City of Boston drops Microsoft for Gmail - <AUTHOR> http://www.bostonglobe.com/business/2013/05/09/boston-goes-google-its-drops-microsoft-mail-services/atkfJhGz82wstRzXUTPw4O/story.html#__sid=0 <comment><USER3> "The city estimated it costs about $100 a year per employee to use its current roster of Microsoft products."

$100 per year is such an insignificant cost for something as vital to their productivity as their software. If the employees lose any time at all to learning to operate in the new environment it is all but wiped out.

While saving $280,000/year sounds pretty significant, with 20,000 staff as the article suggests you only have to make a difference of 14 dollars per year to realize those savings.

14 dollars per year is maybe 0.03% of an city employee's salary. I don't have a concern if they wanted to move for technical reasons, or if it was because it was more efficient, or if they just thought it was better software. But to save 14 dollars per employee per year and only recover the cost of migration after 3 years. That's dumb.

But it's definitely worth it for google.

<comment><USER4> The original announcement on boston.gov: <http://www.cityofboston.gov/news/default.aspx?id=6123>

It's clear the decision was made to boost productivity. The dollar savings are just a bonus.

</comment></comment><comment><USER5> Hope this doesn't turn out like the last time Boston tried a significant migration away from Microsoft.

"When the state information technology chief of Massachusetts announced in 2005 that the state was going to standardize its computer document format to be more compatible with open-source software-software that isn't controlled by a company-than with Microsoft products, loud choruses of support and outrage ensued, closely followed by the announcement of an investigation into the chief's apparently perfectly legal state-funded travel for participation in open-source software conferences, followed by a new state-government announcement that it would work with Microsoft to stay compatible with the company's document formats, followed by an announcement from Microsoft that it would bring its document format closer to an open-source format."

[0]: _A Perfect Mess_ : [http://www.amazon.com/Perfect-Mess-Benefits-Disorder- ebook/d...](http://www.amazon.com/Perfect-Mess-Benefits-Disorder- ebook/dp/B00CAUHGB4/)

<comment><USER6> > followed by the announcement of an investigation into the chief's apparently > perfectly legal state-funded travel for participation in open-source > software conferences, followed by a new state-government announcement that > it would work with Microsoft to stay compatible with the company's document > formats

In other words, it's just safer to stay with Microsoft. You really don't want well-funded groups investigating every single activity, making you dig up every single receipt, and sponsoring your opponents, do you?

Looks like textbook Microsoft tactics.

</comment></comment><comment><USER7> I sincerely miss Outlook now that I'm at a company that uses Google Apps. The gmail web interface just isn't usable the way a real mail client is, and using an IMAP client is never as good an experience as native Outlook/Exchange. And that's just for mail. When you add in calendaring Outlook gets even better in comparison.

<comment><USER8> Huh, my experience is the exact opposite of yours. I find the gmail interface much faster and easier to use, plus searching email actually works. Have you enabled the advanced keystrokes in gmail?

As far as calendaring, I never really figured out how to use it that well in Exchange, Google's seems so much easier to me.

<comment><USER9> How do you sign and encrypt emails in the gmail web interface?

<comment><USER10> There are browser extensions that help with this (especially for chrome).

</comment></comment></comment></comment><comment><USER11> "$800K to make the switch. Save $240K per year."

Interesting they got that deal done. Assume for safety sake a 20% to 30% overrun and now you're at $1 million. And if for some reason your savings take a little longer than you thought to get there (don't they always?). Plus add in the opportunity cost of having to focus on this and retrain your workforce on Google vs MSFT that they all know. Then there's always the risk that any big project is the 1 in 10 that goes completely haywire. I just don't usually see enterprise deals with this long of a payback window getting done (based on $$'s alone anyway - without some other compelling reason)

Just curious on the dynamics of the deal not the Google vs MSFT component.

<comment><USER12> I agree, I'd be interested to see what happened in negotiations.

Also, while they may save $240k per year in money they don't pay to Microsoft, I imagine anyone selling enterprise software would argue that there is money you will save from a theoretical increase in productivity from using their products, after everyone's been trained.

<comment><USER13> What if Microsoft does something stupid, like making all menu and toolbar muscle memory obsolete with that damn Ribbon?

<comment><USER6> Or worse: an interface designed for touch, rather than a mouse...

</comment></comment></comment></comment><comment><USER14> "Meet the new boss. Same as the old boss." -- The Who, "Won't Get Fooled Again"

I don't see why a city government migrating form one proprietary software vendor to another is considered newsworthy. I would be more impressed by something like, "City of Boston drops Microsoft for local hosting provider running free software".

<comment><USER15> >I don't see why a city government migrating form one proprietary software vendor to another is considered newsworthy. I would be more impressed by something like, "City of Boston drops Microsoft for local hosting provider running free software".

That is because, for some, it's less about promoting software freedom and more about taking Microsoft down. That's why we have SJVN on the ZDNet "Open Source" blog promoting Chromebooks and Google Docs which are less "free" than Windows and MS Office because of being completely locked down and being tied to Google's Cloud.

For a even better example, see Ubuntu's Bug #1.

As usual, Linus has pithy insight.

[http://arstechnica.com/information- technology/2009/07/linus-...](http://arstechnica.com/information- technology/2009/07/linus-torvalds-microsoft-hatred-is-a-disease/)

<comment><AUTHOR> > promoting Chromebooks and Google Docs which are less "free" than Windows and > MS Office

Google Docs goes out of its way to import/export to various formats, including Microsoft's. Given this I think the above statement is hardly fair.

<comment><USER16> He means that the source for GDocs is private.

</comment></comment></comment></comment><comment><USER17> Money wise, it's good since it saves them a lot of money in the long term, but I still wish all government institutions would switch to open source software wherever possible.

And by wherever possible I don't mean that some users might be "inconvenienced" by some menu change. I mean when an open source alternative actually exists.

But even then, if the government is willing to spend money to get people or companies to _build_ that software, they should make it open source after that.

<comment><USER18> >Money wise, it's good since it saves them a lot of money in the long term,

I know that's what the article says, but I'm wondering if they truly put Google Apps up against Office 365 which would be an apples-to-apples comparison? It seems more like they put Google Apps up against an on-premises Exchange + locally installed productivity software suite which is not a good comparison

Microsoft has actually been forced by their competitors (especially Google) in offering a competing offering by way of Office 365. You can have hosted Exchange for $4 per user per month. It's been in production for years, and in the last year has really worked well for my organization.

<comment><USER19> I saw some blog recently claiming that Office 365 downtime was 100x more abundant than Gmail downtime.

[http://blog.cloudsherpas.com/hot-topics/google-apps-vs- offic...](http://blog.cloudsherpas.com/hot-topics/google-apps-vs- office-365-a-comparison-of-gmail-and-exchange-system-availability/)

</comment></comment></comment><comment><USER20> I've witnessed an abortive attempt bring a large city from MS to Google - <USER2> luck.

I'm truly all for it conceptually, but in my experience this kind of project tends to be full of false expectations and bad math, but plenty of press.

