Mathematician Wins $3M Prize for 'Magic Wand Theorem' - <AUTHOR> https://www.livescience.com/breakthrough-prize-mathematics-2019-winners.html <comment><USER2> Maybe I'm overly annoyable right now but I was unable to find, in the first 20 or so paragraphs of fluff, a statement of what the theorem actually _is_ , and barely a hint of even what field it's in. Is there a better write up anywhere that actually talks about the math rather than trying to spin it into a soap opera?

Edit: found an explanatory paper on the theorem that appears more technical but still accessible with the right background: [https://arxiv.org/abs/1502.05654](https://arxiv.org/abs/1502.05654)

<comment><USER3> Numberphile to the rescue [https://www.youtube.com/watch?v=xhj5er1k6GQ&app=desktop](https://www.youtube.com/watch?v=xhj5er1k6GQ&app=desktop)

<comment><USER4> Rooms are 3D. Why is the problem drawn out in 2D and not 3D? What difference would it make?

<comment><USER4> I would appreciate it if the downvoters would answer my question. Thank you.

</comment></comment></comment></comment><comment><USER5> I wonder if the bit about it only working for rational angles would be better phrased as it not being proven for these angles yet? It seems strange that it would not work for one of these if you can get arbitrarily close to it on either side and have that work.

Then again there all a lot of strange things in mathematics and my only knowledge of this problem is from this article.

<comment><USER6> That's fair to say. Rational angles happen to make things easy and result in a problem which has connections with lots of well-developed areas of mathematics.

This paper [https://www.math.brown.edu/~res/Papers/intel.pdf](https://www.math.brown.edu/~res/Papers/intel.pdf) is mentioned in one of the Numberphile videos on the topic and it basically says this in the introduction.

</comment></comment><comment><USER7> Of course, knowing that the theorem proves that a room of mirrors is fully lit by a candle is totally worth $3M. /s

Seriously though, the article glances over the applications of such a theorem that make it so useful.

<comment><USER8> why wouldn't it be lit. the photons diffuse everywhere

<comment><USER9> You may be imagining a simple room. There are lots of polygonal rooms (with non mirror walls) where a candle in the center leaves dark areas.

It's not obvious (to me anyway) that it's impossible to construct a sufficiently pathological room of mirrors such that there is at least one dark corner.

<comment><USER10> It seems to me that the amount of lighting in the room will depend on (1) the luminosity of the candle, and (2) the interior volume of the room. Add all the mirrors you want, but you're not going to light a large area with one candle because you don't have enough light.

<comment><USER9> I don't know this research, but I think the candle metaphor shouldn't be taken too far.

The candle is probably more like a source of particles and the claim is that if the particles reflect off the boundary and you can send particles from every direction from the center, then you come arbitrarily close to any other point in the room.

Or something along those lines. Again I stress I don't know the research and haven't seen the paper and I'm just speculating.

<comment><USER10> > then you come arbitrarily close to any other point in the room

It looks like the claim is that all but a finite number of points are actually achieved. This is a stronger result -- you can easily prove from that claim that you can get arbitrarily close to any point (because a neighborhood of any radius contains an infinite number of points, and therefore contains a point that is achieved), but you can't go the other way. It's quite possible to be arbitrarily close to every point while failing to hit an infinite number of points.

</comment></comment></comment></comment></comment></comment><comment><USER11> This over-simplification of the theorem made me think of the theory of Light Field History. In the 15th Century, Leornado Da Vinci noted "The air is full of an infinite number of radiant pyramids". Later Michael Faraday gave his "Thoughts on Ray Vibrations", His ideas were intended to do away with the ether in favor of lines connecting the particles; light being the vibrations of these lines or rays.Today we know it "light field' as consisting of the total of all light rays in 3D space, flowing through every point and in every direction.

</comment><comment><USER12> So how can I design a building without doors with unilluminated spaces? What would it be like in such a space? How can we use this to design spaces where darkness is easily preserved in set spaces without adding materials? This sounds like a lovely concept for designing a temple of some kind. Or whatever building might have rooms set aside for practicing things in darkness, like playing with one's vision or learning to do chores in the dark.

</comment><comment><USER13> Is this related to visibility problems in computational geometry (like the art gallery problem) or am I being misled by the candle example?

<comment><USER14> Yes, it's the art gallery problem, but the walls are mirrors.

</comment></comment><comment><USER15> The paper was published in 2013

</comment><comment><USER16> Someone smart in math, does this have implications in elliptic curve crypto? From what little I know about EC key generation, it seems related.

<comment><USER17> I highly doubt it. Elliptic curve multiplication does involve "mirroring" the point around the curve, but it has nothing to do with real mirrors or specular reflections.

</comment></comment><comment><USER18> > Now place a candle in the middle of the room, one that shines light in every > direction. As the light bounces around the different corners, will it always > illuminate the whole room? Or will it miss some spots? A side effect of > proving the magic wand theorem, Eskin said, is that it conclusively answers > this old question.

This is a point light in the middle of a regular polygon right? Why is this noteworthy? Is it that the light settles on all points evenly? Is it in spite of some sort of phase cancellation thing?

<comment><USER19> To help people understand why this theorem is surprising, first rephrase it from "the candle lights the entire room (bar a finite number of points)" to "the candle can be seen from any position in the room (bar a finite number of positions)"

Next, don't think of "room"; that puts your mind too much towards simple, almost convex structures. Instead, think of the a floor of a building where all doors are removed.

For example, take the ground floor plan of the Pentagon, with its myriad of rooms and corridors, with all doors removed, and replace all walls by perfect mirrors. Is there a spot to place a candle so that it or it's reflection, reflection of a reflection, etc. can be seen from all locations in the pentagon, bar a finite number? The theorem says there is.

