PixelBlock – Stop people from tracking your email opens - <AUTHOR> https://chrome.google.com/webstore/detail/pixelblock/jmpmfcjnflbcoidlgapblgpgbilinlem/yc <comment><USER2> No Chrome extension can know which images are being used to track email opens. If you want to disable that sort of tracking you should disable images/external resources completely. Otherwise you're just getting a false sense of security.

<comment><USER3> I use (al)pine. Nobody has ever, in any way, received information about my email opens.

I speed through email with keystrokes and zero mouse movement, and I can use email with ease on even the slowest of satellite or 2G network access.

Finally - and this is my favorite part - since I use pine, and my engineers at rsync.net also use pine, not one single intra-company email has ever traversed the Internet. Ever.

All intra-company email is simply a local copy operation on a single mail server.

<comment><USER4> > since I use pine, and my engineers at rsync.net also use pine, not one > single intra-company email has ever traversed the Internet. Ever.

What does the mail client have to do with this? I use Thunderbird with Gmail, and, since all of my contacts use Gmail, not one single email has ever traversed the Internet, ever.

With TLS-enabled mail servers, this isn't very relevant a metric.

<comment><USER5> >With TLS-enabled mail servers, this isn't very relevant a metric.

They still have the meta-data, the actually interesting stuff.

<comment><USER4> They know that some email was sent by someone to someone somewhere around that time, but nothing more.

<comment><USER5> Nothing more? That all you need to know in 99% of the time. Just in case you didn't get the memo: 'We Kill People Based on Metadata'.

[http://www.nybooks.com/blogs/nyrblog/2014/may/10/we-kill- peo...](http://www.nybooks.com/blogs/nyrblog/2014/may/10/we-kill-people-based- metadata/)

<comment><USER4> Really? You're equating knowing who sent what when and how to just knowing that something was sent at some point, from an unknown origin to an unknown destination?

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> BTW what is the point?

I mean, one can legitimately want that _they_ do not receive the tracking information. But are there any real security implications, like siphoning off any unauthorized data, facilitating spam, etc?

<comment><USER7> Tracking an email open is enough of a security threat by itself.

<comment><USER8> We use it to see if you are interested in the email. If you don't open 3 or 4 we take you off the list. We also use it to see if email addresses are no longer used.

I don't really see why you'd care about tracking pixels 99% of the time. If you purchase something from us and we email you, it's super useful for both of us to know if you have read the email (purchase receipt or booking confirmation.)

I personally don't see much spam and what I do see I just delete, so tracking pixels in those aren't an issue for me.

<comment><USER9> > If you purchase something from us and we email you, it's super useful for > both of us to know if you have read the email (purchase receipt or booking > confirmation.)

Why? If I'm interested in the email, I'll request it (i.e. if I'm purchasing something from you, me receiving confirmation emails from you should be opt- in, either in my user settings on your site or on a per-purchase basis). If I'm not interested in the email, I'll click the "unsubscribe" link in the email (you _do_ include unsubscribe links, right?) or otherwise specify such in - again - my user settings.

In other words, that's not your call to make. That's _my_ call to make, and your explanation is sounding like a very weak excuse to pin my privacy to a table and give it a night it'll never forget.

</comment></comment></comment></comment><comment><USER10> google already grabs the images via image proxy.. [http://gmailblog.blogspot.com/2013/12/images-now- showing.htm...](http://gmailblog.blogspot.com/2013/12/images-now-showing.html)

<comment><USER11> Unique images still allow for read receipts.

The proxy effectively prevents cookie setting, ip address determination and geolocation, and injection-type attacks.

<comment><USER12> If Google proxies and caches images at the time of receipt, instead of when you open the email, then you effectively don't have read receipts for Gmail users, because it looks like they all read the email immediately.

Caching images immediately is probably an attractive engineering decision on its own merits. Whether spamming read receipts is good (because it makes them useless) or bad (because it makes people _think_ the emails got read) is an interesting question.

</comment></comment></comment><comment><USER11> Source: [https://github.com/ramoq/PixelBlock](https://github.com/ramoq/PixelBlock)

<comment><AUTHOR> Thanks for posting ibejoeb!

<comment><USER11> Neat tool, thanks. I wasn't going to install it because it required access to mail.google.com and googleusercontent.com, but since it's open I feel better about it. It might be helpful to others to mention that and link to it in the chrome store.

</comment></comment></comment><comment><USER13> ...or if you're using mutt you're laughing all the way to the plain-text version.

On a serious note: just block remote content.

</comment><comment><USER14> Isn't this redundant unless I accept images? I get:"Images are not displayed. Display images below - Always display images from firstname.lastname@example.com" (for example).

<comment><USER8> You are correct, I'm 99% sure this is why blocking images is an option in email browsers.

</comment></comment><comment><USER15> I generally use Thunderbird and while I have not checked what it does in all cases, it generally flags when there is remote content and provides options regarding loading it. I'm happy with that. I know many folk of course use web based mail readers, and this is directed at them, but if its a big issue using a product like Thunderbird may be the way to.

</comment><comment><USER16> [http://techcrunch.com/2013/12/12/gmail-open- rates/](http://techcrunch.com/2013/12/12/gmail-open-rates/)

"[...] Google spokesperson I emailed said that's not entirely correct. (The spokesperson declined to be quoted.) Instead, they said marketers who track open rates through images will still be able to do so — indeed, they suggested that the data might be more accurate now since open rates will count users who read the emails but don't load the images."

Sounds like Google made sure tracking works even when users attempt to evade it.

But another quote in the same article still talks about pixels:

"MailChimp can still detect the first request for the open-tracking pixel."

</comment><comment><USER17> Wouldn't adblock/muBlock/etc. accomplish the same, while working cross browser?

<comment><AUTHOR> unfortunately not, adblock blocks ad related media only. This is one of the few tools that will intelligently block people from tracking your email views/opens

<comment><USER18> * Easy privacy.

EasyPrivacy is an optional supplementary subscription that completely removes all forms of tracking from the internet, including web bugs, tracking scripts and information collectors, thereby protecting your personal data.

</comment></comment></comment><comment><USER19> I thought gmail recently preloaded images so you didn't need this? (I say this because the example shows gmail)

<comment><USER20> I thought that too, but no. It seems it replaces the original link with a google url, which is basically a proxy address for that original url. It seems they may cache it, but don't preemptively download it when the mail is received.

[http://gmailblog.blogspot.com.au/2013/12/images-now- showing....](http://gmailblog.blogspot.com.au/2013/12/images-now-showing.html)

Obviously if they downloaded any image linked to an email send to gmail that could lead to a DOS, and be very wasteful in any case. So they wait until you actually open the email. But at least it obscures your IP unless you click on the links.

</comment></comment><comment><USER21> yeah well what about google tracking emails itself.

<comment><USER22> is a given if you are using gmail. If anyone doesn't want google, microsoft, yahoo tracking email.. you better get your own mail server.

<comment><USER23> Or pay one, e.g. Gandi: [https://www.gandi.net/](https://www.gandi.net/)

<comment><USER9> And now you're back to square one due to draconian French surveillance laws.

Running your mail server on a VPS is not a very good solution, particularly when that VPS exists in a country that interpreted _1984_ to be an instruction manual rather than a cautionary tale.

</comment></comment></comment></comment><comment><USER24> quite useful, great job</comment>


Would a prime-based number system work? - <AUTHOR>

Is it possible to do a positional numbering system where, instead of the positions being powers of some base, the positions were the "next" largest prime?
Would such a system have any advantages over existing number systems?
Has anyone heard of such a thing? <comment><USER2> I have heard of such a thing, but can't remember the name of it right now - I'm not much of a mathematician. [http://ask.metafilter.com/10114/Base-prime- number-system-pos...](http://ask.metafilter.com/10114/Base-prime-number- system-possible)

<comment><AUTHOR> Thanks!</comment></comment>


How I lost my Adsense account - <AUTHOR> http://www.stateofsearch.com/how-i-lost-my-adsense-account/

<comment><USER2> Many people wonder why Google never provides a reason for cancelling an account like this. The answer is that any reason they provide would also be seen as their opening argument. They're not interested in arguing whether their reasons are valid, so they don't even give a reason.

