Facial recognition: It's time for action - <AUTHOR> https://blogs.microsoft.com/on-the-issues/2018/12/06/facial-recognition-its-time-for-action/ <comment><USER2> This is a laudable first step in advocacy for real regulation of a technology that already has huge impacts on privacy and civil society. I was in the room for one of the meetings with Microsoft's senior leadership as a representative of a Seattle-based civil liberties group. While our coalition would like to see MS go further, it was quite clear that they take their commitment to corporate responsibility and ethics around the AI issue very seriously. In particular, they seemed to understand our concerns about how facial recognition technologies can magnify existing biases in our criminal justice system.

This stands in stark contrast to the meeting I attended on Tuesday with Amazon's general counsel regarding their Rekognition service. There was a near complete rejection of the idea that mass deployment of surveillance technologies in today's largely unregulated environment posed any danger to civil society. He also denied that Amazon had any responsibility for the negative impacts of their AI/ML technologies, or role to play in industry efforts to self-regulate.

<comment><USER3> > He also denied that Amazon had any responsibility for the negative impacts > of their AI/ML technologies, or role to play in industry efforts to self- > regulate.

For a period of time, there was a lot of chatter about all developers having some kind of professional oath, like doctors. Many of the approaches that were taken have issues (preclude working on smart weapons program or legal surveillance).

I wonder if what we really need is a developers oath along the following:

"Anything I build can and will be abused. I am responsible for my designs, for my products, and for the data I collect and store. If my technology is used for evil, I am responsible."

<comment><USER4> I don't know if the oath comparison works out so well for development. Let us not forget that each physician is directly responsible for a life every time they see someone. They also have a more direct effect on the success or failure of the procedure as they tend to produce a large portion of the work.

I'd argue few companies ever reach this level of risk, and those that do are so large that the individual contributor cannot reasonably take on that burden of responsibility.

In the example of some Amazon surveillance 'big-brother' software: Max the software dev is just making facial recognition software to the best of their ability. They aren't privy to the motivations, long-term plans, and potential consequences of those decisions.

The oath is always a fun topic to discuss though: In reality it holds no meaning other than to the one who takes the oath. Correct me if I'm wrong, but in malpractice cases I doubt they cite the oath as evidence since all students are essentially forced to recite it.

<comment><USER5> No snowflake is responsible for the avalanche, therefore I must pile on as much snow as possible -- The modern developer.

<comment><USER6> But the snowflake doesn't know that it is falling on a mountain slope.

<comment><USER7> Individual snowflakes are not capable of abstract reasoning.

Can we make it a requirement for ourselves to limit our power to our ability to keep that power safe?

I think that's a superset of the problem of incentive alignment in AI safety, so probably not... but we also shouldn't let the perfect to be the enemy of the improved.

</comment></comment></comment></comment></comment></comment><comment><USER8> Biometrics are creeping into everyday life. One of my local gyms this week switched to requiring fingerprints or you were barred from access. Another local gym uses facial recognition for entrance, although you can choose to have a member card instead if you ask for it directly, they don't list it as an option.

Thankfully in the EU we have GDPR. It considers biometrics as a similar sensitivity to medical data, so unless you genuinely need it (maybe a hospital) then you can only get it with explicit consent. If consent is not given then that can not bar you from service.

So I reported a company to the ICO this week for the introduction of fingerprint scanners and was assured they consider it was a breach and will deal with them. GDPR isn't perfect and I think defaulting to consent is wrong and alternatives must be called out but you can't help people sleeping walking into it, it is very convenient.

<comment><USER9> My gym also uses facial recognition, but does it via a person sitting behind a desk checking that my member ID matches my face. I don't think many people are uncomfortable with this process, and this biometric method has been used for a long time.

<comment><USER10> Yes, but that person can't copy your biometric data stored in their brain, convert it to a standardized format, and distribute it to millions of other devices.

<comment><USER9> You mean like a photo?

<comment><USER10> They would have to use a camera, which you would have to allow.

<comment><USER11> Every gym I've joined snaps your picture when you sign up.

</comment></comment></comment></comment></comment></comment><comment><USER12> This sounds like a Classic leading-and-pacing piece to take the lead in regulating a field before actual hard regulations are passed. So while demands for restriction on government use are (correctly imo) very strict, for private entities we get this:

> _From the moment one steps into a shopping mall, it's possible not only to > be photographed but to be recognized by a computer wherever one goes. Beyond > information collected by a single camera in a single session, longer-term > histories can be pieced together over time from multiple cameras at > different locations. A mall owner could choose to share this information > with every store. Stores could know immediately when you visited them last > and what you looked at or purchased, and by sharing this data with other > stores, they could predict what you're looking to buy on your current > visit._

> _Our point is not that the law should deprive commercial establishments of > this new technology. To the contrary, we are among the companies working to > help stores responsibly use this and other digital technology to improve > shopping and other consumer experiences. We believe that a great many > shoppers will welcome and benefit from improvements in customer service that > will result.

But people deserve to know when this type of technology is being used, so they can ask questions and exercise some choice in the matter if they wish. Indeed, we believe this type of transparency is vital for building public knowledge and confidence in this technology._

So they don't actually advocate that you should get a right to privacy or a right not to be profiled once you enter a store.

Instead, you get a right to opt-out of profiling by not ever entering any kind of store again.

<comment><USER13> Agreed it's sales 101 help the customer write RFP.

</comment></comment><comment><USER14> This is the first instance I've seen of the tech industry calling for regulation. I admire this and the idea that people running a corporation can understand that despite their best intentions, in the long run the corporation will act to maximize profit via legal means, even if an action is not in the best interest of society. And so in some cases we need to make certain things illegal. I would love to see a company do this sort of thing for a broad set of tax loopholes as well, for example.

<comment><USER15> There's always the call for regulation - if a competitor has a product which is ahead if you in some way wher you for whatever reason can't or won't compete. See for instance Steve Cook's recent comments about GDPR and privacy.

<comment><USER16> In this case it's almost the opposite I think. MS has good technology and that is why they would want regulation. If there's regulation then any potential competitor will now have a much harder time creating a competing product.

</comment></comment></comment><comment><USER17> Governments are the first in the line to abuse facial recognition.

Now as CCTV cams are everywhere, everybody should have a right to wear a mask everywhere without getting discriminated.

<comment><USER18> > _everybody should have a right to wear a mask everywhere without getting > discriminated._

It's a losing game. They will track you with your mask on from the moment you leave your house, your phone, your credit card, your gait, your car... It's like a super cookie, if you don't delete all the 10 places it was stored, a single missed one will be enough to regenerate it.

Total citizen surveillance is coming, everyone's location history will be in a database and kept for years, just like phone call metadata.

<comment><USER17> Nevertheless, when somebody has stolen my bike from a bike parking (where there were no other bikes and no crowd) right under a security camera near a fancy shopping centre the police couldn't find it, miraculously they couldn't even find it on the camera record like if both the bike and the thief were invisible.

<comment><USER19> most shops and private facilities have motion activated video to reduce storage volumes. There is a massive variance in how good they are at actually turning on and recording given some movement.

perhaps some city-owned CCTV cams are always on, but I'd be doubtful.

</comment></comment></comment></comment><comment><USER20> I'd like to see some real teeth in their implementation. For example:

* Rather than merely forbidding biased uses in their TOS, an internal team should review relevant source code & use cases of anyone implementing MSFT facial recognition, a'la Apple's app store.

* Build apis, libraries and easy-to-use tools that allow consumers to destroy their face data.

* Increase the concentration of pressure on Amazon by refusing to engage in the race to the bottom. Specifically, refuse to license facial recognition technology to law enforcement, military, or intelligence agencies until such time as they have independent civilian oversight, direct neutral-party monitoring, transparency, and demonstrated accountability for mis-use.

MSFT (and any corporation) is fundamentally untrustworthy. Principles are easily changed or ignored. Instead, they should begin creating institutions, code, and business process that make abuse difficult. Testing tools and APIs are the right idea - more of this approach please.

</comment><comment><USER21> Facial recognition should be expressly illegal. Period.

As should license plate surveillance.

And for those that think that license plate surveillance should be legal, what you do not know is that municipalities are mandating that private corporations install license tracking cameras on their facilities and report back to the municipality who is driving by that address. Menlo park is just one such municipality.

<comment><USER22> It's a computation. Laws against it are unenforceable in general, absent draconian restrictions on computing devices.

<comment><USER21> This is HN. I fucking get it.

Facial recognition surveillance technology deployed in any public sphere should be expressly illegal. Period.

<comment><USER23> You clearly don't get it. What if facial recognition technology can be replaced with body recognition technology? Do you ban all forms of recognition technology? That would criminalize a lot of legitimate uses for machine learning.

</comment></comment></comment></comment><comment><USER24> This is where the ACLU should spend their time and effort rather than their political meanderings. This is politically neutral, it affects everyone and Americans should enjoy some basic rights in this realm. Govern how private entities use this tech and data. Regulate official use so it's not abused, etc.

<comment><USER15> Political neutral doesn't exist. Regulation invades freedom of corporations. I support that, but I'm also left of the center. (For some definition of left and some definition of center)

<comment><USER24> Yes, I suppose. I still think this would have bipartisan support in congress as well as support from the public, regardless of affiliation.

</comment></comment></comment><comment><USER25> "The law should specify that consumers consent to the use of facial recognition services when they enter premises [...] In effect, this approach will mean that people will have the opportunity to vote with their feet"

What this really will mean that in effect, facial recognition will be widespread, legitimized, and unavoidable unless you want to live like a hermit, just like CCTV today. The only way this could potentially be avoided is targeted protests at the first stores adopting it.

The post does have some laudable positions and arguments against government surveillance using facial recognition, but I'm not sure how useful this is if private actors build even more powerful databases and offer them for sale to the highest bidder.