</comment><comment><USER21> As long as they are promised a timely customer service from Google, I think it is a great move in terms of savings. Although I don't see the switch to Google Docs from the Office Suite ending well. Also if they are going through such great lengths to switch everything to Google, then why not save even more by using the Chrome OS instead of Windows?

<comment><USER22>
      > As long as they are promised a timely customer service from Google

I very nearly sprayed coffee on my screen when I read that. Well played.

<comment><USER23> I've worked at several companies who paid for Google Apps; I have spoken to a live support rep when issues have occurred. Problem?

<comment><USER24> Same here. I think most of these folks have never used paid Google Apps accounts, and extrapolate from their gmail.com experience. Google has follow- the-sun, toll-free support and those folks generally do know their stuff.

</comment></comment></comment></comment><comment><USER25> "What's more, Cain said, Google's contract terms are much simpler than dealing with Microsoft. And since Google updates its software via the Internet, which Microsoft only recently started doing with some of its products, it means clients won't be working for years on outdated applications."

This is just willfully ignorant. If you have Exchange, you probably have Active Directory. You can update Office various ways. I updated 1000 computers from Office 2003 to 2010 without touching any of them. I can also push an update to all our computers only downloading the patches once, not with 1000 computers downloading the same thing all at once.

I haven't seen Google Docs mass controls, but with AD and Office I was able to fix a PowerPoint video acceleration issue with a subset of our machines. Otherwise I'd have to change a setting for every person who logged into these particular machines. I realize that I may not have had this problem with Google Docs. However, we've found that we can't replicate what is done with PowerPoint in Google Docs.

<comment><USER26> I'm sure many people were pissed with Office 2010 since the 'upgrade' from Office 2003 to 2010 was a full-price affair (see [http://www.computerworld.com/s/article/9143103/Microsoft_dum...](http://www.computerworld.com/s/article/9143103/Microsoft_dumps_upgrade_pricing_for_Office_2010)). (EDIT: that was for retail, but you get the idea). So, while your 1000 machine deployment was technically straight-forward, it was probably ~ $100,000 for the software, plus your time (with patching!) financially. Lots of large companies and government find that cost not worth it given the benefit and they ultimately end up with outdated versions.

</comment></comment><comment><USER27> Google is killing microsoft in the government sector, since I'm helping pay for all this I can't tell you how happy I am that they're saving money. GSA went Google and is saving millions.

<comment><USER15> And yet, Office revenues are up 7% in the last quarter and Google's revenues from Apps/Docs/Email is still only a few percent. The government is a lot bigger than a few departments.

<comment><USER27> Nice try, microsoft "data from 2012 that shows of 42 federal government contracts that both Microsoft and Google competed for during the year, Google had more than twice the success than Microsoft. Of the deals, 23 were won by Google and 10 by Microsoft."

<comment><USER28> Interestingly, the GSA which supplied that data to the NY Times has also moved to Google Apps in 2011: [http://googleenterprise.blogspot.com/2011/07/gsa-has- gone-go...](http://googleenterprise.blogspot.com/2011/07/gsa-has-gone- google.html)

<comment><USER27> I know, we provide their SSO & 2fa solution for access (mail.google.com/a/gsa.gov is a public website as is secureauth.gsa.gov) along with many other government agencies. I've done many identity provider installs, google apps always goes great, office 365, not so much. MS requires them to have adfs which is basically a horrible offering (want to get rid of exchange, here, install all of these adfs servers on premise). Don't get me started.

<comment><USER29> Isn't it fun to explain that to provide SSO to Office 365 you effectively need 8+ ADFS servers and a couple of pairs of load balancers (or NLB) spread across at least two data center locations?[1]

At least now dirsync is 64-bit so they've removed the "don't run this on your ADFS server" bit.

[1][https://devcentral.f5.com/blogs/us/big-ip-and-adfs- part-1-nd...](https://devcentral.f5.com/blogs/us/big-ip-and-adfs-part-1-ndash- ldquoload-balancing-the-adfs-farm-rdquo)

<comment><USER27> and there's the little part about adfs not including any integrated two-factor for external users. Someone can basically sit here all day and bang away at mail.google.com/a/doi.gov with accounts like firstname.lastname@example.com or firstname.lastname@example.com (just google @ios.doi.gov) and it'll never lock out access from your ip.

</comment></comment></comment></comment></comment></comment></comment><comment><USER30> Google drive seems to be down: [http://www.google.com/appsstatus#hl=en&v=status&ts=1...](http://www.google.com/appsstatus#hl=en&v=status&ts=1368212487427)

</comment><comment><USER31> I'm surprised that they're moving to Google Docs as well. From my experience Google Docs does not fare very well in government & enterprise settings where people are used to Microsoft Word.

<comment><USER32> From what I can tell in government ( _my_ side of the vast government) no one uses Word beyond the sheer basics. No macros, no fancy "decimal tabs", WordArt, gradients everywhere, any of that.

For what 95% of people are doing Google Docs is more than sufficient.

<comment><USER33> That might be true in general as far as client features go, but I do know that at least the DoD is a heavy user of the identity and access management services which effects what you can _do_ with an Office document. That rules out Google Docs for anyone that is already or planning to do that.

<comment><USER32> Shipmate, I'm _in_ the DoD. Maybe you're talking about OSD, JS, Army, Air Force or something else though.

Edit: Also, doesn't Google Docs have controls to limit sharing of online documents to certain persons, groups, or teams?

The big concern I can think of is PII spillage, but honestly I think I trust Google more than I trust random GS-13s with their externals and laptops. DoD at least has PKI but in the Navy we're recommended to _also_ use a password- based certificate for encrypted externals in case the CAC is lost, which kind of defeats the point since I'm sure the password is not going to be high- entropy.

</comment></comment></comment></comment><comment><USER34> I've recently been forced to use the whole Microsoft ecosystem and it's _awful_. So many basic UX mistakes that make daily use painful. For instance in Outlook there's no clear indication of which emails I've read and which I haven't, so I just constantly miss emails.

Looking forward to more of the world switching to Google.

I hope that one day the notion of enterprise products will disappear completely so that everybody can happily use well-designed consumer products.

</comment><comment><USER35> They will be back..

<comment><USER36> Yeh just as soon as MS comes up with a chunky discount :-)

Though the question has to be asked would all of the users in local government be OK to use Gmail from a legal perspective?

for example police or social services might have more stringent data protection requirements.

<comment><USER37> Do you really think this hasn't been asked by Boston or any of the other very large Google Apps deployments? The answer is a single Google Search away...

[https://www.google.com/enterprise/apps/government/benefits.h...](https://www.google.com/enterprise/apps/government/benefits.html)

> Google Apps for Government includes dozens of security features specifically > designed to keep your data safe, secure and in your control. This segregated > system, for government customers in the U.S. only, was the first cloud-based > email application to receive FISMA accreditation from the U.S. federal > government.

<comment><USER36> MM I think you will find that Boston is a city in the commonwealth of massachusetts and not a "federal agency".

</comment></comment></comment></comment><comment><USER38> Two words: "Google Support"

Yes, you can can read it both ways...

</comment><comment><USER39> I think you meant Microsoft Exchange, not Outlook.

</comment><comment><USER40> Good for Boston & Google.