Now, feel free to make it harder: add back the doors, but don't completely close them, keeping a rational angle with the walls the door opening is in. Feel free to make the angles as small as you like.

Next, place room dividers wherever you want, as long as they are perfect mirrors, form rational angles with the walls, and don't completely close of some room or corridor in the Pentagon.

Do you think you'll be able to completely shield of at least one room, wherever that candle is placed? If so, you're mistaken.

<comment><USER20> That would make a great 2D game... You're given a floor plan at each level (with increased complexity/geometry) and you need to place the candle (light source) in a point where it will illuminate the whole floor.

<comment><USER12> I want to design floorplans with intentional shadow spaces.</comment></comment></comment></comment>


Facebook enters the age of accidental oversharing - <AUTHOR> http://money.cnn.com/2012/06/11/technology/facebook-oversharing-airtime/index.htm <comment><USER2> Facebook had discovered a very sweet blind spot in the human social awareness system.

One person posts a picture and a friend comments on it, then mutual friends (such as those who are oddly curious about the poster of the picture or someone in it) can take a quick glimpse at that person's life. This is rewarded by the brain with a small shot of dopamine.

This is a function not of the social graph itself (friend) but of the addictive nature of the fleeting glimpses it allows people to have of others.

Suppose you have 500 friends who each have several hundred friends. Some subset of those friends constitutes your "fascination graph". Maybe you think they are hot, maybe you aspire to their lifestyle, maybe you hated them in high school, etc. etc.

In order to continue to succeed, Facebook (and app makers) have to realize that it's not the mundane behaviors of your Facebook friends that are interesting... it's the allure of those on the fascination graph that generates the dopamine and the slot machine-addict kind of clicking that is gold to advertisers.

Facebook has managed to deliver this dopamine in a way that's not creepy (nobody has to go through anyone's garbage, etc.) so the question is, is it ever going to start to seem creepy?

<comment><USER3> It would get more creepy, the more media spins Facebook as a privacy nightmare and the more tech-minded users persuade their friends that Facebook is leaking everything, which they are not. There is a privacy problem but not to the extent most people wave hands about it.

It's funny when you think about it, in the earlier years, you had the network search tool. Basically all profiles were public and you could search based on age, country, gender, university... everything. I could literally narrow down searches to people on a street. Was it really more private then? No? Then what changed? At what point will privacy be fulfilled and can one really call it a _social_ network at that point?

There is Diaspora, if privacy is really what users want then, why haven't we seen a massive conversion to Diaspora?

<comment><USER2> I think you hit upon the gist of it which is that users don't care. The same could be said about users' general complacency about the tracking/storage Google does.

Users are generally right, it doesn't matter in most cases. No harm is being done... yet.

The general trend is toward services that do not make privacy optional and that require the users to accept a narrower range data collection and advertisement policies in order to use the service.

In time (maybe in 5-10 years) getting on the internet will require accepting terms that basically give up lots of privacy and anonymity. (My other prediction is that we'll see the return of interruption ads that cannot be skipped for nearly all content, or every 7 or 8 minutes during a typical internet usage setting).

The above is why investors are paying so much money for shares of Google and Facebook. Both are a combination of internet gatekeeper and data collector. Both are awaiting the right moment so they can enter the "last mile" business. In the meantime, the fact that users don't care is just gravy.

Incidentally, the most relevant consequence of this in today's world is that both firms are happy to do whatever powerful governments want. Facebook and Google are destined to become the next Halliburton and Ratheon as cyber warfare and terrorism loom large as threats to security and government finds itself horribly data-poor compared to private firms.

<comment><USER4> Users don't care _yet_. I think this will be looked on as a blip some time in the future. Once enough of the this generation has enough embarrassing or undesired information shared there will be a shift. They don't value the privacy yet because they haven't learned the value of it yet. I say give them time. Eventually they will learn that value and then the Facebook and company will have will see people wanting to control it.

</comment></comment></comment></comment><comment><USER5> From the article: "Oliver Cameron, founder of a private social network called Everyme, says most of the responsibility lies with developers. 'The apps that are implementing this could do a better job,' he says. 'The average Facebook user has no clue what they're sharing.'

I couldn't agree more with this sentiment. If we, the startup community, can't figure out a way of being transparent about our intentions with user's personal information in a way that makes sense to them, we will suffer a backlash. We risk facing a cultural shift where it becomes hip to "drop out" of a social online society.

This has already started to some extent as people become more aware of the risks of oversharing (as pointed out in the article) but it could quickly become more pervasive.

<comment><USER6> > We risk facing a cultural shift where it becomes hip to "drop out" of a > social online society.

And? While this might scare the sizable portion of HN readers who have money staked on social, I would see this as a net positive.

EDIT: No but really, besides the Arab Spring social media has spammed the world with cute cat pictures and eaten away at the blogosphere. The portions eaten away are subsumed into one of the competing walled gardens. The web wasn't designed to be an echo chamber.

<comment><USER7> I'm not sure why this was down-voted ... isn't "dropping out" just the extreme version of reduced usage? There was an article posted last week that described users as being tired of FB and that there was a 30% drop in engagement (I'll link later if I can find it).

</comment></comment></comment><comment><USER8> My biggest problem is that, last I checked, I don't have the option to prevent a Facebook app from auto-sharing things at the moment of installing it.

Instead, I have to agree to install it, _then_ go to my privacy settings, _then_ remove its permission to auto-share.

Nowadays I just refuse to install apps.

<comment><USER9> This is how I solved Facebook's over sharing problem: I don't use Facebook apps. If I need to, such as for business, I run it through a dummy account.

