Apple's no internal client syndrome - <AUTHOR> http://rant.monkeydom.de/apples-no-internal-client-syndrome <comment><USER2> This really is quite true. iOS development is moving at breakneck pace and the API quality is starting to show.

Most people outside of mobile dev don't know this, but when iCloud shipped in iOS5 the API support was woefully not ready - heck, even Apple's own 1st-party apps that exploit iCloud had notorious syncing issues. To this day iCloud + Core Data support is buggy, poor, and more or less undocumented (the go-to guide for using it is a thread on the forums dozens of pages long full of angry devs and overwhelmed Apple engineers).

There are a number of rather egregious bugs still in the API today that date from iOS3, including one date parsing one that any iOS dev worth their salt has run into first-hand - every time a new release happens people circle back and are continually disappointed that major, easy to hit API bugs are left unattended for so long.

It really does seem like Apple is having trouble keeping up.

I remember when the iOS4 beta came out for developers - it was an incredibly solid beta, and the OS was stable and highly functional months before it was due. Compare with iOS5 and iOS6, the betas of which have both been notoriously buggy, crashy, and downright unusable _right_ up until release. Devs have had to struggle with horrible stability and broken APIs in all beta builds right up until the day the GM drops.

It could be worse. Definitely not the worst API I've ever touched. But still, troubling.

<comment><USER3> As the post mentioned, game developers aren't really interested in the platform. As a result, they file less Radar reports and Gamekit continues to be buggy. I'd really like to see Apple up the ease-of-use of Radar (or something new).

It's becoming a trend that iOS devs are forced to struggle with the ecosystem, but like I've been saying, from my experience the revenues are strongly tilted in favor of iOS. While we complain about certain aspects of iOS, on a whole, (at least from anecdotal evidence) it's still better than the problems that other platforms face.

<comment><USER4> That may be true today but in a business that moves this fast you have skate ahead of the puck. And the quality of the engineering I'm seeing on Google's side in the last few releases of Android impresses me a lot more than anything I've seen come from Apple since iOS4.

My hunch is the sheer volume of Android sales and Google's engineering edge is going to turn the tide but external factors could trump all.

<comment><USER5> What engineering are you impressed with on Google's side? I'd love to see examples of things to help me erase my painful memories of developing on Android around 1.5/1.6/2.1.

<comment><USER4> Fragments and the ActionBar. The new holo styles and interface conventions. The flexibility of layouts and the way that activities work. There are some rough edges, to be sure, but it all seems a lot more forward looking than Apple's miniaturization of Cocoa.

<comment><USER6> I agree that the flexible layout approach is pretty nice (and obviously we're seeing Apple move towards this direction with autolayout), but I'm not a big fan of the fragment API. They sounded better in theory than they've worked out in practice, IMO.

The inability to nest fragments in other fragments makes doing certain things like fragment based tabs or viewpagers rather awkward. And since the fragment lifecycle almost but doesn't quite match up with the activity lifecycle, some extra careful bookkeeping is required to make sure state is transferred properly upon rotation since the entire thing gets destroyed and recreated.

Anyway, the biggest problem for me on Android is that although the new APIs in 3.0 and 4.0 are pretty sweet, I can't use most of them due to having to maintain compatibility back to 2.2 (Froyo). ActionBarSherlock and the compatibility library help a bit, but it's not quite the same.

<comment><USER4> Which APIs specifically are you missing that aren't in the compat libraries? I agree that Google should be putting in more effort here and not leaving it up to a third party to come up with a backported action bar implementation but so far I've had pretty good luck with the compat libs.

I also agree that there are some rough edges in the fragments API but it's nothing like the mess that view controller containment is on iOS.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> I think there are two seperate issues we shouldn't mix up: On the one hand Apple is moving at such a quick pace, that there is less time for quality control, and many bugs stay even between major releases.

On the other hand Apple has never been good with networking software. For example, File Sharing is slow and used to be very unreliable. The built-in FTP support in OS X was a joke. Sending files with iChat on AIM often failed. Mobile Me was never really successful. More recently there is FaceTime, where my Mac just randomly fails to connect. Every time I synced bookmarks with iTunes between Safari on the Mac and on my iPhone I ended up with duplicates on both devices. And now we have iCloud syncing, which is incredibly unreliable.

<comment><USER8> > Sending files with iChat on AIM often failed.

iChat still regularly fucks up Jabber.

</comment></comment><comment><USER9> Absolute truth. The more obscure the piece of software in the Apple kingdom, the worse it is. Their OS X server product alone is so unbelievably ratty it single-handedly defeats the notion that Apple doesn't ship garbage.

Apple's best code is in the space between Cupertino and new money. Everything else tends to lie fallow.

<comment><USER10> Dude, as an _internal team_ trying to get OSX Server support was a joke. The answer was never anything other than crickets or "next major rev, maybe."

</comment></comment><comment><USER11> There is a similar problem for users of non San Fracisco Bay Area maps.

There is a general problem with non-SF parts of the world as well. I've noticed that many web apps work better in San Francisco than anywhere else the country. The situation in other parts of the country is different. For example, Houston has much more geographic dispersion per capita. The concentration of VC money in the SF Bay Area means that other parts of the country don't benefit from "eat your own cooking" as much. I think there's an opportunity there.

</comment><comment><USER12> There are problems but it's not all bad. Sure, some of Apple's technology pushes have turned out to be half-baked, especially those which seem to be more marketing or management driven, such as iCloud syncing, and of course the subject of this article, Game Center. On the other hand, Apple has added some nice incremental improvements recently which will no doubt make life considerably easier once everything is running on iOS 6 as the minimum. Examples include the UIView "auto-layout" system, NSAttributedString support throughout UIKit, UICollectionView, and so on.

Things aren't all _that_ different from the OS X days, where there was often a mixture of good and bad. Letting Apple know when things aren't working right is the first step to improvement.

<comment><USER13> Even iOS 5 adds a _lot_ of niceties for developers. I am absolutely in love with storyboarding and so are the non-programmers on my team.

And as badly designed Game Center may be, I have been playing Letterpress all day on it with only one hiccup. It can't be _unusably_ bad anymore on iOS6. The author of Letterpress found nice words for it too[1].