</comment><comment><USER26> This is the same guy who recently vowed to provide any/all of MSFT's AI technologies to the Department of Defense [https://www.google.com/amp/s/www.nytimes.com/2018/10/26/us/p...](https://www.google.com/amp/s/www.nytimes.com/2018/10/26/us/politics/ai- microsoft-pentagon.amp.html)

</comment><comment><USER27> I don't understand how this could be realistically regulated. It's passive technology and its use can't be detected. It's like trying to stop people from thinking.

<comment><USER28> You could say the same about a credit card skimmer on an ATM. It's passive, right? It's just a sensor that sits there and absorbs people's data. I don't think this argument makes a lot of sense.

The point is, there needs to be some law and order in place so that when people abuse this tech to harm people and society and get caught, there's some precedent to stop them and punish them. It doesn't matter if the technology is passive. The intent and action to use it to harm people are not passive and are not analogous to thought crime at all.

There is dire need for regulation with a lot of emerging technologies right now. We're building systems with enormous power which can break human society if misused. I think the intangibility and "passivity" of this tech (or at least how it is perceived) gives us a very false sense of security. Like how a few decades ago very few average people could understand how the internet might have a great impact on society. Obviously they aren't thinking that way anymore.

Check out Charles Stross's speech at C3 about regulatory lag relative to the the accelerated nature of tech growth: [https://www.youtube.com/watch?v=RmIgJ64z6Y4](https://www.youtube.com/watch?v=RmIgJ64z6Y4)

<comment><USER29> The passivity sense is in that it doesn't do anything /to be stopped/. The installation of the credit card skimmer is what is illegal along with the theft involved.

It is like declaring your city nuclear weapons free when the only players are either above the law by jurisdiction or within detonation range already. Just having the law on the books makes the city look stupid.

Facial recognition is a process that works on images - that makes it more passive than even a sensor since there are definite precedents for 'not here' with sensor recordings.

</comment></comment></comment><comment><USER30> Without teeth--without meaningful consequences for violations--laws and terms of service are meaningless.

What will MS do when their terms of service are violated?

A regulation forbidding use of this tech for discriminating against certain people is worthless if it specifies a $10/day fine. Penalties have to be significant, and life-changing for violators.

For example, HIPAA / HITECH specifies criminal penalties, and pierces the corporate veil, for intentional violation of patient privacy.

Both are important. 1) the penalties have to be criminal, not civil. 2) natural persons (not Romney persons) who break the law must not be able to hide behind the limited liability of corporations.

A third step would be a bounty system for citizens bringing charges. The same thing made the Clean Water Act enforceable in the 1970s-1980s.

Without enforceability like this, it's all chin music. Or even greenwashing.

</comment><comment><USER31> Think about the participants in a facial recognition system:

\- Targets (people)

\- Enablers (tech companies)

\- Stalkers (consumer companies)

\- Big Brother (governments)

Notably the only ones who cannot use the system are the Targets, because they don't have the necessary scale. Being part of a system you can't use is typically to your detriment.

<comment><USER32> FR is not out of reach for ordinary people. The algorithm of choice by the NSA is available as a cost of about $1200 per seat, and it only needs an ordinary PC to operate. This is no longer rocket science...

<comment><USER33> "$1200...ordinary people...needs an ordinary PC"

I'm guessing you had the US or Europe in mind rather than other parts of the world like Argentina, Uganda, China and India. (ignoring the omission of scale)

</comment></comment></comment><comment><USER29> Personally I think facial recognition is a sign of an underlying problem - evidentary standards and liability. We have already had people effectively murdered by bad evidence from win seeking prosecutors taking any sort of psuedo-science voodoo they can get like bite mark analysis. False positives of any sort like from facial recognition should be no different. Similarly AWS thinks that many members of congress are already in jail. Something that bad had no place being sold.

I could see holding the providers liable for bad detection a good precedent for calibrating caution in a rational way although it is a bit 'eye for an eye' for societal liking. Having something which if it recognizes a face 60% of the time saying "Hi John" to Bob isn't a liability to anyone - really just amusement. Locking someone out of their apartment and causing them to need to call a locksmith because they got a bloody noise and facial recognition doesn't work any more is low stakes. Having someone potentially jailed for a long time would bring the intervals of confidence appropriately tight if say the prosecutor were at risk of death row or 300 consecutive years sentencing. We would see people very reluctant to work in forensics or prosecution if that were the case.

</comment><comment><USER34> When someone follows you around constantly, lurking and observing your actions, that's called stalking. And it's illegal.

We are to the point where commercial entities and governments are full-on stalkers. And that should be illegal, too.

Further, it is immoral. There is a fundamental hypocrisy when people are exhorted to autonomy and personal responsibility -- "by your bootstraps", "entrepreneur", "gig economy", etc. -- at the same time they are, with mass surveillance, being left with none of this, in truth. Your every action monitored, measured, standardized, and compelled to _conform._

You are left with no agency, save that granted -- left -- to you by the powers that be.

And with everything recorded and stored, seemingly indefinitely, you become self-monitoring, self-constraining. Will this be used against me in a year? Five years? Does one slip or oversight last a lifetime?

Fy the way, do you see them taking action to swing the cameras, and the monitoring, the other way? Even Obama, with ever and ever more secrets and aggressive prosecution of whistleblowers. The police, who have fought cameras and monitoring for years. NDA's left and right, disparagement suits. On and on and on...

And, I've gone on too much, here.

Never mind just the philosophy of the matter; look, too, at how it works in practice!

Do we all want to spend not just our work hours, but our lives, in virtual cubicles?

The post-modern panopticon.

</comment><comment><USER35> There are already several anti-bias and discrimination laws on the books. Why does facial recognition warrant additional regulation?

Numerous processes already capture gender, race, and age.

Facial recognition seems like a better/faster tool for capturing these data points. But the requirement to comply with existing laws is unchanged.

Any further regulation will only limit the development of facial technology to a few large players that can afford compliance and enforcement measures.

<comment><USER36> > There are already several anti-bias and discrimination laws on the books. > Why does facial recognition warrant additional regulation?

Mainly because many companies doing it are arguing that when their models produce biased results, it's not their fault, it's just "computer thinks that way". So far as I know, this approach hasn't been properly tested in court, but it might just fly, if courts decide that you need to have intent to discriminate (and that training on real-world datasets, that are always implicitly biased, does not constitute such intent).

</comment></comment><comment><USER37> (Re-posting my comment on this link from yesterday)

This is really interesting. I wonder how much of this is real, versus PR (although, Brad Smith has an excellent track record in this area). The company that has the most to lose, were there to be real regulations concerning facial recognition, is actually a company in Microsoft's investment portfolio. That company has built the world's largest database of face and identity information. Facebook.

</comment><comment><USER38> This is a time for action, not just for facial recognition, but for every algorithm.

Every decision made by an algorithm should make its inputs clear, its criteria for interpreting those inputs clear, and its judgement to be disputable. If you can't get your black-box neural network to do so, then perhaps it shouldn't be making life-changing decisions for other people.

There's a startup that's doing sentiment analysis of social media posts, to measure how 'risky' a babysitter is - ad likely does so in a biased manner. [1]

It's illegal to use such a system, for purposes of vetting an employee, yet their entire business model revolves around families using them to vet babysitters.

[1] [https://gizmodo.com/predictim-claims-its-ai-can-flag- risky-b...](https://gizmodo.com/predictim-claims-its-ai-can-flag-risky- babysitters- so-1830913997?fbclid=IwAR0k70VnKmz5ziUnm7Pu1RrB0oJB75tXNvgAk8OPUiiCwyE-6uldLYVvi44)

</comment><comment><USER39> _Enabling third-party testing and comparisons.New laws should also require that providers of commercial facial recognition services enable third parties engaged in independent testing to conduct and publish reasonable tests of their facial recognition services for accuracy and unfair bias. A sensible approach is to require tech companies that make their facial recognition services accessible using the internet also make available an application programming interface or other technical capability suitable for this purpose._

Does anyone else find this interesting? Is Microsoft trying to keep their facial recognition algorithm on top by comparing their's to others'?

</comment><comment><USER40> blatantly obvious attempt at regulator capture is obvious. If there's anyone I'd guess is already doing what they are warning against in this "open letter" \- it's MSFT.

</comment><comment><USER41> Maybe I'm a bit too cynical, but I guess MS isn't that heavily invested/successful in facial recognition technology, that's why it can posture like that?

Because this feels a bit reminiscent of the "G-man" campaign, which might have been fun and had a point, but a point that seemingly got lost along the road of "Windows 10 as a service/storefront".

At least gotta give it to MS PR: They seem to know what's on peoples minds and are rather good at trying to appeal to that.

</comment><comment><USER42> So MSFT was actually ranked the most accurate facial algorithm company in the world by NIST. It's interesting they're just now talking about this (after these results were published)

<comment><USER43> That's the perfect time to call for regulations to make it harder for your competitors to catch up.

cf Regulatory Capture ([https://en.wikipedia.org/wiki/Regulatory_capture](https://en.wikipedia.org/wiki/Regulatory_capture))

<comment><USER42> Brilliantly malicious

</comment></comment></comment><comment><USER44> Microsoft gains the social kudos for speaking up (vaguely) about some "issue" or another. Meanwhile, actual development of the scenario will occur regardless.

</comment><comment><USER45> I understand there is some overlap and some divergence between the perils of poor privacy practices and pervasive facial recognition, but doesn't addressing the former help with the latter somewhat?

It might seem like I'm trying be on the side of the perfect against the good, but there is room for both efforts without stifling either. A holistic approach to privacy in general would help inform the values necessary towards the responsible use of facial recognition technology.

</comment><comment><USER46> The TLDR, MSFT says "You can't trust any of us so you better regulate us now."

... or they are just mad that I refuse to give them a linkedin photo. :) Supposed to be funny, but also serious. Every time they ask for one, and then ask why not, I tell them because they are fundamentally untrustworthy. And they are untrustworthy, as is every public for profit business whose officers carry a fiduciary responsibility to shareholders.

