment><USER3> Is this a two-character book, or one or more longer (but illegible) books?

<comment><USER2> It's two separate books, each ~150 pages long with just that emoji repeated. Completely useless, made em as a joke a few years ago, they still bring in money during the holidays.

<comment><USER4> Would you mind sharing a purchase link?

<comment><USER2> Sure, here's links to both of them:

[https://www.amazon.com/dp/1505357888](https://www.amazon.com/dp/1505357888)

[https://www.amazon.com/dp/1507842953](https://www.amazon.com/dp/1507842953)

</comment></comment></comment></comment></comment><comment><USER5> I made an Adsense plugin for Angular and if you copy and paste the doc's use example with my ad code (it says to replace) it shows you my ads (duh). Several people have for some reason used it in production, maybe hoping to get their own adsense account/code later. It earned $140 last month.

<comment><USER6> I'd be careful, if the end-user breaks google's policies you could be banned from adsense permanently.

</comment></comment><comment><USER7> 100-200/mo from YouTube this year. Down from nearly a grand at it's peak. Algorithm is worse, ad rates are terrible and demonetization for no real reason is very rampant.

So I guess mutual funds is the answer this year.

<comment><USER8> If yt/g isn't careful they are going to start bleeding out users even faster than they already are. I've seen a huge uptick in comments like yours the last few months. To go from 1k/mo at peak down to 100-200 largely due to their arbitrary algorithm fuckery is... really fucked up.

</comment></comment><comment><USER9> Bought a couple cheap condos near the biggest university in a flyover state, got a property management company to take care of everything (finding tenants, collecting payments, handling service calls, etc). It's a few hundred bucks a month on top of other people basically buying houses for me.

<comment><USER10> Does it make free cash flow after all expenses (including amortization of big ticket repair items) ?

<comment><USER9> Yes, the figure I gave was profit after all expenses. Since they're condos, the association covers the heating/cooling system and everything exterior. I guess we've been lucky on the repair front, because the only thing we've had to pay for (in ~6 years) was a cheap dishwasher and toilet fix and occasionally repainting between tenants.

</comment></comment></comment><comment><USER11> Truly passive: Stock gains

Mostly passive: Managing rental properties. There is some work involved occasionally when things break or new tenants need to be found, but for the most part I just collect my fee each month.

<comment><USER12> Do you worry about renters you'll have to evict? That's what scares me about getting into this -- the thought of losing thousands when it can take months and months to get someone out. Plus the emotional toll of having to do that; not sure I'd want to, although from watching some TV shows on it it seems there's quite a few people who do it on purpose. Still, if those people have kids...

<comment><USER13> You can use a property manager, they will take 10% of gross rent. If the margins aren't good enough to support that, then the property isn't a good buy.

<comment><USER14> > You can use a property manager

OP is the property manager :)

</comment></comment></comment></comment><comment><USER15> I make ~$200-250/month with Find-me[1]. Essentially a database with statistics and contact information for content creators actively looking for advertisers/sponsorship opportunities.

Had a lot on the road map (creating more of a platform) but have pivoted to other projects since this doesn't seem to be getting the traction I was hoping for.

[1] www.find-me.co

Also make ~$1.5k/year from old Udemy courses on pretty basic topics (beginner- level SQL, Google Sheets, etc).

</comment><comment><USER16> Public market stocks. I know this isn't exactly what you're asking but I mention because it's worth considering in your personal decisioning framework (and is my honest answer)

<comment><USER17> Just to put it in perspective, you can make ~$500 per month from having $150,000 in mutual funds if you assume that you make an average of 4% per year after inflation. VTSAX made almost 15% last year, but last year was unusual.

<comment><USER18> I've put $23k into $clm and make $345 in dividends a month.