If you give people a reason, the implication is that there is a deficiency which can be improved, a fault which can perhaps be forgiven, or a set of circumstances which can be seen another way. It gives people a place to begin an argument, and this is clearly a case where people are eager to do so.

Google doesn't want to start a conversation, they want to remove the participant from the program. Not having a reason makes that clear, and providing reasons makes that less clear.

It's the same dynamic when salespeople want to know why you don't want to buy — they're hoping they can persuade you to set aside those concerns and leave you with no rational reason not to make the purchase.

It's also the reason why, if you dump a needy romantic partner, you're better off not providing concrete reasons — the reason is just that you want the relationship to be over! You don't want them running after you screaming, "But I can change!"

In this case with AdSense, sifting out the accounts who "sometimes" break the rules from complete scammers is probably just deemed to be not worth the trouble. Doing things this way also helps establish that they are tough on fraud.

Also, as Google themselves say, they don't want to help give those who are gaming the system to get any more information than necessary about what sets off their alarms or trips the trigger to deactivate an account. But even so, there are good reasons to not give reasons.

</comment><comment><USER3> I'm surprised Google couldn't tell him what it was. Exactly what are they protecting by not telling people what rules they've broken?

Surely, all the breakable rules are in the T's & C's anyway?

<comment><USER4> I've been temp banned from Google Groups just by opening a bunch of posts in tabs before going through and reading them all. So it isn't just what you do, it's the amount. I've seen ad networks complain when ads just strangely get too many clicks before compared to what their ads usually get. Saw one demand the ad be placed further away from any buttons in the UI due to this, etc..

If Google was more specific, fraudsters could probably figure out how many fake clicks per day per IP are allowed, etc.. While innocent people like the author will get banned once or twice, fraudsters will probably go through tons of accounts, maybe one for each family member, for example. So the fraudsters are going to be picking up data due to experiencing many more bans than innocents.

Heck, if the innocents all blog about it afterwards like this one, they are just acting like an extra data point for the fraudsters anyway, and most of them have so little traffic that banning them or not and telling them details or not will never make a difference to Google. So hiding details from them hides them from fraudsters too, although treating them this way is probably due to the expense of dedicating resources to worthless customers more than that. Let's say you have a million users and 10 customer support reps. Which users are you going to support and tailor your polices to? The ones with appreciable traffic who make most of your money.

</comment></comment><comment><USER5> tldr; The author asks users to click his Adsense ads and gets banned for it. 'lesson learned'.

<comment><USER6> Yeah, nothing new, one of the basic rules of adsense since forever.

<comment><USER7> Basic rule true, but the guy did it 7 years ago on his first site. If we are to believe him, he wasn't doing anything against Google rules currently.

As he mentions, it is like being sentenced to life for shoplifting a candy bar when you were a teenager. There is no appeal nothing(unless you can somehow bring attention to public).

<comment><USER6> I'm not going to defend google on their practices, I also think it's too harsh, but they probably just don't separate accidental offenders with full- time scammers (just like with panda algo, etc.). Luckily for us all, adsense is not the only context ad program, if you have a valuable traffic channel you have the option to move on to competition - it's their loss too.

</comment></comment></comment></comment><comment><USER8> So much precautions in the text to maybe get his account back, funny.</comment>


The design of the Strict Haskell pragma - <AUTHOR> http://blog.johantibell.com/2015/11/the-design-of-strict-haskell-pragma.html <comment><USER2> Does the bang pattern have the opposite semantics when Strict or StrictData pragmas are in use? Can one recover lazy semantics inside a Strict module? That would be convenient/confusing!

<comment><USER3> You can use ~ to get lazy semantics, apparently.

</comment></comment><comment><USER4> Back when I was way into Haskell, Johan Tibell was the guy I tried to be most like. I learned a lot from him not only about Haskell, but good software development practices in general, and how to work better with others. Great guy.

</comment><comment><USER5> Idris is strict by default and has a stronger type system than Haskell that supports dependent typing and in effect forced the hand of the GHC developers and the wider Haskell community by showing laziness, one of the most unpopular aspects of Haskell, to be completely unnecessary for a modern, purely- functional language.

The strict pragma is a tacit admission that default non-strict evaluation was a mistake, and all of those who defended it here and on proggit for years should come clean and apologize for having done so, especially those who dishonestly tried to pass it off as an optimization while knowing full well that "spaceleaks" are one of the biggest performance concerns with deploying non-trivial Haskell code in production. I wrote off Haskell entirely for that very reason, and I'm not alone in having done so (search HN comments).

In fact, I would wager that if Haskell had not adopted such an unusual evaluation strategy, GHC would have required only a tenth of the manhours that have presently gone into it. Yes, you CS PhDs who secretly wish you were math PhDs wouldn't be able to write toy programs with infinite lists, but that's a small price to pay for lowering the language's skyscraper-steep learning curve and giving it predictable, easily reasoned-about performance characteristics.

<comment><USER5> The Haskell community is by far the most abrasive and hostile to criticism of any programming language. You can get away with voicing trite complaints about too many parentheses in a thread on Lisp, but nearly any comment here critical of Haskell ends up at < 0.

Attempting to shutdown your critics is a great way to alienate the unconverted. "Avoid success at all costs" indeed.

<comment><USER6> Perhaps you are being shutdown because you are combining your criticism with condescension and personal attacks? Like deciding that people were being "dishonest" because they don't agree with you and argue for their opinion? Or levying insults against CS and math PhDs?

I haven't done enough Haskell to be part of the community (and to have bought into whatever hostile groupthink you think surrounds it), but I down-voted you just the same for being a complete jerk.

<comment><USER7> Indeed. There is something very familiar about the tone and content of these posts from haskeldownvot5. There was another individual that achieved a degree of infamy within the Haskell community for posting similar screeds to various forums. The claims that the Haskell community can't accept criticism, the accusations of the same 'lying' about performance, the referring to 'lazy evaluation' as though it were a carcinogen, the aspersions cast against the education of various individuals, both specific and non-specific...yes, all very familiar.

I think there's some interesting psychology at work here. haskeldownvot5 is clearly inviting downvotes by his/her choice of username as well as the contents of his/her posts, but I think haskeldownvot5 has managed to convince himself/herself that there is some cabal within the Haskell community that is responsible for the downvotes. There must be a name for the phenomenon where an individual brings things upon themselves and then uses the criticism/persecution they receive as evidence to the fact that they were right all along.

<comment><USER8> > There must be a name for the phenomenon where an individual brings things > upon themselves and then uses the criticism/persecution they receive as > evidence to the fact that they were right all along.

I believe that "persecution complex" is the phrase you're looking for.</comment></comment></comment></comment></comment>


United States v. Microsoft Corp - <AUTHOR> http://www.scotusblog.com/case-files/cases/united-states-v-microsoft-corp/ <comment><USER2> This is a very important case. If the SCOTUS rules in favor of the US then corps which are active in both the US and the EU will be stuck having to decide who's laws to follow. Unilateral extraterritorial application of domestic laws is rarely a good idea, especially when a bilateral mutual legal assistance treaty already exists (which the US didn't use in this case).