I guess nobody wants to administer mail these days...

<comment><USER41> I've seen enough horrors first (but mostly second) hand of small shops (admittedly not like the story, but I'll talk about what I know) running their own systems. They'll have 2-3 people running _everything_. From the mail server to setting up printers to replacing bad hardware components.

If I were in that boat, I'd beg and plead to put everyone on a disposable internet-only type machine and run webapps only. Then I could worry about security and reliability, which sadly gets last priority in most places :(

</comment></comment><comment><USER42> Hope it doesn't end up like this deployment.

[http://betanews.com/2011/10/20/los-angeles-wants-refund- for-...](http://betanews.com/2011/10/20/los-angeles-wants-refund-for-google- apps/)

""Google's record with the city is nothing but broken promises and missed deadlines," the letter reads in part. "The Internet giant simply has not done what it said it would do and has tried to buy its way out of the mess it has made by covering the unbudgeted costs of the LAPD's GroupWise System that the department has been forced to continue using."

The mayor's office did not have any immediate comment as of press time."

Edit: Somewhat ironic that Google Docs and Drive are currently down. [https://twitter.com/search/realtime?q=google%20drive&src...](https://twitter.com/search/realtime?q=google%20drive&src=typd)

"Google Drive documents list goes empty for users " [http://news.cnet.com/8301-1023_3-57583952-93/google-drive- do...](http://news.cnet.com/8301-1023_3-57583952-93/google-drive-documents- list-goes-empty-for- users/?part=rss&subj=news&tag=title&utm_source=dlvr.it&utm_medium=statusnet)

<comment><USER43> I once convinced a CEO of a company with a few hundred employees to move from Outlook to Gmail.

For a while after I was a social pariah. My expense reports would go missing (want to find a Microsoft fan? look in accounting). My calls to IT (staffed with MCWhatever certified individuals) unanswered. The controller pulled me aside and said in a menacing Brooklyn accent I didn't know he had in him, "I would appreciate it if you would make this go away."

I learned a valuable about switching costs that day.

<comment><USER44> I once recommended a 12 person company move from a self-hosted, internal exchange server to Google for email. They ignored me until a truck hit a telephone pole and we lost email for 2 days.

<comment><USER45> I worked for a similarly sized firm a few years ago and we also moved from Exchange to Gmail, partly because we had had a few severe outages with Exchange for various reasons. From a technical perspective, the migration went pretty smoothly. But there were at least a couple non-technical people on the business side who always hated the new system, partly because Gmail didn't have the hierarchical folder system they were used to. (And I don't think Gmail had sublabels at the time.)

<comment><USER46> I feel you, nested labels is the easy answer to this. However, the better answer is teaching people about archiving and search.

People used to folder their emails because searching was terrible. Gmail's search is pretty good, so the best workflow in my opinion is to archive email once you're done with it, and search if you need something specific. I do use labels too, especially auto-labels, but I've found search to be more useful.

Still, some people are reluctant to change, and just want to do things the way they've always done it. So that's why nested labels exist.

<comment><USER47> My issue with gmail search is that it's incomplete, and I don't know how incomplete.

I've downloaded my mail to mac's mail app. With identical search strings, the Mail app finds more messages.

This includes searching by sender email, which yields incomplete results in gmail.

There have been many occasions where I've only sent someone one email, or vice versa. Gmail often misses these.

So for anything I _must_ find (e.g. tax documents) I label them.

<comment><USER48> Are you sure that isn't due to duplicates in Apple Mail? If I'm remembering right, things with labels (including "Inbox") will have copies in All Mail as well as each of their label "folders."

IMAP and POP use hierarchical folders and don't understand that a tax email might be marked as both "Government" and "Finances", or whatever your filing system happens to be.

<comment><USER47> I'm sure that could be an issue as well, but it's not causing the problem in my case.

I've found 1-2 emails in mail from a particular sender, where gmail was unable to find any results, even with their exact address.

I've likewise found perhaps 7/10 of a set of emails in gmail, and found the remaining 3 in mail (while confirming they had unique information not listed in gmail).</comment></comment></comment></comment></comment></comment></comment></comment>


C to Delphi converter (2018) - <AUTHOR> https://github.com/WouterVanNifterick/C-To-Delphi <comment><USER2> FL Studio is/was Delphi based but I got to believe that it's been ported to c/c++ in light of the Mac version that's now available. I know there is kylix but I can't imagine that was the way it was ported. But maybe so. I actually maintain a Delphi app used for trucking and logistics that the company purchased the source code for. We have a vm sitting on our server farm that is hosting an image of a highly customized version of Delphi that's our "build" server. We are going to port this to C# second half of the year. The dude made all sorts of UI snafus, like 4 way check boxes using multi color checks for security provisioning. To add insult to injury if you have any color blindness you cannot perform this task- red, violet, green and blue are the options. I don't have any known color blindness and it's hard for me to tell.

<comment><USER3> I think Image-Line is still using Object Pascal actually, both for the PC and the Mac version of FL Studio. They've been managing the Mac version by using Free Pascal for the compilation. They also have a fair amount of inline assembly, for the performance critical parts, and they have their own in-house GUI and widget library, which, apparently, will compile and run equally well using both Delphi and Free Pascal.

Edit: I notice that the post below says they're using Delphi for both the PC and the Mac version now... It could be a recent development. Last year there were posts on the Image-Line forums saying they were still using Free Pascal, due to the fact that Delphi (at that point) could not produce 64 bit binaries for Mac.

<comment><USER4> Delphi still cannot produce 64 bit binaries for macOS.

</comment></comment></comment><comment><USER5> Could somebody please check how it converts the following program:

        #include <stdio.h>

        int main()
        {
            if (((unsigned char) 255) + ((unsigned char) 255) == 510) {
                puts("yes");
            } else {
                puts("no");
            }
        }

(The code outputs "yes", and it does not rely on undefined behavior.)

In other words, I doubt that proper "conversion", with all the C semantics, is feasible.

<comment><USER6> Typecasts seem to trip it up, it replaces the check with

        if (unsigned char then 255) + ((unsigned char) 255) = 510 then  begin

<comment><USER7> I'm not particularly familiar with Delphi, but the issue here appears to be a combination of parenthetical grouping not being picked up and the program not knowing that "unsigned char" should become "byte".

Ex:

      unsigned char a = 255;
      unsigned char b = 255;
      if ((a + b) == 510) {
          puts("yes");
      }

becomes

      unsigned char a = 255;
      unsigned char b = 255;
      if a + b then = 510 then  begin
        WriteLn('yes');
      end;

instead of

      var a,b: byte;
      begin
          a := 255;
          b := 255;
          if (a + b) = 510 then begin
              writeln('yes');
          end;

It's also worth noting that assuming parenthetical grouping is fixed, the C code snippet should work fine; according to the online compiler I was toying around with, Pascal uses integer type promotion.

</comment></comment></comment><comment><USER8> Where exactly is Delphi being used nowadays?

<comment><USER9> I've seen it recently being used in industrial automation. The IDE is friendly to non-programmers, the generated binaries perform really well and the compilation times are very fast.

From my perspective, as a developer that uses more up-to-date tools, Delphi is not great, but it's not bad either.