</comment></comment></comment><comment><USER19> A game that had 2mm++ downloads free / paid since 2012. It's an online game with players still playing although well beyond it's peak. Since 2013 we pivoted from making games to it services and had not much time to make significant changes other than updating to newer iOS. It still generates about 2-3k yearly revenue which is a good bonus in central Europe.

soctics.com

</comment><comment><USER20> Checks if a website is mining crypto currency [http://whoismining.com](http://whoismining.com)

Donations/Affiliates 10/month

</comment><comment><USER21> My blog gets 1M unique visitors per month and earns 2K/mo with adsense.

<comment><USER22> Question: with that many uniques, wouldn't you be able to monetize further? Affiliate marketing and such?

<comment><USER23> Seems low to me too. I'm getting ~US$200/month with about 30k page views per month (not even uniques, but I'm a one-stop-shop, not a portal).

And it's all static, so zero maintenance. Just pay the couple bucks a month to S3 and domain names.

But then again, I target people angry at their XYZ provider, so the clickthrough rates are pretty good :)

<comment><USER8> Are you doing the writing or are you aggregating or something else?

<comment><USER23> Myself, but I haven't added any content for ~4 years.

</comment></comment></comment></comment></comment><comment><USER24> I offer up a weekly printable office football pool sheet for the NFL season. I've had it running for a few years now, and I find that it ends up doing better each year. It's mostly automated/passive, but I spend about 15 minutes each Monday night updating it for the next week.

I mention this one because it's one of those things that I just did, mainly for my own needs, and put out there. And it mainly just sits there but does better year-over-year.

</comment><comment><USER25> $32 a month from a cash pension (in the form of an annuity) from a previous employer. Apparently they still exist, and it pays half of my phone bill.

<comment><USER26> wow how'd that happen

<comment><USER10> Once I worked for a forestry industry company and they forced me to be in the union. After a month of working with them I had accrued like $300 in pension (total value, not monthly). They actually tracked me down and paid it out to me like 4 yrs later when I had completely forgotten about it. Probably cost them $300 to get it into my hands.

</comment></comment></comment><comment> pablo-massa $1000/year for hosting.

Got a cheap HostGator shared hosting and host low traffic websites for some clients (static/WordPress).

As a designer with no advanced knowledge in hosting/IT/domains/backend, it was pretty easy and no complications, I can't complain.

Now planning to move from HostGator to DreamHost because HTTPS is expensive in HG and free in DH (also using the free Netlify plan for static sites, HTTPS free).

<comment><USER27> How much to people pay you for hosting one such site? The idea to design and host simple sites sometimes crosses my mind when I go to some restaurant that doesn't have a working site.

<comment> pablo-massa $100-$200/year.

</comment></comment></comment><comment><USER28> Got lucky with a Kickstarter project that has evolved into a business which finances my life/interest in programming+design. It was definitely the most lucky thing to happen to me in my entire life.

<comment><USER29> Is it truly passive if it's a business?

<comment><USER28> Debatable, but I've hired a few people and do next to nothing—maybe an hour or two a week. Plus, aren't all profitable side projects technically 'businesses'?

</comment></comment></comment><comment><USER30> I'd consider spending time organizing and planning my finances a "side project" since I'm a spreadsheet geek and enjoy doing that sort of thing.

As a result, I realized I was an idiot and had let too much accumulate in my checking account that gets abysmal interest. Moved it to a savings account with slightly better interest and I get a little more money from it. Nothing worth writing home about, but definitely worth the few minutes it took me to make that change.

<comment><USER31> What savings account, if you don't mind?

<comment><USER30> I don't share that information, but I'd suggest you check sites like Bankrate or other comparison sites (warning, they are all affiliate sites) to check out savings rates.

Suffice to say, I went from something like .01% APY to considerably more than .01%.

</comment></comment></comment><comment><USER32> I make ~300/mo off of a peer-to-peer loan management software I created for lenders off of 0 marketing (just word of mouth sales). I have some residual revenue along those same lines for a book I wrote in 2015 on helping junior developers get hired at their first job (link in bio if interested).

