Logix: Adding macros to Python - <AUTHOR> http://livelogix.net/logix/index.html

<comment><USER2> Is it just me, or does it seem like everyone and their mother is inventing a new programming language these days?

<comment><USER3> They are and it's a direct result of CS's immaturity.

Python is close to something very, very good but not quite there. Logix in "Base Logix" mode seems to fix some of Python's problems while retaining its redeeming qualities.

If only a real Lisp would come along that had the leadership, library, community and documentation of Python.

<comment><USER4> > If only a real Lisp would come along that had the leadership, library, > community and documentation of Python.

Someone was asking for that just the other day. I was thinking myself that it would be pretty neat to write a Lisp dialect that compiled down to Python, and therefore you could get access to all the Python libraries, a decent VM, and also macros.

I've had trouble figuring out where to start, though. Would be a fun project.

<comment><USER5> _"I was thinking myself that it would be pretty neat to write a Lisp dialect that compiled down to Python"_

That would be an incredibly bad idea. The implementation of SBCL (and CMUCL, upon which SBCL is based) is second to none--it has an optimizing compiler (available at runtime) with code-generation backends for architectures from x86 to MIPS; fantastic support for type inference, inline expansion, modular arithmetic, unreachable code deletion, constant folding, control optimization, generational garbage collection (doesn't python still use _reference counts_?)... amongst a bunch of other stuff.

[http://shootout.alioth.debian.org/gp4/benchmark.php?test=all...](http://shootout.alioth.debian.org/gp4/benchmark.php?test=all&lang=all&calc=Calculate&xfullcpu=1&xmem=0&xloc=0&binarytrees=1&chameneos=0&message=0&fannkuch=1&fasta=1&knucleotide=1&mandelbrot=1&meteor=0&nbody=1&nsieve=1&nsievebits=1&partialsums=1&pidigits=1&recursive=1&regexdna=1&revcomp=1&spectralnorm=1&hello=0&sumcol=1)

Benchmarks are of course arbitrary, but no matter what way you dice things, SBCL is vastly superior to Python's crappy VM. In the case of the link above, over 10 times faster.

<comment><USER4> As I mentioned in another post, I'm aware of the qualities of SBCL. I know it is a much better VM. That's not what I am concerned about...what I like about Python is its quantity and consistency of libraries and its overall consistency period. Common Lisp just doesn't have that, and SBCL isn't perfect - its full functionality doesn't work across all platforms.

> That would be an incredibly bad idea.

And I'm just wondering...even with SBCL, why would it be an 'incredibly bad idea' to undertake such a project to convert a Lisp dialect to Python?

<comment><USER5> _"I know it is a much better VM."_

SBCL isn't a VM. It's a Lisp implementation with a compiler that generates native code.

Admittedly, many dynamic languages folks seem to find this concept odd. The idea that {dynamic typing, garbage collection, your favourite feature from ruby/python/perl/php} requires a VM unfortunately seems strongly ingrained.

</comment></comment></comment></comment></comment></comment><comment><USER4> The GPL licensing would be an issue for some.

Edit: Unfortunately Logix seems to have been dead since 2005.

<http://common-lisp.net/project/python-on-lisp/>

<comment><USER6> How come?

<comment><USER4> Well, if you wanted to ship a desktop application or such, you'd have to open source your code. That doesn't work for all companies.

</comment></comment></comment><comment><USER7> Since some of you are asking for the converse:

<http://news.ycombinator.com/item?id=36178></comment>


A response about dep and vgo - <AUTHOR> https://peter.bourgon.org/blog/2018/07/27/a-response-about-dep-and-vgo.html <comment><USER2> Vgo has certainly been a disaster from a communication and community point of view. From an outsider perspective, it looks like a case of maintainer arrogance, and it _is_ hard to believe that Go really has needs that are significantly different from those of e.g. Rust or Java.

However, I am also in the unusual position that I had to design and implement a package manager for my own little language recently. My original hunch was to just create a Cargo clone, but after reading Russ Cox's writings, I ended up cloning vgo (with a few simplifications). The implementation was wonderfully simple - everything just fit together. The algorithms are trivial. Operationally, it is easy to understand what the package manager is doing (even more so than for vgo, as vgo has do deal with various Go idiosyncracies and backwards compatibility).

This is in stark contrast to my experience with other package managers, which are temperamental beasts at the best of times. When they work, everything's groovy, but their error modes are easily incomprehensible. I think vgo's approach of restricting expressivity and streamlining processes is the right one. But since nobody has used such a package manager before, it remains to be seen whether it works in practice.

For my own experiment, I do have one data point: I showed people the (rather brief) documentation for my vgo-inspired package manager, and they all felt it was very simple to follow and easy understand what it did, and how.

<comment><USER3> For what it's worth, I analyzed as many Gopkg.{lock,toml} files I could find in the wild, and found that vgo's algorithms would service all of them. I've done similar analysis for a smaller number of Rust projects using Cargo and had the same findings. I've found it hard to find projects in the wild that actually do any non-trivial version selection. I think this is some good evidence that it will work out in practice.

I think it's less that Go has significantly different needs, but it's more that people overestimate what their actual needs are.

[https://github.com/zeebo/dep-analysis](https://github.com/zeebo/dep-analysis)

<comment><USER4> The problem with minimal version selection isn't that it can't support nontrivial version selection but rather that it doesn't automatically select the newest versions of packages.

<comment><USER5> It's a feature not a problem. It select the only know working solution. You're still free to update to newest versions.

</comment></comment></comment></comment><comment><USER6> I'm relieved to see that the fate of Go is ultimately controlled by a small team of highly talented engineers, not a nebulous "community" that designs by democracy.

If Go had been designed by community vote from the beginning, it would almost certainly have generics... and operator overloading, and exceptions, and 50 exposed GC knobs, and macros -- and a SAT-based dependency resolver, of course.

I trust Russ, Rob, and the rest to get it right, and they've proven that my trust is justified over and over again.

<comment><USER7> > nebulous "community" that designs by democracy

I can't read that statement without thinking of perl, and the nightmare of developing in a team of perl devs. We don't need ten thousand ways of doing things and not everyone needs their way to be represented. I'm very happy to have Russ enforce one "right" way of doing things and vgo seems to fit that nicely. One less argument for me and my fellow engineers using go to argue about.

</comment></comment><comment><USER8> I am not involved in this discussion and have no skin in the game, but from an outsider's perspective it seems that Russ laid out exactly what his concerns were about showstoppers in the dep implementation and those concerns were effectively ignored by the dep committee. What were they expecting to happen after that? Are there some other non-showstopper classified concerns that Russ should make up on the spot and have the dep committee then concentrate on? Why bother after showstoppers are effectively ignored?

It's odd to call out Russ as being disingenuous when he says his concerns were ignored when the dep committee did effectively ignore them. Adding 'effectively' as a qualifier here is somewhat important because it grants that there may have been a deliberation process and that those concerns were not outright dismissed, but the output of a deliberation process must be either in favor or against, and when a concern is deliberated against it is effectively ignored. It has never made sense to me when someone says something along the lines of "we've heard your concerns and have taken them into consideration" and yet did not heed those concerns. Obviously you haven't taken them into consideration and therefore they were effectively ignored.

In this case it seems to me that the burden of proof is on the dep committee to demonstrate that the alleged showstoppers are in fact not stopping the show. You don't get to call a committee meeting, decide to ignore showstoppers by claiming that you don't believe them to be so, and then expect nothing but smooth sailing and cooperation from there on. That makes no sense at all. All this rhetoric about community involvement and "working with us" falls on its face when the implicit terms of engagement are not adhered to.

<comment><USER9> I think the issue is that Russ should have clearly told the dep people that if the showstopper issues are not handled, then he will seek for some other solution, e.g. build one by himself.

However, what happened was that he told the dep people "I will build a dep tool myself to understand more on the problem details", which implies "after I understand more, I will come back to you and discuss more", but not "after I build the tool myself, I will just integrate my version into the official tool". For this part, Russ was not executing his own words, or at least delivered the wrong impressions. Maybe this result should be already well expected based on Russ's personality or how the golang team did stuff in the past, but many programmers are not that politically awareing..

It is not the technical result that the "vgo" solution kills "dep" saddens dep people. It is rather the form of communication: "vgo" stabs "dep" in the back, by emerging suddenly out of Russ's pocket, and essentially claims immediate victory using the power of the Go core team. When the vgo posts are out, and the vgo proposal is posted (and it is not really bad technically), there is really no effective way for the rest of the community to reject it.

Russ could have kept his words by going back to the dep people and told them about what he learned from writing "vgo", and then move forward with integrating "vgo" if a consensus cannot be reached. Eventually, Russ might just be able to get the same technical results as today anyways (but maybe with larger communication overhead).

What the dep people essentially says here is that, if Russ really wants, they can also implement exactly "vgo" from "dep", but they never got the chance.

<comment><USER8> If I were in Russ's shoes and I had told someone as politely as I could that their solution exhibits what I consider showstopper issues, I wouldn't expect to have to clarify that I find that solution entirely unacceptable and flawed from its very design. There's no issue in the clarity of communication when the term 'showstopper' is thrown around.

Russ said he was going to go and build a tool to understand the problem better. In no way does that imply that any lessons he learns from the implementation must be communicated back to the dep committee. But for the sake of argument, let's say that did happen. Then what? Does Russ practically force the dep committee to implement vgo out of the remains of dep? Why would he do that when he just spent a month or two implementing vgo from scratch? Why bother going back to a problematic group that doesn't believe their core issues are showstoppers? If that difference of perspective exists and they're not willing to debate that, to say nothing of the fact that they feel that they should be on the receiving end of the burden of proof, what more can be gained from them from Russ's perspective?