The following amicus briefs are a good read introduction to the case:

Brief amici curiae of Bundesverband der Deutschen Industrie e.V., Deutscher Industrie- und Handelskammertag e.V., Ibec clg, Konfederacja Lewiatan, and Mouvement des Enterprises de France filed. (Distributed) [http://www.supremecourt.gov/DocketPDF/17/17-2/27520/20180111...](http://www.supremecourt.gov/DocketPDF/17/17-2/27520/20180111125139649_17-2.AMICUS.FINAL.pdf)

Brief amicus curiae of European Commission on Behalf of the European Union in support of neither party filed. [https://www.supremecourt.gov/DocketPDF/17/17-2/23633/2017121...](https://www.supremecourt.gov/DocketPDF/17/17-2/23633/20171213113332456_17-2%20Amicus%20Brief%20in%20Support%20of%20Neither%20Party.pdf)

———

These are way to long to read completly, but already a quick browse can be enlightening:

Brief of petitioner United States filed. [https://www.supremecourt.gov/DocketPDF/17/17-2/22902/2017120...](https://www.supremecourt.gov/DocketPDF/17/17-2/22902/20171206191900398_17-2tsUnitedStates.pdf)

Brief of respondent Microsoft Corporation filed. (Distributed) Jan 17 2018 [https://www.supremecourt.gov/DocketPDF/17/17-2/27619/2018011...](https://www.supremecourt.gov/DocketPDF/17/17-2/27619/20180111205746909_Brief%20for%20Respondent%202018.01.11.pdf)

———

HN Readers might also enjoy this one:

Brief amicus curiae of 51 COMPUTER SCIENTISTS filed:

[https://www.supremecourt.gov/DocketPDF/17/17-2/28101/2018011...](https://www.supremecourt.gov/DocketPDF/17/17-2/28101/20180117133756823_FILE- Amicus%20Brief-US%20v%20Microsoft%20No.%2017-2.pdf)

<comment><USER3> There's no reason to believe a multinational corporation can roll out a service globally and maintain it consistently with all nations's laws. See for example Google in China. They could always segment their services or be split into multiple companies.

Although it would be convenient to live in a legally consistent world, I think we are in a much better situation than hundreds of years ago, when the largest corporation had its own laws, its own army, and the ability to carry out the death penalty.

<comment><USER2> > See for example Google in China.

Yes, Google's Services in China are adapted to local laws. But China only applies those laws inside it's territory. China is not demanding that Google block "Tank Man"-Videos outside of China. The US wants to apply the Stored Communications Act outside of it's territory (In casu to Ireland).

<comment><USER4> _The US wants to apply the Stored Communications Act outside of it's territory (In casu to Ireland)._

Devil's-advocate point of view: if SCOTUS decides in Microsoft's favor, won't that give them carte blance to play "keep away" with any data sought by law enforcement? Any potentially-sensitive data would presumably be stored outside the US's borders in that case, in a country with laws sympathetic to the company's interests. I just don't see a good argument to be made for allowing a company _chartered under US law_ to behave this way.

IMO, if Microsoft has the ability to access the data, then they have the responsibility to turn it over in response to a legitimate court order. The fact that they chose to store the data on a server in Ireland, a server in Washington, or a server in orbit around Mars seems immaterial. If it's under their control, it's under their control.

<comment><USER5> > Any potentially-sensitive data would presumably be stored outside the US's > borders in that case, in a country with laws sympathetic to the company's > interests. I just don't see a good argument to be made for allowing a > company chartered under US law to behave this way.

well currently than they need to search a country that would not coporate. Currently if some bad guy would store sensitive/illegal or whatever data in germany and the us would come and ask for it, the german law enforcement would check if the request (would meet all requirements in the german law for data search, etc) is valid and if it would, they would hand over the data. that's how it should happen and how it actually happens to some extent.

<comment><USER4> But this isn't just "some bad guy" stashing data on a foreign server. The person who is the target of the search warrant handed his data over to a third party, a corporation operating under US law.

The fact that it's currently stored on a server that happens to be outside the US strikes me as one of those clever technicalities that impresses us nerds but doesn't impress judges.

<comment><USER6> The issues are not actually technological here.

These data access/privacy/disclosure issues could have and did exist in the days of paper records. The tech stuff is just a spurious justification for stepping around 200 years of treaties this country has signed, many of which cover jurisdictional issues wrt multi-national companies.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> Also [https://blogs.microsoft.com/on-the- issues/2018/01/19/somethi...](https://blogs.microsoft.com/on-the- issues/2018/01/19/something-extraordinary-happened-washington-d-c-yesterday/)

</comment><comment><USER7> If Microsoft has to disclose information from other countries this will be a big hit for all the other providers too. I even see the coming of a segmented internet. A future where you'll need permission to cross "internet" borders.

<comment><USER8> > A future where you'll need permission to cross "internet" borders.

Yes, a natural (if slightly delayed) consequence of the internet becoming an important part of the real world is that governments treat information moving across the internet like everything else in the real world.

</comment></comment><comment><USER9> I am American and believe as patriotic as anyone but honestly it does not make sense to me for the US gov to be able to go after data stored outside the US. This is a very important rulling and I worry about the ruling being the wrong one, imo.

<comment><USER10> Think about it in terms of physical documents or items, and it might make more sense.

Suppose, for example, I have leased a rare car from you. The lease has expired and I have refused to return the car. You have sued me for the return of the car. You have won, and the court has ordered me to turn over the car.

The court can force me to comply, even if I'm keeping the car in a garage I rent across the border in Mexico.

Does that raise issues of extraterritorial jurisdiction? Will Mexico be upset with the court? Will the court have to work with Mexican authorities to enforce its order?

The answer to all three of those questions is no.

The key is that the court is not ordering anything to happen in Mexico. It is just ordering me to produce the car.

Sure, I may have to act in Mexico to do this, by sending someone to go get it, or calling up the garage there and paying them to ship the car back, but those are ordinary acts that I am allowed to do in Mexico at will. As far as Mexico is concerned all that is happening is that someone (me) who has legally stored a car in a garage there is legally retrieving that car. They don't care WHY I'm retrieving the car.

Now if the court was not ordering me to produce the car, but instead was authorizing a sheriff to go seize the car from the garage, that would be an attempt at a US court at exercising extraterritorial jurisdiction, and Mexico would quite strongly object. The sheriff would have to go through the Mexican judicial system and get a Mexican order to seize the car.

The above example used a civil case, but the principles apply in general. I used the US and Mexico, but that's how it is between pretty much any pair of countries.

If it did NOT work this way, it would be a complete disaster for consumer protection regulation (and most other regulation). Any company that wanted to keep their records secret from regulators could simply keep those records in another country.

Nowadays, in the age of paperless, this could even be made automatic. Keep your internal mail servers and file servers in another country that does not have good relations with your home country and most of your internal records are now out of reach of regulators.

<comment><USER11> How does this work if the car was never in the US in the first place, and you are being ordered to turn over a car that was procured, leased, operated and contracted in Mexico entirely, nothing to do with the US, other than the fact that you live here and were ordered by a Judge to go get the car and bring it back?

Isn't this closer to what has actually happened? The account holder indicated he was from Ireland when he signed up with Microsoft, thus the account was created and maintained in Ireland to reduce latency, thus the Fed should invoke the mutual assistance treaty with Ireland to get the data properly.

The example of using the Government agents to do the bidding being bad and FORCING me to do the bidding is proper is completely wrong. If I am being forced to do something by the government, am I not acting as its agent at that point? If the government is denied a warrant for a building, it can't convince the janitor to steal the docs at the end of the night, thats just a run around the checks and balances of the law.

</comment></comment></comment><comment><USER12> Am I missing something, or is there no new information here since summer 2017? Did the supreme Court ruling happen already?

<comment><USER13> In the External Links section is a link to a SCOTUSBlog page that appears to be kept up to date on the case:

[http://www.scotusblog.com/case-files/cases/united-states- v-m...](http://www.scotusblog.com/case-files/cases/united-states-v-microsoft- corp/)

<comment><USER14> Thank you, we've updated the link from [https://en.wikipedia.org/wiki/Microsoft_Corp._v._United_Stat...](https://en.wikipedia.org/wiki/Microsoft_Corp._v._United_States).

</comment></comment></comment><comment><USER15> Unrelated to this article, but concerning the government's anti-monopoly crusade against Microsoft in the late 90s (which is relevant because many circles are unfortunately exploring government intervention against tech) ...

One common narrative is government intervention proved irrelevant because Microsoft missed mobile and the web anyway.

This is correct for mobile but wrong for the web.

Imagine no government intervention around the browser. If Microsoft controls the browser, and essentially the search engine, does Google enjoy the same trajectory? It's possible, but improbable.