IMO this position is well written and these two sentences succinctly articulate the situation:

"In particular, we don't believe that the world will be best served by a commercial race to the bottom, with tech companies forced to choose between social responsibility and market success. We believe that the only way to protect against this race to the bottom is to build a floor of responsibility that supports healthy market competition."

<comment><USER32> This is MSFT saying "we can't compete here, and can't apparently buy the leaders, so we must legislate because We MSFT is not in control."

</comment></comment><comment><USER47> Cool! How about Microsoft taking their own advice to their heart and build services (e.g. Cortana) that run on-device?

</comment><comment><USER48> This is really interesting and I agree, but I think _only_ addressing facial recognition is missing the forest for a tree.

There is an underlying idea here of a person owning information about themselves and having control over it and making sure a company can not use it inappropriately. I think addressing it as only 'facial recognition' wouldn't go far enough.

<comment><USER49> They're not missing anything; by regulating hot topics individually they can prevent sweeping GDPR-style privacy regulation.

<comment><USER48> I am not convinced GDPR is a bad thing yet... What makes you think it is?

<comment><USER49> I like GDPR but it's probably bad for Microsoft.

</comment></comment></comment></comment><comment><USER50> Part of the problem with "algorithmic accountability" is that you need a way to verify that the software that is being used is identical to the one that has gone through the audit. With open source software you can do this with checksum verification. Is this type of verification something that any AI or facial recognition software has provided?

</comment><comment><USER51> A bit odd coming from a company that harvested so much facial data, no? [https://www.lifewire.com/website-that-can-guess-your- age-348...](https://www.lifewire.com/website-that-can-guess-your-age-3486143)

</comment><comment><USER52> I would love to have an alarm go off every time someone enters my mailroom wearing a hoodie with with hood drawn over their head after 10pm. Do we have that technology yet? I would be your customer.

</comment><comment><USER53> facial recognition is probably worst because it is harder to avoid, unless your are Muslim, but cellphone tracking is very bad: [https://www.theregister.co.uk/2018/12/05/mobile_users_can_be...](https://www.theregister.co.uk/2018/12/05/mobile_users_can_be_tracked_with_cheap_kit_aka_protocol/) (bluetooth and wifi are also pretty bad)

</comment><comment><USER54> The same should be said of the online advertising industry.

</comment><comment><USER55> From the article: _" The law should specify that consumers consent to the use of facial recognition services when they enter premises or proceed to use online services that have this type of clear notice."_

So that's what Microsoft really wants. Allowed everywhere, minimial notice, no user ownership of data, and no opt-out.

</comment><comment><USER56> Whenever this topic comes up I think about Judas Priests "Electric eye" song

</comment><comment><USER57> This is great. I congratulate them and thank them for outlining specific policy objectives.

My immediate next thought, though, is that Microsoft operates its "Cognitive Services," including facial recognition, in China. That's worrying, even if Microsoft would loudly prefer that governments generally pass nice privacy laws.

</comment><comment><USER58> "Let's make something new, which not even the scientists know where will lead! But first let's create a ton o bureaucracy and regulations so only a few super giant tech companies can participate to make these regulations with no further intentions..."

</comment><comment><USER59> as someone born in america it amazes me that america sticks its head in the sand while china creams them through embracing tech. this is old tech that is already underused in america

</comment><comment><USER60> You need a catchy slogan. "Your Face, Somebody Elses Money"

</comment><comment><USER61> I have to ask. Are those crazy wireframes really part of how facial recognition works? If so are these real for those people in the photo?

</comment><comment><USER62> This document is very thorough; yet it misses a key point. IMHO, the primary concern here is not the algorithms that produce outcomes and regulating those but what happens to the resulting data streams as well as the raw input for the algorithms. Simply storing huge amounts of video footage means you can later run algorithms as they improve or become available. It's the act of storing and exchanging data that is problematic not running algorithms against that data. You might even capture data before algorithms are invented/available to process that data or use new algorithms against historical archives of data to extract new information.

What are the implications of the right to be forgotten on e.g. security camera footage that is stored for weeks or months or even longer. The raw data contains personally identifiable information, given the right algorithms and access. Mining and correlating information from raw data that so far is considered innocent changes the game completely. Somebody with access to isp data logs, cell tower logs, and security footage in buildings, on streets, etc. can start looking for patterns in that data and cross verify and correlate events between data sets.

Recent history in China teaches us that this is neither science fiction nor an imagined risk. China is quite openly implementing mass surveillance using all means available to them and they are already using it to control their own citizens.

IMHO the focus for legislation should be on legislating not the right to be forgotten, because that is inherently hard to enforce and impractical, but instead on ensuring data capturing parties stick to strict rules with respect to auditing and securing access to that data, retention, transparency of their policies regarding all of this, and making sure serious violations have consequences.

Additionally, any surveillance data used in a court of law needs to have an impeccable auditing record proving it was captured and handled lawfully. One critically important aspect here is also ensuring the data has not been tampered with in any way: algorithms to falsify information are also becoming a risk. Capturing data that may be used for privacy invasive analysis creates a duty to adequately handle and protect that data. This should not be optional.

The key to enforcing this is sousveillance: observing the observers. This should be both legal and common. In a world where there is multi lateral surveillance by multiple groups of people, companies, and governments, hiding undesirable behavior/actions is going to be increasingly hard and you can never be sure that nobody is watching whether you are a citizen, chief of the secret police, or a head of state. Surveillance is a double edged sword and abusing it might be observed by others. The 1984 type scenarios always assume a single evil government doing all the surveillance in secret. So, we should make sure governments themselves are equally exposed to surveillance in order for us to ensure that they do not abuse their level of access to surveillance data.

</comment><comment><USER63> Are

</comment><comment><USER64> There needs to be a device that you can jam under your chin to disfigure your face for some period of time. Granted this would not be legal or pain free, but might be required in special situations like misidentification. I could absolutely see a device like this being sold on the black market in the future.

<comment><USER32> All one needs to do it wear a hat with a blinky LED light, or a illuminated eyeglass frames: the cameras try to compensate for the bright, and cause your face to have degraded color / illumination space. This will kill almost all FR algorithms because it destroys the image inside the camera before the FR algorithm can begin.

</comment></comment><comment><USER65> Too late for China.

<comment><USER66> These concerns also apply to China at least to a certain degree (or to a lesser degree from a Western centric perspective) and different emphasis.

The point is: whatever being asked for here is to advance a technology for the greater good of the society, and that's government's responsibility.

It has little to do with China or geopolitical tensions. At the end of day, everyone nation needs to choose the right path for their own. If they believe some other nations are threatening their own ideology, the should build defense or sometimes offenses to counter that.

In summary, this statement is about useless as a random chant of "communism is bad".

<comment><USER28> Kind of squirrely phrasing going on here. "If they believe some other nations are threatening their own ideology, the should build defense or sometimes offenses to counter that."

They "believe" their ideology is threatened--so it's okay to clamp down on their own citizens, representing over a billion human beings, censor and intercept all communications, edit out government atrocities and historical facts like Tienanmen square, and spy on every citizen on a profound and constant panopticon level? This isn't about western or eastern perspective. This kind of philosophy justifies the actions of any dictator or autocratic fascist. This whole obsession with a perceived national threat is the prod that pushes through all sorts of oppressive policies.

We in the west also have severe problems with this. The whole post-9/11 mentality has been all about yielding personal dignity and rights and basic privacy for the sake of assuaging some vague (and mostly imaginary) threat. We also are building a massive panopticon, we just aren't as far along as China is at the moment, and our machinations of totalitarianism are privatized instead of powered by the state. We should pay very close attention to what's going on in that culture, because we may need those lessons sooner than we think in our own future--even if they come in a slightly different form.

<comment><USER66> > This isn't about western or eastern perspective. This kind of philosophy > justifies the actions of any dictator or autocratic fascist.

You read to much into my statement.

What I said is that: \- US and China will have their own strategies for their own ideologies. \- They might clash if one or both think the other will threaten their ideologies.

I said zero about which is legitimate or a standard to make judgement.

As for the complain to the OP. The statement is contextless. I was merely extend along the most likely line of thinking based on my experience.

</comment></comment></comment></comment><comment><USER67> I could've sworn just a few days ago I saw a story about MS working with the government for such things.

<comment><USER46> That's probably partly why. They understand up close and personal what they are being asked to do and the money they can make for doing.

</comment></comment><comment><USER68> Hang on, Hang on. Let's not get too carried away here. The big corps are all scared after what has/is happening to facebook, and this is an attempt at trying to "go down the unsteady river together" with the authorities.

Now, in an ideal world, where governments are ideal, then this is a good thing for the population, as the government theoretically represents the people.

However, the government is run by people and is not ideal. This is not a good thing, and will allow all sort of actual abuses of power occur, in the long run.

I read this as the tech industry trying to get the gov. in with them also. (even more than already so), in my opinion.

<comment><USER69> Brad is very specific about the problems with facial recognition and he generalizes an approach to regulation that seems sound. The argument that the government is always going to abuse power and should therefore not attempt to regulate anything is a rallying cry of politicians who were hired to run for office to stop regulation at all costs. There is skepticism and then there is cynicism. Skepticism serves the purpose of finding realistic solutions while cynicism serves the purpose of finding a reason to justify doing nothing. When someone in government proposes that a problem be solved by doing nothing you can be sure that they don't really work for the people. We can't fix environmental problems by shutting down the EPA, we can't fix public schools by reducing their funding and when a company reaches out publicly to talk about regulating their own industry we can't prepare for the future of that industry by telling them to stay in their lane.

</comment></comment><comment><USER70> >We believe it's important for governments in 2019 to start adopting laws to regulate this technology.

 _We worked on facial recognition for decades, recently added it to our console and Windows10 Hello, we built a decent API into our cloud.... but um now we need governments to stop us, please?_

Ok, I mean... I guess I don't understand big company speak. I didn't see anywhere they are shutting down their own offerings.