<comment><USER9> hmm.. I was not aware that Russ used the word "showstopper" until recently in his tweets, and even if he literally used the word in the past, the word of the meaning was not delivered, reading from the post here.

That said, the dep people also made a similar mistake on not clearly confirming with Go core team that they had a chance to integrate dep into the official toolchain eventually. They wanted dep to be the thing, and they really thought that they were on the right track.. poor folks..

If Russ managed to influence the "problematic" group to do what he wants, rather than doing it by himself, he could give these people a meaningful place in the Go community. _That is the gain._ If that is worthy or not (comparing with discarding 2-month work on Russ's own time) depends on your own perspectives, and I am not sure what Russ thought or thinks. No matter how, it will affect how the community grows in the future.

So this goes back to the root issue about how the Go core team view its Google-external language community (or even more fundamentally, if they will be rewarded/recognized by Google if they did a good job on making the community happy). Specifically, do they want to carry the responsibility to deliver messages to the community clearly, at least to some certain extent? Opinionated is fine and firing users (e.g. users who think generics is a must) is fine, sometimes even preferred, but hurting people that were willing to follow and contribute might not be the best way to go.

</comment></comment></comment></comment><comment><USER10> Rather than a technical argument, or a clarifying point of view, all I see here is basically "we formed a committee goddammit, we're the incumbent, how dare you not listen to us?"

In my eyes, Russ is too nice here, and this committee seems like it would've been difficult to work with at an intellectual level, anyhow, judging by this type of griping.

Maybe Russ should hire Linus to deal with situations like this :-)) /s

</comment><comment><USER11> > _Community consensus is not always possible. If we don't get there, then the > core Go team decides. Technically I am the final decider but what actually > happens is that a bunch of long-time Go team members talk through the > decision to get to a consensus among ourselves._

Was anything major ever decided based on a "community consensus" in Go?

What I've read about, and this case is no exception, is that it's always "a bunch of long-time Go team members". Aside from making libs, and conferences, and such, the community might as well not exist.

Certainly nothing like PEP process, or something like Swift (which despite Apple's thing, goes out of its way to engage the community in feature roadmap) or Rust.

> _We did all of this because we wanted to be an exemplar of how the community > could step up and solve a problem that was being ignored by the core team. I > can't think of anything else we could have done to be better than we were. > But the end result of this effort was no different than if we had done none > of it at all: the core team ultimately didn't engage with us meaningfully on > the body of work we'd contributed, and instead insisted on doing the work > themselves, as an essentially greenfield project._

Well, have they had any other impression about the prospects of such external effort? The author adds an even more bitter remark later on, and then retracts it saying: "Upon reflection, I think this may be too strongly stated. There are good examples of large contributions that originated outside of the core team, including support for different architectures, like WASM".

But adding a different architecture is not a decision that changes the languages syntax, standard libs, tooling, direction or semantics. It can even be dropped at any time, and none other architecture would even care. It's like proving how an OS is "open" to third parties by pointing out that anybody is welcome to contribute a hardware driver for it.

<comment><USER12> > something like Swift (which despite Apple's thing, goes out of its way to > engage the community in feature roadmap)

Good you say that. Not too long ago solutions from swift-server-group is discarded and Apple simply developed swift-nio in-house. I read that server group was blindsided by this development and now more or less disbanded.

<comment><USER11> Not sure about the swift-server-group situation -- some where blindsided, but here's e.g. the head of the closely related Vapor (server side web framework) project:

"I've seen a surprising amount of people thinking that the server-side Swift community or the Swift Server working group was somehow blind-sided by SwiftNIO. That couldn't be farther from the truth. We had known about SwiftNIO before the first line of Vapor 3 code was even written."

And in any case, even if the server group was blindsided it's not representative of a general tendency, as there are a very active features discussions e.g. in [https://forums.swift.org/c/evolution](https://forums.swift.org/c/evolution) with the community and public members involved and shaping changes.

<comment><USER12> Well discussion is all fine. The important thing will be if Swift core team which is all Apple employees (except Chris Lattner who left Apple recently and removing him would look petty) will simply accept community solution even if they don't think its right.

I don't know of examples if anything got in Swift just by force of community without core team approval. And it seems right thing to me whether Swift or Go or Rust.

One thing better in Swift is clear rejections of pitches if it is not right for swift which makes sense as communication is always better with everything Apple.

<comment><USER11> > _I don 't know of examples if anything got in Swift just by force of > community without core team approval._

It's not about that though. Of course the core team should approve. It's when the core team only approves its own things, which often are designed decidedly not the way that the community wants, that's the problem.

</comment></comment></comment></comment></comment><comment><USER13> _" Dep does not support using multiple major versions of a program in a single build. This alone is a complete showstopper. Go is meant for large-scale work, and in a large-scale program different parts will inevitably need different versions of some isolated dependency."

Russ has asserted this from day one, and has brought several examples out in evidence, but has simply not convinced the committee that it's true. Calling it a serious problem, let alone a showstopper, is a significant overstatement. The strongest claim that can be made on this point is that it's a matter of opinion._

OK that's enough for me. "BDFL" clearly correct, random critics totally unwilling to consider the proposition. More language developers are realizing that hierarchical imports with directory name conventions are a good practical thing that just works. Multiple versions come for free with this arrangement. If your tool can't handle that, your tool sucks.

</comment><comment><USER14> The discussion about the original post can be found here: [https://news.ycombinator.com/item?id=17623023](https://news.ycombinator.com/item?id=17623023)

This response is a long one, of which the ending deserves special note:

> I hope this story serves as a warning to others: if you're interested in > making substantial contributions to the Go project, no amount of independent > due diligence can compensate for a design that doesn't originate from the > core team.

> Maybe some of you are reading this and thinking to yourself, "well, no duh, > Peter, that should be obvious." Maybe so. My mistake.

It personally made me think of this issue / PR in the Go issue tracker, [https://github.com/golang/go/issues/20654](https://github.com/golang/go/issues/20654), about support for constant time arithmetic with bigints. Currently, operations on bigints in Go may leak secret data via timing channels, because calculations with different values take predictably different time. The maintainers have chosen to specially modify only the P256 curve (but not P224, P384, or P521) to work in constant-time.

The author of the issue has written an extensive (somewhat strawman) PR that includes the constant-time code _inside_ the current implementation of the bigint. That's a choice – for seemingly good reasons laid out in the issue, and of which the author admits that it also could be a separate package – but the rest of the conversation is halted in indecision about how the core team should proceed, without referring back to any of the arguments and reasons the original author has put forth.

<comment><USER15> I don't see the comparison you're drawing here. The question proposed in the Go issue is whether the standard bignum library in Go should be constant-time, whether crypto primitives should provide their own constant-time math, or whether a third library for constant-time bignum math should be added that all Go crypto can rely on. That's not an easy question, and meanwhile significant chunks of the bignum crypto code that people actually use in Go is written in assembly anyways.

The Go crypto libraries have a domain-specialist owner: Filippo Valsorda. If you have questions about constant-time math operations in Go, he's a smart and nice guy; you should maybe ping him.

Go's crypto library is imperfect, but it is the best native crypto library provided by any modern language. (Ring is excellent too, but is not as I understand it part of the Rust standard library).

<comment><USER16> > I don't see the comparison you're drawing here.

I think the similarity is as follows:

\- there is a desire to fix something that feels like a gap (in this case limited support of constant-time math in standard library)

\- there is a change proposal coming from the community

\- there are arguments why it should be included and some discussion if it belongs in a separate library or not

\- very little or no input from core team

\- the whole process is stalled waiting for core team to participate

Now we just need someone on the core team decide they need to research via implementation instead of actively engaging community, end up liking their own solution more and we'll have dep all over again.

<comment><USER17> > which the author admits that it also could be a separate package

I don't think the similarity is all that apt.

If the core team is the limiting factor in the PR, and if there is a need for this, then why not just make the separate package and be done with it? If it is popular and core wants to merge it in at a different time, then great.

<comment><USER16> I'm not aware of a way to plug your own crypto to a lot of things that are part of standard library and I'm not aware of a way to plug your own math library to existing crypto.

<comment><USER13> Would they take PRs for adding that bit of plugability?

<comment><USER15> Probably not.

<comment><USER18> There has been some discussion about a pluggable TLS stack: [https://github.com/golang/go/issues/21753](https://github.com/golang/go/issues/21753)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> There's an interesting discussion about this with russ and peter participating over on reddit here: [https://www.reddit.com/r/golang/comments/92f3q1/peter_bourgo...](https://www.reddit.com/r/golang/comments/92f3q1/peter_bourgon_a_response_about_dep_and_vgo/)

</comment><comment><USER20> One thing that I think is being missed is that code/a product is not the only thing that matters. In fact, it's one of the less important things here.

Once a design is set, implementing it is "just work". I'm not sure trying to undervalue that, but the important part is first investigating the design. The package management committee came up with the tried and tested design while Russ was trying to understand the true requirements. Both have their merits, and time will tell if Russ is right here. The thing to do keep in mind is that investigative work is inherently "wasteful".

</comment><comment><USER21> I don't have extensive knowledge of the matter in hand, but this narrative seems much more coherent. And sad for Go/Google. So much for "open". Just like Android/Google play services thing.

Calling something "open" a hundred times a day does not remove one bit of corporate control.

<comment><USER12> If someone is putting >90% of funding for project, it is just common sense they will veto things they do not like. I wonder if some people believe that online cliche about open source is all there to it.

</comment></comment><comment><USER22> Is there any package manager using P2P technology (e.g. Bittorrent) to speed up transfer? Or would this generally a bad idea?

</comment><comment><USER23> Dep is awesome from the user perspective. You just type > dep ensure and it works and it's fast.