[1] [http://www.cultofmac.com/197905/tweeties-creator-has-a- new-i...](http://www.cultofmac.com/197905/tweeties-creator-has-a-new-ios-game- called-letterpress-and-its-all-about-words-review/)

<comment><USER14> Storyboarding strikes me as an example of another problem; it's very nice, but so poorly documented that it can be unclear how to do anything non-trivial with it. There are also a few deficiencies which require ugly hacks.

<comment><USER13> I think the award in that category goes to NSIncrementalStore :) I could often guess what I had to do in an overridden method...but in some places, I am still scratching my head.

</comment></comment></comment></comment><comment><USER15> This article and the comments on this thread run into the same problem as the "maps are broken!" arguments did - Apple's overall reputation is mistaken for its actual track record. They have always had their problems, as had other software developers, and everyone just selectively piles on something at some moment in time.

With the release of Letterpress, a spike in Game Center activity has brought about some talk about how it sucks/breaks easily, and thus Apple's overall QA is going down the toilet.

Criticism is healthy, but let's not forget that the past was not at all perfect or ideal.

<comment><USER16> I tried to introduce my gf to Letterpress last night. Game Center stumped us. It wouldn't send an invite (email? Apple ID?) and we both wound up connected to strangers, which was totally confusing. And it looked like some sort of online gambling interface, which didn't help.

<comment><USER17> _It looked like some sort of online gambling interface, which didn't help._

Nails what's horrible about it, thank you. I've always disliked its aesthetics but never realized before why it feels so _extremely_ inappropriate.

</comment></comment></comment><comment><USER18> Apple would get a huge benefit from integrating their UI code bases, Cocoa and Cocoa Touch. I and a lot of other developers dream about the day Apple will deliver a modern and saner Cocoa implemented with CALayers.

If that happens they'd have the resources needed to properly fix these issues that haunt us all.

<comment><USER19> With well over $100 billion in the bank, their problem isn't one of resources.

<comment><USER18> They may have a lot of money in their bank accounts. But be sure, there aren't a lot of available developers capable of producing high quality objc code.

So yeah, they need all developers they already have in other to fix their code bases instead of throwing shiny new features just to capture the markets attention.

People say things like you said thinking that by just throwing money at developers problems automagically vanish. In reality, that's not how real engineering solutions are developed.

</comment></comment></comment><comment><USER20> Well, Apple's Chess app now supports Game Center in Mountain Lion, so at least there's some hope there.

</comment><comment><USER21> I'm thinking now I should write an internal client for my APIs. I admittedly don't have one, and it would show me what's wrong with them.

<comment><USER22> yes. Absolutely. This is the number one rule of writing APIs.

If you use an api of any kind, from open-source code API's, to proprietary black box HTTP api's -- you can _definitely_ tell when the api developers have a strong understanding of the use cases, and when they don't. The best way to get a strong understanding of the use cases is to write a client.

This is what "dog fooding" means.

</comment></comment><comment><USER23> GameKit was written by the designer to solve a use case: His kids, playing in the backseat without, "Daddy, can you setup the game?"</comment>


'Geek Girl' gamers are more likely to study science and technology degrees - <AUTHOR> https://www.surrey.ac.uk/news/geek-girl-gamers-are-more-likely-study-science-and-technology-degrees <comment><USER2> > It also found that 100 per cent of girls in the study who were already in > PSTEM degrees were identified as gamers. However, the same could not be said > for boys where a similar amount of gamers existed regardless of degree type, > leading to thoughts that boys experience far less pressure to conform to the > video gamer stereotype if they were studying a PSTEM degree.

That's a very strange train of thought. Those girls that basically said FU to all the traditional gender roles by getting educated in technology now show 100% conformity to vague expectation that STEM student is a gamer, which is funny because students know not everyone of them is a gamer.

</comment><comment><USER3> My positive summation of both the paper and the article.

Strong correlation found between women that identify as GEEK GIRL GAMERS and Women Who Study PSTEM.

Statistically insignificant correlation found between MALE subgroubs GEEK GAMERS and MEN THAT STUDY PSTEM.

Suggested implication is that given [PRESUMPTION; Supporting Scientific Evidence Exists] that due to Underlying PERSONALITY Substructers people who vary at the extreme from their group norm along one dimension of measurement GEEK GIRL GAMER are more than likely to also vary at the extreme of another form of measurement Women Who Study PSTEM.

This suggests [PRESUMPTION; Further Scientific Study] that due to Presumed underlying PERSONALITY Substructions women [= specifically] who that have an interest or apptitude for in gaming are likely to have an apptitude of interest in PSTEM.

Possible Application that it MIGHT Be beneficial to encourage exposure of young women who have an interest or talent in the field of Gaming to PSTEM, as research suggests women and girls that identify or show an interest in Gaming are LIKELY have to have an Aptitude and or Interest for PSTEM.

</comment><comment><AUTHOR> Actual paper: [https://www.sciencedirect.com/science/article/pii/S074756321...](https://www.sciencedirect.com/science/article/pii/S0747563218304862)

</comment><comment><USER4> >The studying of physical STEM degrees is dependent on level of social deprivation.

Dont have access to the paper to see any more of this. Is that social deprivation increases STEM participation or decreases it?

</comment><comment><USER5> Geek anyone would at least stereotypically be likely to study science and tech.</comment>


Vasili Arkhipov - <AUTHOR> http://en.wikipedia.org/wiki/Vasiliy_Arkhipov <comment><USER2> Interesting tidbit: when I describe my Soviet and early post-Soviet childhood to Americans, Americans of my age are surprised that their fears of Soviet nuclear attack, civil defense training ("duck and cover"), were not unique. "Whoa, you thought we were going to nuke you?! We thought you were going to nuke us." A popular (not very politically correct by US standards!) Soviet joke of this time conveyed the cynicism around the idea that once a nuclear war began, humanity would have any hope--

Armenian Radio ([http://en.wikipedia.org/wiki/Radio_Yerevan_jokes](http://en.wikipedia.org/wiki/Radio_Yerevan_jokes)) was asked: "what do to if a nuclear attack is imminent?"