</comment><comment><USER33> 100 bucks about every 2 months from Youtube ads. Aboot 10 bucks a month from adsense. Can't be arsed to do more aboot my Youtube and webpage. 's fine for now. Maybe down the road sometimes in the future. There's definitely potential, definitely an audience with need tho.

</comment><comment><USER34> I feel like this recent article "Don't give away historic details about yourself" is relevant: [https://news.ycombinator.com/item?id=16793636](https://news.ycombinator.com/item?id=16793636)

</comment><comment><USER35> Made [http://historio.us](http://historio.us), a full text search engine for bookmarks, nine years ago. It's been making a few hundred dollars a month with zero marketing ever since.

</comment><comment><USER36> Releasing the Landing Page Cookbook[1] and making Product of the Day on ProductHunt worked pretty well.

[1] [http://yourlandingpagesucks.com/cookbook](http://yourlandingpagesucks.com/cookbook)

</comment><comment><USER37> Interesting answers. I expected Bitcoin owners to be a big part, 2017 was crazy.

Wondering if, a) there are not too many people owning bitcoin in the hn community. b) everybody is a HODLER. c) nobody counts this as passive income.

<comment><USER38> or maybe they cashed out in 2018? I sold my Ethereum in 2018

</comment></comment><comment><USER38> In 2017, I made a net profit of $11,000 from 3 niche websites + my blog about said websites

I also have other investments I keep for retirement but I really do not track how much I get there. It is for the distant future.

</comment><comment><USER39> iOS app "Leap Second" made about 2k a month last year this year 5-10k. Required some initial upfront work to create the app but since then Ive been putting in about 2h per week.

</comment><comment><USER4> I got about 20% ROI from cryptocurrency. I didn't get greedy, just targeted a better return than any other account.

<comment><USER8> Are you targetting a specific coin you like for the featureset or are you diversifying and just spreading it out and focusing on the volatile liquidity at play?

<comment><USER4> I keep it simple. Only invest in coins with very good fundamentals, as in so strong they could potentially beat Bitcoins.

Buy when people are panic selling for no reason. Sell when everyone gets excited about it, when people like my farmer uncle are advising me to buy.

</comment></comment></comment><comment><USER40> Emoji domains... making enough to pay for a Subaru Outback car payment every month!

<comment><USER41> Where can you buy those now? I remember they existed, but I thought that was basically a registrar bug that was fixed. The last time I searched around, I couldn't find any registrars that permitted emoji domain names.

<comment><USER40> Yeah! [https://xn--i-7iq.ws](https://xn--i-7iq.ws) Still a work in progress, but we've sold like 25,000+ of 'em. Just launched .fm as well...

</comment></comment></comment><comment><USER42> crypto "investments" and some mining, 401k, etfs

</comment><comment><USER43> I got $1500/month for cleaning houses on weekend.

<comment><USER44> Are there many part time cleaning jobs out there for men? It seems like an interesting way to make side money but it strikes me as a job people prefer to hire women for (sort of like nanny jobs).

<comment><USER45> Good question. While I do get the bias of society towards women for nanny jobs, I don't see why this would apply to cleaning people.

</comment></comment></comment><comment><USER46> Amazon stock

<comment><USER18> $nflx stock

</comment></comment><comment><USER47> Bitcoin investment up to 40k</comment>


Ask HN: Embedded Database Design Papers - <AUTHOR> In order to learn more about database design principles I thought it would be great to read papers on embedded databases. I have searched around for material on the popular open source databases like RocksDB, LMDB, or LevelDB but haven't found anything concrete. Aside from reading the source code, how can I teach myself about the data structures and abstractions that these provide? Eventually I would like to write a toy implementation after getting acquainted with a subset of this knowledge. <comment><USER2> Where have you been looking? LMDB's design is fully documented. Aside from the papers

[https://symas.com/lmdb/technical/#pubs](https://symas.com/lmdb/technical/#pubs)

every aspect of the source code is documented with Doxygen.