The concerns for _"race to the bottom"_ of tech are interesting. A cynical person might think MS was plenty ok with it when they had little competition but now that just anyone can do it they see the problems, as just a sign of self-interest.

Not that I disagree facial recognition can be abused, it will if not already is. They got it right with genie in a bottle. I don't trust government to regulate themselves and expect the largest abuses from them. I highly suspect my time this year in Singapore was 'heavily calacuated' everywhere I went.

<comment><USER71> Regulation isn't the same thing as prohibition. Biometric sign-in wouldn't be covered by their suggestions. This is probably because biometric sign-in is not inherently abuse of AI/ML. It certainly can be though, but covering that would require prohibiting AI/ML in its entirety, even at home or in academia.

<comment><USER70> >Regulation isn't the same thing as prohibition

True, but it's almost always the first step in prohibition. Which isn't to say I think prohibition possible in this case. Just that asking for government involvement is at very best a double edged sword.

As far as I know, the Azure Facial Recogition API goes well beyond signing in to things.

<comment><USER2> I would recommend reading Oren Etzioni's piece in this month's Communications of the ACM, "Should AI Technology Be Regulated?: Yes, and Here's How."[1] He lays out some very specific, practical ways that regulation can work, while minimizing impacts on innovation.

[1] [https://cacm.acm.org/magazines/2018/12/232893-point- should-a...](https://cacm.acm.org/magazines/2018/12/232893-point-should-ai- technology-be-regulated/fulltext)</comment></comment></comment></comment>


Access private list metadata - <AUTHOR> https://hackerone.com/reports/178506 <comment><AUTHOR> The thing is, this endpoint shows any list as visible: true. You need some other source of truth to verify the actual value of the flag. I use /api/v2/lists/10 for this purpose, but you can look directly into the database.</comment>


Ask HN: What ML/AI events worth visiting in 2018? - <AUTHOR> I'm gathering a list of ML/AI events in 2018. So 224 conferences have been found so far. I wonder could you guys advise me more events to fill this list up a bit more. <comment><AUTHOR> Here's the link to the full list - [https://medium.com/standuply/200-ai-ml- conferences-in-2018-e...](https://medium.com/standuply/200-ai-ml-conferences- in-2018-eec7d0a50bcf)</comment>


Show HN: UXY – adding structure to Unix tools - <AUTHOR> https://github.com/sustrik/uxy <comment><USER2> This is becoming a really crowded space. Some other similar tools that make slightly different design choices and that have variable envisioned use cases:

\- [https://github.com/dkogan/vnlog](https://github.com/dkogan/vnlog)

\- [https://csvkit.readthedocs.io/](https://csvkit.readthedocs.io/)

\- [https://github.com/johnkerl/miller](https://github.com/johnkerl/miller)

\- [https://github.com/BurntSushi/xsv](https://github.com/BurntSushi/xsv)

\- [https://github.com/eBay/tsv-utils-dlang](https://github.com/eBay/tsv- utils-dlang)

\- [https://stedolan.github.io/jq/](https://stedolan.github.io/jq/)

\- [http://harelba.github.io/q/](http://harelba.github.io/q/)

\- [https://github.com/BatchLabs/charlatan](https://github.com/BatchLabs/charlatan)

\- [https://github.com/dinedal/textql](https://github.com/dinedal/textql)

\- [https://github.com/dbohdan/sqawk](https://github.com/dbohdan/sqawk)

(disclaimer: vnlog is my tool)

<comment><USER3> > This is becoming a really crowded space.

Those who fail to understand powershell are condemned to recreate it poorly.

It'd be great for GNU to create a standard for native structured output (as well as a converter tool like the one in this post), then have other tools be able to do it.

But realistically, pwsh is Open Source, runs just fine on Unix boxes and does this now.

<comment><USER4> Amen to that

</comment></comment></comment><comment><USER5> A related problem is the constant churn of logging.. taking structured data, destructuring it with a string serialization and then parsing it again.

This resource-wasting antipattern pops up over and over again.

Also, logs are message-oriented entries and serializing them as discrete, lengthy files is insane.

Structured data should stay structured, say a time-series / log-structured database. Destructuring should be a rare event.

<comment><USER6> I think Plan 9 gives a nice distinction. We use files as both a persistent store as well as an interface, so it seems nice to separate those two concerns out. That way you could have your logs as a UI into application state and only incur the overhead of serialization and persistence when you deem necessary.

Caveat, my Plan 9 experience is mostly theoretical.

</comment></comment><comment><USER7> Excellent, thank you for creating UXY!

I will donate $50 to you or your favorite charity to encourage a new feature: to-usv, which outputs Unicode separated values (USV) with unit separator U+241F and record separator U+241E.

Unicode separated values (USV) are much like comma separated values (CSV), tab separated values (TSV) a.k.a. tab delimited format (TDF), and ASCII separated values (ASV) a.k.a. DEL (Delimited ASCII).

The advantages of USV for me are that USV handles text that happens to contain commas and/or tabs and/or newlines, and also having a visual character representation.

For example USV is great for me within typical source code, such as Unix scripts, because the characters show up, and also easy to copy/paste, and also easy to use within various kinds of editor search boxes.

Bonus: if the programming implementation of to-usv calls a more-flexible function that takes a unit separator string and a record separator string, then you can easily create similar commands for to-asv, to-csv, etc.

<comment><USER8> Eventually you have to deal with content that contains your separator characters, however obscure. So essentially you have two choices:

A. use some "weird" separators and hope those don't appear in your input

B. bite the bullet and escape and parse properly

Option A is perfectly reasonable for one-offs, where you can handle exceptional cases or know they won't occur because you know what's in the data. However for reusable code, you need option B, which means not using `cut` to parse CSV files, for instance (since commas can occur inside double- quoted strings). In that case, what's the benefit of using USV over an existing, more common, format?

<comment><USER7> Yes you're exactly right about escaping.

Orthogonal to escaping, the choice is what characters to use for unit separator and record separator.

If the data are for machines only, then for me the choice of characters doesn't matter. If the data are potentially for reading or editing, such as by a programmer, then my choice is to prefer typically-visible characters over typically-invisible characters and/or zero-width characters (e.g. ASV a.k.a. DEL a.k.a. ASCII 30 & 31).

My choice of USV is thus because U+241F and U+241E are visible, and also in Unicode they are semantically meaningful.

<comment><USER8> Glad we agree on escaping.

I'm still not sure what the value is over CSV, which also has visible delimiters. It's true that you have to establish/enforce a specific convention around escaping and quoting, since CSV has historical variation here. But it would make more sense to me to encourage any particular consistent handling of CSV, rather than yet another entirely new separator. At least some tools already support CSV, whereas nothing currently supports USV, as far as I know.

</comment></comment></comment></comment><comment><USER9> Seems a lot like the Powershell model, which I have mixed feelings about. It's nice for shell _scripts_ , but it makes day-to-day usage cumbersome. I think you can actually use Powershell on Linux, but I'm interested to see where this tool goes.

<comment><USER3> > It's nice for shell scripts, but it makes day-to-day usage cumbersome.

How? `ps | kill node`. No pgrep hack because ps output a list of processes, not a line of text. As a Unix person Windows Terminal and pwsh is where I spend most of my day.

<comment><USER4> > In my experience Powershell is quite a bit more verbose than that.

This is common misconception. Posh allows both verbose and shorten styles via various mechanisms - command aliases, parameter abbreviations and aliases, proxys, pipeline settings for objects etc.

</comment></comment></comment><comment><USER10> > uxy align

> Aligns the data with the headers. This is done by resizing the columns so > that even the longest value fits into the column.

> ...

> This command doesn't work with infinite streams.

Does this do nothing with infinite streams or does it do a "rolling" alignment?

Even with an infinite stream you can keep track of the max width seen thus far and align all future output to those levels. It'll still have some jank to the initial alignment but assuming a consistent distribution of the lengths over time it'd be good enough for eyeballing the results.

<comment><AUTHOR> Currently it uses the alignment of the headers as the default. It's only when a field exceeds the size of the header when the output is misaligned. The next record returns to the default alignment though.

I was thinking about adding a 'trim' command that would trim long fields to fit into the default field size.

</comment></comment><comment><USER11> I think this is putting too many different functions into a single command.

        uxy ls

This looks like it "tabifies" the output of a given command. Aka it turns the output of the given command into a tab seperated format.

        uxy reformat "NAME SIZE"

This seems to collide with the above since "reformat" is not a command which will be tabified. Instead it filters stdin for two columns.

        uxy align

This seems to do the same as "column -t".

</comment><comment><USER12> > * any other escape sequence MUST be interpreted as ? (question mark) > character.

Isn't it better to forbid them? Presumably you are saving the space for further extensions, but this is allowing readers to interpret them as '?'

Similarly what is the rationale for interpreting control characters is '?'? Instead you can ban them, with the possible exception of treating tabs as spaces.

<comment><AUTHOR> Postel's principle: By liberal in what you accept... It means that the tool won't crash just because there's weird input.

<comment><USER13> Isn't it better to crash than to fail silently, possibly storing malformed data?

<comment><USER14> Known as "Fail early, fail loudly".

[https://en.wikipedia.org/wiki/Fail-fast](https://en.wikipedia.org/wiki/Fail- fast)

</comment></comment></comment></comment><comment><USER15> For anyone interested in learning how to create their own Unix command-line tools (not just use them), feel free to check out these links to content by me (about doing such work in C and Python):

1) Developing a Linux command-line utility: an article I wrote for IBM developerWorks:

[https://jugad2.blogspot.com/2014/09/my-ibm-developerworks- ar...](https://jugad2.blogspot.com/2014/09/my-ibm-developerworks-article.html)

Follow links in the article to go to the source code of the tool described in the tutorial, and the PDF of the IBM dW article.