Had Facebook taken the path of not fucking around with privacy settings, I might be more open to Facebook's apps. However their intentions are clear, given events such as: automatically opting in to new email alerts even through I've disabled all other Facebook e-mail alerts, continually changing the privacy settings page resulting in the removal of past privacy options, allowing "friends" to add me to groups I wish to be no part of, un-hiding comments to my page which I have marked as either spam or offensive, and so on.

The end result is a Facebook which I use to look at photos and tell girls to Skype me and not much else. While I may notice these things right as they happen, for other non-technical users their happiness with Facebook slowly erodes away and they can't quite pin point it.

As Facebook continues to add more and more "noise", the chances of a competitor being able to beat Facebook at their own game increases.

While the analogy may be overused, albeit in a different manner, Google was able to beat Yahoo not only because it was a better search engine but because it had a lot less noise. While Facebook appears to be the Google of social networking, the sheer amount of "noise" in my news feed tells me otherwise.

(A note for users of both Facebook, Twitter, bloggers, etc: the amount of "noise" you produce is directly relational to how much people whose ideas matter pay attention to you. The friends who are over sharing get blocked from my Facebook news feed. The Twitter users that tweet about their cat grooming habits are un-followed. And so on. I am extremely cautious what gets posted to my feed, and when it does, people remember what I posted.)

<comment><USER10> Yep, me too. Those SocialCam videos are so enticing! I click but when prompted to install I resist.

It's so f'ing annoying that you can't even follow a link (like anything on Yahoo) without installing the app. I just do a separate Google search for the story title instead of installing the app. At some point there is less sharing going on. I'm more likely NOT to check out what my friend read because of this.

</comment></comment></comment><comment><USER11> Not just this... Facebook's _BASE_ privacy settings for basic sharing on wall posts/timeline etc are extremely counter-intuitive.

My girlfriend recently discovered that professional contacts here in a foreign country could look her up on F'book from behind their desks and see pictures from her college days during their meeting.

Should she have turned her photos private earlier on? YES

Did Facebook give her any indication they were so open? NO. In fact Facebook changed their settings numerous times and each time left different defaults.

Now she had to go through and make numerous settings changes, and each time she didn't really know how things looked to a non-friend logged into Facebook.

Ultimately I think she had to manually make EVERY album private to friends only.

Seriously if I wasn't so locked into Facebook I would be so out of there. Bastards have really abused our trust.

</comment><comment><USER12> It's completely up to the developers here. You have to know that you are breaking the trust of your users for a spike in traffic.

As an example, I no longer use Socialcam or Viddy after they defaulted to "frictionless sharing". They got a really nice spike from it, but it cost them my trust.

</comment><comment><USER13> Hell yes, stay off the wall.

That's the reason most people don't use Facebook login, they're scared it will put something on their wall.

If Facebook had any sense they'd force the API to ask permission and show the user what will be posted before it will do so. Maybe then people would be more likely to use Facebook login and give them that network effect advantage they're after.

<comment><USER14> > That's the reason most people don't use Facebook login, they're scared it > will put something on their wall.

You and your tech savvy friends are not "most people". Most people don't know and don't care.

<comment><USER7> But they do care when they're wall contains things they didn't plan to share. Curiously, I've seen this a lot with G+ and Picasa.

</comment></comment></comment><comment><USER15> It isn't accidental, Facebook chooses defaults that work for facebook ... not for the user. This causes people not to trust facebook, and because of that they're going to find it more and more difficult to monetize user behavior on the site.

They've been trying to sell users on sharing everything, but people want to share things on their own terms. Google _understood_ (hopefully they still do) this, facebook doesn't.

How can they do really great things with user data when the default attitude of their users is "I don't trust them with my data"? ... its a trick question ... they can't.

There's a reason why they say "You can shear a sheep many times, but you can only skin it once".

Will be fun to watch them try though.

</comment><comment><USER3> This is partly the fault of the user (yes, there is a dialog that says what exactly is going to happen, so the ignorance is there no matter how much you think the user is clueless) and mostly the fault of Facebook partners. Facebook partners and web companies with close relationships with Facebook get access to the Open Graph actions first (Spotify was in this group).

Thus, less experienced developers and lesser known companies follow the path these companies take and believe that this is how the Open Graph should be. There are many questions on Stack Overflow or the Facebook developers group from people inexperienced asking how to make articles automatically read when users arrive at their site (the news.read action).

<comment><USER12> It says that they are requesting the ability to share to your wall, yes, but most of our previous experiences have taught us that this means we will have an OPTION to do that in the app, not that it will do it automatically without you ever knowing.

</comment></comment><comment><USER16> Agree with the message of the article, but I feel as though it's a little out of date. Frictionless sharing isn't new, Facebook isn't "entering" this issue.

</comment><comment><USER17> Personally, I have been thinking that the illusion that people are perfect is flawed for a while now.

</comment><comment><USER18> Maybe this is the only way Mark Zuckerberg can keep his "Zuck Law" alive (sharing doubling every year), by forcing everyone's accounts to share more and more.</comment>


Actually Using the Database - <AUTHOR> https://bendyworks.com/actually-using-the-database/

<comment><USER2> Hmm, so almost every bit of logic is pushed to the database. The parts that are not pushed to the database are then delegated to Template Haskell. Not exactly sure what this demonstrates. Macros are good? Seems lacking in terms of what the actual payoff is here.</comment>


Reverse Engineering the Renault Zoe API - <AUTHOR> https://shkspr.mobi/blog/2016/10/reverse-engineering-the-renault-zoe-api/ <comment><USER2> This is also easy to figure out if you use MITMproxy to intercept the traffic between the app and the server/car. This way you can look at the content when it is HTTPS encrypted.