[http://www.lmdb.tech/doc/](http://www.lmdb.tech/doc/)

</comment><comment><USER3> RocksDB and LevelDB use a "log-structured merge tree" so you might want to use that as a search term. There is a section "Papers" at the bottom of the web page at [http://leveldb.org/](http://leveldb.org/) .

LMDB uses a B-tree variant, according to Wikipedia. Maybe it's a B+ tree as Wikipedia says, but keep your thinking cap on -- it's probably not in exactly the form you see described on Wikipedia.

If you want to see a _toy_ LSM-tree implementation, I have one at [https://github.com/srh/nihdb](https://github.com/srh/nihdb) \-- it was written as a starter Rust project, not as a fast LSM-tree engine. It's almost the simplest plausible LSM-tree. But you'll miss out on design considerations relating to concurrency and performance.

</comment><comment><USER4> Goetz Graefe [1] published interesting surveys on B-Trees, query optimization...

The Red Book can give you many ideas [2].

Mark Callaghan has been published a lot of stuff related to LSM recently [3].

[1] [http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.219...](http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.219.7269&rep=rep1&type=pdf)

[2] [http://www.redbook.io/](http://www.redbook.io/)

[3] [https://smalldatum.blogspot.com/?m=1](https://smalldatum.blogspot.com/?m=1)

<comment><USER4> Check my own B+-Tree implementation that I did as an exercise. It's clean and well-commented. [https://gist.github.com/philix/236f82183bbb27bd01033f94fe42e...](https://gist.github.com/philix/236f82183bbb27bd01033f94fe42e69b)

Real database systems are more sophisticated, but the most basic B+-Tree is still very interesting.</comment></comment>


P2P Car Rental Platform in Europe - <AUTHOR> https://ridelink.com <comment><USER2> In the Netherlands, [http://snappcar.nl](http://snappcar.nl) and [https://mywheels.nl](https://mywheels.nl).

The process of booking a car a few days ahead of a weekend can be frustrating -- you spend the time choosing a few only to get a (slow) reply from the owner that the car is not available. When you finally do get one, you have to meet the owner to get and return the key (so no early/late hours). All of this for prices that are comparable with regular rental companies, even for older/not as nice cars.

I ended up a happy customer of shared "neighbourhood" cars -- you know when the car is available, and can use it 24/7 with your card. [https://www.car2go.com](https://www.car2go.com), [https://www.greenwheels.com](https://www.greenwheels.com), [http://www.connectcar.nl](http://www.connectcar.nl), etc.

<comment><USER3> I've been happy with Greenwheels as well. They're available at most Dutch railway stations so you can easily travel the last miles to a destination that is hard to reach by public transit. It's also handy that you can tie your Greenwheels subscription to your OV-chipkaart (the national public transport card) so you don't need to carry an extra card to unlock the car.

Btw, Car2go is only available within Amsterdam.

</comment></comment><comment><USER4> There is also the french company Drivy which allows to rent in Europe. [https://en.drivy.com/?force_country=true](https://en.drivy.com/?force_country=true)

</comment><comment><USER5> in France, [http://www.ouicar.fr](http://www.ouicar.fr) has been doing that for a while (I never used it though).

</comment><comment><USER6> For those in North America, Turo seems to be pretty good for Airbnb-style car rentals.

<comment><USER7> I've used Getaround as both a renter and owner, and have had a pretty positive experience. The killer featured is the "Connect" kit they install in your car, that lets a renter unlock the car with a smartphone -- no need to coordinate key handoff/pickup. It also gives you free 2FA for your car; you need to unlock with the app before the key will start the engine.

</comment></comment><comment><USER8> In Denmark, the company Gomore.dk is very popular. Mostly known for private ride-sharing, but they also offer private car rental.