<comment><USER24> So is GO111MODULE. You just type `go build` and it resolves dependencies as part of the build. It's even one less step than `dep ensure`.

</comment></comment><comment><USER25> Following the meta discussion is more taxing for me than following the technical details.

</comment><comment><USER26> Go does not exist to raise the profiles of Sam Boyer and Peter Bourgon. Sam wanted to be a Big Man On Campus in the Go community and had to learn the hard way what the D in BDFL means. The state of dep is the same as it was before - an optional tool you might use or might not.

Lots of mentions in Peter's post about things the "dep committee" may or may not have agreed with. Isn't this the same appeal to authority he is throwing at Russ? When did the "dep committee" become the gatekeepers of Go dependency discussions and solutions? Looks like a self-elected shadow government, except it didn't have a "commit bit". Someone should have burst their balloon earlier, that is the only fault here. Russ, you are at fault for leading these people on.

Go is better off with Russ's module work and I personally don't care if Sam and Peter are disgruntled.

<comment><USER27> I've interacted quite a bit with both Sam and Peter. Your characterization rings completely false. I've never gotten the least hint of the impression they were doing this for self-promotion, but rather to serve to fill an obvious vacuum, perhaps even with a degree of reluctance.

I remember being excited when the "dep committee" was formed, because (if I remember correctly) it was set up with the explicit blessing of the Go Team, with a Go Team Member on it to facilitate two-way communication.

Your characterizations are both inaccurate and ugly.

<comment><USER12> > Your characterizations are both inaccurate and ugly.

I think it may be blunt but seems true to me. Sam calling integration of Go module as sad milestone does seem disgruntled.

Dep folks have decided not to take high road which is fine but others are free to call this out.

<comment><USER28> I want vgo to succeed and I like most of your contributions, but comments like this and the original post ("Sam just wants to be the big man on campus") are petty and rude. You're better than this.

<comment><USER12> Not that I disagree with you. But this unending whining by dep folks is not helping them endeared to me or so many others.</comment></comment></comment></comment></comment>


Flickr Rebellion Brews at Specter of M$ Acquisition - <AUTHOR> http://blog.wired.com/monkeybites/2008/02/what-would-micr.html "A small but vocal minority on Flickr are already staging online protests at the prospect of a Microsoft takeover. Flickr is one of several popular Web 2.0 websites owned by Yahoo that loyal users fear will suffer under Microsoft ownership." <comment><USER2> I bet they won't use many core users. People are very much invested in flickr.</comment>


Can you make music with strangers? Online interactive art. - <AUTHOR> http://danceydots.com/

<comment><AUTHOR> Hey all, first hacker news post. My friend made this interactive art website. You click to make noise. Its more fun with more people, enjoy!

<comment><USER2> Dude, at least hang out on your own website the night you post it. I'm making wubs on my own because I'm an electronic musician, but it's not very rewarding with nobody else around.</comment></comment>


American Chemical Society bans university after "spider-trap" is clicked - <AUTHOR> http://blogs.ch.cam.ac.uk/pmr/2014/04/02/acsgate-pandora-opens-the-american-chemical-societys-box-and-her-university-gets-cut-off/ <comment><USER2> It's worth noting that many journals don't control the platform their scholarly content. It looks like ACS uses this [Atypon]([http://www.atypon.com](http://www.atypon.com)). That's the likely source of this spider trap, not ACS.

Atypon has [a relatively small client list]([http://www.atypon.com/our- clients/featured-clients.php](http://www.atypon.com/our-clients/featured- clients.php)). Compare it to [Highwire]([http://highwire.stanford.edu/lists/allsites.dtl](http://highwire.stanford.edu/lists/allsites.dtl)). I'd be willing to bet that all journals hosted with Atypon share this spider trap—even journals that are supposed to be open access where spidering _should_ be OK.

Scientific publishing is weird. Source: I work in scientific publishing.

<comment><USER3> In Highwire's case, they typically have a robots.txt blocking everyone but Google ... and the reason is not malice, it's inefficient software. Fetching a page once every few seconds is enough to overload their system.

<comment><USER4> A problem with robots is that they will scan all of a website. Normal user traffic is somewhat focused and is easy to cache. When one robot comes and scans everything at once, it brings a bunch of unpopular pages in the cache, possibly evicting more popular ones in the process. The more popular one will then need to be re-cached as requests come back for it.

If you avoid caching requests by robots, then instead you end up having to go through all the layers of your app, possibly going in the database.

In most situation, I don't think the above matters much. But I can see why it could be a worst case for some stacks.

<comment><USER5> That's easily detectable and mitigable via a MRU cache, or no caching at all.

</comment></comment></comment></comment><comment><USER6> Is it bad that I'm just as insulted by the so-called "spider trap"? It's so technologically simple as to be useless against anyone who could deploy a web scraper in the first place.

I mean, it's marked by comment tags that say "spider trap" right on them! Its the worst type of disambiguation system: likely to generate false positives, unlikely to catch real violators.

<comment><USER7> Yet the off-the-shelf bots that are just let loose on the web in general will likely fall for it, as long as the "spider trap" is not off-the-shelf itself; and the ones actually targetted at just you you likely can't defeat anyway.

</comment></comment><comment><USER8> Note how this means that anyone who is tricked into clicking that link has just blacked-out their entire institution. This has massive potential for abuse.

<comment><USER9> They have posted a reply here: [http://www.asihcopeiaonline.org/doi/pdf/10.1046/9999-9999.99...](http://www.asihcopeiaonline.org/doi/pdf/10.1046/9999-9999.99999)

<comment><USER10> That looks like the spider trap link.

<comment><USER9> That's the joke.

<comment><USER10> This sort of Slashdot-esqe misdirection is not exactly appropriate on HN. It starts with black-holing universities with a link mislabeled as a response, but could quickly devolve into misdirections to other black holes of Slashdot that (I assume) we really don't want here.

<comment><USER11> As a user of HN, don't tell me or others what's appropriate, thanks.

<comment><USER12> Nitrogen is right. This sort of Slashdot-esqe misdirection is not exactly appropriate on HN.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> arXiv.org, back when it was still xxx.lanl.gov had a similar trap. Yes, I clicked on it. It gave a warning of the sort "don't this again, here's what's happening, if we see many more requests from your site then we'll shut off access."

This was in the late 1990s.

<comment><USER14> I still remember that page. As a middle schooler who didn't know anything from anything, it was a perplexing thing. The site's got an xxx at the front, but looks like a legit government site from wait, Los Alamos? Like from "Surely You're Joking Mr. Feynman"? Oh jeez, I'm gonna get in trouble with the school...

</comment></comment><comment><USER15> Funny, we used to do this when I was working at arXiv.org. We had incessant problems with robots that didn't obey robots.txt so we needed spider traps to keep the site from going down.

</comment><comment><USER16> That's some level of incompetence - the trappers I mean. A half arsed solution because they couldn't think of a better one. A registration system with abstracts and unlock-this-article links would be a better one, off the top of my head.

<comment><USER2> I'm willing to bet that they provide site licenses, where everyone in an entire university's subnet range might have access. In an open access journal, it _shouldn 't_ matter, but many journals are hosted on the same few platforms, and the spider trap is a feature of the platform.

</comment></comment><comment><AUTHOR> Reporting the content since site is down:

Tl;dr: researcher is browsing source code of a research paper's web page and finds a strange link (but same domain). She clicks and is informed that her IP is banned for automated spidering.

Apparently, this research site is meant to be open-access...

\</comment><comment>-

Pandora is a researcher (won't say where, won't say when). I don't know her field – she may be a scientist or a librarian. She has been scanning the spreadsheet of the Open Access publications paid for by Wellcome Trust. It's got 2200 papers that Wellcome has paid 3 million GBP for. For the sole reason to make them available to everyone in the world. She found a paper in the journal Biochemistry (that's an American Chemical Society publication) and looked at [http://pubs.acs.org/doi/abs/10.1021/bi300674e](http://pubs.acs.org/doi/abs/10.1021/bi300674e) . She got that OK – looked to see if they could get the PDF - [http://pubs.acs.org/doi/pdf/10.1021/bi300674e](http://pubs.acs.org/doi/pdf/10.1021/bi300674e) \- yes that worked OK.

What else can we download? After all this is Open Access, isn't it? And Wellcome have paid 666 GBP for this "hybrid" version (i.e. they get subscription income as well. So we aren't going to break any laws…

The text contains various other links and our researcher follows some of them. Remember she's a scientist and scientists are curious. It's their job. She finds:   Since it's a bioscience paper she assumes it's about spiders and how to trap them.

She clicks it. Pandora opens the box... Wham!

The whole university got cut off immediately from the whole of ACS publications. "Thank you", ACS

The ACS is stopping people spidering their site. EVEN FOR OPEN ACCESS. It wasn't a biological spider. It was a web trap based on the assumption that readers are, in some way, basically evil.. Now _I_ have seen this message before. About 7 years ago one of my graduate students was browsing 20 publications from ACS to create a vocabulary. Suddenly we were cut off with this awful message. Dead. The whole of Cambridge University. I felt really awful.

I had committed a crime. And we hadn't done anything wrong. Nor has my correspondent. If you create Open Access publications you expect - even hope - that people will dig into them. So, ACS, remove your spider traps. We really are in Orwellian territory where the point of Publishers is to stop people reading science.

I think we are close to the tipping point where publishers have no value except to their shareholders and a sick, broken, vision of what academia is about.