Do you know someone else with a Renault, so you check if you can change the VIN-number with the same auth? This was the problem with the Nissan "hack" that made it possible to control every car in the world.

<comment><AUTHOR> The "app" is just a web wrapper. I found it was easier to load up the JavaScript in a desktop browser and examine that.

I've not tried with someone else's VIN - although the auth process does show which VINs are associated with your account.</comment></comment>


Lions' Commentary on Unix 6th Edition, with Source Code - <AUTHOR> https://en.wikipedia.org/wiki/Lions%27_Commentary_on_UNIX_6th_Edition,_with_Source_Code

<comment><USER2> Note that the complete PDF of Lions' book, plus a complete source code listing, can be found under "External Links" at the bottom of the page.

</comment><comment><USER3> This was my first look at the insides of a real operating system. Small enough to really get your head around what was going on and even to try hacking on, but big & elegant enough to not be some toy. Good times.</comment>


On user program breakage from Linux kernel changes - <AUTHOR> http://article.gmane.org/gmane.linux.kernel/1414106 <comment><USER2> Puhh... Linus is known to be quite reckless and he may be right in essence, but the language... he might calm down a little and learn one or two things about social interaction.. there are a ot of ways to say what you want without plainly insulting someone over and over again.

<comment><USER3> > there are a ot of ways to say what you want without plainly insulting > someone over and over again

Sure, and in the above context they are less effective. So why would he care?

> he might calm down a little and learn one or two things about social > interaction

Why? What purpose would that serve? The LKML is one of the last few places where politically correct bullshit does not prevail. Communication is efficient and effective. There is no evidence that changing the tone would make it more efficient and more effective, but there's evidence galore that the opposite would happen. Experience has thought me that the only people hurt in the process are technical morons, and such people have no place in a technical discussion.

If someone cares more about the language or social niceties than about the correctitude of technical solutions they have no place in a technical community.

<comment><USER2> Writing a wall of text with insults and a low amount of real communiction is not effective. It's also nothing to do with political correct. Linus' second post in the mail thread is much more technical and much less insulting.. more effective.

<comment><USER3> On the contrary, reading Mauro's e-mails before and after Linus' post proves that it is very effective.

<comment><USER4> The only thing it proves is that people working at Red Hat have to deal with linus rage outbursts by the very nature of their jobs.

</comment></comment></comment></comment></comment><comment><USER5> As a Linux user, I'm happy that Linus is passionate about not breaking USERSPACE. Had I done something of the scale that Linus is pissed about, I would have expected a much worse reaction.

</comment><comment><USER6> There is only 2 rules in kernel development which you can't break:

1\. Kernel APIs to userland are always backwards compatible

2\. If you break something, you will take responsibility

If maintainer breaks both of those rules, how can you accept patches from him/her ever again? Remember that amount of patches handled by kernel core team is enormous, you have to able to trust subsystem maintainers at least some degree. In corporate world this would have caused immediate "clear your desk" reaction.

</comment><comment><USER7> Good project _must_ have passionate leader. Linus or Theo or Richard or Guido or Igor or Salvatore you name him..

Otherwise it will become a "kolkhoz". )

<comment><USER8> The unbalanced paren at the end of your comment really irks my OCD.

<comment><USER9> this is russian smiley. usually used like that )))))

</comment></comment></comment><comment><USER10> I can appreciate his enthusiasm, but that man is gonna have a heart attack one of these days.

He's right of course... Breaking semantics is bad.

</comment><comment><USER11> I wonder what he says when he's really angry ;)

</comment><comment><USER12> I wonder if they've fixed the various breakages of dup3 and the equivalent fcntl that I reported about 4 months ago?

<comment> iso-8859-1 Why are you not linking to your report if you want to know? Your post is almost useless as it is.</comment></comment>


1000s of times every month,we give governments information about Apple customers - <AUTHOR> from
https://wikileaks.org/podesta-emails/emailid/30593
I wanted to reach out to say thanks for the principled and nuanced stance the Secretary [Hillary Clinton] took last night on encryption and the tech sector. Leadership at Apple certainly noticed and I am sure that is true though out the Valley.
Please know that Apple will continue its work with law enforcement. We share law enforcement's concerns about the threat to citizens and we work closely with authorities to comply with legal requests for data that have helped solve complex crimes. Thousands of times every month, we give governments information about Apple customers and devices, in response to warrants and other forms of legal process. We have a team that responds to those requests 24 hours a day. Strong encryption does not eliminate Apple's ability to give law enforcement meta-data or any of a number of other very useful categories of data. <comment><AUTHOR> FYI Lisa Jackson's page at Apple: [http://www.apple.com/pr/bios/lisa- jackson.html](http://www.apple.com/pr/bios/lisa-jackson.html)

Apparently a board member of Clinton Foundation? Not sure how current that info is.</comment>


Regrets of the Dying - <AUTHOR> http://inspirationandchai.com/Regrets-of-the-Dying.html

<comment><USER2> I never know how much to attribute to these kinds of stories. It's easy to say you'd have risked more when you know you are about to die. For example, if you knew you were going to die in 2 months would you care about HIV? Would you care about pissing someone off? Would you care about planning for your future (ie, working and saving for retirement?), Would put any money in a savings account? Or save for that house? Would you stay in a stable job?

Once you are a just a few months from dying it's easier to regret things without fear because you know you're going to die soon. But when you don't know you're going to die soon then all of a sudden you'd likely make different choices. Choices that have few negative repercussions.

</comment><comment><USER3> Totally agree with all the premises here: more time with loved ones, be happy, etc. But to nitpick...