<comment><USER10> My experience with Delphi-based Windows software is that they always load quickly and and most things are snappy, in contrast to most modern programs. I've always wondered if it's due the language itself, but then again modern programs run in managed environment. I guess if the same program is created using MFC they would be just as fast. Maybe if you don't have to deal with accessibility or internationalization it's possible to create such binaries in any compiled unmanaged language.

</comment></comment></comment><comment><USER11> Does it know when to use 1-indices for accessing converted C strings vs 0-indices for other types? That seems to be one difficult thing to infer dynamically, especially for non-constants. I suppose it could just always treat C char* as dynamic arrays.

It does appear to treat C string constants as Pascal string constants, so if those are to be indexed correctly, it must be somewhat clever.

</comment><comment> v-yadli Sounds like there's no macro support?

Edit: in that case, better target FreePascal or Lazarus.

<comment><USER12> Also no "typedef", "unsigned char", "unsigned long" support, nor apparently understanding of what "char *argv[]" means as a function parameter. So don't expect this is something you can use for arbitrary C code.

Still an interesting teaching tool, as long as the user understands it's very limited.

</comment></comment><comment><USER13> I was pleasantly surprised, does a lot of things, very useful for when it's needed.

It had one unexpected glitch:

        // C
        if (known_devices & BIT(0))

        // Pascal
        if known_devices and BIT(0 then )

</comment><comment><USER14> It seems there a quite a number of people who are not that hot on C++, Qt or both.

The FreePascal guys though have put in some effort to create useable LCL interfaces (the Lazarus equivalent of Delphi's VCL) to interfaces to Qt4 and Qt5

</comment><comment><USER15> How does it compare to C2PAS?</comment>


Theranos CEO Elizabeth Holmes takes big gamble at conference - <AUTHOR> http://www.sfchronicle.com/business/article/Theranos-CEO-Elizabeth-Holmes-takes-big-gamble-at-8003887.php <comment><USER2> Behind a Paywall.</comment>


Freelancing VS Startup - <AUTHOR>

I am a full stack programmer and have been freelancing for over 3years now. I started in my third year in school, have worked at two companies and last year i realized that there is actually no future in freelancing. My colleage and i have this startup idea and we already have potential investors but they have not given us anything yet what you suggest should i quit freelancing totally and focus on my startup and develop it full. NB: Freelancing is my current source of income though i have savings. I don't see any programmer making it big as a freelancer. <comment><USER2> I wouldn't knock freelancing; I've heard of people pulling in $500K+/year with it. Save up for 8-10 years and you've got your F-U money. You don't have to be particularly good (the folks I know who manage that probably aren't any better than your average startup employee or Googler), but you do have to deliver on your projects, work independently, and communicate well. And most importantly, you need to pick an industry with a lot of money. Do freelance projects for banks and $500K/year is easily within reach; do freelance projects for schools, non-profits, or small businesses and you'll be lucky to make $50/hour.

<comment><AUTHOR> But it's not like i can retire with that, i want to build a business that will last and that way create a passive income stream, i cannot keep freelancing forever

</comment></comment><comment><USER3> I think you're in a pretty good position to bootstrap your startup: can you reduce your freelancing to free some time to build the MVP of your startup on the side? Once you have the MVP you can see how it goes, and you will still have an income from freelancing.

Good luck!</comment>


Inspired by the HN community: Bootstrapping an idea you believe in - <AUTHOR> http://page99test.wordpress.com/2010/09/10/bootstrapping-an-idea-you-believe-in/

<comment><AUTHOR> To be clear, the inspiration to 'get out there' and build something came from this community... I've been lurking here for months reading post after post about just getting started with something. It doesn't have to be the most amazing idea ever. Come up with an idea for a real business. Build it. Test and get feedback from potential customers. Iterate. Repeat.</comment>


Harry Potter & the Methods of Rationality returns with a fundraising twist - <AUTHOR> http://www.fanfiction.net/s/5782108/73/Harry_Potter_and_the_Methods_of_Rationality

<comment><USER2> He's basically trying to help promote the non-profit he is working at which makes sense, not for his own monetary gain.

It's the equivalent of Stephen Colbert saying he'll do something silly if people help raise x amount of money for y charity.

</comment><comment><USER3> The actual fundraising bribe is a 6/5/4/3 day release schedule for $0/50000/750000/125000 SIAI donation challenge. Not holding chapters hostage or anything, as I was first afraid of.

<comment><USER4> Here at the Singularity Institute, our motto is "Be less evil than Google."

</comment></comment><comment><USER5> This seems a little dangerous. Does this seem like monetizing fanfiction containing copyrighted characters in a non-direct way to anyone else?

I do like the story so far, and I'd hate for it to go _poof_ because of legal issues.

<comment><AUTHOR> Only the release timeline would change, by a few days, not the writing or the releasing at all. But I am not a "copyright" lawyer.

<comment><USER6> Copyright law doesn't care about whether this is "monetizing" or not. He's infringing simply by using JK Rowling's characters; he's safe only thanks to JK Rowling saying that she doesn't mind HP fanfiction as long as it's not obscene and non-commercial.

So the only real question here is: What does JK Rowling think of this?

<comment><USER7> She supports fanfiction but it has to be non-commercial. See eg <http://news.bbc.co.uk/2/hi/entertainment/3753001.stm>

<comment><USER6> Sure. My point is, this is all based on her whims, not on any legal definitions. So "non-commercial" in this context just means whatever JK Rowling wants it to mean in this context.

<comment><USER8> Given that it's raising money for a charities, and that the donations only accelerate the publication rate, I would be surprised to see Rowling object when she hasn't objected to previous chapters.

</comment></comment></comment></comment></comment></comment><comment><USER8> Frustrating: I've been trying for 15 minutes now to make a donation. First, I had to search to find where to make a donation since the announcement didn't include a link. Then the Google Checkout button did not work. Then causes.com sat frozen for over 3 minutes the for getting me a message that there was an unspecified problem with my card. it's a good cause and a great work of fiction so I'm willing to try 1 more time.

<comment><USER9> It seems that fanfiction.net doesn't allow links in the body text of books. I hope this is the correct link: <http://singinst.org/donate/>

<comment><USER10> I think it's this: <http://singinst.org/2011summerchallenge>

</comment></comment></comment><comment><USER11> I donated, but that's simply because I'm an incredible fan of the work (and most of his writing) - I figure it's my way of 'supporting' him. Wonder if this counts as 'monetizing?

<comment><USER12> Dedicating my donation to the 'The Stanford Prison Experiment' sequence.</comment></comment>


Show HN: Logic to solve Sudoku with visual cues - <AUTHOR> https://samples.sachinnayak.info/visual-sudoku-solver.html <comment><AUTHOR> Do you think you can learn how to solve a Sudoku problem by looking at the steps here?

<comment><USER2> It looks as though the process is solving the puzzle the same way humans do (enumerate possibilities for each square, then assign value to the ones with only one possibility and repeat), so I'd say yes, you can.</comment></comment>


Twitter DM - automatic, yet personal, twitter DMs - <AUTHOR> http://twitterdmer.com

<comment><USER2> Anything automatic is by nature impersonal.