Armenian Radio responded: "wrap yourself in a linen sheet and slowly, in organized fashion, without creating any panic, crawl to a cemetery."

To paraphrase War Games (a classic which I watched only after coming to the US), the winning move is not to play."

</comment><comment><USER3> This is another interesting story about a Russian who may have saved the world: [http://en.wikipedia.org/wiki/Stanislav_Petrov](http://en.wikipedia.org/wiki/Stanislav_Petrov)

<comment><USER4> Yup in 1983. Thanks to both of them. Petrov is still alive, so you can send him a Hallmark card if you're over 30 and glad to be alive.

[https://en.wikipedia.org/wiki/Stanislav_Petrov](https://en.wikipedia.org/wiki/Stanislav_Petrov)

<comment><USER5> Do you have his address?

<comment><USER4> The thread is two years old, but it is a start. Let me know if you have any luck. BTW, someone in the Reddit thread points out that cash sent through the mail _will_ be stolen, so if anyone wanted to send him money, we'd have to me more clever about it.

[http://www.reddit.com/r/AskReddit/comments/dkear/can_anyone_...](http://www.reddit.com/r/AskReddit/comments/dkear/can_anyone_find_the_address_for_stanislav/)

</comment></comment></comment></comment><comment><USER6> Oh look, another title edit that adds nothing and takes away from the original title that actually told us why we should care about Vasili Arkhipov. Get it together, mods!

<comment><USER7> Out of curiosity, does anyone know what the original title was?

<comment><AUTHOR> It was "A guy called Vasili Arkhipov saved the world", a quote from a former NSA director, taken from the first paragraph of the article.

</comment></comment></comment><comment><USER8> It's a lonely and sad thought that the biggest heroes whose immense sacrifices and contributions to the well being of everyone around them are celebrated by... the blissful ignorance of everyone else.

Except in movies. There, we get to see and experience it all.

<comment><USER9> It is also a scary thought that a decision on nuclear war was/is in the hands of a few individuals.

<comment><USER10> It still is. Most nations' Commanders in Chief (i.e. the Presidents) have the power to order a nuke launch by themselves. Of course they have advisers and so on, but that does not mean they have less of a power.

<comment><USER11> Under US protocols, only the President can _authorize_ the use of nuclear weapons, however the Secretary of Defense must _also_ approve the use.

<comment><USER10> > Under US protocols.

I wasn't only talking about the US. There are many other countries in the world who own nukes and where their usage protocol is different.

<comment><USER11> Interesting factoid: The US made it's PAL (permissive access link) technology available to other nuclear powers, _including enemies_ in order that _they_ could secure _their_ weapons against unauthorized use.

Which makes _everyone_ better off.

<comment><USER10> How many are using their technology as well, then ?

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> I was lucky enough to learn about this in high school - Andover. I forget the speakers name but he gave the speech between 2001 - 2005 (I can't remember). It was an incredible speech about Mutually Assured Destruction and how the theory was absurd. The speaker pointed out that no one thought that we would exit the Cold War without a horrible war. And then he asked, "Why did this not happen?" He pointed to Vasili's example as to how one SANE person can make a difference. He talked about several other examples. He ended the speech by repeating, "PEACE. PEACE. PEACE." At the moment I thought it was cheesy... but here I am more than 10 years later and I still remember it.

<comment><USER13> > At the moment I thought it was cheesy... but here I am more than 10 years > later and I still remember it.

Incidentally, I think that's what good parenting looks like.

</comment></comment><comment><USER14> It's a shame that we have gotten ourselves to a point where we must rely on the level headed decision making of so few people to keep us from annihilation. To say 'saved' may be a bit premature. It's more of a shame that we have created such monstrosities with the gifts of technology and have kept them around and continue to threaten our very own existence with them. Here's to hoping for cooler heads and compassion to always prevail, for all our sakes.

</comment><comment><USER15> [https://www.youtube.com/watch?v=4VPY2SgyG5w](https://www.youtube.com/watch?v=4VPY2SgyG5w) is an hour long documentary about this man and the incident he is famous for

</comment><comment><USER16> _" Three officers on board the submarine [...] were authorized to launch the torpedo if agreeing unanimously in favor of doing so. An argument broke out among the three, in which only Arkhipov was against the launch."_

Opportunity for a playwright to write a really tight two scene piece there. Doubt if we could get it up to 50,000 words[1] even if we did the 'follow three scenarios with multiple endings' trick, and even if we had the Bobby Kennedy/LBJ dynamic in the committee going.

Edit: The K-19 'incident' would have made a major psychological impression on _anyone_ , even allowing for the high threshold that I imagine Soviet navy commanders of that era had.[2]

[1] [http://nanowrimo.org/](http://nanowrimo.org/)

[2] [http://en.wikipedia.org/wiki/Soviet_submarine_K-19](http://en.wikipedia.org/wiki/Soviet_submarine_K-19)

<comment><USER16> [http://www2.gwu.edu/~nsarchiv/NSAEBB/NSAEBB75/](http://www2.gwu.edu/~nsarchiv/NSAEBB/NSAEBB75/)

Has the charts, photos, signals and some wonderfully unreliable reminiscences by crew members. (edit link has gone hence reply to my own post).

</comment></comment><comment><USER17> the guardian wrote about his story: [http://www.theguardian.com/commentisfree/2012/oct/27/vasili-...](http://www.theguardian.com/commentisfree/2012/oct/27/vasili- arkhipov-stopped-nuclear-war)

</comment><comment><USER18> Well, I'm glad the worst is over. It's chilling how many near misses there were. How many more near misses might we have endured, had the Cold War gone on, before the one not-any-kind-of-miss that would have destroyed human civilization?

<comment><USER4> I've been reading a lot of Bamford lately for obvious reasons. Apparently, the CIA, NSA, and Chair Force were quite provocative during the Cold War. Something like twenty US aircraft were shot down by the Soviets (over Soviet airspace).

<comment><USER19> I find it amazing the US officials thought it a good idea to drop small (trainer) explosives on a nuclear armed USSR sub during one of the tensest standoffs of the Cold War.