2) My comment, here:

[https://news.ycombinator.com/item?id=19564706](https://news.ycombinator.com/item?id=19564706)

on this HN thread:

Ask HN: Looking for a series on implementing classic Unix tools from scratch:

[https://news.ycombinator.com/item?id=19560418](https://news.ycombinator.com/item?id=19560418)

</comment><comment><USER16> Cool project!

Have you considered having a way to render output in a graphical toolkit?

See for example:

[https://github.com/dharmatech/PsReplWpf](https://github.com/dharmatech/PsReplWpf)

which renders PowerShell output in WPF presentations.

<comment><USER2> You can use this (I wrote it, and have been using it daily for many years): [http://github.com/dkogan/feedgnuplot](http://github.com/dkogan/feedgnuplot)

</comment></comment><comment><USER17> Can anyone elaborate on why the tool is named UXY? I couldn't find anything in the repo, and there is no wiki.

<comment><USER18> Seems like an acro-mondeau of UX (user experience) and XY (tabular format). The tool normalizes some of the Unix tool outputs as a table which can be manipulated.

</comment></comment><comment><USER19> Very cool, I've had a similar idea myself recently! Though, why not go with a simpler format like TSV (tab-separated values)? Then you don't have to worry about quoting and escaping anything but tabs and newlines (which are very rare in tabular data).

<comment><AUTHOR> Tabs are a nightmare to deal with when you want to align the columns. Also, I don't consider tabs to be human readable: They are too easily confused with spaces. (Case in point: make)

<comment><USER19> Fair enough, I've experienced those pains myself. But what is the strategy with UXY? kind of a semi-fixed-width format that is only partially aligned, but still requires quoting/escaping? I'm not sure it's any better than CSV or PSV (pipe), and it also doesn't interoperate with existing tools.

I'm not attacking your overall idea, btw. I've just given this a bunch of thought myself, and the design space is very tricky. My current approach would be to use ASV (ascii codes 27-31) and abandon 'cat'-based readability in favor of a 'vcat' which gives you a better visual representation. Of course that has its issues too.. :)

<comment><USER20> > I'm not sure it's any better than CSV or PSV (pipe), and it also doesn't > interoperate with existing tools.

I think the point is that it's largely a formalization of what unixy tools already do.</comment></comment></comment></comment>


IRC.com outlines its roadmap - <AUTHOR> https://www.irc.com/ <comment><USER2> Snoonet people seem to be heavily involved with IRC.com stuff, which isn't very surprising considering Andrew bought snoonet. In the past there have been some very credible accusations[1] from ex-snoonet operators claiming that snoonet operators spy on users messages.

I don't know if I'd trust IRC.com.

[1] [https://bpaste.net/show/932b93fc2dce](https://bpaste.net/show/932b93fc2dce)

      <rdv[swag]> ENOUGH
      <rdv[swag]> THIS IS MY NETWORK AND I WILL RUN IT THE WAY I WANT TO RUN IT
      <rdv[swag]> YOU CAN ALL QUIT FOR ALL I CARE

PIA decided to hire this person _AFTER_ other network staff called him out for spying on users.

Oh and PIAs support site and customer DB were compromised using a deserialization vulnerability in kayako. They never bothered to publicly acknowledge this, clearly a very "privacy oriented" business.

Kayako seems to have taken down their page detailing this particular vulnerability. Their helpdesk product used to store users sessions as serialized objects in user-controlled cookies, allowing attackers to execute arbitrary code by just sticking an appropriate php object into their cookies.

Any automated auditing tool would've immediately discovered this bug, so clearly PIA just didn't bother.

The cookie looked like this, it's impossible to miss the serialized php object:

      Set-Cookie: SWIFT_client=a%3A1%3A%7Bs%3A15%3A%22templategroupid%22%3Bs%3A1%3A%221%22%3B%7D; expires=Wed, 28-Dec-2016 23:24:13 GMT; path=/; httponly

But hey, maybe their new CTO - Mark Karpeles - runs a tighter ship ;P

<comment><USER3> Full disclosure: i'm being paid to work on InspIRCd for use on the IRC.com network. This is my personal opinion not an official statement on behalf of my employer.

The IRC server software used by Snoonet, InspIRCd, does not contain any functionality for message interception (it doesn't even tell server operators the contents of a message that has matched a spam filter) and at least on the infrastructure I have access to Snoonet does not have any message interception capability either.

<comment><USER2> As an InspIRCd developer you must also be aware that it only takes minutes for anyone to patch an IRC daemon to log chats. I don't think the lack of such a feature in core inspircd indicates anything.

<comment><USER3> Whilst that is true as I have explicitly stated there is no intercept capability on the infrastructure that I have access to. If you're willing to believe some completely unverifiable logs dumped on a paste site over someone with access to IRC.com infrastructure then i'm not really sure what I can say to convince you otherwise.

You can use OTR for private IRC chats and an IRCv3 contributor is currently working on an end-to-end encryption system suitable for use in IRC channels so if you're concerned about your privacy you are welcome to use those.

</comment></comment></comment></comment><comment><USER4> What's the "IRC Foundation"? As a long-time IRC user, this sounds like a scam after reading through the the 'article', I don't know what exactly they are doing besides throwing all the buzzwords and trendy web design out there.

On the other hand, I want to give the benefit of the doubt that they are somehow improving the IRC protocol in some meaningful way.

<comment><USER5> The IRC Foundation, as it says on the linked page, doesn't exist yet. That's a goal of irc.com to do.

irc.com is a domain purchased by Andrew Lee of Private Internet Access last year. Formerly, irc.com had a letter written from him about his goals hosted on it:

[https://web.archive.org/web/20180622180151/https://irc.com/](https://web.archive.org/web/20180622180151/https://irc.com/)

<comment><USER6> The letter is still on the site, click on "Let's take IRC further" in the upper right corner.

At the bottom of the page opening there is a link to "London Trust Media Holdings":

Some of the brands listed:

* Private Internet Access

* Linux Journal

* freenode

* snoonet

and others

<comment><USER7> Went there to check if Twitch was listed. Twitch chat runs on IRC, or at least can be connected to with an IRC client - are they involved with the ecosystem?

<comment><AUTHOR> Twitch have their own custom IRC servers and not part of IRC.com/London trust media. They have been watching out on the IRCv3 group to ensure they implement IRC correctly though in the past.

</comment></comment></comment></comment></comment><comment> em-bee IRC is, and always was a walled garden. yes, IRC servers can be distributed, but they can't be federated. IRC hails from a time of the internet when it was so small that everyone pretty much could trust everyone else. someone who controls one IRC server is more or less able to control the entire network.

if there are IRC servers that can't be trusted, they can't join the network, and hence will form a network of their own. there are dozens of networks out there (hundreds if you include smaller ones), and each one is an island. if i am on a different IRC network than you, then we can not talk to each other.

the only worthwhile improvement of IRC would be to turn it into a federated protocol to rival XMPP or other alternatives. i am not sure that is even possible though, but i wish it is, and i wish that this is where irc.com will be going.

i do look forward to see IRC brought into the modern age.

<comment><USER8> I don't think it can be. Everything irc does is better done centralized. The big problem is leaking of user iP's. Ip's regardless of how they work technically are treated by police and courts as a unique identifier. As sad as it may be, Discord thrives far more than IRC ever did for that very good reason. All content has to be proxied, and that costs big bucks.

One way around it would be to stick to embedding of content only from a small number of known sites, but even then things like YouTube can still show geography of viewers iirc. Plus if those sites get tired of your bandwidth they can just block you, no negotiation of money if you don't have big bucks.

But regardless of how it's done, when you host your own actual server, you're now liable. You're identifiable, and In the U.S. identity is all that's required for any civil case, which could be thrown at you by anyone for any reason. When you host yourself you're taking on legal liability for your users, too, such as underage users that get access to pornography through it.

</comment></comment><comment><USER9> > But we still need to make it much easier for the general public to use. > People understand WhatsApp and Messenger, not servers, ports and commands.

Please don't do that. I like the fact the IRC is controllable in plain text via commands. Also, what is wrong with knowing about servers and ports? Why is it that IRC should be changed to appeal to the masses?

<comment><USER10> Because 99% of the people don't know what a port is. If they want to rethink the way things work and make the protocol more attractive you have to rethink some assumptions that were maybe correct in the early days.

Nobody is going to stop you from just using the "old" protocols. Maybe it's even backwards compatible in the way that right now you can also add port 80 to a URL but you don't have to.

<comment><USER11> And when I was in high school 99% of people didn't know what a disk drive was, much less something fancy at the time like a pen drive.

Now everyone including grandmothers knows what a pen drive is.

And people are using a chat application 99% of the time. Anything they need to know to chat with their friends, they will learn, fast.

IRC did not die because it used ports and servers. That actually had nothing to do with its decline.

IRC was replaced by something without the feudal structure of founders, SOps, and Ops, and the medieval control they had over normal users, muting and kicking people off channels all the time.

It was a social issue, not a technical one.

</comment></comment></comment><comment><USER12> My current favorite ircd is ngircd. Super easy to install with just an apt-get install away. I usually hide everyones IPs on it cause nobody should just randomly know everybody elses IP. My only issue is making an IP count exception for connection bouncers. I had a server wide bouncer setup for a good number of my users.

<comment><USER3> As the maintainer of InspIRCd i'm biased towards it but ngircd is a pretty solid piece of software if you only want something which is simple and easy to set up without a bunch of fuss.

I have to look through the source code of other IRC server implementations regularly when checking for cross-server compatibility and looking through ngircd's source code is always a pleasure. Its extremely well written and easy to follow unlike the irc2-based IRC server implementations (UnrealIRCd, etc) which usually are a pain to find out what they're even doing.

</comment></comment><comment><USER13> They say they're sponsoring an IRCd, which one it is ? InspIRCd ?

<comment><AUTHOR> Yes, currently we're putting full time dev resources into Inspircd to bring it up to date with newer IRCv3 features so that we can showcase what IRC is capable of these days. Once the Foundation has been setup further down the line then we plan to open that up to other projects.