I've always wonder if this is _valid_. I think it's fairly established that people who are dying have these feelings, but is that to be the guiding principal for our lives? If I feel something else is more important for 30 years of my lifetime, am I wrong because in the last 10 years I regret it?

I'm not sure if the objective function of my life is to minimize regret, it seems much more complicated than that. Furthermore, I'm not convinced that incremental time spent with loved ones will do much to assuage the pain of not having felt like it was "enough".

</comment><comment><USER4> Posts like this always depress me. I spend all my time in class or working, and for no use - my last 8 months of work were removed last week due to a bureaucratic decision - not the first time, so I can't argue that my life has any purpose. I don't really have any friends, have had few opportunities to collect memories or feelings, etc. I'm about to graduate, move 1000 miles away and move on, so I sort of have this assumption that everything will change, but I know myself well enough to know that in all likelihood I will end up playing video games by myself every night.

<comment><USER5> Remember, a classic is something that everybody wants to have read and nobody wants to read. Spending time with family/relatives/friends is something that everybody wants to have done and nobody wants to do. Hard work is something that everybody wants to have done and nobody wants to do. Don't be afraid to just do what makes you feel good (unless it causes others significant trouble), regardless of what some sacred social convention dictates.

Remember also that the grass is always less brown on the other side. The moment you entertain the thought that some other situation would be better, you suffer. If you think some choice you made in the past was a bad one, it might be because you've only seen the consequences of the one option you chose. The other options might have been just as bad.

It's already hard enough to stay sane here on planet shithole _without_ romanticizing Things As They Aren't.</comment></comment>


Silicon Valley's Mirror Effect - <AUTHOR> http://www.nytimes.com/2014/12/27/opinion/joe-nocera-silicon-valleys-mirror-effect.html

<comment><USER2> I get that this is issue is very real, but the skeptic in me is wondering if there isn't an even greater related problem hidden here. If a certain group of people isn't fairly represented in silicon valley, then there are two explanations in my mind that could be contributing to this (not exclusively to each other). There could be a great deal of discrimination in this sector, and realistically there probably is. Alternatively, one could argue that something about our system of education and upbringing does not encourage women and non white/asian students to actively seek out jobs in that arena or to try and get seed funding for a company. Maybe I'm being ignorant here, but I feel like at this level, especially with the insatiable demand for real talent in silicon valley, this might be a bigger and more societal issue than just "Google et al discriminate against X." There is more that can and should be done to encourage diversity in the tech sector.

<comment><USER3> Regarding specifically the male-female gap, isn't the obvious explanation simply that these jobs select for extremely high IQ? (Men have higher IQ variance, so the further out on the bell curve you go in either direction - seeking geniuses OR seeking morons - you'd naturally expect to get mostly men.)</comment></comment>


Outlook Lite 10KB Svelte (MS Hackathon Story) - <AUTHOR> https://youtu.be/bTwSg4YKTr4 <comment><AUTHOR> Tanay Pratap talks us through the thought process behind building a tiny email client and serving markets where slow network connections are common.</comment>


Brain Simulation Promised a Decade Ago Hasn't Succeeded - <AUTHOR> https://www.theatlantic.com/science/archive/2019/07/ten-years-human-brain-project-simulation-markram-ted-talk/594493/ <comment><USER2> Is there any website, project or repository that keeps a track record of predictions/promises more broadly?

<comment><USER3> There's Long Bets, where people or money against their long term predictions

[http://longbets.org/](http://longbets.org/)

<comment><USER2> This is helpful, thanks.</comment></comment></comment>


Show HN: Calcflow, an open-source complex maths visualization tool in VR - <AUTHOR> https://github.com/matryx/calcflow <comment><USER2> Lately I've been wanting a VR tool that does interactive 3D projections of 4D geometry. It's already so counterintuitive, I'm curious if the additional information available when projecting to 3D rather than 2D would allow better intuition for 4D transforms, volume-as-surface, etc. For some reason 4D geometry has always been an annoying obsession for me, like an itch that I can't scratch.

<comment><USER3> Have you seen 4D toys ([http://store.steampowered.com/app/619210/4D_Toys/](http://store.steampowered.com/app/619210/4D_Toys/))? Its definitely a toy and not a serious visualization tool, but it still might help you build some intuition about 4D space.

</comment></comment><comment><USER4> From the readme it looks like the visualisation is off to the side in a self contained box. What I'd really want to do is have walk/fly through capability to visualise projections of higher dimensional data. Is this possible with your tool?

Second question: how many data points can a visualisation be before you start to see noticeable lag?

<comment><USER5> Hopefully this isn't the start of a trend where programs are made "VR-first" and the people who don't want freaky goggles on get left behind.

<comment><USER4> I partially disagree. Whilst I don't have VR goggles myself, and agree with you in that so far, I haven't seen a reason for the purchase at all. A tool like this for visualisations though, is a use case that I see as possibly beneficial.

With that being said, it has to be done right. Not only that, I'd expect to be 'VR-only', not even just 'VR-first'. A visualisation tool that I'm expecting would have difficulty conveying the same data on a flat screen. Sure, one could argue that you're still only looking into flat screens in the goggles, but the multiple axes of movement allowed by both the head translations as well as hand movements give you superior control vs just mouse input.

<comment><USER6> > Sure, one could argue that you're still only looking into flat screens in > the goggles, but the multiple axes of movement allowed by both the head > translations as well as hand movements give you superior control vs just > mouse input.

If you're looking at two screens with identical images, then that might be a valid argument, but VR headsets provide stereoscopic viewing by presenting different images of the virtual scene from each eye's viewpoint-- this is known as binocular disparity. It's the same principle used in 3D TVs and anything that requires you to wear special glasses.