Is it only in retrospect that this seems poorly thought through?

<comment><USER20> They didn't just do it for sport, they tried to get it to surface and there aren't that many way to talk to a submarine that doesn't want to be found and is too deep to hear radio communications. They wanted the sub to surface, probably to enforce the blockade over Cuba. The captain of the sub erroneously decided that they're being attacked, because he had no communications with outside and didn't know what's going on. Arkhipov persuaded him not to rush and surface, and find out what's going on before firing.

</comment></comment></comment></comment><comment><USER21> An essay in the book _What Ifs? of American History_ (Robert Cowley, ed.) by Robert L. O'Connell, "The Cuban Missile Crisis: Second Holocaust," details what might have happened if Arkhipov had not been successful and the _Randolph_ had in fact been hit by a nuclear torpedo.

In the aftermath, the U.S. military executes air strikes on Cuba followed by an invasion. The Soviet forces obliterate Guantanamo with a nuclear strike, send nuclear cruise missiles at the incoming invasion force,and, most seriously, manage to launch two of the SS-4 missiles...one of which hits Washington D.C. and wipes out the entire National Command Authority. In response, U.S. forces execute the entire SIOP against the Soviet Union, an effort which gives "overkill" a new name.

The aftermath of "The Two Days' War" includes the near-extermination of the Soviet Union, radiation issues in large parts of the world, and a "nuclear twilight" causing worldwide food shortages and famine. Ultimately, the United States was viewed as the aggressor by the rest of the world, compounded by the actions of President Richard Nixon (elected in 1964, replacing Acting President John McCormack). The U.S. stood alone in refusing to join the Geneva Convention for the Abolition of Nuclear Armaments in 1966, and renounced UN membership in 1968, ordering the organization out of New York City. The American public felt Nixon had taken the wrong turn, and elected Eugene McCarthy to succeed him in 1972.

The essay is written as the report of an investigative commission written in 1972 and finally declassified in 2002, in part by the actions of U.S. Archivist Newton Leroy Gingrich (who never went into politics in this timeline) at the New Capital District in Cheyenne Mountain, Colorado.

</comment><comment><USER22> Should we extend Petrov Day to him too? [http://lesswrong.com/lw/jq/926_is_petrov_day/](http://lesswrong.com/lw/jq/926_is_petrov_day/)

</comment><comment><USER23> Holly Molly, I live 1 mile far from this guy's last home(which was in Kupavna, Moscow region, a place where Russian air defense command resides)

</comment><comment> guard-of-terra Vice Admiral is hardly "a guy", while I'm not sure he had this rank at the time of incedent.

<comment><USER24> he was a flotilla captain, 2nd in command of the boat, but in command of two others, according to the WP article.

</comment></comment><comment><USER11> Спасибо, товарищ.

<comment><USER23> KGB watches you, tovarisch!

</comment></comment><comment><USER25> We read about this 7 months ago...

[https://paste.xinu.at/hVamTs/](https://paste.xinu.at/hVamTs/)

</comment><comment><USER26> Great story, but not really tech related

<comment><USER27> From the Guidelines [1]:

 _On-Topic: Anything that good hackers would find interesting. That includes more than hacking and startups. If you had to reduce it to a sentence, the answer might be: anything that gratifies one 's intellectual curiosity._

[1] [http://ycombinator.com/newsguidelines.html](http://ycombinator.com/newsguidelines.html)

<comment><USER28> That basically translates to "any off-topic shit that the community and mods will tolerate". Shame on them.

<comment><USER29> This is pg's playground. You can play by his rules, or play elsewhere.

The best way of playing by hos rules is creating content that we would find interesting. It's a lot more fun than whining for everyone.</comment></comment></comment></comment>


'Plastic recycling is a myth': what happens to your rubbish? - <AUTHOR> https://www.theguardian.com/environment/2019/aug/17/plastic-recycling-myth-what-really-happens-your-rubbish <comment><USER2> The only way to make recycling work is to make the waste worth something. It works well with beer and wine, with a deposit, 95%+ of beer/wine waste gets recycled. If tossed, the deposit is enough to induce street people to return the old container for the deposit. Going a step further, I propose all items sold have a dual bar code. One part is the point of sale (POS) universal product code (UPC). I propose to add a serial number AND a buyer number to this. The serial number is for that piese of waste, the buyer number is whoever bought it. Buyer number is permanent, tied to you and your address. The tie between the purchase and the items number and the waste item will prevent counterfeit garbage being made to get the deposit. The potential deposit thief will not know what was bought and for how much or where, sso faked ecycle returns will fail. Now a can or bottle is onlt worth 5 o 10 cents and does not drive countefeiting which 50 cents or $1 would - unless the check sum of who/what/where is consistent with the item returned. Deposits need to be substantial, like 50 cents or $1 per item so the genuine buyer pays that when he buys it. The fee is large enough to motivate a high rate of return - which 50 cents or $1 will do. Recycling trucks will have bar code readers and each item must be scanned and the deposit credited to the buyer. The bar code will also allow the truck to divert each item into a category box where the items are all alike for best recycling practice. This will slow the process, but the process will be highly automated znc can be done while the truck moves, or back at a depot to keep truck mobility high. This means ALL packaging. All plastic bags are outlawed, only paper allowed. paper bags reinforced with jute or hemp (jute/hemp are fibrous plant used for rope or reinforcing bags because it biodegrades). All packaging will, in time, be fully identifiable as well as biodegradeable. With all plastic being capable of a detailed machine sort and segregation the waste plastic will all be of one type for bext ability to recycle. If someone tosses waste on the ground, the bar codes will identify who tossed it and he can either be fined or lose part of the recycle fee. Street people will be able to recycle items found on the street and will earn that fee. At 50 cents or $1 that fee will motivate street people strongly - might even cause fights?? Once an items is scanned as recycled, the cash goes to the buyer/reycler's account or the street persons one. Once this happens, the name is wiped from the system, but his cash remains as his deposit returned tax free, as it was his money in the first place. The street person also gets the $$ tax free

This sound like 1984, well, it is - in a way. We are heading down a globally unsustainable path with our trash. We either die of it, or we defeat it. Only people who die of it are 1984 casualties - those that recycle and get the $$ are not recorded, not taxed and are helping the world as we all must see the rising sea of trash needs to be dealt with rationally.