<comment><USER13> Awesome :)</comment></comment></comment>


Ubuntu 16.04 LTS to Ship Without Python 2 - <AUTHOR> http://news.softpedia.com/news/ubuntu-16-04-lts-to-ship-without-python-2-windows-printers-detection-affected-501410.shtml <comment><USER2> IMHO the right thing to do is to update system-config-printer to work with python 3 and forget this issue.</comment>


Belgian team develops "LCD" contact-lens display - <AUTHOR> http://optics.org/news/3/12/6

<comment><USER2> What a mean trick that headline is. Everyone reading that thinks its going to be an awesome augmented reality enabling HUD, and instead we find out its only a "display" for everyone BUT the wearer.

<comment><USER3> Isn't there a rule about writing biat switching headlines?

<comment><USER4> It's the headline of the actual article. I suggest you write a strongly worded letter to the editor explaining the HN submission guidelines.

Probably best send it in triplicate, just to be sure.

<comment> jack-r-abbit It also isn't really inaccurate. The team was Belgian. They developed a contact-lens. The contact-lens uses "LCD" technology and acts as a display.

True... I thought it was going to be a HUD type thing but I blame that on me wanting a HUD and having no interest in using my contact-lens to display things to passers-by.

</comment></comment></comment></comment><comment><USER5> I never understood how contact-lens displays were supposed to deliver a focussable image on the retina. Is this doable? Maybe it will require some kind of magic metamaterials or something.

<comment><USER6> I don't think it's doable with today's technology, that's why laser-based retina projection is what everybody's working on right now. Achieving the same effect with a thin and semitransparent lens would require a lot of engineering to achieve tightly controllable photon angles and I imagine power/data transmission to the lens would also be an issue. Also, personally I would rather put on a pair of glasses than stick a piece of plastic directly into my eye.</comment></comment>


Ubuntu bug: Microsoft has a majority market share - <AUTHOR> https://bugs.launchpad.net/ubuntu/+bug/1 <comment><USER2> This was kind of a fun read. I remember years ago when I was firmly in the "open source or nothing" camp, even as a non-developer. I remember the anti- DMCA campaigns, anti-microsoft linux user groups, early Linux World Expo gatherings..But then over the years, things lost a lot of steam. Linux because more corporate. Things started to shift from the desktop to the mobile device, and also being a big Mac guy at the same time I also noticed that Mac OS X offered a lot of what Linux was without the frustration of hunting down different library versions and failed compilations.

I'm thinking out loud again. But I enjoyed the read. I like the trips down memory lane.</comment>


One merchant has better reviews. The other has more reviews. - <AUTHOR> http://www.johndcook.com/blog/2011/09/27/bayesian-amazon

<comment><USER2> I can't remember the last time I had to actually pick between the two, but as long as the percent of positive reviews is still relatively high (~95%?) I would tend to go with the one who has more reviews. Seems to me that they'll be doing more business, therefore their payment, packing and shipping is more streamlined and I'll receive my item sooner.

<comment><USER3> Which is a shame really. No, I understand that from a customer POV, and I usually do (did) the same, but now being on the other side of the fence I feel the pain of all those small just-starting-out e-shops. Can't compete on price as you're only starting and buying in thousands to get a better price is not an option. And on top of the suboptimal price they don't have enough reviews. 10-20 good reviews comparing to 100k+ 95%? Yeah, good luck...

</comment></comment><comment><USER4> I don't the beta(1,1) is a good prior. There is not an equal probability between 0 and 100 that a store has that percentage of good reviews. I think the the article should recompute the beta parameters using mle over all amazon stores.

</comment><comment><USER5> High-percentage positive reviews, how I deal with them:

Read the negative reviews. Your answer is there. Positive reviews generally tell you very little about the product that the product page doesn't already tell you. Negative reviews are much more informative. If the negative reviews are only written by mouthbreathers who naysay anything, you know you've probably got a good product. If your negative reviews start picking up on issues, especially if they agree, you've got a good indication of the stumbling blocks.

I've always found negative reviews a lot more informative about the quality (rather than utility) of a product.

<comment><USER6> I agree. That's why I'm working on summarising reviews as "Common problems with this product" on my new shopping site.

</comment></comment><comment><USER7> Every company building a rating ranking engine needs to understand Bayesian estimation. The IMDB Top 250 page has an explanation of how they rank at the bottom of the page: <http://www.imdb.com/chart/top> which shows you a lot of the methodology without all the math.

</comment><comment><USER8> The article needs some graphs, or some other visualisations.

<comment><USER9> You are right. It needed a graph, so I added one this morning.</comment></comment>


Show HN: My MVP - Viidya - Etsy for Videos - <AUTHOR> https://www.viidya.com/

<comment><AUTHOR> This is the beta launch of my latest project, an online marketplace for videos.

It is currently free to use while in Beta. After beta, we are planning on charging a 5%-10% transaction fee per sale.

The current feature set is all the basics to get started: people can upload videos, set a price and then get paid directly to their PayPal account.

In the future, we are working on supporting Stripe and Merchant accounts.

Additionally, coming soon we will have video "channels" which visitors can purchase access to on a recurring basis, allowing people to produce and sell online television shows.

<comment><AUTHOR> We also just had our first independent feature film uploaded today. Very exciting!

</comment></comment><comment><USER2> Is Viidya supposed to stand for knowledge (as in Sanskrit) or is it just a play on words video-ya?

<comment><AUTHOR> Originally it was just a play on "video" but when I saw that it also had this meaning I knew it was the perfect name.

</comment></comment><comment><USER3> Congratulations on your launch. I like the design and concept. Who is paying for the paypal transaction fees? Does it get added on to buyers total? Good luck and Keep it up.

<http://jackpotbuddy.com>

<comment><AUTHOR> Thank you!

The PayPal transaction fees are paid by the owner of the video. It usually about 2.9% + $0.30.

<comment><USER3> So if they are charging only $1 for a video, then they will only get about .68 cents.

<comment><AUTHOR> True. So that's the low end of the scale. Although it's still more than people get through iTunes.</comment></comment></comment></comment>


Cyber Monday Voucher Codes – Enjoy - <AUTHOR> http://www.vouchercloud.com/cyber-monday-voucher-codes

<comment><AUTHOR> Should point out these are for the UK mainly!</comment>


Flipkart to Snapdeal:Do Not Blame India If You Cannot Hire Good Engineers - <AUTHOR>

What a strong answer by Flipkart CEO Sachin Bansal to Snapdeal "Don't blame India for your failure to hire great engineers. They join for culture and challenge" Such a bullshit statement ever made from Snapdeal. Just for fact Google, Flipkart and Facebook hires programmers from India every year..they don't complain !! <comment><USER2> [http://economictimes.indiatimes.com/magazines/corporate- doss...](http://economictimes.indiatimes.com/magazines/corporate- dossier/argumentative-too-emotional-are-indians-tough-to-work- with/articleshow/45638709.cms)

</comment><comment><USER3> I happened to interview few employees from Snapdeal for my company, technically they were inept and they didn't know why a specific this they had implemented. I blame their HR team for not hiring good engineers in first place.

<comment><AUTHOR> Yes this is specific case where HR team is very incompetent to hire technology talent. HR team should be capable enough to understand how IT industry changes over last couple of years. If they use same tactics to hire good tech talent I am sure they will not.

</comment></comment><comment><USER4> Yes, a good reply by Flipkart.</comment>


Show HN: CloudBoost.io: Search, Store, Sync Data with One Simple SDK - <AUTHOR> https://www.cloudboost.io

<comment><AUTHOR> Founder here :

Value Props :

#1 - We have one API, that automatically detects how you query your data, and how you store and depending on it, We store your data into Redis, mongo, elastic search , orient db, etc.

#2 - You don't have to learn any of these, all you have to do is play around with a simple SDK.

#3 - You don't want to manage your data in multiple db's which most of the big guys do. As an indie developer you have the power of what big guys have. For ex : Stackoverflow uses Redis + ElasticSearch + SQL. We don't expect an indie to learn all of these.

#4 - Query time is theoretically fast, because we leverage multiple db's at once.</comment>


The Coming Code Bootcamp Destruction - <AUTHOR> http://zedshaw.com/2014/10/19/the-coming-code-bootcamp-destruction/

<comment><USER2> Wonder if more experiences like this [1] will come up. He actually got a cease and desist to take down the blog post from them...

[1] [http://joselcontreras.com/about-coding- house/](http://joselcontreras.com/about-coding-house/)

</comment><comment><USER3> After deeming the academic science career path too exploitative and fraught with landmines, I decided I wanted to being a transition into the tech industry as a software engineer. Only trouble was... I didn't have any of the necessary modern web development skills to actually get hired and it would have probably taken me over a year working 'on the side' to gain them. Having just completed a PhD, I was not in the state where I could have justified going BACK to school for a masters in computer science either. So for my level of experience, place in life, and motivation, the coding bootcamp I attended (Hack Reactor) was the best thing I could have ever hoped for. I worked hard during the program and got a great job as a software engineer only a couple weeks after graduating the program and have been happily employed in my new role for ~7 months so far.

I'm torn on this issue though, because even though I feel that Hack Reactor was worth every penny, I can acknowledge that the "coding bootcamp" space could potentially be littered with shysters and people trying to make a quick buck, taking advantage of students by promoting false hiring stats. I'd welcome for a light to be shined on those programs, but would lament if Hack Reactor specifically gets thrown under the bus or that the tech industry sours on grads of good schools like Hack Reactor because they are labeled as simply "bootcamp grads".

<comment><USER4> From what I've seen of bootcamps, they can be very useful for someone with a decent amount of software and computers already under their belt. For someone completely green, it's dicier.

That said, either way the real tests come later. Things like adapting to new technologies and new ideas, or self-teaching all the theory that bootcamps inevitably skip over.