Incidentally, mobile probably looks different with no Android, with Apple possibly even more dominant. However, this mobile assertion is more tenuous because it's two hypothetical steps away from non-intervention.

Whether intervention is right or wrong is a separate question altogether. But to claim that intervention had no practical effect on Microsoft undermines the pursuit of the right answer.

<comment><USER16> n/m

<comment><USER15> Already noted, just wanted an excuse to hear discussion on this topic since government intervention is gaining steam among many circles.

Didn't mean to distract from the article. Better to delete the comment?

Thanks for the reply!

<comment><USER17> I'd say keep it up. Made me think for a minute

<comment><USER15> Thanks, do you agree/disagree? Received downvotes so it seems the crowd felt like it didn't belong, but couldn't delete the comment because the option vanished.</comment></comment></comment></comment></comment>


Space Art or AI Breakthrough? - <AUTHOR> https://intelactica.com <comment><USER2> Wow! Thank you for looking. No GANs just a bunch of specially crafted convnets.

</comment><comment><AUTHOR> Is this for real or just another Photoshop "miracle"?

</comment><comment><USER3> Probably photoshop. But I am secretly hoping that it is not :)

</comment><comment><USER4> Nice! I wonder if they use GANs</comment>


Atlassian Bamboo Cloud Shutting Down - <AUTHOR> http://pastebin.com/m1J45iKa <comment><AUTHOR> I personally very recently migrated a large build system to Bamboo Cloud and am quite dishearted to find out I will have to migrate it to the self hosted version which doesn't seem like it is a super smooth process.</comment>


An Open Source Honeypot Using Docker - <AUTHOR> https://github.com/iankronquist/beeswax <comment><USER2> To me, Docker doesn't seem like a good choice of technology for a honeypot, as any kernel-level exploits could lead to potentially lead to complete system compromise or worse.

<comment><AUTHOR> If they manage to find an exploit in the Kernel then we have something far more valuable on our hands than the run of the mill WordPress malware. Remember, anything inside the honeypot is being aggressively monitored, so we'll know where it came from and what it did.

</comment></comment><comment><USER3> Note that Docker is not a security technology (or not a secure technology?); one should not assume that an attacker cannot break out of a Docker container. This honeypot does assume the security of Docker containers; be extremely careful running it in production.

</comment><comment><USER4> Would a VM be better for this? Is a VM less likely to be broken out of than Docker in this case? I'm guessing bare metal is the most secure thing to run a honeypot in? My limited knowledge says... probably?

<comment><USER5> I have run various honeypots for years. I wouldn't feel comfortable with a "honeypot in a container". I'm not even _that_ comfortable with a honeypot in a virtual machine, though I have done it for short periods of time.

My personal preference is always for bare-metal. There's always an old PC or server sitting around that can be put into service as a honeypot and if something happens to it -- e.g., hardware failure with no replacements -- well, it's not a big deal.</comment></comment>


Air Force sends mystery mini-shuttle back to space - <AUTHOR> http://www.sfgate.com/news/texas/article/Air-Force-sends-mystery-mini-shuttle-back-to-space-4108518.php#photo-3875958 <comment><USER2> As a boy I often read stories in the papers about space shuttle launches and was sad to read the payload was always classified missions. It turned out they were deploying the GPS satellites.</comment>


Data first, not code first - <AUTHOR> http://etodd.io/2015/09/28/one-weird-trick-better-code/ <comment><USER2> "Show me your flowchart and conceal your tables, and I shall continue to be mystified. Show me your tables, and I won't usually need your flowchart; it'll be obvious." \-- Fred Brooks, The Mythical Man Month (1975)

via "Objects have not failed" \-- Guy Steele, [http://www.dreamsongs.com/ObjectsHaveNotFailedNarr.html](http://www.dreamsongs.com/ObjectsHaveNotFailedNarr.html)

<comment><USER3> Though Guy Steele's idea sounds contentious, that OO encourages "data-first" because code is encapsulated:

      "Smart data structures and dumb code works a lot better than
      the other way around."

      This is especially true for object-oriented languages,
      where data structures can be smart by virtue of the fact
      that they can encapsulate the relevant snippets of "dumb
      code." Big classes with little methods–that's the way to go!

Or maybe he is just encouraging OO programmers to think more in this vein?

<comment><USER4> The tricky part is that smartness of data structures is context-sensitive.

One of the most common design errors in OO systems seems to be building systems that beautifully encapsulate a single object's state… and then finding that the access patterns you actually need involve multiple objects but it's impossible to write efficient implementations of those algorithms because the underlying data points are all isolated within separate objects and often not stored in a cache-friendly way either.

Another common design problem seems to be sticking with a single representation of important data even though it's not a good structure for all of the required access patterns. I'm surprised by how often it does make sense to invest a bit of run time converting even moderately large volumes of data into some alternative or augmented structure, if doing so then sets up a more efficient algorithm for the expensive part of whatever you need to do. However, again it can be difficult to employ such techniques if all your data is hidden away within generic containers of single objects and if the primary tools you have to build your algorithms are generic algorithms operating over those containers and methods on each object that operate on their own data in isolation.

The more programming experience I gain, the less frequently I seem to find single objects the appropriate granularity for data hiding.

<comment><USER5> Well said.

The exercise of comparmentalising and creating atomic islands of objects that dutifully encapsulate data becomes difficult during reassembly simply because we recreate the need for declarative style of accessing data in an imperative (OO) world. It's ye old object-relational impedance mismatch.

A (relational) data model is a single unit. It has to be seen this way. Creating imperative sub-structures (like encapsulating data into objects) breaks this paradigm with serious consequences when attempting to rejig the object-covered data into an on-demand style architecture. The whole model (database?) must be seen as a single design construct and all operations against the entire model must be sensitive to this notion - even if we access one table at a time. Yes, at specific times we may be interested in the contents of a single table or a few tables joined together declaratively for a particular use case, but the entire data model is a single atomic structure "at rest".

When paradigmatic lines like this are drawn, I side with the world-view that getting the data model "right" first is the way to go.

Fred Brooks and Linus Torvalds speak from experience in the trenches.

</comment></comment></comment></comment><comment><USER6> Or, start from the user experience.

Both are good places to start, and both should be given serious consideration early in the project.

Code is usually the worst place to start. If you do need code early on, I think it's fine to write it as quickly as possible, even ignoring edge cases and simplifying algorithms.

If you have good data structure design (and understand the invariants) and you understand the problem space well from a functional standpoint (including functional edge cases), you can get the code into shape later. The bugs you encounter will be mostly the trivial kind.

But if you misunderstand the user experience, or the data structures are a mess, then it's difficult to recover.

That's one of the reasons SQL databases are so great: they help you get the data design up and going quickly, and will enforce a lot of your invariants (through schema normalization, PK/FKs, and CHECK constraints). If anything goes wrong, rollback returns you to a known-good state.

I don't know anything equivalent at the user experience level, though.

<comment><USER7> This is one reason why prototyping is often so necessary. When you start from the user experience, you usually end up working your way back from the front- end: first you visualize what the user should see, then you mock up screens to give them that, then you figure out what they should be able to interact with and how, then you write code to make that happen, then you define data structures that make the code possible. When you start from data, you identify what data the user will need to manipulate, then you identify relationships between that data, then you write code to manipulate it, then you slap a UI in front, one which usually mimics the relationships you identified a priori.

There's a bit of an impedance mismatch here. Start from the UX, and you end up with a bunch of ad-hoc data structures that are very difficult to rationalize and inefficient to access. Start from the data, and you end up with a UI that mimics the data you were given and not how the user thinks about achieving their task.

The solution is to write a quick & dirty prototype focusing on UX, nailing it but focusing on _only_ the happy-path that's core to the user experience. Then take careful note of the data structures that you ended up with, and throw away the prototype. Then you start with a carefully planned data architecture that captures everything you learned in the prototyping phase, but eliminates redundancies and awkward access paths that you wrote in the quick & dirty prototype.

<comment><USER8> The better solution is to start by designing the API, and to leave the design of the data model (to support the API) and myriad of user interfaces (as clients of the API) for later.