</comment><comment><USER3> those kinds of things scream "automated"</comment>


Covid.bio – Analytics for Coronavirus - <AUTHOR> https://covid.bio/ <comment><AUTHOR> Hello all! I created this since I felt better data analytics was necessary. It's a work in progress, so please bear with me if you see any issues.

I am planning to add:

\- Daily change tracking (just added 21:34)

\- Country specific pages (with daily change tracking) (just added 21:34)

\- Log scaling

</comment><comment><USER2> Looks good. I'd be interested to see trend lines on the graphs.

<comment><AUTHOR> They're coming, but there really isn't enough data to extrapolate a good trend yet. Except for Japan. That exponential curve fit perfect.

</comment></comment><comment><AUTHOR> I just added individual country pages (with charts): [https://covid.bio/south- korea](https://covid.bio/south-korea)</comment>


PPK - Javascript events on mobile web browsers [video] - <AUTHOR> http://yuiblog.com/blog/2009/04/27/video-ppk-jsevents/

<comment><AUTHOR> Above link is part 1; it gets into mobile phones at about -26:00

Part 2 is here [http://google-code-updates.blogspot.com/2009/04/ppk-open- web...](http://google-code-updates.blogspot.com/2009/04/ppk-open-web-goes- mobile.html) and it starts off right away in mobile browsers</comment>


Solar Sinter: Solar-powered 3D printer that sinters sand into 3D objects (2011) - <AUTHOR> http://www.markuskayser.com/work/solar-sinter/ <comment><USER2> I'd like a device like this to create a moon base

<comment><USER3> Here is an interesting project :

[http://www.nasa.gov/centers/goddard/news/topstory/2008/lunar...](http://www.nasa.gov/centers/goddard/news/topstory/2008/lunar_telescopes.html)

</comment></comment><comment><USER4> Somewhat related: Cory Doctorow's shortish story "The Man Who Sold The Moon". [http://boingboing.net/2015/05/22/the-man-who-sold-the- moon.h...](http://boingboing.net/2015/05/22/the-man-who-sold-the-moon.html)

<comment><USER5> Nice story. I guess the title is a reference to Heinlein's version ([https://en.m.wikipedia.org/wiki/The_Man_Who_Sold_the_Moon](https://en.m.wikipedia.org/wiki/The_Man_Who_Sold_the_Moon)), which has greed/capitalism conquer the moon.

</comment></comment><comment><USER6> All that time in the video and all but zero seconds showing the finished product which is surely the point?

<comment><USER7> Not sure why the posted link went to that page instead of the overview (with separate pictures).

Here: [http://www.markuskayser.com/work/solarsinter/](http://www.markuskayser.com/work/solarsinter/)

</comment></comment><comment><USER8> There was a news about metal sintering used for an actual market (sorry, memory failing). That reminded me of this video and got me wondering how complicated it was to control the beam focus and energy. To allow for finer and leaner shapes.

<comment><USER9> You're probably thinking of [https://en.m.wikipedia.org/wiki/Selective_laser_sintering](https://en.m.wikipedia.org/wiki/Selective_laser_sintering) which is pretty widespread -- for example you can order metal parts straight off ShapeWays that are SLS!

<comment><USER10> I wonder if a solar sintering machine could be made nearly as precise as an SLS machine. Maybe if you could focus the beam into a fibre optic cable and measure the intensity of light to control the path planning.

</comment></comment></comment><comment><USER11> i can think of a few obvious improvements but the first thing i would add would be a shutter.when he was setting it up i was worried he would burn his back or something in the beam.

</comment><comment><USER12> This is an older article, but still interesting. I used my scavenged fresnel lens from an old projection TV to try and melt sand. It works (kind of) but control is a challenge.

</comment><comment><USER13> this needs a tag [2011]

<comment><USER14> Added.

</comment></comment><comment><USER15> The only point this raises is : are they serious ? This looks quite akin to the Solar Impulse project. It makes us dream of something that looks like a very bad way to treat the actual problem.

This guy's energy would be better spend at tackling the economical and political problems we have to solve to actually improve the situation... And we need more than a dream...

<comment><USER16> He's an engineer, not a politician. You don't get to vote on what he works on or decide what is important to him.

Sintering is an emerging 3D printing tech now that the patent has expired. We can't predict what all the potential applications are or what impact it will have on society.

<comment><USER17> That's an interesting point on patents isn't it. Things become emerging tech once the patents on it expire.

<comment><USER18> That's not really an inference you can make. In this case, that's happened – but there are plenty of recent, popular technologies that are also patented. Look at any modern smartphone, for example!

<comment><USER17> Yeah, but it does seem like interesting tech that was kept under wraps gets a comeback tour once patent protections run out.

Consumer 3D printing is an interesting case, because the wealth of extrusion deposition products came after the patents ran out. Same thing now with interesting developments in SLS. Patent runs out, some enthusiasts rig up their own, exchange knowledge over the web, and turn industrial technology into open hardware products.

I think the thing here is that companies owning these patents just never thought about the consumer and hobbyist markets. But their patents prevented people selling and innovating in these spaces, thus letting these markets lie fallow. What happens to markets when the legal monopoly stops selling?

Now consumer electronics is a field where there's a lot of motion. But imagine the Smartphone(tm) was patented, and the owner of the patent decided to do industrial PDAs instead and abandon the consumer market. They still prevent others from selling to the consumer market, even they don't loose anything from that except some vacuous "potential revenue".

Trademarks elapse when they're not used, and names can be used in different markets when there's no chance of confusion (Nissan Motors vs. Nissan Computers). Patents (outside of I think 2 renewal dates) don't quite work that way. The question is, do they prevent technology from jumping into different markets by virtue of their broadness?</comment></comment></comment></comment></comment>


Does your mobile app feel ancient after Paper? - <AUTHOR> http://appiterate.com/does-your-mobile-app-feel-ancient/?utm_source=HN&utm_medium=Social&utm_campaign=Dis

<comment><USER2> With Paper, it is evident that online social networks are getting closer to physical world networks...being used for much more than only "sharing" photos/moments. They are also serving a larger purpose now. It is news today, and will be much more tomorrow!</comment>


Public Key Pinning Extension for HTTP - <AUTHOR> https://tools.ietf.org/html/draft-ietf-websec-key-pinning-20 <comment><USER2> Note that beyond just thwarting many attempts at hijacking CAs on an individual connection level, HPKP and/or TACK form the basis of a surveillance system that drastically changes the risk/reward for using compromised CA certificates to conduct mass surveillance. Mass MITM apparatuses will have to assume that some of their victims speak HPKP/TACK and will detect forged certificates; when that happens, there's a decent chance the incident burns the whole CA.

It's not a perfect fix to the CA problem, but it is a huge step in the right direction (which is towards decentralization and peer trust).

<comment><USER3> It's a shame more people haven't really spent time on Tack. I spent a weekend playing with it and it was really great.

Trevor stopped paying for the TACK test server so Im guessing the push has died. Trust agility and certificate transparency really need to come about...yesterday.