<comment><USER3> Instead of all that complexity, why not just expand the small deposit to other items as well? If people are willing to gather bottles for the deposit, let them gather other plastic waste as well. In fact, it could be as simple as charging/redeeming based on weight.

<comment><USER2> People being larcenous, it needs both a carrot AND a stick to make it work. Simple cheap methods will allow shirkers to avoid the intent of full compliance driven by a high return fee with the bar code hoopla to defeat people who return fake old packages with only the bar code to identify it. With a 120 cent bottle worth 50 cent refund and inductry making fake bottle would soon emerge. NO? Yes. When they had a wolf bounty with a fee paid for each wolf killed, they said just bring us the ears = less weight. Immediately a fake wolf ear industry appeaed as civil serpents did not look closely at rotting stinking wolf ears returned. After a few months, the fraud was discovered. So the 100% link of customer ID, coupled with serial nunbered bottle ID as well allow an electronic system to verify the buyer, the product and the return. Of course the cutomer migth want to avoid this by having a friend buy it and toss the bottle, but then a street person would m find and return and would get the rebate, but that would also show who tossed it away and a $50 fine would go to the buyer. If they did not care about that $50, being rich dogs, then that fine would help the compliance business.

We must face the physical reality of our trash risks overwhelming our society - look at Italy, where local trash mafia build monster trash piles in the face of weak and crooked politicians. [https://www.google.com/search?q=italian+garbage+crisis&oq=it...](https://www.google.com/search?q=italian+garbage+crisis&oq=italian+garbage+crisis&aqs=chrome..69i57.6143j0j7&sourceid=chrome&ie=UTF-8)

<comment><USER2> I meant a 10 cent bottle worth 50 cents refund. Plenty enough to drive a fake bottle industry...</comment></comment></comment></comment>


Show HN: End-to-End Encrypted Cloud Storage. All Open Source - <AUTHOR> https://www.disk42.com <comment><USER2> What is actually modified since you cloned the Seafile sourcecode? I found this in the sourcecode:

           Impressum

<comment><AUTHOR> Please find our code base here: [https://github.com/disk42com/](https://github.com/disk42com/)

</comment></comment><comment> digital-rubber "All of our code is open source and can be reviewed by anyone. This guarantees maximum security."

Can be reviewed doesn't mean has been reviewed. Nor does it imply any quality of review, or the quality of the reviewers itself.

And the knife cuts on two sides, though only one side is mentioned, the one side that should attract users. Not the side, that every evil minded person can look through the source code, abuse it, before we were able to counter/fix etc it.

<comment><USER3> > that every evil minded person can look through the source code, abuse it, > before we were able to counter/fix etc it.

I think this is a worthy application of the phrase It's a feature, not a bug.

Closed source necessitates that the software hasn't been reviewed by independent programmers, only the authors.

Open source, while it doesn't necessitate that the software has been reviewed, it at least provides the potential for it.

<comment> digital-rubber In my opinion, it's misleading to advertise your application/products as 'security guaranteed' because it's open source and _can_ be reviewed.

The fact that something is possible to review, doesn't imply it will actually happen. See recent example issues of software like OpenSSL, Bash etc.

Though personally i don't see any motivation that would make me believe the open or closed choice is the better. They both have risks and costs, which you need to weight and make your choice upon. And most important accept the risks of your choice (, which you can of course try to minimise and should).

I _typo_ do cheer for any software you can choose to run/host yourself on your own network/hardware. And not be relying on another party to run and/or host it for you. (Which brings the additional security issues you can't control, physical access etc).

</comment></comment></comment><comment><USER4> I love Seafile, and am running it on my own VPS right now as my primary file sync/store.

I'd love for more companies to pop up offering hosted Seafile instances. Right now I'm hosting my own because I like having the guarantee that it won't get pulled out from under me or change the TOS in an unexpected way, but I don't like being my own sysadmin when things go wrong (not that things go wrong frequently -- the software is high quality and stable). If there were multiple competing providers it could form an ecosystem like Wordpress where the risk of bad actors is low because of how easy it is to pick up your data and move to another platform with a minimum of fuss.

However, based on the lengths disk42 has gone to to omit any reference to the Seafile project, it appears they aren't interested in participating in that ecosystem, which is a shame. I guess I'll just have to keep waiting.

<comment><AUTHOR> Currently we are settings thins up. In the future we will definitely participating in our ecosystem. You might be interested in this: [https://github.com/disk42com/disk42/blob/master/README.markd...](https://github.com/disk42com/disk42/blob/master/README.markdown)

</comment></comment><comment><USER5> The lack of positive, constructive feedback in this HN comments thread worries me. Come on people!

<comment><USER6> This is just a hosted seafile installation from an out-dated fork. Negative feedback is what this should get by all means, if only for being dishonest and evasive about the software used.

<comment><USER5> Then the comments should be both constructive and negative, explaining the situation like yours did.

</comment></comment></comment><comment><USER7> This is the pinnacle of bootstrapping or even the lean startup: Launch early. So early that they didn't need to code much, which is great! it is also great to see businesses growing (or trying to) around open source developments.

Doesn't anyone want to see Seafile further developed? If these guys get traction, they surely will have to chip in Seafile, be it with cash or contributing code themselves.

What's wrong with this, HN? Seafile could be great, but it's nothing if not implemented. Someone has to maintain those servers and take care of security. That's why SaaS does exist.

Why is no one asking questions about how they deployed Seafile? What are they plans to scale? Did they run any load test? Please, something interesting.

</comment><comment><USER8> Look great! Could you explain the differences to SeaFile whose code you built upon?

<comment><AUTHOR> Seafile is a great software we modified to fit our needs. At this point most of the changes we made to Seafile make sure that files are encrypted on the users device.

<comment><USER6> Seafile already lets users simply encrypt repositories if they want. What did you actually change, just made it default and obligatory?