The "head translations" you're talking about gives the visual system depth cues via motion parallax, where objects in the foreground appear to move faster than those in the background when the head is moved from side-to-side.

These two things together (stereoscopy and motion parallax) yield a very strong sense of "3D depth", called stereopsis. Having controllers with six degrees of freedom (6DOF: translation along and rotation about the x-, y-, and z-axes) to manipulate and interact with 3D data should be superior, as it is no longer necessary to map 2D mouse inputs to 3D operations which would also decrease cognitive load, in theory.

<comment><USER4> Thanks! This is what I was trying to get at, and provides a much better argument for VR-only and VR-first tools.

</comment></comment></comment></comment></comment><comment><USER7> IMO, an AR implementation of visualization would be more interactive than a VR. Overall, great job.

<comment><USER8> How would AR make this more interactive? I haven't seen one AR device with an interaction model as good as VR. I also don't know why you'd want to set the real world while visualizing data. Maybe so you could interact with it with other people IRL that are also wearing AR headsets?

<comment><AUTHOR> Calcflow team member here. We are working on something very special involving AR :) Should be released in coming weeks. We think EDU users may benefit greatly from AR collaboration.

</comment></comment></comment><comment><USER9> Very neat tool indeed!

Is there a binary I can download and run? I don't know what version of Unity you used so I don't really want to compile myself if I can avoid it :)

EDIT - Answered my own question, it's available from here: [http://calcflow.io/](http://calcflow.io/)

I'd suggest you put this on Steam, folks - chances are you'd make your $100 Steam Direct fee back fairly quickly.

<comment><USER10> Calcflow is available on STEAM [http://store.steampowered.com/app/547280/Calcflow/](http://store.steampowered.com/app/547280/Calcflow/)

</comment></comment><comment><USER11> Wow what a great idea, if you could interact with jupyter in tandem it might actually lead to more powerful data exploration.

</comment><comment><USER12> As someone building an open source data tool using VR tools I like it that people like CalcFlow are experimenting with this. this is my project: [https://github.com/zubairq/gosharedata](https://github.com/zubairq/gosharedata)

</comment><comment><USER13> FANTASTIC! Wish I could have accessed to something like this in my undergraduate journey

<comment><USER14> I agree that the project is cool. But I just want to give the answer that always aught to be given whenever someone on HN says "I wish we had X when I was learning this stuff", where X usually is some visual way of illustrating a concept. And that is simply that there really isn't any good substitute to learning mathematics to simply doing a bunch of problems with good old dry symbols. Visualizations are great, and they can aid intuition. But that is not the be all and end all. Struggle and doing a large number of problems really is necessary in order to internalize this stuff to such a degree that you maintain a deep understanding ten years after you were first exposed to it.

</comment></comment><comment><USER15> This is a great idea - it's like the medical demos they use ar/vr for but for engineers.

Someone should make a VR version for mechanical motions like that How to Make a Car course that was posted here a while ago

</comment><comment><USER16> The thing I most want from a system like this is low-latency update.

</comment><comment><USER17> Impressive to see that this was built in Unity!

</comment><comment><USER18> Sorry for the skepticism, but what's the advantage of this being in VR? Seems like a 3D visualization that I can see on a monitor / iPhone just as well?

<comment><USER19> No, not "just as well". It's a very well known problem that 2D displays create ambiguity in 3D visualizations.

</comment></comment><comment><USER20> What purpose does the custom license serve? Of all the hills to die on for a project with source available on Github...

> _This project is licensed under the NANOME VR PRODUCT SUITE_

[https://github.com/matryx/calcflow/blob/master/LICENSE.md](https://github.com/matryx/calcflow/blob/master/LICENSE.md)

\--

Digging a bit, it appears this is funded by an ICO, or at least created by a company currently running an ICO? Too bad that basically short-circuits to "smells fishy" to me right now; hopefully they can pull through and build a track record of credibility.

<comment><AUTHOR> Nanome Team member here. Can't blame you for the skepticism, the blockchain space is full of nonsense these days. We are, in fact, running a token sale for our decentralized R&D platform, Matryx. Calcflow will be one of the first dApps to integrate Matryx. By open sourcing calcflow, we hope to establish our commitment to open-access STEM and build said "track record."

[https://matryx.ai](https://matryx.ai)

<comment><USER20> Thank you for taking the time to respond.

Do you know why the project is released under a custom license, rather than something familiar? If this could be summarized in a few simple sentences I'd appreciate it. Ain't nobody got time to read all that legalese.

For example: is the purpose of the license to prevent commercial re-use? In other words: what does this custom license accomplish that no normal OSI- approved license could?

<comment><AUTHOR> The primary function is to prevent commercial reuse. We work with a lot of institutional and enterprise clients and it's a bit complicated to protect their purchase of our software while allowing others to modify the source + grant them free personal use.

</comment></comment></comment></comment><comment><USER21> This _requires_ a VR headset? No mouse controls?

<comment><USER22> It's a VR project, shocking.

<comment><USER21> Just wondering if it will or will not work with a mouse and a monitor. The application is still very relavent without VR.

<comment><AUTHOR> Not yet, but we agree. Would sure beat everything else that's out there.