<comment><USER4> At this point Google pretty much controls the future of web-oriented internet protocols, since they control the client in the form of Chrome, as well as the server in the form of Google properties. What they do is basically what goes.

People inside of Google were putting together HPKP at the same time that we were putting together TACK, so that was pretty much the end of TACK. HPKP is really simple for Google (just pin their own CA), but isn't as clean for most other major sites (who are stuck with many CAs). It also doesn't offer a layer of indirection away from CAs, which again, is not an issue for Google (they already have a layer of indirection in the form of their own CA), but is less ideal for the rest of us.

It's better than only being able to hardcode pins in the browser binary, but it's a shame that it doesn't take on some of the other pain that's come up with pinning.

<comment><USER5> AFAIU the difference between TACK and HPKP is:

\- For TACK, the pinned key is a custom key created just for that, and is transmitted in TLS

\- For HPKP, the pinned key is a CA cert key (one of the CA on the chain), and is transmitted in HTTP

I think pinning the CA cert key makes more sense, because this is what they were created for: certs certify, the matter is in how you transport them. OTOH putting all the pinning information directly in the certificate makes more sense to me. We should have every domain owner running its own CA, with a cert that has all required pinning data, signing all TLS keys of the servers, and then sending the minimal chain "server cert" <\- "CA cert", and then browsers would pin that cert.

</comment></comment></comment></comment><comment><USER6> The link points to version 20 (August 2014) of the draft, a more current version 21 (October 2014) is available at [1], linked in the article.

Chrome has been doing public key pinning out of the box for about three years now, though the feature has only been active for some Google properties and a couple of hand-picked high-profile sites [2]. Firefox has recently added support for static pins, plans to support the HTTP extensions exist [3].

Alternative or complementary proposals include DANE/TLSA [4] (DNS-based Authentication of Named Entities; stores certificate infos for any protocols in a new DNS record; requires DNSSEC) and TACK [5] (Trust Assertions for Certificate Keys; a similar mechanism to the one proposed in this draft but implemented as a TLS extension; possibly discontinued).

[1] [https://tools.ietf.org/html/draft-ietf-websec-key- pinning-21](https://tools.ietf.org/html/draft-ietf-websec-key-pinning-21)

[2] [https://www.imperialviolet.org/2011/05/04/pinning.html](https://www.imperialviolet.org/2011/05/04/pinning.html)

[3] [https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinn...](https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning)

[4] [https://en.wikipedia.org/wiki/DNS- based_Authentication_of_Na...](https://en.wikipedia.org/wiki/DNS- based_Authentication_of_Named_Entities)

[5] [http://tack.io](http://tack.io)

<comment><USER7> I believe your first link is still version 20. Here is version 21: [https://tools.ietf.org/html/draft-ietf-websec-key- pinning-21](https://tools.ietf.org/html/draft-ietf-websec-key-pinning-21) .

Also, your second link point to a 404.

There is a 'g' missing in the link to Mozilla Wiki: [https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinn...](https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning) .

And [https://tack.io](https://tack.io) doesn't respond for me whereas [http://tack.io](http://tack.io) does.

<comment><USER6> Somehow I managed to break every single link. Fixed them now. Thanks for the heads-up!

</comment></comment></comment><comment><USER8> I wish I could pin certificates myself. I'd like the browser or an extension to allow me to either automatically pin all certificates on "first use", or do it manually.

<comment><USER9> Plugin for firefox.

[https://addons.mozilla.org/en- US/firefox/addon/certificate-p...](https://addons.mozilla.org/en- US/firefox/addon/certificate-patrol/)

<comment><USER10> I also use Certificate Patrol and highly recommend it.

It does exactly the most useful thing possible within the current state of the internet: it remembers the certs you've seen before (gasp!) and tells you if they've changed. Simple.

</comment></comment></comment><comment><USER11> How are pinned Public Keys updated when the host changes keys?

Say a user visits a website for the first time and the site's key is pinned in their browser. Then the user doesn't visit for a long time and the pinned key expires. Later, the user visits again but now the pinned key is no longer being used. What _should_ happen? According to the document:

> The UA MUST ignore any expired Known Pinned Hosts in its cache.

This is unfortunate, since the point of pinning keys is to minimize the risk of hijacked CAs down to the very first connection. With this system that risk occurs every time the key expires, and with several pushes to shorten the expiry times of public keys this could be quite often.

In the example above, could the expired key be used to sign the new one? It wouldn't be used to secure the connection, but only to update the pinned key, where the chain of trust is unbroken from that very first visit.

</comment><comment><USER12> Note there is a newer version of the draft: [https://tools.ietf.org/html/draft-ietf-websec-key- pinning-21](https://tools.ietf.org/html/draft-ietf-websec-key-pinning-21)

</comment><comment><USER13> From the introduction of the I-D:

       Key pinning is a trust-on-first-use (TOFU) mechanism. The first time
       a UA connects to a host, it lacks the information necessary to
       perform Pin Validation; UAs can only apply their normal cryptographic
       identity validation.  (In this document, it is assumed that UAs apply
       X.509 certificate chain validation in accord with [RFC5280].)

       The UA will not be able to detect and thwart a MITM attacking the
       UA's first connection to the host.  (However, the requirement that
       the MITM provide an X.509 certificate chain that can pass the UA's
       validation requirements, without error, mitigates this risk
       somewhat.)  Worse, such a MITM can inject its own PKP header into the
       HTTP stream, and pin the UA to its own keys.  To avoid post facto
       detection, the attacker would have to be in a position to intercept
       all future requests to the host from that UA.

       Thus, key pinning as described in this document is not a perfect
       defense against MITM attackers capable of passing certificate chain
       validation procedures -- nothing short of pre-shared keys can be.

I think for most of us, this is still a big improvement. But for people under repressive regimes, isn't there a high chance that you get the MITM great- firewall-of-wherever the first time, and then you're stuck with it from then onwards even if you can tunnel out at some later time (this is assuming the government has control over at least one CA)?

<comment><USER14> > nothing short of pre-shared keys can be.

Any out of band key exchange is.

</comment></comment><comment><USER14> There's also the easy way which avoids the problem almost altogether: let the only entity with the legal power to tell who holds which domain also do so cryptographically.

The infrastructure is already in place. Do a good deed and publish your records today, if you haven't already.

</comment><comment><USER15> tl;dr HSTS thwarts sslstrip, HPKP thwarts CAs hijacking, but neither is actually foolproof. read below for my solution.

The sslstrip problem seems impossible to make secure using the existing web. The inherent problem is that the web allows both insecure and secure connections; if https doesn't work, people [or browsers] will just try http, and there is no way to determine if a site is supposed to use https or not. (It would be nice if we required a 'ssl.' subdomain be used for https-only connections, but nobody seems to like that suggestion, and there's some scaling issues)

I think the most permanent, flexible solution for all these problems is twofold: one, a protocol which makes secure connections mandatory, and two, mandatory multiple identity verification.

Unlike SPDY, which allows non-SSL connections and used to allow compressed headers to be encrypted, another protocol (or layer?) should be introduced that makes it impossible to have a connection which isn't encrypted and signed by a CA (no self-signed certs allowed). This would ensure that no communication with a host over this protocol would be of questionable integrity. Users could decide for themselves that if this connection doesn't work, they simply won't try to contact the host via lesser means (like https).