<comment><USER7> You don't know what should be in the API until you've had a couple clients built on top of it. Users will surprise you; oftentimes that little UI detail (the one that's really hard to fit into your API) is what will make them buy.

<comment><USER4> A similar argument also applies in the opposite direction. That is, it's all very well beginning with a beautiful, idealised API, but if there is no efficient way to implement that interface then you've backed yourself into a corner before you even start.

<comment><USER9> Also UIs which don't have to support an actual data manipulation tend to underestimate dealing with the edge cases of that manipulation - which I tend to think is why you never get too far from the shell in Unix-likes.

<comment><USER7> And why so many database-backed webapps look like a frontend over a database, and virtually all mobile messaging apps are frontends over TCP/IP, and web directories before Google were just webpages with a whole lot of links.

It turns out it can be pretty profitable to break with the machine model of the underlying data and instead present things the way your users want to see them, even if it makes the code necessary look complicated and gross. The danger with building the data model or API first is that you'll build the easy, obvious API, which is the same easy, obvious data model & API that all your competitors build. Start with the user instead and you can end up with some really powerful differentiators, at the cost of it being a bitch to transform into working, sane computer code.

<comment><USER4> _It turns out it can be pretty profitable to break with the machine model of the underlying data and instead present things the way your users want to see them, even if it makes the code necessary look complicated and gross._

It certainly can, though I think you're still figuring out a data model first on those projects. It's just that you're starting with how the information is organised and manipulated from the user's point of view, then figuring out an internal representation to support it afterwards, rather than the other way around.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Ah yes, takes me back to the time when 'Data Analyst' was an actual profession, and organizations planned their workloads in order to place an appropriate order for 'enough' IBM hardware and dasd. Back then, during the first wave of business automation via computer, the processes being automated were so well defined, this level of understanding was acheivable; when you have rooms full of clerks calculating monthly payroll, you KNOW what the data is.

In so many domains today, you don't know, and the business is forgiving enough (or amateur enough?) that THEY don't even fully understand their processes.

<comment><USER11> Everyone bash Cobol since the dawn of microcomputing, but the definition of a "Data Division" section where all data is specified before literally any actual line of code is something very interesting.

This language implementation mostly made the Y2K transition so sucessful, and today these Fortune 500 companies are still stuck with their legacy systems which were written by people "with a clue" back then.

But do not program in COBOL if you can avoid it.

<comment><USER12> Cobol is interesting, but horrifically impractical in practice. Cobol is my bugbear language... I just couldn't solve problems in it. It somehow separates what should go together and puts together what is unrelated.

</comment></comment></comment><comment><USER13> Code samples or GTFO. No seriously: an article that brings up messy real-world OO code and then handwaves it away with "just use FUNCTIONS, yo!" and some box-and-arrow diagrams is useless and borderline unhelpful. Something like:

[http://prog21.dadgum.com/37.html](http://prog21.dadgum.com/37.html)

is, IMO, more valuable in the discussion. It points out the tradeoffs explicitly: pure functions mean (in this case) immutable data, which means more-complex data structures - which means the OPPOSITE of the micro- optimization stuff this article closes with.

It's also worth noting that if you're fussing about the cache efficiency of code you haven't written yet, STOP. JUST STOP. Write the code and MEASURE IT.

<comment><USER14> There are some things worth doing the napkin math first before even bothering writing the code. That includes cache efficiency. Finding and fixing design mistakes long after you've written a few thousand lines of heavily depended on code is rather difficult to tear out when you realize the design was wrong to begin with.

Since it's mostly game engine programmers presently driving this design philosophy imagine a scene in a game. There are some number of entities in the scene. Is that number infinite? No. Do each of those entities exist in their own bubble? No. You want to process all of the entities that need updates all at once. One transformation. You also know that from frame to frame there may be 0 - N entities in the scene but you don't want to be constantly allocating, deallocating, and resizing data structures. So you sketch out a reasonable number of entities to support in a scene. You know the data each entity needs to track to participate in the scene and you figure the best way to pack all of that into a struct of arrays so that processing that update is fast and doesn't waste a byte of cache. You haven't even written a line of code yet.

There is a give and take. You have to test out your assumptions and not be afraid to throw away bad code and start again. Once you start down a path you may find that the statistically significant number of accesses for entity data happens for the members related to the physics update. You might choose a different structure to pack that data into apart from the cold data that doesn't change much.

Much of data-oriented design is like this: save the modelling for documentation and diagrams and things that humans understand. Write the code for the machine since the machine is the platform. You lose mechanical sympathy when you start designing data structures based on intuition.

It doesn't cost you anything to think about these things. It's just engineering.

</comment></comment><comment><USER15> _Input - > Process -> Output_

Somewhere a Haskell programmer is nodding.

<comment><USER16> I believe computing has 1 concept needed to be understood by programmers: Input & Ouput. That's all programming is.

<comment><USER17> > I believe computing has 1 concept needed to be understood by programmers: > Input & Ouput.

That's two concepts. So, the two concepts that need to be understood by programmers are Input and Output. And State.

<comment><USER18> State is just emergent behavior caused by feeding your output back into your input.

<comment><USER19> Programmers therefore need to understand time.

<comment><USER20> However, time is shackled to space. Therefore, all programmers need to understand space.

<comment><USER19> That's interesting, we don't generally consider relativistic effects on computation.

There could be an interesting synthesis between Minkowski spacetime, lambda calculus, and Lamport clocks that will either a) show that the fundamental unifying element in the universe is _functions_ (and really annoy at least one side in the disagreements over the Black Hole Information Paradox), or b) make for a terrific Greg Egan novel.

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> Does the conclusion boil down to "use functional programming"? The author doesn't specify the way data or functions are encapsulated in the final figure. But my gut reaction is that this describes FP better than OO or any other paradigm.

<comment><USER22> Check out functional relational programming ([http://shaffner.us/cs/papers/tarpit.pdf](http://shaffner.us/cs/papers/tarpit.pdf)).

<comment><USER23> I admire the combination of theoretical audacity and sweeping pragmatism taken by the authors of that paper.

They mention Oz a few times. I am big fan of "Concepts, Techniques, and Models of Computer Programming" by Van Roy and Haridi, which shows the reader how different computing paradigms can be constructed from a kernel language in Oz. That makes the text something of a kindred spirit to the paper, insofar as it tries to aid the student in grasping many different paradigms of computation (functional, object-oriented, concurrent, and relational are covered).

<comment><USER22> The Haskell using folks at Standard Chartered Bank have been implementing some of the "Out of the Tarpit" ideas for a few years now. I can confirm, functional relational programming does work really well in practice.

</comment></comment></comment></comment><comment><USER24> It's interesting that he's advocating this on games.

I've been annoyed at most OOP codebases, but conceded that games and GUIs were the canonical applications of OOP. Perhaps you could say that highly stateful apps running on a single machine can use state encapsulated in objects.

In contrast, for web UIs and their "big data" back ends, I believe you also want to use a data-oriented approach, rather than a code-oriented approach (or at least this is the style that my code has converged upon). You don't need to wrap everything up in objects all the time when you're really just passing strings through the network and doing light processing. And when you're not even using a type-safe language to begin with.

But he's advocating the same style on games, just with structs and functions rather than buffers and processes. This makes me think OOP is more of a mistake, although I will admit that I use objects as modules now (a longer conversation, but the idea is to instantiate almost all your objects at startup, and not allocate during normal program flow).

I've long thought there was this interesting historical oddity in that we came up with languages in the 90's and designed them for GUIs, but we're using them the 2010's for web and server programming. Then you get web apps that are a mess of misleading objects, when really the architecture is stateless (or stored in a database, which is not programmable using your language).

<comment><USER25> I think our main error was in thinking that objects could be pervasive, in the same way that today one encounters "test-driven" culture.

They work reasonably well at a lower level of granularity - make a fairly complex data model using components under the hood, and then publish the resulting api as a more streamlined mutable object.