Is your average bootcamp grad who had no real experience going in able to have a normal software engineering career trajectory? There's no good data, and there won't be for a while, but I have my doubts.

<comment><USER3> Because the bootcamp industry hasn't been around very long, you're right, there is no good data. But from my experience and the experience of my peers in my class, I believe that adapting to new technologies/new ideas is actually one of our main strengths. Those skills are essentially a pre-requisite to getting through the program.

Your question about the potential to have a normal software engineering career trajectory is a good one (one that I am particularly interested to hear the answer to) and that's why I wish that more employers would speak to this issue. I would venture to guess that my employer would speak highly of Hack Reactor and how prepared HR grads are because they have continued to hire from there, but it would be nice to see how employers actually review these schools and not just the students.

<comment><USER4> One of the common hazards in entering a field is that the neophyte tends to see everything through the lens of what they grasped first. In a traditional CS curriculum, this is intended to be a formal and mathematical understanding of computers.

When you start by learning a language, that becomes the basis for your understanding of computing. This isn't always a strength. Imagine someone who learned programming via C but now has to learn Lisp - they're going to have a hard time.

I've heard very mixed reviews of hiring from bootcamps. For people who needed the exact skillset the bootcamp taught, it was perfect. For those without that exact alignment, ran into the limits of the person's knowledge pretty fast.

<comment> FLUX-YOU >For those without that exact alignment, ran into the limits of the person's knowledge pretty fast.

That seems natural. They only have 3 months of experience. The company is simply going to have to help with that, along with ample googling and reading.

I think the expectations of those doing the hiring may have been out of line, possibly due to bootcamps selling them something they simply can't deliver reliably, possibly due to hiring managers not knowing the field.

<comment><USER4> A lot of it was that the bootcamp grads didn't have a good grasp of what they actually knew. They would claim to know a language, but in actuality only know one particular framework in that language.

</comment></comment></comment></comment></comment></comment><comment><USER5> I really hope that, when he makes the actual Code Bootcamp Destruction post, he makes sure that he has more than a couple emails about each situation he exposes

not that I think a pile of lies were sent to him, but more along the lines of, what happened isn't always what was perceived to happen, or what was perceived from hearing about something happening.

<comment><USER6> I always cover my ass and being as I don't want to get sued I make sure to get reports of stories from multiple sources and research things heavily before I move.

</comment></comment><comment><USER7> I'm a "bootcamp" graduate who has been happily employed at a great company for around a year now.

I would definitely say that my experience of grinding out 60 hour weeks of programming was very much aligned with learning something the hard way, so I really hope that Zed at least manages to acknowledge the successful programs in the space.

While I share the concern that many of these programs may not live up to their claims, it should not be overlooked that there are a few quality ones that really change people's lives.

</comment><comment><USER8> A couple months ago I decided to start a dev bootcamp here in the midwest. We only had one other dev bootcamp school where I live so I decided to give it a try. I work a full time job so I really didn't need the money. After talking to so many people full of passion and desire to become a programmer that have little to no money, I have decided to do it for free so I can network with people and collaborate on ideas. It's a 6 month course that covers just about everything. It is done at night from 6-10pm monday - thursday, with one on one mentoring all other times from 8pm - 1am. It is done over Skype, HipChat, Webex, and IRC. Look forward to meeting you. [http://www.midwesthackerschool.com](http://www.midwesthackerschool.com)

</comment><comment><USER9> Over the past 2 years, many small web consultancy shops have figured out that teaching boot camps is more lucrative than doing actual consulting.

<comment><USER10> Yeah, many bootcamps have become like those "get rich late night informercials".

</comment></comment><comment><USER11> "I've been for them because they aim to help people learn to code and try to keep costs low compared to a similar degree from a university. I've been against them because most just take my books, teach my material, then rip off students for $15k programs that don't actually get anyone deployed."

Isn't that what traditional education/university courses do?... but over a much longer period of time and more money?

Light is the best disinfectant, I hope your post spark some strong discussion because that rarely happens with universities and the stakeholders.

I wonder very strongly what happened to the students of Livingsocial's Hungry Academy experiment led by Jeff Casimer and JumpStartLabs in 2012. It was a initial class of 8-15 or something with promised contracts at the end. LivingSocial chose not to continue the program and I believe gschool(galvanize) spawned off of that model.

Jeff talking about his vision for teaching people to code on ruby rogues in 2012 [http://rubyrogues.com/050-rr-hungry-academy-with-jeff- casimi...](http://rubyrogues.com/050-rr-hungry-academy-with-jeff-casimir/)

I started Dev Bootcamp in early spring 2013, signing up after lamenting that [http://pragmaticstudio.com/](http://pragmaticstudio.com/) in Reston, VA was 2-3,000 for a 3 day course. It just made sense in comparison.

I've found Dev Bootcamp to change and evolve as time moved due to student feedback(I parttime coached students there to stay in touch). The curiosity to learn everything and knowing how to find the answers was my favorite takeaway from the bootcamp.

<comment><USER12> I worked at LivingSocial while Hungry Academy was happening. I believe there were about 15-20 students and they were promised jobs with the company if they successfully completed the program.

Most of what I heard about it was second-hand, so my information may not be entirely accurate. That said, I believe the outcome was pretty mixed. Some of the students did very well and ended up becoming respected members of the engineering org. Others were just OK. A few left for other companies shortly after completing the program -- pretty tacky stuff, since LivingSocial PAID them the entire time they were students. I also heard one or two of them didn't pan out at all and were eventually let go.

I think the primary reason LivingSocial chose not to continue the program was because they started running out of money. The first class finished around the time it became clear that daily deals were not going to be the cash cow that everyone expected. LivingSocial saw their valuation drop dramatically, and started being much more careful about how they were spending money.

I left the company about a year after Hungry Academy ended, so I have no idea where these folks are now.

</comment></comment><comment><USER13> As someone who learned to code long before the whole "boot camp" thing, I would be very interested in hearing stories of what they are all about. I would hate to give someone bad advice in either direction.

</comment><comment><USER14> I've had my suspicions about the rebranding of vocational schools as "hacker schools" and "bootcamps". Regulation and accreditation, while stifling, does allow government aid and ensures some kind of minimum quality (like restaurant health inspections).

That being said, I still think there is a valid business in training developers who want to change "stacks" (i.e. Embedded dev jumping into web dev, C# dev jumping into Erlang). The stacks, and ecosystems, are just complex enough to require allocating a lot of free time to becoming proficient and employable. Not everyone is an autodidact. (Perhaps, this is also the solution to the old "developers burn out at 35" axiom.)

</comment><comment><USER15> I for one feel quite vindicated by this endeavor I attended a bootcamp in Pearland, TX and it was terrible. Luckily I was able to get a job later in a programming related field, but it was nonetheless a ridiculous and terrible experience. If anyone is interested in my experiences they are over at sprky.co I have also reached out to the other people from my camp that had a terrible experience. Overall I think the idea of coding bootcamps is on the right track and really hope to see it succeed. However the instance of what I went through has left a bad taste in my mouth.

</comment><comment><USER16> Perhaps ThoughtBot has a better model with $500/week paid apprenticeships.

<comment><USER17> That's not a bootcamp. Thoughtbot runs metis now, which is a bootcamp at $12,500 - [http://www.thisismetis.com/](http://www.thisismetis.com/)

<comment><USER16> Not being a bootcamp is the point. Real experience without going into debt.</comment></comment></comment>


Ask HN: Thinking about Applying for a Gamedev Job, Any Tips about My Portfolio? - <AUTHOR> I have a sort of messy CV (multiple studies without degree), been self-employed for the past years working on a super niché project (Energy Market Simulations) and some other small projects, and now consider applying for a junior position at a  german game developer working on an RTS (I'm german myself). I put together a quick portfolio. I never applied anywhere before so could you please give me some feedback, I'm a bit at a loss - I obviously could improve the design of it but for now I'm not even sure if I should include all those small not-very polished side projects or not.<p>Aurelwu.github.io/portfolio.html <comment><USER2> It's good and you'll be fine if you leave it as is. IF you have extra time to mess with it, read on.

Be aware that on average the people interviewing you will look at your portfolio for ~60 seconds. Show off the stuff you're proud of and think is interesting.

Show your games in action: use gifs. It'll make people more likely to try the actual games. They still almost certainly won't, but that's not a strike on you, it's just that there's literally no time.

Tell us why the project is cool. "Random terrain generation in ShaderGraph!..A unique twist on Sokoban with procedural puzzle generation! An Excel add-on that visualizes energy market futures using realtime data!"

If this is used instead of a CV, I'd want to know what languages and tech are involved with each project too.

List the relevant companies for the playtesting experience. Knowing which QA operation you were in is more important than the specific game.

Finally, I'd encourage you to do a little bit more styling of the webpage. Let's get some margins to center up the content. Use complete sentences with correct grammar, but keep things as brief as possible. Let the gifs and screenshots speak for themselves when they can.

<comment><AUTHOR> Lots of good advice, thanks a lot. As they are a rather small company and they posted the position a few months ago I think they might spend a bit more than 60 seconds but gifs are still more telling than still images.

There will be a CV, list of languages/tech I am experienced with and cover letter as well, so I omitted that here, might add it to the work projects for clarity.

Improving the styling - not my strong point but I should definitely do it.

</comment></comment><comment><USER3> > including 1st Place in Supreme Commander with my brother Dario who now is > professional Starcraft 2 Player (LiquidTLO)

As someone who has watched TLO play, that's pretty awesome.

I think your portfolio looks pretty good! I think the trick is really a good cover letter or way to get attention before they look at your portfolio. If you say why you're a good fit, and how you would like to work for them, and why, and how you can help them with your skills, then they look at your portfolio, I think you'll have a better chance. I personally think the hardest step is the first one, because if a company has a lot of people applying, the manager might only look over your resume/portfolio for a minute or two, and might not even be fully paying attention when they do.