</comment><comment><USER9> Just from the byline, this sounds like a more disruptive idea than Uber.

<comment><USER10> It also looked like more an insurance nightmare than Uber but it appears that they are partnered with Allianz so I assume they have that figured out.</comment></comment>


2757 days - <AUTHOR> https://web.archive.org/web/20190120171852/https://plus.google.com/+MartinSeeger/posts/JtbWHWiDgWn <comment><AUTHOR> Given the imminent G+ shutdown. WBM link, though the source, for now, is here:

[https://plus.google.com/+MartinSeeger/posts/JtbWHWiDgWn](https://plus.google.com/+MartinSeeger/posts/JtbWHWiDgWn)</comment>


Breaking the net neutrality deadlock - <AUTHOR> http://news.stanford.edu/2016/09/13/breaking-net-neutrality-deadlock/ <comment><USER2> I get how this _could_ benefit end-users if all goes to plan, but how does this benefit ISPs like Comcast? The entire reason they want to break net neutrality is to push their own agenda on users. This doesn't allow them to do that at all. I suppose it opens users up to coercion.

That said, I think the net neutrality deadlock is a good thing. It's where it's supposed to be at right now. We have a free and open internet and a public branch of the government protecting that.

There will be a constant onslaught of corporate interests trying to limit free speech via marketing and bribery for many years to come, and I don't see Network Cookies solving that issue...in fact, I think it gives leeway more to the ISPs than the users. Now Comcast can sell you a modem with "recommended settings" and unless you know what 192.168.0.1 is you're going to just go along with it.

Let's keep net neutrality simple: access means full access.

<comment><USER3> More simple yet: you build it, you get to decide what to do with it.

<comment><USER4> Just curious, what do you mean with "you built it"?

<comment><USER5> > Just curious, what do you mean with "you built it"?

You know, paid taxes that funded government projects that largely developed the underlying technology. Got your friends in local and state governments to allow you to use a combination of public land and imminent domain to force people to let you build your network (nominally partially as a public good), etc., etc. Once your network was in place, you used regulations to prevent competitors from the same sorts of government manipulations. You built a telco that manipulated governments in the proper way, and now you get to engage in rent-seeking on those imminent-domain'd pipes all you like.

At least in NYC, the local telephone company is required to lease phone lines to competitors essentially at-cost, as a condition of their monopoly status and use of imminent domain (according to my DSL installation guy when I moved to NYC a decade ago, when he explained that my landlord had cut all of the phone lines during renovation and Verizon would take their sweet time providing the legally required 12 inches of working phone line into the domicile). I don't think similar competitive measures apply to cable and fiber lines that also use public land and imminent domain.

</comment></comment></comment></comment><comment><USER6> Isn't this just QoS revisited?

Also, think about it for a second: the user wants _all_ their traffic to be high-priority zero-rated. Except maybe ads and DDoS traffic.

The anti-net-neutrality cases come from reversing the customer relationship. Zero-rated traffic obviously doesn't exist, what they mean is "traffic paid for by someone else". Either voluntarily as part of a market-cornering promotion (Facebook basics), or as part of a shakedown (throttling of Netflix in an attempt to get them to pay).

The lack of an integrated billing system is a great historical strength of the internet. We already had a global telecoms network where the billing had primacy, it's the telephone network. In which the lack of market competition meant that every little thing got charged for.

The one case that _might_ work would be the possibility of specifying a "not important" flag on your own traffic in exchange for exemption from any kind of caps. In the event of actual congestion the ISP could drop "not important" traffic first.

</comment><comment><USER7> I'm not really sure why consumers or ISPs have a reason to be excited about this. I'm beginning with the assumption that the custom shaping rules will only take effect once a bandwidth cap is reached (otherwise, why would someone self-limit?). If a consumer reaches their bandwidth cap it means some service will suffer. Letting them choose which one suffers the most doesn't seem like a killer feature. For ISPs, it doesn't matter how the bandwidth is distributed once the cap is reached.