UPDATE: See comment from Ross Mounce: The society (closed access) journal 'Copeia' also has these spider trap links in it's HTML, e.g. on this contents page:[http://www.asihcopeiaonline.org/toc/cope/2013/4](http://www.asihcopeiaonline.org/toc/cope/2013/4)

you can find

I may have accidentally cut-off access for all at the Natural History Museum, London once when I innocently tried this link, out of curiosity. Why do publishers 'booby-trap' their websites? Don't they know us researchers are an inquisitive bunch? I'd be very interested to read a PDF that has a 9999-9999.9999 DOI string if only to see what it contained – they can't rationally justify cutting-off access to everyone, just because ONE person clicked an interesting link? PMR: Note - it's the SAME link as the ACS uses. So I surmise that both society's outsource their web pages to some third-party hackshop. Maybe 10.1046 is a universal anti-publisher.

PMR: It's incredibly irresponsible to leave spider traps in HTML. It's a human reaction to explore.

</comment><comment><USER17> Seems like an easy way for a university-based "conscientious objector" to have this issue addressed would be to intentionally click on the spider trap link once a day?

<comment><USER18> Too much work. Wget with cron. Then you can click every day without having to click every day.

</comment></comment><comment><USER19> I work for a (non profit) journal publisher and we do indeed cut off robot downloading but not after one click of a link. We analyze traffic to determine robot downloads. I suspect though that the whole entire university did not get cut off in this incident. Usually it is on a per IP basis and unless the University proxies all of their journal traffic through a single IP which is not common I think saying the whole university being blocked may be an exaggeration. I personally wish we had no robot monitor but then again we would get heavy spidering then of large files.

<comment><USER20> Is there reason to block instead of throttling?

<comment><USER19> We do have a CAPTCHA too before the block. Basically to get the block you have to really work hard at it. We also do not mind limited robot use for cases like downloading all papers given a search term or author but we do not want people downloading our entire corpus either. So throttling is not an option.

I think the case mentioned in the article is definitely heavy a heavy handed approach. When it comes down to it at my place we are just trying to block the wget -r's of the world.

<comment><USER21> Is there any reason why you don't want people downloading your entire corpus?

</comment></comment></comment></comment><comment><USER22> Doesn't Chrome pre-load links as well?

Not sure it checks for styling before prefetching them.

<comment><USER23> no I think this plan was scrapped, too dangerous (too many websites had stateful actions as GET). I think they just stuck to pre-loading DNS.

edit: and i was messing the webstats for advertisement.

<comment><USER24> We had an internal wiki where the "delete article" link was a GET. Then someone wrote a crawler for it and deleted the entire wiki in 15 minutes. It was changed to a POST after that.

<comment><USER25> Heh, this reminds of a story many years ago at Google, where we got angry messages from some guy complaining that Google kept deleting all the photos from his online album.

We eventually figured out he his online album had an unprotected "delete this photo" endpoint via a GET, and no robots restriction! We eventually had to fix the crawler to detect things like this...

<comment><USER26> I bet Google gets tons of these: [http://thedailywtf.com/Articles/The_Spider_of_Doom.aspx](http://thedailywtf.com/Articles/The_Spider_of_Doom.aspx)

</comment></comment></comment></comment></comment><comment><USER27> For anyone that can't load the page, here's the site from Google's cache: [http://webcache.googleusercontent.com/search?q=cache:_EBW_po...](http://webcache.googleusercontent.com/search?q=cache:_EBW_poxSLoJ:blogs.ch.cam.ac.uk/pmr/2014/04/02/acsgate- pandora-opens-the-american-chemical-societys-box-and-her-university-gets-cut- off/+&cd=1&hl=en&ct=clnk&gl=us)

<comment><USER28> Oddly, the google cache version won't load for me either. The google cache header is there, but the content area is blank, with the chrome status bar saying "Waiting for blogs.ch.cam.ac.uk".

Looking at the source... there's some weird things going on, I think maybe the _original_ page loaded it's content with Javascript, and the google cached version is just the JS skeleton, waiting on trying to load JS from the original (overloaded) site which will actually load the content?

Ugh. The trend for JS-dependent sites for simple content breaks the web, people.

<comment><USER29> No, you need to click the text only link in the header or it will still try to load images and will eventually time out.

</comment></comment></comment><comment><USER30> It would be interesting to see what conversations might happen if lots of people from lots of universities clicked on these traps.

</comment><comment><USER31> The warning message returned by the spider-trap says that it banned a particular IP address. How does this cut off the entire university? Is everyone behind a NAT?

<comment><USER32> For licensing purposes, they'd need to be able to associate ranges of IP addresses with a specific institution. So if they want to, it's easy to block that whole license for one violation.

</comment></comment><comment><USER33> This is an important topic, but that blog entry was not very well written. If I hadn't heard about this before already I would have been very confused what they actually wanted to say with this convoluted story.

<comment><USER12> Can anyone suggest a better url? If so, I'll change it.

</comment></comment><comment><USER34> 1\. get university with good ties to ACLU and other such movements.

2\. subscribe

3\. click link

4\. sue them for breach of contract and damages. (they didn't deliver the content you paid for, it damaged your main source of income: providing knowledge to paying students)

5\. repeat.

</comment><comment><USER35> Sigh, did no one notice that the link is in a  ? Look at the style sheet and note that class 'hide' sets the link to be the same color as the background (it makes it invisible to humans) and yet it got clicked on anyway.

There are bad actors out there, they exploit services, and one of the ways the services detect them is to create situations that a script would follow but that a human would not. When they do something bad you've got a couple of choices, cut them off or lie to them (some of the Bing markov generated search pages for robots are pretty fun))

So she sends an email to the address provided, they talk to her, she gets educated and they re-enable access. If it happens again the issue gets escalated. Its the circle of fraud.

<comment><USER36> Some people also override site based CSS with their own, which could likely make the link that was intended to be hidden come unbidden. Most browsers I've used have that option.

<comment><USER21> There even are browsers out there that simply don't support CSS.

<comment><USER20> Lynx seems a likely candidate, though I'm not positive it has zero support.

<comment><USER37> Konqueror on RHEL seems more likely than Lynx.

</comment></comment></comment></comment></comment><comment><USER38> Tack spider traps and booby trapped documents to the long list of scientific publishing problems.

</comment><comment><USER39> This is only interesting for as long as ACS is asleep at the wheel.

Lets wait and find out how long it takes them to respond to the inevitable interest that 999999.99999 people will have sent their way ..

</comment><comment><USER26> I sometimes get a similar message from Google (maybe it's due to the search queries I use...), but they provide a CAPTCHA so you can (reasonably) show that you're a human.

</comment><comment><USER40> Some asshole just discovered a whole new reason to wardrive...

</comment><comment><USER41> It's odd that at the top of the article the author claims Pandora might be a scientist or a librarian (but they won't reveal such things) Then later claims they looked at the hidden link because they were curious (because scientists are curious). Maybe someone should have re-read their text for consistency.

</comment><comment><USER42> last 5 mins I'm trying to reach this link. the website is not reachable any more. How many people are trying to do the same ?

<comment><USER43> [http://blogs.ch.cam.ac.uk/pmr/](http://blogs.ch.cam.ac.uk/pmr/) worked for me eventually, also [http://webcache.googleusercontent.com/search?q=cache:_EBW_po...](http://webcache.googleusercontent.com/search?q=cache:_EBW_poxSLoJ:blogs.ch.cam.ac.uk/pmr/2014/04/02/acsgate- pandora-opens-the-american-chemical-societys-box-and-her-university-gets-cut- off/&hl=en&strip=0).

There are several posts about this issue, [http://blogs.ch.cam.ac.uk/pmr/2014/04/03/acsgate-the- america...](http://blogs.ch.cam.ac.uk/pmr/2014/04/03/acsgate-the-american- chemical-society-spider-trap-reactions-and-warning/) appears to be the best I've looked at as it gives details of the links that were followed that initiated the suspension of service by ACS.

</comment></comment><comment><USER44> I work at a university and just clicked on it.

</comment><comment><USER45> Trying to stop spidering or web scraping or making it criminal is asinine. Do not publish it online. Even if you put content up as Flash or Java applet, someone will find a way to crawl/scrape it.

This goes against the nature of the internet and information, it is bound to be free.

<comment><USER18> You cannot simultaneously publish something and stop people from knowing what it contains. Expecting that you can is absolutely insane--literally insane--as in believing that P and not P can simultaneously have the same logical value.

This makes me furious. It isn't because the intent is malicious. That only makes me just a tiny bit angry. I am furious because the malice was implemented in the stupidest, most useless, laziest manner possible.

It's like keeping the neighborhood kids off your lawn by burying a pressure plate switch out there for the armed nuclear bomb in your garage. And then not telling anyone about it. And then inviting all the neighbors over for a croquet tournament.</comment></comment>


OpenNT: A Fork of the Microsoft Windows NT 4 - <AUTHOR> http://opennt.net/ <comment><USER2> This is based on the leaked Nt4 source code with some changes merged from W2K hence the 4.5 moniker.

I expect the code would be fun to read. It leaked out of Israel (I think) about a decade back and if I remember correctly the entire NT4 tree leaked plus significant components from 2k.

Can't imagine Microsoft will be too happy with this.

<comment><USER3> Im sure it will be fine, they have this in the documentation:

       All new or significantly modified C/C++ source code files must contain the following header.
       Copyright (c) (YEAR)  Microsoft Corporation

;-)

</comment></comment><comment><USER4> There is something seriously wrong with your IT infrastructure if it's easier to create a clone of an ancient operating system then it is to upgrade the software you are running to newer OSes. There is something seriously wrong with your corporate infrastructure if those upgrades weren't just happening as a matter of course over the years. "A stitch in time saves nine."