But the diminishing returns are fast once you start needing each piece of data to be fungible and adapt to new requirements, and then wrap it up in an object. The relational database has been standardized for some time in large part because it guides you towards coherent data automatically - systems that resist that model are more likely to experience a catastrophic failure, and "ORM" systems are likewise brittle.

</comment></comment><comment><USER26> When I took my first APL class the prof drilled into our heads to focus on data representation before writing any code. Over the years and across a dozen languages or so this has proven to perhaps have been the most valuable thing I learned in CS. I lost count of how many problems I've seen go from difficult to manageable and even simple to solve by devoting more effort towards finding the best way to represent the data or the problem than simply taking things as presented and writing code right away.

</comment><comment><USER27> Hey there! First off, beautifully written. Thank you for a lot of food for thought.

Second--I can't help but think of the notion of mechanical sympathy.[1] Very useful.

Finally, I want to put on [2] but my wit is eluding me.

[1] [http://martinfowler.com/articles/lmax.html](http://martinfowler.com/articles/lmax.html)

[2] [https://www.cs.cmu.edu/~crary/819-f09/Backus78.pdf](https://www.cs.cmu.edu/~crary/819-f09/Backus78.pdf)

</comment><comment><USER28> I feel the author has chosen poor examples for illustrating 'bad code'. Does he really think so little of the id software team that they aren't aware of these things? There's no mention of the fact that in the real world, all the patterns and _weird tricks_ there are won't save you from compromising on a perfect design to get stuff done & shipped.

<comment><USER29> Good people make mistakes too. It's important for all of us to accept criticism of our ideas and code without mistaking that for personal criticism.

</comment></comment><comment><USER14> This idea of data-oriented design has been influencing much of how I write code and approach problems these days. In dynamic GC'd languages it's all too easy to trick yourself into believing that all problems are unbounded. However most problems are not. And doing the math ahead of time allows you to write the minimal amount of code to do the transformation required.

It's really cool.

</comment><comment><USER30> I think the author has some great points to begin with, but the finale is a little.. lacklustre.

It's all well and good to say we can separate process from objects, but in reality it's not uncommon to require instantiating new objects/components dynamically or changing structure in ways that don't map so easily to the input->process->output diagram shown.

I also think that maintaining code and building up testable modules was one of the niceties of OOP ahead of all the inheritance spaghettis that started happening in many poorly-OOPed projects.

Kudos though to the author for showcasing his first few points by commenting on Doom's code- you don't often see that.

</comment><comment><USER31> The author had some pretty good points there. But I have to wonder if these are somewhat cherry picked.

I mean, where is the other side of the coin? Where do the advocated philosophies break?

Has any big project been built using that approach? With no problems at all?

<comment><USER32> A lot of AAA games are built that way.

<comment><USER31> Have any of them released their source code?

Not a snarky comment, just wondering if it would be possible to peak at the code.

<comment><USER32> None that I know of. The Ogre3d renderer has moved from an OOP to a data oriented design in their newer versions, so maybe you can look at that.

</comment></comment></comment></comment><comment><USER33> Two relevant blasts from my past:

"Algorithms + Data Structures = Programs" by Wirth

The Jackson Design Methodology, which essentially said that the structure of the data will produce the structure of the program.

</comment><comment><USER34> I've heard this as "debug data not code" and that's an addage that has served me very, very well.

<comment><USER35> Yeah, "smart data-structures, dumb algorithms." Mathematicians know this too: if you get the notation right, then the calculation is simple.

</comment></comment><comment><USER36> Couldn't agree more. Whatever program we write, it is manipulating and transforming data. If our code is revolving around data, it couldn't make more sense to formulate data before actually start code which is supposed to work on that data.

</comment><comment><USER37> I used to think I can communicate the architecture (including code) of an entire website using just the tables. And a good enough developer+designer could turn the schema into a website.

<comment><USER38> You imply that you no longer believe this. What changed?

</comment></comment><comment><USER39> I so wish c++ would let me code like this without getting in the way with it's OOishness. Recent gripes:

\- got a few bit flags per struct, need to know if there is at least one instance with the flag set (a counter per flag). I cannot bit-pack the flags without duplicating the flag getter/setter/destructor code.

\- no way to declare static linkage funcions as friends (the linkage is forced to external). so i need to expose types that are implementation detail in public header.

would be nice if c++ could get some RAD-slanted design work, instead of trying to get all RUSTy

<comment><USER39> (expanding on the above while using non-touchscreen keyboard)

The problem that I continually encounter writing data-first in c++ is the inability to group data members that are related to single implementation detail but are scattered in multiple classes, and indicating in a compiler- parsable way which functions have the responsibility to manage these data fields. For example, consider maintaining an M to N relation links between classes A an B, without putting links in parent class, and grouping all implementation details of these links in a a single file. Or even maintaining reference counter without using inheritance or other heavy-OO mentioned in the article. Even worse if your data is only a bitfield.

C++ assumes single implementation detail to be a single class, contained in a single allocation. It can be subverted using "public", "friend", CRTP, but it feels like hammering nails with pliers.

Newer standards go all-out on supporting really powerful data structures in library, and writing incredible templates, but there is nothing for low-level C-style custom data handling.

</comment></comment><comment><USER40> E. Yourdon was right after all! I knew it!

</comment><comment><USER41> > The boss comes in and says "Hey, change of plans. The player is now a car."

Stupid decision-making is why I will never work in games. With regular coding, you can iterate towards the domain and so long as you keep your wits about you and never make the same mistake twice, never be subjected to such a demand.

In the arts, everything's got to hew to some asshole's vision. The people building it can never really know what's going on in his head and the asshole never understands how much work it is to change things to fit the evolving vision. Killer features on games are rarely evident from day one, game shops seem to always wind up looking like sausage factories.

<comment><USER17> > Stupid decision-making is why I will never work in games. With regular > coding, you can iterate towards the domain and so long as you keep your wits > about you and never make the same mistake twice, never be subjected to such > a demand.

In the ideal environment, perhaps; all too often in real environments, radical shifts in requirements not discoverable by advance consideration of the domain can happen outside of games (sometimes, because there are radical shifts in the domain -- if your system is automating implementation of corporate or government policy, whims of policymakers can change things as radically as "the player is now a car").

<comment><USER41> I work for a marketing company, I'm well aware of shifting whims. You can build flexibility into your infrastructure if you really need it. You come up with a model for how things are likely to change in the future and work modularity into your codebase.

This approach doesn't really work for games. Everything is so interdependent, modularity that allows for all possible ways for the system could change would slow it down to a crawl. There's just no way to avoid expensive, painful rewrites.

<comment><USER42> This is somewhat true, but you structure the code in a way so that rewriting any one part is easy. You keep your modules fairly large, your abstractions thin, and the code very literal. It's much easier to do a total rewrite on code that's like this than when you abstract it out a great deal.

It's very quick to write code like this, and the maintenance cost of this isn't as large as you might think (honestly, after you get used to it, you often end up preferring it. It's very, uh, blunt, for lack of a better term).

Edit: Worth noting that these rewrites aren't always due to a change in creative direction. There are often ones for technical reasons.</comment></comment></comment></comment>


DirectX 12 tested: An early win for AMD and disappointment for Nvidia - <AUTHOR> http://arstechnica.co.uk/gaming/2015/08/directx-12-tested-an-early-win-for-amd-and-disappointment-for-nvidia/

<comment><USER2> Maybe a little surprising due to track records, but since Xbox One (and PlayStation 4 and Wii U) are AMD based, DirectX 12 not performing well on AMD would be an utter failure for Microsoft.</comment>


10 things non-technical users don't understand about your software - <AUTHOR> http://successfulsoftware.net/2010/08/24/10-things-non-technical-users-dont-understand-about-your-software/

<comment><USER2> Very 'funny' and usual problems. I really enjoyed the reading. I have found myself many times helping people on points like 1 and 10 (copy&paste ---> keyboard&chair problems).

I have also found a lot of people which is relatively new to internet and who don't see a difference between 'Internet', the browser and google. You speak to them, and they say: my page does not work, it's not active (when you have checked it is working). Then, with further investigation you find that they are typing the domain name on google, and they get no result, which, of course doesn't mean the page is not working. They just mix google, browser and internet.