<comment><USER12> I just posted on the main thread, but you can make your project work with mouse and keyboard as well as VR, as I have done with my project here: [https://github.com/zubairq/gosharedata](https://github.com/zubairq/gosharedata)</comment></comment></comment></comment></comment>


Why Apple's 3D Touch failed miserably? - <AUTHOR> https://hackernoon.com/why-apples-3d-touch-failed-miserably-72545b608ad <comment><USER2> Any solid UI/UX talks about "affordances". Don Norman's book explains it well:

[http://www.ethanhein.com/wp/2017/affordances-and- constraints...](http://www.ethanhein.com/wp/2017/affordances-and-constraints/)

3D Touch offered _zero_ affordances to the user.</comment>


Synthetic Biology startup releases new platform to hack DNA - <AUTHOR> http://www.youtube.com/watch?v=kaLF8vkgsnk

<comment><AUTHOR> [http://www.TeselaGen.com](http://www.TeselaGen.com) is also releasing a series of tutorials to train bio-hackers use its technology: [http://classroom.tv/course/1588/TeselaGens_basic_BioCAD_tuto...](http://classroom.tv/course/1588/TeselaGens_basic_BioCAD_tutorials)

<comment><USER2> Is there a free version? (e.g. for printed circuit boards, DIPTrace offers free, non-commercial size-limited licenses; I think Eagle does too)

</comment></comment><comment><USER3> We simply aren't ready for this. Barrier to entry should be kept high for this stuff.</comment>


HTTP/2 interop pains - <AUTHOR> http://daniel.haxx.se/blog/2014/09/02/http2-interop-pains/

<comment><USER2> Is this a mistake or Google trying to force the standards process in their favour? Users seem to be blaming Firefox, not Google.

<comment><USER3> > Is this a mistake or Google trying to force the standards process in their > favour? Users seem to be blaming Firefox, not Google.

Given Google's history around this whole HTTP/2.0 shenanigans, I see little reason to see anything in their favour.

They are probably gambling that Firefox will fold (like they forced them to with DRM) so that once again, they can have it their way internet-wide without having to wait for annoying things like feedback from others and standards- committees and such.

They will probably win.

<comment><USER4> Google directly funds the Mozilla foundation with about 300 million USD per year. If Google wanted to see firefox fall they have a very direct way of achieving it.

<comment><USER5> Not true - they don't pay this money out of charity. I am guessing other companies with interest in having a leading search engine (MS and Yahoo primarily, but also Apple, Amazon,...) would probably be happy to take Google's place if they backed out (maybe not for the same amount though).

<comment><USER6> This could be seen as a technique to undermine Firefox and get more users to Chrome, which would devalue Firefox's contribution to Google. As Google appears to _embrace_ standards but continues to implement little flaws and Chrome-only behaviors (that is, _extend_ ), they will eventually deplete Firefox's market share to the point where such a monetary transfer is no longer beneficial ( _extinguish_ ).

People always bring up the fact that there is some value currently provided by Google's payment to Firefox like there's no problem with the vast majority of the Mozilla Foundation's funding coming from a competing entity. It's still a dangerous situation, even if Google is in a position where they're willing to continue paying the "default search engine" toll for the time being. Even their willingness to do that is compassionate, because we all know that Firefox would only harm itself by switching to another default search provider.

<comment><USER5> Agreed, most of your points are valid and it is a precarious position for Mozilla. I just disagreed with the notion that their funding could be cut off this easily - even if Google retracted I'm sure they could reach some agreement with Facebook for example.

I still hope Mozilla is investing the money wisely, because this arrangement is temporary in any case. And I'm hopeful that FirefoxOS takes off!

</comment></comment></comment></comment></comment></comment><comment><USER7> hurley got confirmation from Google that they're working on a fix: [https://bugzilla.mozilla.org/show_bug.cgi?id=1059074#c22](https://bugzilla.mozilla.org/show_bug.cgi?id=1059074#c22)

</comment><comment><USER8> SPDYCheck.org has shown that Google has been advertising support for the suspect h2-14 draft spec for several days now.

[http://spdycheck.org/#google.com](http://spdycheck.org/#google.com)

From the list of protocols:

Success! SPDY is Enabled! Hurray, this website is using SPDY! The following protocols are supported:

spdy/5a1 h2-14 spdy/3.1 spdy/3 http/1.1

</comment><comment><USER9> Does it work on Chrome (nightly or with that support enabled)? Does anybody disagree that this is a no brainer for Mozilla: they should work that around ASAP (with a HTTP/2 blacklist for example). The impact is so high and it affects too many users. Also note that Google in its deepest feelings wants FF down so this may by even intentional since people will always blame the client.

<comment><USER10> Why should Mozilla act? This only affects nightlies and beta, as the article stated. If you use one of those, you should expect things to occasionally not work.

<comment><USER11> When I asked my 11-year-old brother what browser he used (since I saw chrome and firefox on the desktop), he informed me that he used "Firefox Nightly" (which I hadn't noticed, but was also present), because "it's a little better". He had no idea what it was. I don't know how he found it in the first place.

<comment><USER12> > I don't know how he found it in the first place.

4chan, directly or indirectly. They have some crazy obsession with it.</comment></comment></comment></comment>


The 'almost human' gorilla who drank tea and went to school - <AUTHOR> https://www.theguardian.com/uk-news/2017/jan/26/john-daniel-gorilla-drank-tea-school-uley-gloucestershire <comment><USER2> This reminds me a bit of the orangutan who went to the University of Tennessee as a language-training project.

[http://www.pbs.org/video/2365285827/](http://www.pbs.org/video/2365285827/)</comment>


Introducing the Mixable Web - Game Changer? - <AUTHOR> http://lmframework.com/blog/2009/09/the-mixable-web-1/

<comment><USER2> Groovy read of an interesting way of viewing software development.</comment>


Yahoo sells 1/2 its Alibaba stake for $7.1B - <AUTHOR> http://www.engadget.com/2012/05/21/yahoo-alibaba-stake/

<comment><USER2> Wow, alibaba is actually a legit company? Every time it comes up in a google search, I take a few glances at it, and it just _screams_ "spam, landing page" at me.

Odd.

Has anybody here actually bought anything from them?

<comment><USER3> > Has anybody here actually bought anything from them?