<comment><USER5> I don't think this is a clone, I think this must be based on leaked Microsoft- owned source code.</comment></comment>


Show HN: SNMP agent customizing private MIB with Lua - <AUTHOR> https://github.com/begeekmyfriend/smithsnmp <comment><USER2> I don't know a word about LUA; but looks like you wrote the mib implementation _by_ hand. I mean, without a mib compiler that does all the diry work giving you a skeleton where you can build the logic.

Is it true?

Anyway, it is really interesting :-)</comment>


Patterns of Covid-19 Mortality and Vitamin D: An Indonesian Study - <AUTHOR> https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3585561#.XqWfqZvYqW0.twitter <comment><USER2> >> the vitamin D hammer and influenza

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4463890/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4463890/)

> A colleague of mine and I have introduced vitamin D at doses that have > achieved greater than 100 nmol/L in most of our patients for the past number > of years, and we now see very few patients in our clinics with the flu or > influenza like illness. In those patients who do have influenza, we have > treated them with the vitamin D hammer, as coined by my colleague. This is a > 1-time 50 000 IU dose of vitamin D3 or 10 000 IU 3 times daily for 2 to 3 > days. The results are dramatic, with complete resolution of symptoms in 48 > to 72 hours. One-time doses of vitamin D at this level have been used safely > and have never been shown to be toxic.8 We urgently need a study of this > intervention.

<comment><USER3> > complete resolution of symptoms in 48 to 72 hours

Not to be glib, but isn't that about normal for the flu? The reason there's so many folk remedies is that you'll generally recover after a couple of days and attribute it to whatever you did in those days.

<comment><USER2> For average folks, sure. This study is for 'nursing home residents'.

</comment></comment></comment><comment><USER4> Always a good idea to get some sun, so do get out more! Crucially, Vitamin D gained via sunlight is significantly more effective for Vitamin D-related health improvements than supplements.

...which kinda points to the problem here: Vitamin D aka getting sunlight aka living an active life is almost impossible to control for.

Consider Bill Gates as an example for a healthy and active 65-year old man who seems to be spending a lot of time outside, considering their perennial tan. It would be perfectly believable for someone like that to have asthma, or well-controlled diabetes, or have had a bout with cancer 15 years ago without any of that having much of an impact on their daily lives.

Now consider an overweight, opiate-dependent patient of the same age, driving their mobility scooter through wall-mart and otherwise not leaving their couch much.

These two people are in the same category here except for Vitamin D levels.

It's also strange that the numbers do not seem to be representative of the larger patient population. Death rates, especially, are far higher. This isn't necessarily a problem, but it could be. One reason might be the limited availability of patients with data on Vitamin D levels. If so, the immediate suspicion is that testing depends on disease severity. Worst case, Vitamin D testing was previously done for some subgroup of patients: for example, levels might be routinely measured for lung cancer patients but not diabetics.

Finally, I'm somewhat suspicious of discretising the measurements into three classes. This obviously throws away part of the data for no immediately obvious reason. And intuitively, the difference between the two classes with Vitamin D deficits seems somewhat low?

<comment><USER5> > Crucially, Vitamin D gained via sunlight is significantly more effective

Do you have any citations for that?

<comment><USER6> I can't back that statement up but sunlight has a suite of other non-vitD- synthesis effects too: [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5086738/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5086738/)

<comment><USER5> That's a very interesting paper! It has long been my belief that sunshine is good for you, and so long as you avoid an outright suburn, basically the more the better. Even with respect to cancer alone, from what I've seen in the literature over recent decades it seems undeniable that the reduced risk from various common cancers like prostate and breast cancer far outweighs the possible increased danger from skin cancer since melanoma is comparatatively rare and carcinoma not very dangerous; but mostly this is ascribed to Vitamin D and then taken as a recommendation for Vitamin D supplementation rather than increasing sun exposure. The sun, the primary source of life's energy on earth, remains mostly vilified by medical science.

</comment></comment></comment></comment><comment><USER7> An earlier study [i] concluded " _Vitamin D insufficiency is highly prevalent in severe COVID-19 patients._ "

[i] [https://www.medrxiv.org/content/10.1101/2020.04.24.20075838v...](https://www.medrxiv.org/content/10.1101/2020.04.24.20075838v1)

</comment><comment><USER8> I've seen several studies finding similar patterns. I also notice the general media has said nothing about this Vitamin D link.

Also interesting to note that African Americans have been hit very hard by covid. This is also a group that is well documented as having higher rates of Vitamin D deficiency. Generally people with darker skin living in higher latitudes have greater D deficiency rates.

<comment><USER9> Hum, Portugal, Japan, South Korea and China (with a really low deathrate for their population), all eat lots of fish... many african countries and australia have both lots of sun and depend on fish also for their diet.

Spain, eat lots of fish also... but maybe food served on hospital and home retirement was not so equilibrated and many of those people were on other medications that could break the intake before.

Is a promising idea

</comment></comment><comment><USER10> indonesia people are smokers as well

[https://www.economist.com/science-and- technology/2020/05/02/...](https://www.economist.com/science-and- technology/2020/05/02/smokers-seem-less-likely-than-non-smokers-to-fall-ill- with-covid-19)

<comment><USER11> I've spent a lot of time there.

Yes, the smoking culture is similar to the West in the 70's.

But more important, it's a very hot and humid country, so urban people do not go outside to walk more than a block, and if they do, it's with long sleeves, hijab, etc.

So they're not getting Vitamin D from sunlight in the larger cities.</comment></comment>


Faceplanting: an app launch horror story with a twist - <AUTHOR>

http://taptaptap.com/blog/faceplanting-an-app-launch-horror-story-with-a-twist/ <comment><USER2> This has already been submitted: <http://news.ycombinator.com/item?id=2837709></comment>


Ask HN: Developers to Designers - <AUTHOR>

There's many intro tutorial to becoming a developer on the web that I've ran into. Any many designers eventually take on development work, even if it's just html/css. I would love some pointers for developers that wanted to learn how to design. Tips, resources, etc.. anything is welcome. <comment><USER2> The first step (which many don't realize oddly enough) is that design is merely thoughtful solution to a problem. You're already a designer if you're a competent engineer.

The next step is identifying the tools you wish to solve problems with (of which there are several when people think 'Designer'):

\- Graphic/Visual Design: Key concepts to learn are the Layout Principles, Art Principles (Shape/Color/Contrast/Proportion), The Gestalt Principles (Continuation, Proximity, Similarity), Color theory. All of these aid a viewer/customer/user in navigation or action. DO NOT CONFUSE WITH GRAPHIC ART.

\- Interaction Design: Key concepts are Goal-oriented design, personas, basic cognition etc. All of this can help you design a better transaction between a user and your project, or make a more learnable system through action. This is a pretty broad field with deep reaching repercussions if used effectively.

\- User Experience Design: Very much related to the prior subjects and relies on them heavily, focuses more on the final results of the transaction and less on it's construction/execution. Ultimately should satisfy the question, "Was the experience positive, and will they return?"

Another very important thing to realize is that each of these areas have principles, systems, tools, and patterns much like the things an engineer may already know. This is not a discipline of fluff and touchy-feely 'creativity' where answers are plucked from the ether or some magic hat. I feel that making that clear when I'm teaching someone new to the discipline makes the entire thing less daunting since it's a rational process and not a talent based pursuit…

I hope this helps!

</comment><comment><USER3> HackDesign ([https://hackdesign.org/](https://hackdesign.org/)) is an awesome resource for the developer to designer transition. They have hacker-friendly tutorials by professional designers.

</comment><comment><USER4> [http://themeforest.net/](http://themeforest.net/) is my favorite. As a developer, I'll find a template I like for < $25 and use it as a base. I'm a big fan of twitter bootstrap templates but there are a lot others.

To me, it's the same as anything else. Practice, Practice, Practice. I've been doing this for 2 years now and I've started to develop my own designs without needing a template.

Even just looking through what designers are doing is a great source of inspiration.

</comment><comment><USER5> See: [https://medium.com/what-i-learned- today/bad8cdb67068](https://medium.com/what-i-learned-today/bad8cdb67068)

</comment><comment><AUTHOR> thanks for all the replies.</comment>


Show HN: My implementation of Google's bug prediction algorithm - <AUTHOR>

Hi, everyone!
I'm a high-school student. I saw that blog post about bug prediction on Google Engineering Tools blog (<http://google-engtools.blogspot.com/2011/12/bug-prediction-at-google.html>), and today I decided to implement it in Python, just for fun.
It's buggy on some repos due to issues with GitPython.
<http://pypi.python.org/pypi/bugspots>
Anyway, what do you think?
I know, weird title: character limiting. <comment><USER2> had a look at the code (specifically version 1.0). a couple of comments.

first it's not bad! much better code than when i was your age.

second, you have a huge assumption, i think, at line 73 where your code has "repo_age = int(time.time()) - first_commit_time". this assumes that the repository has seen edits recently, but think about a repository that has been dormant for a few months. the score of any bugfix will go down but there's no reason for it to: did bugs get fixed - and less "hot" - when the repo was dormant? no. what you need to do is to find the total timespan of the repository, looking at the min and max times of the commits, then base your scores on that.

keep up the good work!

<comment><AUTHOR> Thanks for your comment!

About your concern: I too think it's strange but they put it clearly in their blog post:

"The timestamp used in the equation is normalized from 0 to 1, where 0 is the earliest point in the code base, and 1 is now (where __now is when the algorithm was run __)."

I could do `repo_age = commits[0]["time"] - commits[-1]["time"]` but I'd like to stick to what the blog post says.

<comment><USER3> (I'm the author of the original blog post/algorithm)

For Google, this makes sense, although I see now it's a weird idiosyncrasy outside of the Googleplex :)

Google has changes all year round, so "now" always represents a day of some changes. The algorithm is run on the entire code base, so now is a perfectly normal spot to go with. It didn't occur to me that really what now represents is "last time of changes". This is a good spot, and I'll put it in the paper I'm writing! Thanks!