</comment></comment></comment><comment><USER9> This is awesome. End-to-end encryption is the natural solution to the problem of universal surveillance as well as more mundane issues, like companies losing data and servers getting hacked. I think it's very elegant that one can build useful services with untrusted servers.

The algorithms for end-to-end encryption are there, but usability of actual implementations has been pretty terrible so far. For example, compare the usability of Gmail vs Thunderbird+Enigmail. Or compare the usability of Dropbox and Tarsnap. I've actually wondered why there isn't a good end-to-end encrypted Dropbox alternative that's remotely as easy to use. I hope this works out.

Beautiful, usable end-to-end encrypted software is the future. See, for example, Keybase, @moxie's Signal or Whatsapp. The only caveat is that writing secure software is really hard. I just made a disk42 account, but I'll treat it as a untrusted demo until it's had more test mileage and outside code review.

Also, curious:

* How do you detect changes in the synced folder?

* How do you do conflict resolution (if a file is edited simultaneously on two different client machines)?

* What algorithms, key sizes, etc do you use for the actual encryption?

<comment><USER6> See [http://freeplant.gitbooks.io/seafile-server- manual/](http://freeplant.gitbooks.io/seafile-server-manual/) and [https://github.com/haiwen/seafile-docs](https://github.com/haiwen/seafile- docs) , that's the software this provider uses.

</comment></comment><comment><USER6> What revision of the seafile components was used as base?

<comment><USER6> [https://github.com/disk42com/disk42](https://github.com/disk42com/disk42) == [https://github.com/haiwen/seafile/releases/tag/v3.1.7](https://github.com/haiwen/seafile/releases/tag/v3.1.7) (almost 2 months out of date)

[https://github.com/disk42com/ccnet](https://github.com/disk42com/ccnet) == [https://github.com/haiwen/ccnet/tree/dd3f1fab491dfcec8b8ca30...](https://github.com/haiwen/ccnet/tree/dd3f1fab491dfcec8b8ca30dbcc75b890cb3529a) (3 months out of date)

Looking at seafile-client at the moment, this reeks of an unmaintained and dishonest fork. They did not even bother merging encryption related changes from upstream. Stay away.

Code is sometimes commented out and sometimes marked with a "code42" comment.

</comment></comment><comment><USER10> Can I self-host this? If not, then how can I be sure that your server is running the version of the software in the open-sourced repo?

<comment><USER5> Why would you need to be sure of that?

<comment><USER11> Because they can say "hey look at our code here" when in fact they're running something else entirely.

<comment><USER12> But that does not matter if you trust your client and everything gets encrypted locally. That's the entire point of client-side encryption, not having to trust the server. Just review and then compile the client. And just self-hosting the server will not make you any saver because the client may be rogue and send your data to anyone.

</comment></comment></comment></comment><comment><USER13> Nice!

Since your imprint states you have your offices in Germany, I presume you are also hosting in Germany? What providers do you use?

</comment><comment><USER14> I just installed the Ubuntu client on Linux Mint 17.1. Ran into a dependency issue, but "sudo apt-get -f install" fixed it.

The client and the Web dashboard still need some work, which they alluded to in the introductory video.

Overall, I think this looks very promising. will wait and see what the next few months brings.

</comment><comment><USER15> Interesting project, but I'm rather wary that the claimed security could be attacked in a similar manner to Hushmail: [http://www.wired.com/2007/11/encrypted-e- mai/](http://www.wired.com/2007/11/encrypted-e-mai/)

</comment><comment><USER16> That raised fist has some political connotations in many places:

[http://en.wikipedia.org/wiki/Raised_fist#Logo](http://en.wikipedia.org/wiki/Raised_fist#Logo)

</comment><comment><USER17> With ubuntu client, is there a cli exposed? we use ubuntu servers for our infrastructure, it would be nice to deliver files from certain servers to non- techincal users, is that possible

<comment><AUTHOR> Thats not possible. At least not yet.

</comment></comment><comment><USER18> So this seems bold. I just cloned all the repos, thinking I'll try and dockerize the server end to see what it's like.

<comment><USER6> Watch out, the repos are out of date from upstream which is [https://github.com/haiwen/](https://github.com/haiwen/) . You probably want security fixes and updates from that...

</comment></comment><comment><USER19> Can you explain how the data is encrypted?

Why so you only support _Ubuntu_ Linux? It doesn't run on other distros?

<comment><USER14> I'm guessing they had to start somewhere, and that support for other distros will follow probably after they've implemented support for mobiles.

</comment></comment><comment><USER20> Typo on the main page: "At disk24 we believe in privacy."

<comment><AUTHOR> Thanks. Fixed.

<comment><USER21> May I suggest "At disk24 we believe in liberty"?

I know it's more heavy handed, but it falls in like with the Appelbaum quote "What we used to call liberty and freedom we now call privacy... and in the same breath we will say that privacy is dead."

</comment></comment></comment><comment><USER22> Logo is a floppy disk? seriously?</comment>


Illegal prime - <AUTHOR> https://en.wikipedia.org/wiki/Illegal_prime <comment><USER2> This is the "they're all just plants, man, they grow in the earth" argument of technologists. I wonder what goofy arguments accountants have.

If it wasn't obvious (for instance, because you've never implemented RSA before): _all information_ can be represented as a number (and I suppose, theoretically, as primes).

<comment><USER3> This article is the "they're all just plants" argument of technologists? I thought Wikipedia articles didn't have a point of view...

Anyway... what's wrong with the "they're all just plants" argument with regards (I'm assuming) to the completely absurd "War on Drugs"? How is that goofy? I don't think it's goofy at all. I think it's a fairly common-sense, level-headed reaction to the absolutely ridiculous idea that people need be protected from putting whatever they want into their own bodies.

<comment><USER4> First time reading Wikipedia?

<comment><USER3> Nope.

But I didn't see any argument put forth in this article that equates to the "they're all just plants" argument...

Care to point it out?

<comment><USER5> They're both appeal to nature arguments. "Tobacco should never be regulated because it grows in nature" and "Cryptography should never be regulated because it uses math".

There are plenty of reasons to be anti-DRM or pro-user privacy, but the "it uses numbers" argument is not a particularly good one.