Building something and showing it off is still way ahead of most people, even if you are a bit embarrassed about a lack of polish. That's what the artists are for! Good luck!

</comment><comment><USER4> Looked briefly and saw a typo. "A word typing game a friend and me created during LD 42." Should be "a friend and I".

<comment><USER5> (At last! the perfect occasion to link to one of my favourite cartoons... "THRAK AND I")

[http://explosm.net/comics/2830/](http://explosm.net/comics/2830/)</comment></comment>


Reuse Your old personal GSM phone for SMS control and monitoring - <AUTHOR> http://dev.emcelettronica.com/reuse-your-old-personal-gsm-phone-sms-control-and-monitoring

<comment><USER2> now i how what to do with my old gsm

<comment><AUTHOR> Open your garage door or switch-on the boiler of your mountain cottage?</comment></comment>


A Zero Day Broker's Price List - <AUTHOR> http://www.wired.com/2015/11/heres-a-spy-firms-price-list-for-secret-hacker-techniques/ <comment><USER2> So finding a way to sneak an obfuscated bug into a library used by Webkit now yields 500k? Opens the door for a whole new class of 'open source monetization strategies'. Seems like it starts to make sense to pay people to infiltrate core dev groups of infrastructure libraries.

<comment><USER3> 500k are for a remote jailbreak on iOS from the web browser, not just for code execution in the sandboxed browser. So a webkit vulnerability alone will not be enough, you will need to chain multiple 0 days in order to escape the sandbox, and a kernel memory corruption vulnerability to "jailbreak it". and additionally you will need a codesign vulnerability to run the untether exploit everytime the device boots because the jailbreak is not persistent otherwise.

</comment></comment><comment><USER4> > For the harder target of Google Chrome, Zerodium's price rises to $80,000

>> Rewards for qualifying bugs typically range from $500 to $50,000. [https://www.google.com/about/appsecurity/chrome- rewards/inde...](https://www.google.com/about/appsecurity/chrome- rewards/index.html)

Maybe the bug bounty is too low?

<comment><USER5> Yes let's give more incentive to be black hats.

Anyway, IT has still not proven positive impact on the real world economy...

IT startup are fed up with cash since 20 years and every benefits seems to be sunk into a fast obsolescence sink.

In terms of engineering it is like comparing the F16 now from 40 years ago:

new F16 has a lot of electronic devices, BUT costs more to operate, lose in dogfight vs its former self and former Mig/Suckhoi, it is 9 tons heavier, it costs way more to build...

Nowadays, IED are costing peanuts, and russia is frigthening europa with planes that should be in museums loaded with nuclear missiles.

In economics as in war, costs matters. And at one point for making financial transaction, the costs of security will matter. Given a point of distrust, people may revert back to old tech like faxes and unplugged networks and notice they are more competitive this way.

</comment></comment><comment><USER6> So they know about vulnerabilities in all those products and keep them private for profit?

Good thing the secret services have no access to those exploits. Fun times we live in.

Edit: /s was omitted as an exercise for the reader.

<comment><USER7> I could spot the sarcasm a mile off, but them I'm British.

<comment><USER8> I'm Irish, I laughed.</comment></comment></comment>


An experiment mimicking the Dock of OS X using only CSS - <AUTHOR> http://michaelhue.com/cssdock/ <comment><USER2> Have there been any usability tests (or even just a logical argument) that show the OS X-style dock to be a good UI mechanism?

Seems to me that turning off magnification and flushing it to a corner (so that everytime it grows it doesn't move around the existing icons) would have been a better default solution.

Apple usually thinks these things through though so maybe I'm missing something?

<comment><USER3> The hit space for the icons is static, and matches the area of the un-zoomed icon. It achieves this by growing and shrinking (and sliding) the zoomed icon as you mouse across it, so you come to the end of the icon at the same place you would have if the icon didn't zoom in at all. This allows it to look neat while still having good usability, because your spatial memory is left intact (the only thing that changes that is adding/removing icons).

<comment><USER2> You're talking about horizontal space? Or does it apply to vertical space as well.

Because I had a lot of trouble acquiring the resizing corner of a window when it was near the dock. I would miss that tiny target and mouse-over a dock icon and then have to drag the mouse a lot further up to make the icon go back down.

I have since switched to having the dock on the left side of the screen instead of the bottom and that seems to be noticeably easier to use.

<comment><USER3> I was talking strictly about the horizontal space. If you don't like the icons moving up to cover more vertical space, maybe you should just turn off zooming?

</comment></comment></comment></comment><comment><USER4> I am seriously impressed. Thanks for sharing!

I wish there was an easy way to fit this into some of my projects. I don't mean the browser incompatibilities others have pointed out, either!

I feel like the idea of using this in a practical application is stunted by the "Ikea effect" of something looking awesome in the showroom but crappy in your actual house. Unless you take great pains to make sure that everything in a room matches thematically, it will look like a careless hodge-podge of well- intentioned designs that don't work well with each other.

The reason it looks great inside OS X is that Apple have put years of thought into how the Dock fits in with the rest of the user experience. You can't drop a dock into an application without putting real thought into whether it's the right navigation tool.

It's usually not the right navigation tool, but it sure is pretty.

</comment><comment><USER5> It works on the latest Google Chrome and Firefox on the latest Ubuntu and looks nice. On my several years old computer both cores used around 20% to 30% while moving between the icons at a normal pace. Not critical and good performance, comparable to a few flash sites I checked for comparison.

One of those flash sites seemed to mess up the browser and the subsequent flash dock sites failed to load correctly. I don't see this with HTML 5 and CSS sites which achieve the same level of feature usability.

</comment><comment><USER6> Does not work properly in two of three browsers I have. I don't see a reason why not use javascript in cases like this. I get it as a showcase of power of css but please, don't use this on your websites (yet). Here's[1] an similair example from 2007, works just fine in all three browsers I tested.

[1] [http://www.ndesign-studio.com/demo/css-dock-menu/css- dock.ht...](http://www.ndesign-studio.com/demo/css-dock-menu/css-dock.html)

<comment><USER7> Which browsers?

<comment><USER6> Opera, Chrome, and Konqueror. In Chrome it seems to work fine, in Opera the reflection is missing and in the Konqueror there is no reflection and it is not animated.

<comment><USER8> Maybe you really should reconsider you browser preferences? I mean, it also doesn't work in the browser that the kid from next door built as his school side project.

<comment><USER6> I don't use Konqueror, I just have it. My point was that even with this browser the javascript version works. Chrome is quite popular in desktop market and Opera is too (in some regions at least). Besides that, the same rendering engine is used in mobile and internet-enabled devices (such as a TV) -- so it's still relevant.

</comment></comment></comment></comment></comment><comment><USER9> Wasn't Google's homage to the OS X dock, done in 2005, also using pure CSS? <http://www.macworld.com/article/43631/2005/03/googlex.html>

</comment><comment> jarek-foksa Is something like -webkit-box-reflect available on other browsers? It seems to be totally non-standard (none of the CSS specs mentions it).

<comment><USER10> Things that start with -webkit are only (at least originally) available on WebKit browsers (Chrome and Safari, mainly).

<comment><USER11> Isn't this sort of thing is why everyone hated IE6?

I can't help but think we're going to have a bunch of bloat due to formatting between the webkit-/moz- options, just like we had to for IE.

<comment><USER12> The vendor specific thing allows vendors to do widespread bug testing. People who coded border-radius expect it to work, and (I'm not 100% sure of the current state of that) people who wanted it before they were sure it worked had to do -webkit-, and -moz-, etc. They should understand that the vendors aren't 100% sure they coded it right. This way, if someone finds a bug with -webkit-, they don't have to worry about breaking websites by changing it.

<comment><USER13> What will happen to all those -webkit and -moz declarations in the wild once a feature gets added to the standard? Will all browsers be expected to observe -webkit-feature-foo or -moz-feature-foo as though the author intedended to use feature-foo with no vendor tag? It seems unlikely that all authors will go back and update their code once standardized.

<comment><USER14> It's the website developer's responsibility to switch it over.

Using them in the first place is saying, "I want to use cutting edge features that may change and break at any time." Being removed and replaced with the standard version is just a special case.

But it doesn't hurt to use multiple versions, so most people just specify it for each browser and the standard. The browser will ignore the ones it doesn't understand. For example, this works:

        div {
            -webkit-border-radius: ...;
            -moz-border-radius: ...;
            border-radius: ...;
        }

</comment></comment></comment></comment></comment></comment><comment><USER15> Works great in Safari. In Chrome, there is a flicker when you click an icon. Sometimes the entire window flickers white.

</comment><comment><USER16> I think the growth rate should be adjustable easily. What's your approach to this problem?

<comment><USER17> The growth rate can be changed quite easily in line 190 and 199 of dock.css.

</comment></comment><comment><USER18> It looks nice on Safari, but I do echo other people's comments: the code looks like it uses non-standard mechanisms for achieving it's goals and had to be tailored for specific browser families. To me, that's a "code smell".

<comment><USER19> It's an experiment using cutting edge browser technology. It's acceptable to only work in certain browsers.

<comment><USER18> And one cannot critique an experiment?

<comment><USER20> Saying "This experiment uses experimental features" presented as a negative is odd, that's all.

</comment></comment></comment></comment><comment><USER19> The link to the old version leads to a 404.

<comment><USER17> Fixed, sorry about that.

</comment></comment><comment><USER21> Don't shake the platform when the user moves the mouse across the icons; the effect is rather nauseating. (FF 9.0 on Win7)

<comment><USER22> the problem is that the icons don't overlap. The space between them isn't a hit target

They are like [ ] [ ] [ ]

When it should be

[ ][ ][ ]

and just center the image inside

This is really cool though

<comment><USER7> Yes, and I remember some early GNOME docks had this same issue, so you couldn't appreciate fluid motion when you moved the cursor horizontally across the dock. But it's very well done otherwise.</comment></comment></comment>