A reasonable/desirable modification is probably for now to be changed to represent the last change, just like the first change is when the normalization window begins. (0 = time of first change, 1 = time of last change).

HTH.

<comment><AUTHOR> Thanks for clearing that out, I now remember that "50% of the Google codebase changes every month."</comment></comment></comment></comment>


Reverse engineering 3D printer protocols - <AUTHOR> http://layer0.authentise.com/reverse-engineering-3d-printer-protocols.html <comment><USER2> Don't most of the consumer 3D printers use some sort of open source software? I wonder what he is reverse engineering.

</comment><comment><USER3> This article makes no sense at all.</comment>


Patriot Act amendment needing a warrant for browsing history fails - <AUTHOR> https://www.theregister.co.uk/2020/05/13/us_spying_laws/ <comment><USER2> [https://news.ycombinator.com/item?id=23172870](https://news.ycombinator.com/item?id=23172870)

</comment><comment><USER3> Actual terrorists(like 9/11 type, well funded) know better than to even touch anything digital for comms. They literally get a drone strike for having called a known terrorist or for going to a wedding other terrorists with cell phones go to.

For home grown terrorism, how many school shootings happen when the people who know the shooter literally tell police/fbi beforehand about the state of the shooter. Are school shooters not terrorists? They have a social/political gripe and the terror is their way to get their voice out, avenge (like jihad) or inflict change. So why are they failing so bad even after almost 20 years of patriot act?

Politicians don't want to be blamed because they know the next terrorist attack will happen soon and it can't be prevented,except the politicians that gut the patriot act will be blamed for it. On the flip side,information on voters,tracking them like this helps politicians

<comment><USER4> > Actual terrorists(like 9/11 type, well funded) know better than to even > touch anything digital for comms

Shit like this is said all the time on HN with absolutely nothing to substantiate it.

<comment><USER5> I do stats for a living, and while I think it's good to back up claims with data when possible, inductive reasoning is still a validate tool for understanding the world.

The logic is that active, dedicated terrorist groups already know: "They literally get a drone strike for having called a known terrorist or for going to a wedding other terrorists with cell phones go to."

The reasoning that knowing this information you would be very careful about what you communicate over the internet is very sound to me. To convince me that this reasoning is incorrect would require an abundance of data to the contrary.

<comment> kube-system If terrorists know not to touch digital comms, then how would they get caught by being at a wedding with other terrorists with cell phones? Do terrorists use cell phones or not?

The claim directly conflicts with the supporting anecdote.

<comment><USER3> Both, they adopt. This isn't a video game you get to beat after figuring out the enemy, unlike games real life enemies adopt to your tactics.

</comment></comment></comment></comment></comment><comment><USER6> When we look at the kinds of things these surveillance powers are used for, it's a glimpse of how it's abused. Thanks to FOIA requests, we found that the Boston Regional Intelligence Center was using their surveillance capabilities to spy on Occupy Boston during the Boston Marathon that was bombed, despite the ostensible aim of the center being to coordinate local and federal intelligence capabilities and despite the FBI receiving a tip from Russia that the Tsarnaevs were up to something. If we want to make the world safer, we should focus on making responsible and strategic use of the intelligence we have than to grant new powers.

[http://www.justiceonline.org/unaware_of_tsarnaev_warnings](http://www.justiceonline.org/unaware_of_tsarnaev_warnings)

<comment><USER7> There is probably also an issue of too much information. All these massive efforts generate data that is barely ever used as the time and resources just aren't there.

<comment><USER8> Reminds me of how back in 2003 we were cracking jokes about how the FBI was still making their way through the 2000's 4chan posts.

</comment></comment></comment><comment><USER9> I would be surprised if many of the common public believed that warrantless searches of anyone are reasonable, while exempting federal elected officials from the same law.

Now's a good time to call you senator (if they voted against this) and tell them that they fucked up by weakening your rights and freedoms.

Then, get a VPN or better use Tor as much as you can.

<comment><USER10> But political candidates are not exempted. That leaves a huge area for abuse.

<comment><USER11> They're voting on an amendment to exempt candidates for federal office from warrantless surveillance. It is expected to pass.

That way, the executive branch can tamper with state and local elections with impunity.

The supreme court just heard oral arguments in a case where Trump's lawyers argued he was allowed to shoot people for no reason in public. (Really. This is not hyperbole.)

Presumably the next step is to (perhaps selectively) cancel elections (or some ballots) because "emergency", and then refusing to step down if the resulting impeachment somehow succeeds (which it won't).

<comment> streb-lo I think your last point is a bit of a leap, but I agree we have seen constant undermining of the institutions built to make the United States a free country during this administration.

What I find most interesting is the complete hijacking of a large portion of the conspiracy crowd such that this is all permissible to them, as long as it keeps the Other out of the power structure.

<comment><USER11> I'm not sure it's that big of a leap. Gore won the vote in Florida, but the courts installed Bush. The ballots were illegally transported from Ohio to Indiana and back, and then favored Bush in 2004 in a way that was a statistical anomaly. Both those elections were the first I can remember where the exit polls didn't match the outcome of the election (and the bias was only in crucial districts in swing states).

2016 was a total catastrophe of an election. The courts intervened in one primary earlier this year, in bid to get a conservative judge elected. That backfired, fortunately.

The Senate is intentionally blocking funding for election security, and now, with COVID, they're refusing to provide funding to allow mail in ballots in many states.

Some of the leaders responsible for underfunding the election have publicly said they are withholding the funding because the republicans will lose if there is high turnout this fall.

</comment></comment></comment></comment></comment><comment><USER12> A point from _Enlightenment Now_ that I wish was better understood.

Groups that use terrorism to get their way almost always fail. This should not surprise us. Terrorism is the last available option for a weak interest group that has no better way to make their will felt. Therefore as scary as it is to face, the fact that they are resorting to it is evidence that they are underdogs and we should not be surprised that they later fail.

Given that fact, the extreme efforts that we take to drive the nail even farther into terrorism is overkill.

<comment><USER13> > Groups that use terrorism to get their way almost always fail.

Totally untrue. When the US used atomic bombs to level cities in Japan, that was terrorism. The goal was to strike fear into the regime and the people for an unconditional surrender. It was not an attack against the military or government, it was an act of terrorism.

When the US uses drone strikes to blow up weddings, that's terrorism. They are not actively engaged in a military conflict, even if there is allegedly some 'terrorist' they are trying to kill.

The communist revolutions in various places heavily employed terrorism.

<comment><USER14> I actually think there may be a legitimate criticism here if you define demonstrating nuclear weapon/asymmetric warfare capability as employing terror toward political ends and stop there. I'd tread carefully there though. That's a lot of sensitive history you're coloring with a rather unattractive brush. There is a lot that prevents that particular viewpoint from being convincing without dragging down a lot of the framework of Western political discourse, however, to the point you may find astonishingly few people willing to entertain it. In the West, it is generally accepted that application of violence is justifiable. Those examples you called up fit within that justifiable envelope, in the first case, near unanumously, and in the latter case, it fit enough for majority buy in, but with significant controversy as well.

Point being, the label of terrorism in the eyes of Western political discourse necessarily connotes violence of an unjustifiable or unsanctioned by the majority nature. I'm curious on your view of the Civil War. Would the secession and war waged by the Southern States (or by the Union retaking them) also qualify as terrorism?

<comment> streb-lo > Those examples you called up fit within that justifiable envelope, in the > first case, near unanumously

I don't think this is true at all. Maybe if we define the West as America, but even then I think that's a stretch. I can say anecdotally in my circles that the trading of unwitting Japanese civilian lives en masse in exchange for American military lives is looked on with disgust.

<comment><USER15> I also think it's important to be aware that much of the available intelligence at that time and reasoning behind it was classified, allowing the perpetrators to establish a narrative that went unchallenged for decades. For instance most Americans are completely unaware that the Japanese were actively trying to negotiate a surrender before Hiroshima was bombed. Most Americans are unaware that a ground invasion of the Japanese mainland was not being seriously considered, this ignorance let the government establish the false narrative you allude to. And most Americans aren't aware that American leadership intercepted communications indicating that the Japanese intended to surrender unconditionally if the Soviets entered the war, which happened on the day that Nagasaki was bombed.

<comment><USER13> We had to murder them is still what's being taught in schools today. In the USA, the ends always justify the means. CIA Black Sites? Indefinite detention? Extrajudicial assassination of citizens? Torture?

It's okay, these people are terrorists and don't deserve any rights.

<comment><USER14> I'm sympathetic toward your reasoning; and Floegipoky also makes a good point as well.

I've become increasingly uncomfortable with the power that classification confers to the executive branch to shape the national discourse; but I don't know as that will realistically change without an unprecedented shift in Congressional _and_ Executive sentiment.

As to the narrative still being taught in schools; I certainly don't have a great answer for that one either.

We have to teach them something, and you certainly don't have the most room within a child's worldview for being able to address the type of nuance the historically correct narrative creates without difficulty. At least that is the assumption I'm led to by assuming that there is a compelling reason the "System" has converged on the solution it has (locking the knowledge outside of normal curricula, and requiring extra independent digging to get at the truth of it, notionally done on the student's own initiative once they get older).

You run into the indoctrination outcome more often than not; but you should have an eventual consistency effect over the timescale of generations. That doesn't seem fundamentally unreasonable to me. Pain in the ass? Yes. Fraught with hazard to the stability of the national identity? Assuredly. However, if we respect that we the Citizenry represent the standard bearers of national truth, then we must be the ones to change the history books; just as those who came before us did.