<comment><USER3> OK, just to be clear: the Wikipedia article does not state this argument or really represent in any way.

I'm just not sure who the criticism was directed towards.

</comment></comment></comment></comment></comment></comment><comment><USER6> The budding discussion in these comments reminds me of the classic post "What Colour are your bits?" \- [http://ansuz.sooke.bc.ca/entry/23](http://ansuz.sooke.bc.ca/entry/23)

</comment><comment><USER7> This concept is dizzying for me.

Is it OK to think of numbers as a landmass? Is it OK to think of that numerical landmass to be partitioned and owned? Is it OK to hide things in private plots of numbers? Is it OK to expect your numerical plot to be private?

I'm not sure if I like it, or hate it.

<comment><USER8> Copyright and patent attempt to protect you from others stealing your research & efforts involved in producing a product. If someone represents your idea as a number, and then copies it with the intention of using it for their own purposes without coming to a licencing arrangement with you, then they have broken copyright / patent. It's incidental that the representation of the information is numerical. Additionally the likelihood of some other useful random number coinciding with the numerical representation of your special information is also extremely low - hence why the OP used a prime ( which are pretty common ), and also why it's interesting ( and therefore exceptional ).

</comment></comment><comment><USER9> What an interesting hack to publish source code! Read the first sentence of wikipedia quite a few times and still didn't understand, while the later text made it clearer..

</comment><comment><USER10> 'An illegal prime is a prime number that represents information whose possession or distribution is forbidden in some legal jurisdiction'

Maybe the coolest math term I heard all year.

</comment><comment><USER11> Yet another incredibly stupid idea. Thank you, legal system.

<comment><USER12> It's a stupid presentation of an arguably reasonable idea.

<comment><USER13> No, it is a stupid presentation of an even more stupid idea.

Numbers are abstract constructions devoid of any meaning. For mathematics to have any practical application, there are of course ways to assign meaning to numbers, but there are arguable infinite amounts of mappings that can match numbers to concepts. There are also infinite number of ways to match every number to every other... so, if you have enough computing power, it can be demonstrated that you could, at least theoretically, match every conceivable concept to every other.

The idiocity of the legal implications is beyond limits. The only legal defense to such enourmous liability is to restrict yourself, for your practical applications to sufficiently small numbers such that there is not enough entropy in them to hold any potentially forbidden information. Good bye IEEE754, hello PI==3!!!

<comment><USER12> Your analysis here is roughly isomorphic to the original presentation.

The law doesn't care about the actual bits, except insofar as they represent evidence of what's really at issue. The law cares that you have some pattern of bits that you laid out with the intent that it represent BAD THING X. If it happens to appear in the digits of PI you've been reading out, you're not at risk. If you go to others saying "You can find the BAD THING at offset XYZ in PI", then that's another matter - you've got the data _and the interpretation_. On the other hand, if you happen to stumble across one of these primes and don't notice, not a problem. The known "illegal primes" were found specifically by looking for primes that represented illegal things.

I'm not convinced that criminalizing possession of data is a good idea, but it's _not_ "under some arbitrary interpretation".

</comment></comment></comment></comment><comment><USER14> It's not the prime that's illegal, it's the prime + the connection to its ability to circumvent specific encryption.

The number itself without that connection is not illegal.

I.e. 123 is not illegal by itself. "123 is the encryption key to XYZ's DRM" is illegal.

</comment><comment><USER15> Fuck the legal system.</comment>


Ask YC: HN submissions feels like submissions on reddit post sale, do you guys feel the same way? - <AUTHOR> HN submissions feels like submissions on reddit after it was purchased by wired parent company. Do you guys feel the same way? <comment><USER2> I think what happens is that eventually there aren't enough "good" links out there that haven't been submitted, but there's still a demand to be filled. Newspapers keep "filler" stories around for that eventuality ("slow news day"). I think the same thing happens on social news sites - especially ones that grow - because the demand (for new stuff) eventually outstrips the supply (of good new stuff).

</comment><comment><USER3> Please pardon the way this sounds, I only aim to help: Lately, yes but continuously saying "this place is turning into Reddit" really doesn't help nearly as much as continuously posting the types of articles people come here to read.

<comment><USER4> Posting good stories and comments won't help if the quality of the community at large is going downhill. And what else would the falling quality of the stories and comments be a symptom of? No amount of "following the guidelines" or "only posting interesting stories" by the regular community will help if there is a swarm of other users who don't give a fuck.

If this development persists, history dictates that the old regulars won't hang around for long, which is really sad.

It's such a pain in the ass to drift around the internet like nomads, leaving for new territory when the locusts come to consume the places you know and love..

For the record, I do my best: I submit new stories when I find them and produce (presumably) useful commentary. And it works, for now, but I'm not very hopeful as to what HN will look like in a year.

<comment><USER5> That seems to suggest the next system should be designed to expressly counter this effect. Perhaps, allow groups to form and close themselves off, while still remaining on the site? Move to a different subsite (instead of a whole new site)? This might be a little more successful than trying to filter submissions in some way for some nebulous "quality".

<comment><USER6> The "funny" thing is that all these problems are not new. They are all manifestation of Eternal September <http://en.wikipedia.org/wiki/Eternal_September> Even the Eternal September itself was a reflection of a problem that happened earlier when USENET has grown beyond size where most people knew each other and quality of conversation went down. Alas I am not able to find the links for it, it would be really nice to find those complains.

The other funny thing is that there is a well-known way to preserve the comunity - maintain very strict set of rules and punish all deviations by a singular authority (THE Moderator) and his minions. Fidonet used to work that way and it worked very well. It only fails when The Moderator loosens the grip for even short time - the place gets overrun and can not be taken back. The problem is that any moderator will have a moment of weakness and so Fidonet got entirely overrun in the end.

The more things change the more they stay the same.

</comment></comment></comment></comment><comment><USER7> I like the extra level of filtration from reddit for postings that are relevant to what draws people to come to HN. I could care less if a posting was on reddit before it comes to HN.