Maybe there is some use case for metered connections or data caps?

<comment><USER8> > Maybe there is some use case for metered connections or data caps?

The main legitimate use case I can imagine would be to spread out peaky utilization to minimize congestion and make the most efficient use of links. This might be achieved through differential metering or caps, where off-peak usage is unmetered or costs less. Giving everyone a 300GB limit doesn't do much good for the infrastructure if they're all blowing their 300GB watching Netflix during "prime time".

Of course, that would require an ISP that had genuine concerns about congestion and efficiency rather than blowing smoke about how "fairness" somehow demands that they squeeze more revenue out of any party within reach [1].

[1] [https://www.reddit.com/r/technology/comments/3rnfnm/leak_of_...](https://www.reddit.com/r/technology/comments/3rnfnm/leak_of_comcast_documents_detailing_the_coming/)

</comment></comment><comment><USER9> If I can zero rate whatever traffic I want, what's stopping me from zero rating torents and download terabytes of content on lte with impunity?

<comment><USER10> Your data cap?

<comment><USER11> Zero-rating means it doesn't count towards your cap. Blackberry messenger is an example of a service/traffic that was zero-rated.

</comment></comment></comment><comment><USER12> This opens "interesting" commercial opportunities for ISPs. "If you (the customer) voluntarily zero rate or fast lane services X and Y you get a discount." And those services pay the ISP more than that to get an advantage over competitors. The money flow is similar to having X and Y pay the ISP not to be throttled down on the ISP network, which is what some ISPs wanted to do.

</comment><comment><USER13> There is no reason for data caps (duapolies ISPs are being greedy)... if you sell a specific speed/bandwidth (which are usually sold as bits per second?), I should be able to use it all the time.

<comment><USER14> For most customers, average usage and instant usage are very different though. A data cap is a way to be able and sell higher peak bandwidth than would otherwise be possible, by oversubscribing in a controlled way.

<comment><USER4> _> sell higher peak bandwidth than would otherwise be possible_

What about increasing the total capacity, by investing into the infrastructure? Better transportation technology, putting more fibers in the ground, putting up more LTE/5G/6G/7G whatever towers.

Violation of network neutrality gives a competitive advantage to those who trick their customers over those who actually invest in their infrastructure.

Network neutrality is a way to restore the ISPs' incentives to invest in the infrastructure, and to protect those ISPs who already do that from their shady competitors.

(The only other way would be to educate the population so they votes against network neutrality with their money. That may or may not be harder to achieve than passing a law.)

<comment><USER14> Net neutrality and investing in infrastructure are completely orthogonal to data caps, so I'm not sure what you're trying to argue.

</comment></comment></comment></comment><comment><USER15> There is a simple algorithm that would suffice.... Whatever I'm using right now is what I want to have preferential delivery. Really it is that simple.

</comment><comment><USER16> Why are they using the term "cookies"? It has such a negative connotation.

</comment><comment><USER17> Same as other commenters I'm struggling to see how this is useful in the zero rating debates. But if it could somehow be used as an easier more dynamic way of doing user-controlled QoS then that would be fantastic.

</comment><comment><USER18> Just give preferential treatment and zero rate to ALL content. Then we're actually neutral, and everyone is happy.

<comment><USER16> But what if you send 1 packet, and your neighbor sends 10 packets, disguised to be from 10 different IP addresses. Then your neighbor effectively gets 10x your speed.</comment></comment>


Scientists can tell how wealthy you are by examining your sewage - <AUTHOR> https://www.inverse.com/article/59914-sewage-wastewater-can-show-how-wealthy-a-community-is <comment><USER2> little known fact. when you flush a toilet, "the poop spreads out like a gaussian". so if multiple people flush at the same time, you have to deconvolve the results using a gaussian mixture model</comment>