Keeping society moving along is a lot of work.

<comment><USER13> > I certainly don't have a great answer for that one either.

Would you be okay sending your children to an education establishment that was pro-Nazi? Probably not.

Start treating the system for what it is: evil. Quit letting meaningless current affairs dominate the political dialogue. Speak out against the war criminals.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> As a practical matter who do they get this "browsing history" from? I see a lot of people suggesting folks use a VPN.

But if they're getting the history via companies like Google, they'd link together your records just as easily.

I see VPNs often being touted as anonymity tools, when it's my understand not all VPNS have multiple users sharing one IP.

(Ex: it's my understanding that an Algo VPN might obscure your geographic location, it's an IP unique to you. Not clear on how a commercial service like Tunnelbear works - many services tout no logging but seem to stay mum on if IPs are shared)

If any of the above is incorrect, please feel free to jump in and reply but it looks to me like moving as much browsing over to Tor as possible is the best move if you're worried about _anonymity_ and not simply someone owning the wifi you are connected to.

<comment><USER17> Pseudo-anonymity is sufficient for those whose life is not in danger (like a journalist or dissenter). Personally identifying yourself to websites is an optional use of the Internet, as is participation in ad networks such as Google and Facebook. You are correct that ad networks have more information than your ISP does. The VPN will protect you from your ISP. Pseudo-anonymity is what protects you from ad networks.

An easy implementation is to provide no personally identifiable information while using the web, and siloing the personally identifiable information when necessary. 1 email for your bank accounts and unemployment registration that uses your real name. A variety of differing emails and logins for all other websites.

<comment><USER16> >You are correct that ad networks have more information than your ISP does. The VPN will protect you from your ISP.

So to be clear, they'd get the data from the ISP? I'm not surprised DNS queries get saved but whole URLs is another thing.

I guess I shouldn't be surprised, but I am a little bit, that they'd expend the $$$ to store that info longer than necessary for core business functions.

>An easy implementation is to provide no personally identifiable information while using the web, and siloing the personally identifiable information when necessary. 1 email for your bank accounts and unemployment registration that uses your real name. A variety of differing emails and logins for all other websites.

I do this + throw the banking and personal email into Firefox containers.

Guerillamail is really useful for creating stuff like a HN account though it's sadly abused often enough many sites won't let you register using it anymore:

[https://www.guerrillamail.com/](https://www.guerrillamail.com/)

(The other issue being requiring SMS auth after an initial signup)

<comment><USER17> It became legal for ISPs to sell their logs during the beginning of the Trump administration. I began using a VPN consistently at that time.

</comment></comment></comment></comment><comment><USER18> No one should accept the state's justifications on the basis of terrorism for expanding its surveillance powers. Terrorism from the middle east comes from US imperial intervention there, if they wanted to stop "terrorism" they would stop terrorizing the middle east. Instead, expansions of the police agency powers are probably aimed at surveiling political targets that have become disfavored.

The bait and switch the USG loves to use, and in fact all governments love to use, is to point to a (possibly nonexistent) external enemy and use that to scare the population into accepting ever increasing authoritarian measures domestically.

</comment><comment><USER19> I'm curious at how the article implies that DoH is going do anything. I'd imagine CloudFlare, etc. would comply with FBI requests just as much as your local ISP.

Factor in co-operation from CDN's and really that covers a vast array of data that the US Government could access.

<comment><USER20> For one cloudflare is a lot more reputable than most US ISPs. Cloudflare explicitly says "We committed to never writing the querying IP addresses to disk and wiping all logs within 24 hours." [https://blog.cloudflare.com/announcing-1111/](https://blog.cloudflare.com/announcing-1111/)

If gov tried to force CF to change that they would likely put up a huge public legal fight to prevent it whereas ATT / Verizon and Comcast would bend over backwards to secretly comply while also simultaneously seeing if they could inject some ads into the pages you visited.

<comment><USER21> Does CloudFlare have multiple external auditors verifying their claims?

<comment><USER20> Literally the next para in that blog - "we committed to retaining KPMG, the well-respected auditing firm, to audit our practices annually and publish a public report confirming we're doing what we said we would."

In addition Mozilla put them through a rigorous process when selecting them as their default DoH provider which included them contractually agreeing to adhere to their stated policy. [https://wiki.mozilla.org/Security/DOH- resolver-policy](https://wiki.mozilla.org/Security/DOH-resolver-policy)

</comment></comment></comment></comment><comment><USER22> Committing the initial capital to form a FEC recognized national political party "The Privacy Party" to begin direct opposition to this and related activities.

If you are interested in collaborating or learning more:

[https://theprivacyparty.org/](https://theprivacyparty.org/)

<comment><USER23> What is the purpose of this party given the Libertarian party already exists and has ballot access in all states?

<comment><USER24> The libertarian party also considers taxation to be unethical confiscation of private property, and advocates for the privatization of most-to-all government-provided services. If either of those are anathema to you, its hard to vote Libertarian.

</comment></comment></comment><comment><USER25> I don't understand. Isn't the surveillance program illegal? Wouldn't this be passing a law that would require the government follow the law?

Serious question, I was under the impression this was equivalent to warrantless wire tapping, which was already illegal.

<comment><USER11> The executive branch (under GWB, Obama and Trump) has argued the law is ambiguous. Since congress just considered this amendment and rejected it, it will be harder for the Supreme Court to rule that the executive branch misinterpreted the law when it concluded that 100% digital surveillance is OK.

We already have secret courts and indefinite pre-trial detention in the US. This is another small step in the creation of a police state.

The precedent this vote created only took 37 votes in a chamber that is skewed much further right than the electorate. It would take about 55% of the vote to get the senate to be 50% democrat. That would give them enough procedural control to stop this sort of thing (if they bothered; they didn't under Obama...)

This is not democracy in action. This is democracy in its death throes.

</comment></comment><comment><USER26> Define 'your' browsing history. Where I live you can buy a SIM card with cash, load it with credit and surf on a 3G/4G network, without having to register the SIM or attach your legal name to it in any way.

I can also encrypt my phone, turn on permanent incognito mode, disable Javascript, and have uBlock Origin running to stop trackers. Good luck trying to pin my legal name to a particular website visit. Then there's the fact that 3G/4G uses vague carrier-grade-NAT IPV4 addresses so countless others all share the same IP address enabling you to 'hide among the crowd' (providing the useragent is something common that many people use like Safari on an iPhone5)

<comment><USER27> > Where I live you can buy a SIM card with cash, load it with credit and surf > on a 3G/4G network, without having to register the SIM or attach your legal > name to it in any way.

Where is that? My experience in Europe and Thailand is that I have to sign documents and show a proof of identity.

<comment><USER28> In Europe "I'm sorry, I didn't take my passport with me, but I remember my passport number" has had a 100% success rate for me.

<comment><USER29> So then you're committing fraud or whatever. Once again, law abiding people bear the burden while bogeyman-with-beard just gives a false number.

One of the general difficulties with the government threat actor is that law abiding people have to thread the needle of both technical protection and legal requirements.

<comment><USER30> Quoting your own true passport number is not fraud. Fraud would be supplying a fake passport number / fake passport / doctored photocopy.

<comment><USER29> I was responding to the implication that you could just give a fake number.

</comment></comment></comment></comment></comment></comment><comment><USER31> Between Https and VPNs, this seems ineffectual for people who actually want to stay hidden. Am I missing something?

<comment><USER32> Metadata such as what domains/ip's are contacted can still be harvested.

<comment><USER33> And remember: metadata is everything. It makes the actual content of the communication discoverable and indexable. The information of what you're saying and doing is not actionable without being able to find it / categorize it at scale.

</comment></comment></comment><comment><USER34> That's unfortunate. What's Bernie's excuse?

</comment><comment><USER35> I'm a bit impressed how close it was to passing.

<comment><USER36> Don't take that for actual closeness. In many votes including this one, Senators may want to vote against leadership but will only do so if permitted. So if, say, 5 more Democrats had insisted on voting yes to make the amendment pass, McConnell would have told 5 more Republicans that they were disallowed from voting against it, and the amendment would have failed by... one vote.

The dynamic here is that Republican politicians often want to present themselves to constituents as being against the police state or big government, but the party/party leadership wants to pass measures such as this. So the individual politicians are accommodated to the extent that they don't interfere with the party passing what it wants.

You see a similar dynamic in quite a lot of votes.

TL;DR: McConnell knows how to count.

<comment><USER35> I don't doubt the premise can happen, I am not inclined to assume it is the case automatically.

</comment></comment></comment><comment><USER37> FYI, no warrant is needed to set up a pen register on a person of interest. That's where LEOs request that the Post Office record the envelope metadata of all your correspondence.

ISTM that pen registers not requiring warrants is reasonable -- I'm not sure it's good for society, but it is reasonable.

ISTM that keeping track of cleartext metadata emitted by personal devices on the public Internet is exactly like a pen register.

DNS w/ QName minimization, DoH/DoE, and preferably DNSCurve, are techniques that can reduce the visibility of various metadata involved in gathering browsing history.

</comment><comment><USER38> So, this amendment lost by one vote, and Bernie Sanders didn't vote. Does anyone know what happened? I've understood him as having been against most of the Patriot Act since its inception.

<comment><USER39> Perhaps it's because Section 215 is already expired and Sanders doesn't plan to vote for its renewal, so he doesn't see a point in voting for an amendment that makes said renewal more likely to pass?

</comment></comment><comment><USER40> It only needed a single additional vote to pass and Bernie abstained

</comment><comment><USER41> There is a typo in the title. Should be "amendment".

<comment><USER2> Fixed now. Thanks!