</comment><comment><USER8> not really, but i do kind of feel like the majority of the submissions i see are from people trying to karma whore via automatic submissions of popular-ish sites

i feel like reading the new links area is like reading my feed reader.

which is unavoidable, and what i do to combat it is submit more quality things when i can find them, and be picky with my modding things up.

</comment><comment><USER9> Dude, give it a break already. Constantly crying about how HN doesn't suite your taste isn't going to make it any better and certainly doesn't raise the quality of the front page articles.

<comment><AUTHOR> I am not constantly complaining about HN submissions. I do submit good (the ones I think are good) links.</comment></comment>


Facebook Is Being Sued for Discriminatory Ad Targeting - <AUTHOR> https://motherboard.vice.com/en_us/article/43bxq9/facebook-sued-for-discriminatory-ad-targeting-housing-propublica <comment><USER2> Ad targeting is Facebook's entire business model...where was this outrage a few years ago? It seems like this lawsuit is just piggybacking off of the current "Facebook is evil" theme we've been seeing lately.</comment>


Belle II and the matter of antimatter - <AUTHOR> http://www.symmetrymagazine.org/article/belle-ii-and-the-matter-of-antimatter <comment><USER2> Nice article.

> At present, the SuperKEKB accelerator is successfully storing both electrons > and positrons to prepare for the tests that will lead to new experiments.

I couldn't help but read that as they are stockpiling electrons and positrons, maybe in a barrel somewhere. What do they really mean?</comment>


Brick–one of the world's oldest building materials–is having a moment - <AUTHOR> https://www.fastcodesign.com/90132880/6-radical-buildings-built-from-the-humble-brick?partner=rss&utm_content=bufferae45f&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer <comment><USER2> Brick buildings are dangerous invariably of the amount of reinforcement you put into their walls. Bricks can't take shocks, or shears. This is just how it is.

Even decorative only uses subject people to danger.

Large interlocking blocks are somehow better, but they are not bricks per conventional definition.</comment>


Why your company should have a very permissive open source policy - <AUTHOR> http://nathanmarz.com/blog/open-source-policies/

<comment><USER2> I found this article particularly prescient as I work for a large company that has an especially draconian open source policy.

We're not allowed to contribute to any open source projects, post about software, speak publicly, or report security vulnerabilities (either to the security community at large or even to the vendors).

I was part of a small (approximately 200 person) security company who got swallowed up by a large company about 4 years ago (who has since been acquired by an even larger company) and the intellectual property agreement we were made to sign after the acquisition was particularly heinous. In fact, it led directly to the resignation of my entire 12-person team (all except for me).

The consequence has been that we now operate as a sort of parasite in the security community. We make direct financial use of the efforts of the security community, but in no way give back anything. I most certainly wouldn't move to company with as restrictive an open-source policy as where I work now; if I were a more principled person, I'd probably have quit over it.

<comment><USER3> _if I were a more principled person, I'd probably have quit over it._

There's a middle ground: Fight to change it. I've had sufficient personal success in a large corporation (50,000+ employees) to convince me to stick around and keep pushing. But then again, I am in a position to head elsewhere should progress stall. Having that degree of security has been important in being able to speak dispassionately to the issues with our previous policy.

<comment><USER2> I'm envious that you were able to effect change in a company that large (we're some measure larger or smaller than that); and I wish I could say I had the optimism to continue giving it a go.

 _edit: vague-ified company size per DannoHung's suggestion (not particularly worried, but those could be famous last words)._

<comment><USER4> Your edit doesn't really make it very vague, still.

<comment><USER2> really? I'd think that "some measure larger or smaller" could apply to companies from several thousand employees to a million.

<comment><USER4> Yes, but together with the surrounding comments and the note saying something about "enhanced vagueness", it's still clear that it is probably bigger. (Unless he also changed the number.)

<comment><USER2> I suppose that's true, but I can't really think of a way to respond to his comment without mentioning that "large" is a relative term. The logical thing would have been to not reply, I guess; but I thought it was worth responding to.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> Contributing to open source doesn't just increase my _perceived_ value (which it definitely has in concrete terms), but it also increased my _actual_ value because I'm exposed to a much more competitive marketplace of ideas. Heck, even just using open source provides this benefit to some extent.

I consider myself a competent programmer, and I've definitely come up with some nice solutions to particular problems, but I've also been blind-sided by what in retrospect should have been obvious issues. I'm sure this happens less to great programmers, but even still the open cross-polination of ideas really makes up for the weaknesses in the human mind in remarkable ways. Within a single company there can certainly be many amazing minds and ideas, but even the biggest company has orders of magnitude less breadth of technical knowledge than the open source community.

</comment><comment><USER6> A few years ago, I was offered a job because they googled _java programmer australia_ and I was first (they told me in an interstate phone call). This could only have been because of my open source project.

</comment><comment><USER7> Sadly I've seen lots of re-invention of the wheel because battle-tested, proven, reliable component X that was available for FREE on-line weren't licensed under terms that were acceptable to a particular organisation. I think the benefits of a permissive open-source policy aren't just in the sense of satisfaction it can bring to the developers, but in real measurable dollar terms to the cost of projects.</comment>


Anatomy of a botnet: Rapid7 researchers dissect Skynet - <AUTHOR> https://community.rapid7.com/community/infosec/blog/2012/12/06/skynet-a-tor-powered-botnet-straight-from-reddit Researchers from Rapid7 (the company behind Metasploit, Nexpose, and Mobilisafe) dissected the malware and CnC infrastructure powering the Skynet botnet recently discussed in a Reddit AMA. <comment><USER2> "What the Skynet botnet creator realized, is that he could build a much stronger infrastructure at no cost just by utilizing Tor as the internal communication protocol, and by using the Hidden Services functionality that Tor provides."

This is not good, as this kills sinkholing the C&C. Add to that the ease by which this can be obfuscated from AV detection (it's already 15Megs of random data), and you'll have some storms brewing on the horizon.

Looking at the net as the weather, i have to say very recently it's been pretty stormy out. My mail server's been getting hit badly by spam that it hasn't in the past been hit by.

I wonder if the Tor developers could provide any insight on this. If i were them i'd be facepalming like "This is why we can't have nice things."</comment>