Going further, it seems to me there's two logical ways to prevent a hijacked CA from feeding you spoofed certs on the initial connection: Convergence, and/or multiple CA verification.

Convergence stops the initial-connection attack by requiring multiple independent parties agree on the data you're getting. The hijacker would have to also hijack all the Convergence peers for this to succeed, which is effectively very difficult. But this requires a highly available public network of peers to work, which is problematic in many cases.

Instead, one could provide a certificate chain on the initial connection to the destination host with the same certificate signed by multiple independent CAs. IMO this is a better solution than Convergence because it doesn't require the consensus of a live public network or multiple hosts, but does still provide a guarantee of authenticity verified by multiple independent parties, which would again be very difficult to hijack all at once.

To provide this second method you'd need to do several things: One, send the same CSR to multiple CAs and collect the certs (this already works). Two, require a protocol identifier that mandates only secured connections (something other than http/https, so users don't get confused). Three, mandate no self-signed certs. Four, require a certain minimum 'assurance index' be reached by using a set of heuristics to classify the certs received and determine if they're from enough CAs (or CAs different enough from each other, like one from the UK, one from Iran and one from Brazil). Five, make sure all the certs match and are all signed by the same origin host key.

Then all you'd have to do as a user is type in 'rfsp://mybank.com' and your connection would either succeed securely the first time, or irreversibly fail. The server admin would just tack on a bunch of different certs from different CAs into the chain and provide the new encryption layer, under which HTTP (or whatever) would pass.

<comment><USER16> >The sslstrip problem seems impossible to make secure

I just do a 301 redirect to HTTPS on any requests that hit port 80. What makes that insecure?

<comment><USER14> It's not secure against traffic hijacking, where a malicious server would serve plaintext to the client and the average user would be none the wiser (no broken padlock).

<comment><USER16> oh, of course. that makes sense. thanks.</comment></comment></comment></comment>


Announcing EBS snapshot copy - <AUTHOR> http://aws.amazon.com/about-aws/whats-new/2012/12/17/announcing-ebs-snapshot-copy/

<comment><USER2> Finally, they took care of the last major reliability/availability issue.</comment>


Fix the DMCA - <AUTHOR> http://fixthedmca.org? <comment><USER2> A couple of things:

1) DMCA 1201 is "treaty implementing legislation" for the WIPO agreements. Repealing it entirely is unlikely without getting that fixed -- but we (the United States) are the ones who actually wanted that crap in the treaty to begin with, so if the executive is behind scrapping it, pushing for that to happen internationally would be a big win. In the meantime, fixing the law so that circumvention-without-infringement is never illegal would still be a great improvement even if we can't be rid of the whole thing immediately.

2) There are two relevant parts to DMCA 1201. The first is that circumvention is prohibited. This is the thing the Librarian of Congress currently is allowed to create exemptions for. The second is that circumvention _tools_ are prohibited. The exemptions the Librarian makes apparently don't apply to this -- if we're doing some reform, it really ought to exempt tools with a "substantial non-infringing use." This is the thing that prohibits Walmart from selling e.g. a DVR-like device that allow you back up all your DVDs and stream them to your phone whenever you want. There is a serious amount of innovation that doesn't happen because of the lack of that exemption.

<comment><USER3> > The second is that circumvention _tools_ are prohibited.

I don't think "substantial non-infringing uses" should be a standard for tools. These tools are not infringing at all. They do not contain or distribute copyrighted content themselves. In fact they can be small keys, or information tangentially related to the DRM scheme. They can also be various things in various contexts.

I think the entire "anti-circumvention tools" part should be removed, period. It's not even helpful for its original purpose and probably unconstitutional (the government cannot criminalize instructions for violating the law). It's also being abused.

<comment><USER2> >In fact they can be small keys, or information tangentially related to the DRM scheme.

These sound like things that should have substantial non-infringing uses.

>I think the entire "anti-circumvention tools" part should be removed, period.

So then you need to fix the international agreements. Go for it. I still think we should do what we can in the meantime though.

<comment><USER3> Can you find the part of the WIPO treaty that requires anti-cirvumvention _tools_ to be criminalized? I can't.

<http://www.wipo.int/treaties/en/ip/wct/trtdocs_wo033.html>

Keys do not always have "substantial non-infringing uses" by the way. They can be unique enough to skate the line. And tools which address a general type of DRM (enormous research value) would also be criminalized, which would not meet that standard if the tools were explicit enough.

Hell, if I released the circumvention tools for my own DRM (intended to allow others to access the protected content) I would be violating that standard.

<comment><USER2> Maybe you're right about the treaty re: circumvention _tools_. I don't see it either.

>Keys do not always have "substantial non-infringing uses" by the way.

I think fair use should be a substantial non-infringing use. The phrase comes from Sony Betamax, right?

>Hell, if I released the circumvention tools for my own DRM (intended to allow others to access the protected content) I would be violating that standard.

How so? Accessing protected content with the copyright holder's permission is not infringement, so there's your substantial non-infringing use.

<comment><USER3> "Substantial non-infringing uses" is the standard the court set for things which _could_ subject you to "secondary liability" for acts of infringement. The tools are legally separate concepts (which is why the DMCA codified them), and the first amendment traditionally prevents the government from criminalizing speech which could assist others in breaking the law.

I didn't waive my copyright just because I released circumvention tools for my own DRM scheme.

<comment><USER2> >I didn't waive my copyright just because I released circumvention tools for my own DRM scheme.

So your scenario is that you wrap your work in DRM and you release a circumvention tool without giving anyone permission to use it to copy your work and it doesn't have any other substantial non-infringing uses (e.g. can't be used for any substantial fair use). I'm no fan of the prohibition on circumvention tools, but I don't think that's the scenario that worries me. A party doing that looks to be engaged in some kind of entrapment scheme.

>"Substantial non-infringing uses" is the standard the court set for things which _could_ subject you to "secondary liability" for acts of infringement. The tools are legally separate concepts (which is why the DMCA codified them)

I understand that it isn't the standard that applies to circumvention tools right now. But it seems like an exemption that _ought to_ apply if the prohibition on circumvention tools is to stand at all. And amending the law to that effect is likely going to be a lot easier politically than repealing the prohibition in its entirety. Can you suggest some other language that would be preferable? (I mean obviously "get rid of it altogether" would be preferable.)

> the first amendment traditionally prevents the government from criminalizing > speech which could assist others in breaking the law.

I think they addressed this in the 2600 DeCSS case.[1] Something like: Code is speech, but it's also functional, and you lose the First Amendment argument on the functionality. Which I'm not really convinced of the logic of (isn't all speech "functional" in that it provides information that allows you to do something with it?), but that's apparently the counterargument you'll get.

[1] <http://en.wikipedia.org/wiki/Universal_v._Reimerdes>

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> It's great but the only people who it would speak to are technical people. If you started with the section on blind people, then security researchers, then go into detail about other things like getting apps from an app store first, you'd appeal to more people. And if I studied english more I'd have learned how to write that without a run-on sentence.