It's similar to when you hear 'using the internet' exclusively refered to web browsing, as if web was the only thing internet had.</comment>


Man 'cured' of prostate cancer by shocking tumour to death with testosterone - <AUTHOR> http://www.telegraph.co.uk/science/2016/11/30/man-cured-prostate-cancer-doctors-shock-tumour-death-testosterone/ <comment><USER2> "Manliness kills Ass-Cancer". That should have been the headline, even if a bit vulgar.</comment>


Home Computers Connected to the Internet Aren't Private, Court Rules - <AUTHOR> http://www.eweek.com/security/home-computers-connected-to-the-internet-arent-private-court-rules.html?google_editors_picks=true <comment><USER2> _A federal judge for the Eastern District of Virginia has ruled that the user of any computer that connects to the Internet should not have an expectation of privacy because computer security is ineffectual at stopping hackers._

 _" (...) the court FINDS that any such subjective expectation of privacy—if one even existed in this case—is not objectively reasonable."_

Some days are more dystopian than others.

Also, see the EFF statement: [https://www.eff.org/deeplinks/2016/06/federal- court-fourth-a...](https://www.eff.org/deeplinks/2016/06/federal-court-fourth- amendment-does-not-protect-your-home-computer)

</comment><comment><USER3> So there is no private property, because anyone can force doors?

There is then no intellectual property more so, because anyone can crack DRM.

I like this ruling. It is delicious dumb precedent.

Also it would imply that you needed a licenced for public screening of any content played on a PC connected to the Internet.

</comment><comment><USER4> This is a dangerous ruling, for sure.

But the problem is that most home computers connected to the Internet are in fact not private. Sure, the defendant in this case was using Tor. But the fact that NIT pwned him tells me that he was working in Windows. Probably with just Tor browser. And obviously not with any protection against non-Tor Internet connectivity. The Tor Project ought to warn users about these issues.

</comment><comment><USER5> From an OPSec perspective, yeah, you shouldn't expect that your location couldn't be compromised somehow, even with countermeasures. So in some sense they're right, in a legal sense is where its a bit scary.

</comment><comment><USER6> And the ramifications of companies and businesses connecting computers to the internet?

Privacy policies?

Could this be used as a defense for an attacker?

<comment><USER4> Well, we know that the NSA pwns sysadmins.

More generally, the ruling seems inconsistent with CFFA. So websites could freely compromise users, even more than they already do. And perhaps _vice versa_. Although there's arguably a distinction between home computers and commercial ones.

<comment><USER7> Arguable distinction is that no-one wants to talk about industrial espionage.

</comment></comment></comment><comment><USER8> Sounds like this judge is in the agencies pockets.

</comment><comment> wisp-hr Wow, that's not good</comment>


Graphical timeline from Big Bang to Heat Death - <AUTHOR> http://en.wikipedia.org/wiki/Graphical_timeline_from_Big_Bang_to_Heat_Death

<comment><USER2> The monetization period is going to be relatively short lived.

</comment><comment><AUTHOR> Note the double-logarithmic scale.</comment>


What about a blog reader where you can prioritize the blogs to which you are subscribed and bloggers get this info as feedback? - <AUTHOR>

<comment><AUTHOR> If you care more about blog X than blog Y, you might give blog X higher priority so that you would see its posts first.

This info in turn can be used to give feedback to bloggers. They would see not only the number of people subscribed to their blog but also the priorities that they have assigned to it.

As a blogger, this might tell you that you should focus on quality rather than quantity for example.

<comment><USER2> Not a bad idea, Some thoughts though:

1\. How does it make you money? 2\. How do I know, as a blogger, who is "rating" me? If I write a blog on personal finance, and you check that after 20 celebrity blogs, do I consider that valuable? Is it? Am I 20th or better?

<comment><AUTHOR> If most people don't rank your blog highly, then you might think about focusing more on quality, cutting down the number of posts, or both.

<comment><USER2> I think you're missing my point. "Most people" isn't what I'm getting at. It's the type of person that is doing the ranking that I'm concerned about. For example, my blog on personal finance might be targeted to financial planners. Their opinions of where my blog ranks to them are more important to me than the opinions of the 18 year olds who have a passing interest in finance after they read all about justin and Angelina.

If both of those groups are taken at face value by your system, how is it helping me as an author?</comment></comment></comment></comment>


iPhone 2.1 Software Update Now Available - <AUTHOR> http://www.apple.com/iphone/softwareupdate/

<comment><USER2> What's amazing about this update is that Apple has included a what's new.

FINALLY!

<comment><USER3> Previously they probably didn't want to promise something that might not work. With all the recent high-profile problems they probably feel they finally have to.

I agree, about time!

</comment></comment><comment><USER4> Hey, you know what's a radical new idea? Shipping production-quality software when you make a new release! Just imagine for a sec... company releases a new product and instead of a POS beta-quality software, you get a decently-working software.

I have OS 2.0 right now and yes, despite what Apple may say it IS beta software and it is embarrassingly slow and laggy.

<comment><USER5> The other extreme is to ship production-quality software and call it beta. (Ahem.. gmail)

<comment><USER6> I'd rather see more of Google's strategy. At least it actually _works_...

</comment></comment></comment><comment><USER7> Yes, this upgrade is the reason I upgraded iTunes to 8.0, as the installer said I had to in order to get the iPhone upgrade. Sadly, as noted elsewhere, my itunes install is now borked. Thanks, Apple!

</comment><comment><USER8> Thank goodness they fixed the dropped call problem, I was seriously considering to return the phone because my calls got dropped so much.

And I would love it if they could somehow amplify the speakerphone functionality too... it's got to be the quietest speakerphone I have ever used

</comment><comment><USER9> Wow i can finally browse my contacts without having to wait a minute for the damn thing to load.

<comment><USER10> Please, please tell me that is true. As it is, it's embarrassing..."let me just add you to my address book... just a second. ok hang on... erm. got a pen?"

</comment></comment><comment><USER11> In related news..

""Apple has responded quickly to reports that its initial release of iTunes 8 caused STOP errors on some Windows machines"

Anyone else find that statement gloriously ironic?

<comment><USER7> Yeah. Now if they would fix my macbook's itunes crash... Off to the "Genius bar", I suppose.

</comment></comment><comment><USER12> FYI you need iTunes 8 to see the iPhone 2.1 software update.

....yeah.

</comment><comment><USER13> I got it on Wednesday for my iPod Touch. I like how there's more information like duration, album in the song lists, podcasts, etc.

</comment><comment><USER5> I have been waiting for this for a long time. 2.0.2 drops calls like that was its intent.

</comment><comment><USER14> I tried to do this in the morning, it hung for about 30mins.

</comment><comment><USER15> The biggest problem - no push notification.

</comment><comment><USER16> umm..it is still showing 2.02

<comment><USER17> Update your iTunes.

</comment></comment><comment><USER18> I'm just glad someone finally used the correct capitalization for iPhone.</comment>


Rogue restaurant sites raise questions about YC-backed delivery service - <AUTHOR> http://www.geekwire.com/2015/rogue-restaurant-sites-raise-questions-about-orderahead-the-y-combinator-backed-delivery-service/ <comment><USER2> this is effectively what postmates did in the early days, which was to offer delivery from places without delivery mechanisms, which inherently isn't wrong. interesting approach to try and outrank the restaurants' own sites, if they have them, and charging a delivery fee. clever but HUGE copyright infringement and I can see why restaurants are upset.

reminds me when software companies in the 90s went to small businesses to digitize their menus for free and then monetize any orders that came through the site via email, fax, webform, or phone.

funny thing is, if they just went back to partnering with Philz after almost a year of not, they'd make more (at least in the short to mid-term)</comment>


Coming of Age as an Entrepreneur - <AUTHOR> http://www.metamorphblog.com/2011/02/coming-of-age-as-an-entrepreneur.html

<comment><USER2> I used to stay in Matt's house in NYC when he was a hustlin' startup noob. And Matt you have come a long way, you are doing awesome things with SpeakerText man.