</comment></comment><comment><USER42> I am _absolutely_ no fan of Bernie Sanders. I disagree with him on a majority of policy matters.

However, this popular media framing, which blames the failure of this amendment on Bernie Sanders, is unhinged. It's not just this Register article; you'll see the same sniping at Sanders specifically in most articles that carry a negative opinion on the PATRIOT Act.

Being absent for the vote is shameful, sure. But how about laying the blame somewhere more meaningful? For example, on us Californians who re-elected Feinstein despite knowing she is absolutely abysmal on privacy. Californians like myself _should_ carry this shame, not Sanders and Vermont voters. We Californians are sorry for voting so blindly and continuously re-electing terrible senators.

<comment><USER43> It failed by one vote. If he did his damn job and showed up it could turn out different.

<comment><USER15> As somebody else explained, if he had showed up to vote against it the amendment almost certainly would have still failed by 1 vote. The party whips would have just required one of the other "no"s to switch. The reality is that party leadership controls exactly what gets voted on and when, and to a large extent predetermines who is allowed to vote yes and no. The rest is just theater.

<comment><USER43> I must be obtuse, but if it's all a theatre what's the point of him being a senator then?

</comment></comment></comment></comment><comment><USER44> I do most of my browsing in private mode anyway. I'm usually pretty careful to never put things onto websites that I don't want people to find publicly as well. The US has no strong privacy protections, so you should just assume that nobody has your best interest in mind. This includes HN, Reddit, and the FAANG giants. Although Apple is probably the only one that isn't strongly incentivized to violate your privacy.

<comment><USER45> > _I do most of my browsing in private mode anyway._

What do you think "private mode" is, exactly?

I'll tell you what it is: It's a mode where _your local web browser_ doesn't save its history, which only means that people who has physical access to your device cannot see this saved history. Your ISP can still see everything of consequence, and your DoH provider can see most of it.

<comment><USER44> I think you may be overestimating the technical proficiency of the government. When they talk about browsing history, they're probably quite literally referring to looking at your web browser history. Yes, they might also subpoena your ISP for data, but if the ISP isn't collecting it in a way that is 100% correlated with your computer and browser (which is pretty hard with a NAT), then they only have a weak case at best. It probably wouldn't hold up in court.

<comment><USER46> I don't think you understand what's going on. Private browser has no visible difference to server or the party listening to your communication in the middle. The only effect it has is that it doesn't _persist_ your browser history upon closing it.

<comment><USER44> There's a big difference between what's possible in theory and the reality of current practices. I think many people in this thread are missing that point.

<comment><USER47> Missing the point that this is already going on? Or missing the point that the amendment to the patriot act didn't pass and that this will _keep_ going on?</comment></comment></comment></comment></comment></comment>


Ask HN: Founders whose startups failed, do you experience bias in interviews? - <AUTHOR>

Over the past few years I've been seeing a steady increase in the number of resumes that pass in front of my eyes that have the last job experience at 1-2 years with the title "CEO" or "President" and this very much signals "failed startup".
Several of us who are part of the hiring process (note: we're all programmers) find ourselves having to try and ignore certain biases we've been noticing:
"Oh, failed company, they must not be very good..."
"Is someone who's used to being boss of the company going to handle taking orders?"
etc. And the bias appears to be worse the older the applicant is (that's just a gut feel, I have no data to back that up).
Obviously these are false, and we take time to stop and remind each other of the many quality traits a startup founder brings (and the experiences a failed one brings as well!).
But, I'm curious if many of you have personally experienced these biases? Is this common? If you could tell someone in a hiring position something - with respect to this - outside of an interview setting, what would it be? <comment><USER2> Steve Blank was recently in Melbourne and said that his opinion was that 'experienced' was a better adjective than 'failed' for founders who have stopped working on a startup. It's a nice perspective.

Personally I agree, but would add a single caveat. I consider a founder 'experienced' when they have made a good faith effort to attempt solving a difficult/worthwhile problem. Someone who succeeds at someone pedestrian isn't terribly interesting and neither is someone who tried to build the hyperloop with paper mache for a week.

So, my advice is to ignore the title and give weight to the particular characteristics of their startup. The presence or absence of success is far less relevant than what they were trying to achieve and how they executed. I would pick someone who got to 80% of a home run over anyone who succeeded at hitting to first base. Ask questions about how they executed, the unique problems they faced and why they picked their vertical - this will tell you more about them than a snap judgement based on whether they were a CEO or a President.

On a side note, I would generally consider managing to found a company that survives for 1-2 years (full time) while tackling a hard problem as a demonstration of above average/high capacity. I would definitely look into them.

Again, depends on the context of your workplace, and the context of what they actually worked on.

Hope this helps.

</comment><comment><USER3> Hopefully most people are aware that only one in ten startups succeed. That and often times a "startup" is really "me and my buddy hacking on some stuff on the weekends". It's actually the latter that bugs me more... calling one's self a CEO when you never had any employees (other than your buddy, who worked for fun & free beer)... it feels like it cheapens the title. Sure, call yourself a founder, absolutely... but CEO is a bit different.

</comment><comment><USER4> These people should have the good sense use titles that are subsets of their full roles.

      s/CEO/Sr. Product Manager/g
      s/CTO/Sr. Software Engineer/g

<comment><USER5> You mean lie on the resume / hide their level of responsibility?

That doesn't make any sense whatsoever (beyond being dishonest, it would likely be surfaced in reference checks and stop a hire).

I'd see the startup experience as very positive, assuming they could articulate why the startup failed and learned from the experience. There's many startup CEO's who would make (and are) great sales, strategy, or product leaders, and CTO's who would be great fits for engineers, architects, or engineering managers.

<comment><USER6> The best course is probably to use 'Founder'. You're not really a C-level executive until you have a company big enough to require one.

<comment><USER7> I opt for the less glamorous title owner/operator

</comment></comment></comment></comment><comment><USER8> I've only held two jobs since my startup, and my first job directly led to my second job. I know for sure that my failed startup experience was considered an asset in that first job because the company was very entrepreneurial minded. It was a very natural fit.

Before I ran a failed startup, I was a grad student who never actually graduated (albeit, a very good one who opted to start a startup rather than write a thesis), and before that, I was a failing high school teacher teacher. So I have a bit of a history of not achieving unambiguous success.

Honestly, it really comes down to how you sell your experience. If the interview has behavioral questions, your running a startup should give you plenty of good fodder to pull from. Know the role you're applying for and be able to succinctly explain how your skills and experience will allow you to excel. Ideally, have some quantitative evidence of your capabilities. Don't be a know-it-all; come in with great questions and be a listener. And hopefully you can frame your startup, and especially its downfall, in a positive light.

One last thing, my personal opinion, based purely on my instincts, is that although I was technically President and CTO, I feel most natural identifying my former role as "Founder" (with responsibilities and accomplishments outlined), because we never quite reached a stage where we truly had executive responsibilities that would translate to an established company.

</comment><comment><USER9> I was one of those 18-month CTOs. I just made sure to get past it very quickly in the phone screening and get to why I was looking for a job, the kind of role that I was best suited for, ect, ect.

IMO, the approach to take with such a candidate is to see if this is someone who needed to "sow wild oats," or someone who keeps making the same life mistakes over and over again.

I understand your bias that older candidates are the worst ones. They're the slow learners.

</comment><comment><USER10> Comments so far focused on bias in judging capability based on past startup results. I'd really wish see the other angle explored: "Is someone who's used to being boss of the company going to handle taking orders?"

When reviewing resumes do you expect the founder to just want to recover for a year before founding another startup?</comment>


Gmail extractor - Extract all email addresses from your inbox - <AUTHOR> http://giacomoballi.com/gmail-extract-email-addresses-from-inbox/#.UUsnf6XIik_ <comment><AUTHOR> 60sec for 12k emails. Does anyone have a benchmark reference? fast? slow?

</comment><comment><USER2> Uhm, I'm not going to enter my password.</comment>


How I made $40K in 16 days with a technical eBook - <AUTHOR> https://twitter.com/dvassallo/status/1216175468681940992 <comment><USER2> This has been submitted a number of times in the last ~24 hours:

[https://news.ycombinator.com/item?id=22024794](https://news.ycombinator.com/item?id=22024794)

[https://news.ycombinator.com/item?id=22026089](https://news.ycombinator.com/item?id=22026089)

[https://news.ycombinator.com/item?id=22028225](https://news.ycombinator.com/item?id=22028225)

[https://news.ycombinator.com/item?id=22031634](https://news.ycombinator.com/item?id=22031634)

<comment><USER2> Edit: It's much more than that, it seems:

[https://news.ycombinator.com/item?id=22024794](https://news.ycombinator.com/item?id=22024794)

[https://news.ycombinator.com/item?id=22028225](https://news.ycombinator.com/item?id=22028225)

[https://news.ycombinator.com/item?id=22031634](https://news.ycombinator.com/item?id=22031634)

[https://news.ycombinator.com/item?id=22034394](https://news.ycombinator.com/item?id=22034394)

[https://news.ycombinator.com/item?id=22037443](https://news.ycombinator.com/item?id=22037443)

[https://news.ycombinator.com/item?id=21888049](https://news.ycombinator.com/item?id=21888049)

[https://news.ycombinator.com/item?id=21944090](https://news.ycombinator.com/item?id=21944090)

[https://news.ycombinator.com/item?id=21971195](https://news.ycombinator.com/item?id=21971195)

[https://news.ycombinator.com/item?id=21984824](https://news.ycombinator.com/item?id=21984824)

<comment><USER3> [I mostly agree, but you have some repeated links in your list. I count only 5.]

</comment></comment></comment><comment><USER4> Spoiler: there is a lot of up-front work before those 16 days started.</comment>