</comment><comment><USER5> This campaign needs all of the support it can get. If you'd like to help, please upvote on reddit: [http://www.reddit.com/r/technology/comments/19sbuc/fixthedmc...](http://www.reddit.com/r/technology/comments/19sbuc/fixthedmcaorg_congress_please_fix_the/)

</comment><comment><USER6> Why are we trying to fix the DMCA instead of just trying to get it repealed? What parts of the DMCA are worth keeping?

<comment><USER7> Safe harbor for Internet providers is a pretty important piece of it.

<comment><USER6> But it's tied together with the requirement to block access on receipt of a takedown notice, which is precisely what gets abused so often. I think this provision is a case of the "cure" being worse than the "disease".

(Btw, I'm not sure how much of a "disease" there would be in the absence of this provision anyway. Internet providers could defend against accusations of copyright infringement by pointing at their terms of use, assuming they were smart enough to have them and make customers agree to them, as pretty much all of them are.)

<comment><USER8> Terms of use don't insulate them from contributory copyright infringement charges.

<comment><USER6> Why not?

<comment><USER8> Because you are still contributing. The DMCA is the only thing that provides the safe harbor to prevent this claim. It's the only good part of the law.

<comment><USER6> _The DMCA is the only thing that provides the safe harbor to prevent this claim._

Is this really true? Is there case law pre-DMCA that showed that website owners or ISPs were being forced to pay large judgments for copyright infringement even when they showed that the infringer had violated their terms of use?

I understand that without the DMCA, the claim could still be made, and that it might cost a website owner or ISP quite a bit of money to defend it in court. But that's more a sign of how broken our court system is than anything else; the way to fix that is to raise the penalty for frivolous lawsuits. "Loser pays" would be one way to do that.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> This is a start, but what you guys really need to do is author specific legislation and then lobby to get a few sponsors to introduce it. Once you have identified a few potential sponsors, we can focus our efforts into lobbying them, ad once it is introduced, we can lobby the rest of Congress to pass it.

</comment><comment><AUTHOR> This is a bug thread.

We built this in 72 hours while on a bus going from San Francisco to Austin on terrible cellular connections and running on 9 hours sleep in total (StartupBus). Please help us debug. If you see CSS/JS that needs changing, tell me and we'll get it done immediately.

<comment><USER10> This:

On October 28th, the Library of Congress decided to not renew an exemption for carrier unlocking cell phones*

Should be changed as follows:

"decided to not renew" => "decided NOT to renew" =(or)=> "FAILED to renew"

at first glance, I misread it as "decided to renew".

Also, "Library of Congress" should be changed to "Librarian of Congress"

<comment><USER11> "declined to renew" would be IMO better than throwing in an all caps word.

<comment><USER10> Agreed, caps here to highlight the change.

</comment></comment></comment></comment><comment><USER12> A very valid argument, however nothing on the current DMCA Takedown Notice provisions enforced upon "Online Service Providers" (aka pretty much any service, platform or ISP which makes content available online)

That seems like an area which is worth addressing as well, at least in passing, and there are plenty of examples of abuse hanging around.

</comment><comment><USER13> We don't need a set of permanent exemptions, we need to repeal the anti- circumvention provision. Not the whole DMCA, although there are other parts that could use adjustment. This provision stifles innovation all over the place and I seriously doubt it has any significant impact on piracy, which was it's original intent.

</comment><comment><USER14> Aren't media backups, including DVDs, already legal under Fair Use? Is there any legal precedent to the contrary?

<comment><AUTHOR> Circumventing the security measures that protect them is illegal under the DMCA, even though it's not actually copyright infringement. Section 1201, the circumvention provision, is specifically what we're trying to get fixed.

<comment><USER15> It is not illegal when it's fair use. But this DMCA section shifts the burden on those who break the DRM (i.e. to prove that something is fair use) instead of keeping the burden on those who should prove that certain action _is not_ fair use.

<comment><USER16> I'm not disagreeing with you, but asking for my own edification.

I can't find (or am misinterpreting what I can find) in the DMCA that makes it legal for fair use.

The main portion I'm trying to interpret is 17 USC S 1201 (a) (1) (A):

"No person shall circumvent a technological measure that effectively controls access to a work protected under this title. The prohibition contained in the preceding sentence shall take effect at the end of the 2-year period beginning on the date of the enactment of this chapter."

I'm not finding another section that creates a fair use section. Does the phrase "protected under this title" create the fair use exemption? Or is there some judicial precedent that I'm missing?

<comment><USER15> I think fair use makes it legal point blank. DMCA can't override it (DMCA contradicts fair use directly). But this can be open to interpretation by judges and etc. - would be good to hear some clarification from experts.

</comment></comment></comment></comment></comment><comment><USER17> Totally support this.

Also, Streem is listed twice as a supporter. Mistake?

</comment><comment><USER18> Nice, but the DMCA needs more reform than that. There is a severe imbalance in the fact that parties who feel that they have been infringed can serve financially disastrous take-downs that must be complied with immediately. The only recourse for served parties is a long expensive legal process.

Something needs to be done to bring this into balance.

<comment><USER19> > Nice, but the DMCA needs more reform than that. There is a severe imbalance > in the fact that parties who feel that they have been infringed can serve > financially disastrous take-downs that must be complied with immediately. > The only recourse for served parties is a long expensive legal process.

This is demonstrably false. The first line of recourse is counter- notification, which reinstates the content.

<comment><USER2> >The first line of recourse is counter-notification, which reinstates the content.

Sec. 512(g)(2)(B): "upon receipt of a counter notification described in paragraph (3), promptly provides the person who provided the notification under subsection (c)(1)(C) with a copy of the counter notification, and informs that person that it will replace the removed material or cease disabling access to it in 10 business days"

What can the victim of the fraudulent takedown do for those 10 days? Maybe go to court (I have no idea), but if so that certainly sounds like "long expensive legal process" to me, and if not then it's even worse because there is just no recourse at all.

<comment><USER20> I think most providers process counter-notices faster than 10 days. Also keep in mind that before the DMCA you'd have received a lawsuit instead of a takedown in the first place.

<comment><USER2> >Also keep in mind that before the DMCA you'd have received a lawsuit instead of a takedown in the first place.

I kind of doubt it. Filing a fraudulent lawsuit requires finding a lawyer who is willing to risk getting disbarred and putting yourself in front of a judge with the power to impose serious punishments for misbehavior. Filing a fraudulent takedown notice can be done by any jackass with an internet connection and you only get punished if the victim has the knowledge, will and finances required to hire a lawyer and go after you.

<comment><USER21> > Filing a fraudulent lawsuit

Who says that they'd all be fraudulent? I'd bet that there are more valid DMCA requests submitted than invalid. Sites like youTube would be buried in lawsuits.

<comment><USER2> >Who says that they'd all be fraudulent?

The fact that the user in question by stipulation hasn't posted any infringing material. We're not talking about the effect on intermediaries.

Obviously if there were no safe harbor at all then the intermediaries would immediately cease to exist and the internet as we know it would disappear, probably to be replaced by something resembling The Pirate Bay.</comment></comment></comment></comment></comment></comment></comment>