<comment><AUTHOR> Thanks man. Much appreciated. And you can still crash at my house, even if I'm in SOMA :)

</comment></comment><comment><USER3> Cool story, bro.

<comment><USER4> Came to post here the same.

A query though, I liked the SpeakerText.com layout etc, and being a noob, couldn't figure out what tech/lang could have been used to create the site (tried looking at the source :-/)

<comment><USER5> HTML/CSS is a standard - you can't tell what generated it because it's all the same, unless it sucks.

URL structure will give you clues sometimes.

</comment></comment></comment><comment><USER6> Congrats, I actually randomly clicked on this link on HN and had no clue it was you. Do people recognize you anymore?

<comment><AUTHOR> depends on the person, i guess

</comment></comment><comment><USER7> your product reminded me of a great Ukrainian startup Viewdle. They had won the Le Web startup competition in 2008.

their presentation: <http://www.youtube.com/watch?v=gzvfcpLtdgg>

</comment><comment><USER8> Great story man, keep up the hustle!</comment>


Answering the salary history interview question - <AUTHOR>

Recently I blurted out my current salary when asked at an interview. It's hard for me to lie, but I don't need to kick myself -- friends have been doing it for me for the past two weeks. One guy 5 years my junior has jumped his salary 40k in two years by lying about his prior salary at each of two job changes in the same city. But if you do lie, how do you come up with a believable figure? And if everyone lies, why do employers bother asking?<p>According to Robert Half Technology's figures the location I'm in pays 0.7x of the national average, and since I seek desperately to enter a major city --- some with factors of 1.25-1.41 --- telling my true high 30's salary makes me seem like a lunatic demanding double salary. In fact, double would be just enough to maintain my current standard of living, no gain aside from a better location. Advice!? I have 5 years work experience. <comment><USER2> I don't like discussing my salary history. When it comes up, I tell prospective employers 'don't be nosy.' If they can't evaluate your ability without knowing what you were paid elsewhere, then they don't know how to evaluate you and are just hiring based on confirmation bias. If they're insistent, grill them with questions about their company balance sheet.

</comment><comment><USER3> Decide how much you will sacrifice. If you can get away with asking for 50, then seceding to 45, you will have done alright. I usually try to increase by 4-8k. Depending on responsibilities of course. If they want 24hr contact than its an min 55k.

</comment><comment><USER4> Lying works if the interviewing company does not check your previous salary _and/or_ your skills are in such short supply that the company doesn't care even if you do lie.</comment>


PostgreSQL 13: don't let replication slots kill your primary - <AUTHOR> https://www.2ndquadrant.com/en/blog/pg13-slot-size-limit/ <comment><USER2> 2ndquadrant irritates me. Closing the BDR source has harmed the postgres community. There, I said it.

<comment><USER3> I don't mean to disagree with you (definitely harmful) but how is one supposed to make money building open-source postgres tooling? SaaS doesn't seem like a good fit here, nor do many other models.</comment></comment>


My problem with the 1Password subscription model - <AUTHOR> https://medium.com/@guisebule/to-catch-a-liar-1password-edition-4bfa30fbd7e4 <comment><USER2> Software companies absolutely need recurring revenues to survive, new users are hard and expensive to get, and you need to keep an active development team. Historically it was upgrades, you gave customers new features in trade for upgrade revenue, which was usually a great deal for all.

But nowadays that's lots harder, upgrades don't exist on iOS at all. And when their key features are already in the product, lots of users won't see the point of upgrading.

But what they and the author miss is that keeping software operating is a great deal of work. In 1Password's case just compatibility and bug fixing on 4 or 5 operating systems is likely a substantial ongoing effort. On iOS alone my guess is they have to support 3 different major OS versions at a time.

The disconnect is users who bought a version that worked on iOS 7 or Windows 7 and never paid a dime since expecting a free Windows 10 and iOS 11 update.

<comment><USER3> Then charge for the upgrade by doing the standard major version bump (Foo2, just like Foo but now with more Bar!) and don't try to bullshit us. Companies don't need recurring revenue to survive, they need to sell product to survive. If their biz model consists of trying to bleed their current customer base one drop at a time I will look elsewhere.

-current 1password user and evangelist who will drop it in a heartbeat if forced into a subscription

<comment><AUTHOR> This is the correct answer. Every time I hear that a software vendor needs recurring revenue to survive, I think back to the entire history of the software industry where this was clearly not the case until every recently. Its gotten to the point now where anyone who makes some sort of software believes that are a service that must be paid for by subscription.

Don't be those guys, have a good long hard think about why you deserve that recurring revenue and if its not immediately obvious, chances are you are just chasing the dollar rather than trying to solve a problem.

<comment><USER2> You don't know much about the history of software sales. I've worked at software companies for 30 years and you are wrong. The first company i worked for folded down from 12 employees to 3 because revenues couldn't support us. We got our first upgrade out ($29 for existing customers on $99 retail) and it saved the company. Two years later we had 4 products and 30 employees.

If we had been forced to give the upgrade away for free to existing customers like iOS requires, we would have shut down.

</comment></comment></comment></comment><comment><USER4> They can say they support both until they're blue in the face. Version 6 for Windows doesn't support local passwords and they keep kicking the can further and further down the road with no actual roadmap for it. The bullshit that it's a difficult feature to implement is infuriating. There's absolutely no way it's a massive effort to enable writing new passwords on a local safe when you can open and read existing safe's just fine, and create new passwords in a local cache if I'm tied to a "cloud database".

You want to push everyone to subscription and you know it. Don't be "that guy" \- right now they're 100% "that guy".

</comment><comment> norea-armozel It's definitely worrying to me that everyone is going to SaaS on everything since it removes the basic purpose of having a PC or even a smart phone: to do the computing as close to myself as possible. Some things fit SaaS as a natural consequence of their implementation but password managers and image editors aren't good fits for that and they're clearly a cash grab. Eventually, I plan to ditch 1Password when I have the time to find a roughly analogous application (which I've seen a couple but not good enough IMO) since they can't provide local storage for my existing vaults.

</comment><comment><USER5> I'm still using 1Password on my Macbook, but since I've gone full time Linux at home, I had to migrate off. Keepass + SyncThing is more than enough to keep everything synced for me.

<comment><USER6> Exactly same here.

Macpass for osx with browser plugin works awesome for me.

</comment></comment><comment><USER7> Why can't one of those big cloud/disk providers (Dropbox or Amazon or Microsoft or Google or Apple) come up with such a Password Manager? In fact, they can integrate it really well too.

</comment><comment><USER8> I think that those that think the upgrade model will suffice are missing a few things: The increase in free/customer-as-the-product solutions that undercut existing software and by extension, the race to the bottom when it comes to app prices.

Back in the 90's, you bought a thick box with a thick manual and physical media for $25 dollars. You didn't have to worry about some App Store selling just as good software for $0.99

</comment><comment><USER9> Seems like they're going to keep things as they are, if that's what you'd like.

[https://twitter.com/1Password/status/884791799138615296](https://twitter.com/1Password/status/884791799138615296)

<comment><USER10> For now but who knows what will happen next year? Once they make enough money with subscription they will stop caring.

</comment></comment><comment><USER11> So Windows users have to use the crappy EOL v4 client?

<comment><USER12> That's what I'm using now. What's crappy about it? Works great for me.

<comment><USER11> it's abandoned feature-wise and ui-wise it's inconsistent with the rest of the product offerings while they are clearly putting their time in the v6 with its cloud focus.

</comment></comment></comment><comment><USER13> I had the exact opposite reaction. I have been long hoping that they would move to a recurring revenue model.

I WANT my password manager to be backed by a financially stable, healthy company who invests in updates and maintenance. This is an area I am happy to pay a premium for and I am thrilled that 1Password is moving this direction.

<comment><USER10> Having a recurring revenue model does not mean you have a stable company. You might love it but many others don't and if they don't have enough customers on subscription it will be worse for you because you depend on their servers to operate and if they shut down your software stops working.</comment></comment>