You don't really buy from Alibaba, you buy through Alibaba. The amount of money we've spent to the Alibaba owned TaoBao is getting very scary indeed. It's like eBay and Amazon combined, filled with a crappy ActiveX plugin (Alipay) to pay - usually combined with a security token from either of the four dozen or so big banks that one may be a member of - and any question you may have pre-sales answered. Or post-sales too. It's what eCommerce should be in the Western world.

To say that TaoBao is the eBay of China is under-exaggerating things by about hundred-fold.

And it's a shame no one in the Western world has heard of it. It's Alexa rank is... 14. And it's crazy to be assuming that Facebook is supposed to be worth $100 billion, but Alibaba just $35 billion. It should be the other way round.

Also, if TaoBao ever decides to launch in the US, it's game over for eBay definitely and beyond any doubt. It might survive as an exclusively craigslist kind of thing. Amazon should be able to compete, but they will lose a lot of market share.

<comment><USER4> I doubt it would be "game over for eBay". If that were the case, TaoBao would already be here.

What other countries does TaoBao operate in? eBay and Amazon both operate in dozens on countries.

What works only in China works there only for a reason! Government protectionism.

<comment><USER3> > If that were the case, TaoBao would already be here.

eBay didn't even try to go into wholesale, because Alibaba already has that market, in the US, locked up tight. Like someone else said. Half the stuff in your house was brokered through Alibaba.

> What works only in China works there only for a reason! Government > protectionism.

I think it has more to do with shipping being basically nothing and a willingness to do things both vertically and horizontally expansive.

</comment></comment></comment></comment><comment><USER5> So let me get this straight. Yahoo! is getting rid of the only successful asset it has left?

Until right now, Yahoo! had two things going for it: its asian operations (Alibaba, Yahoo! Japan, etc.), and the Hadoop project. Now, it only has one.

<comment><USER6> If they are to keep the asian assets, they may as well become an investment bank because right now, asset management is the only thing that seems to be working for them. If they still wanna be a technology company they really have to get rid of the stuff that's getting in the way of them doing what they're really supposed to do, which is tech.

</comment></comment><comment><USER7> Yahoo! must be getting desperate. While it was probably the best thing to do, Alibaba is quite profitable is it not? It's worth something like $35B, crazy.

<comment><USER8> The relationship between Alibaba and Yahoo hasn't been great in a long time, and there's substantial governance risk to owning a large stake in a Chinese company which hates you. Owning 20% of a $35b company could be worth less than $7b if they decide to make things difficult, and there is limited recourse. I don't think this sale is being driven by Yahoo.

<comment><USER7> Yeah, very true. It's probably best this sale went ahead then. If there is one thing you don't do, its mess with the Chinese especially in the business world. Yahoo! needs the cash anyway.

<comment><USER9> Yahoo needs many things, but cash isn't one of them. They have no debt and have billions in cash in the bank already that they don't know what to do with. The only reason they are doing this is to appease shareholders. And in that sense I suppose you could say that they need the cash, but short of doing a one-time dividend payout to shareholders I don't think they have any idea what they are going to do with it.

</comment></comment></comment></comment><comment><USER10> > The deal, announced late Sunday in the U.S., will see Alibaba Group buying > back the stake from Yahoo Inc.for $6.3 billion in cash and up to $800 > million of Alibaba preference shares.

I'm sure there's a sensible rational for it, but it sounds hilarious for them to be selling their stock in exchange for a bit of cash and some more stock.

<comment> Tuna-Fish The preferred shares are likely callable at the option of Alibaba -- that is, they have the right to buy them back at some defined price at any point in time. They will likely exercise this as soon as they have the liquidity. It's basically just a "we'll pay you 7.1B, some now in cash and 800M later", without having to put debt on the balance sheet.

</comment></comment><comment><USER11> Yahoo should take the money and go private. Yahoo has a market cap of 19 billion so they should be able to easily borrow the money.

They need to make some big changes to remain viable and imho the only way they're going to be able to do it is out of the glare of the public spotlight.

</comment><comment><USER12> I dont understand if Alibaba is planning on buying Yahoo why not just buy them outright now and not worry about buying the stock back? If Alibaba bought Yahoo would it not also not then own the Alibaba stock yahoo was holding?

<comment><USER9> Well, with this deal the Alibaba buyout of Yahoo is obviously off the table.

</comment></comment><comment><USER13> So Yahoo without Alibaba is worth about $4.6 billion (18.8-14.2), subtract the $2.1 billion cash and short term investments and you get a price tag of $2.5 billion for all of Yahoo's other operations and assets.

<comment><USER6> You forgot about the pretty high valued shares they have from Yahoo Japan.

<comment><USER9> And the value of the other Asian Yahoo properties that are fully owned by Yahoo. Yahoo! Taiwan is by far the most visited site in the country, for example. Well ahead of both Facebook and Google. Same goes for Hong Kong. Obviously smaller markets, but one has to wonder what Yahoo! Taiwan/Hong Kong would be worth as a standalone company. It seems to me that would easily be $2B for just that part. Add that to Yahoo! Japan and Yahoo US is valued at some large negative number.</comment></comment></comment>


Prosecutors allege Micfo obtained 800k IPv4 addresses illegally - <AUTHOR> https://www.wsj.com/articles/fraud-case-in-charleston-s-c-shines-light-on-webs-dark-corners-11581944400 <comment><USER2> The writing is quite confusing in trying to explain things but the gist of it appears to be that the person in question (1) applied for IP addresses through numerous companies created just for this purpose in order to bypass ARIN's restriction on the number of addresses it was willing to allocate to a single entity, and (2) made the obtained IP address ranges available to serve as VPN endpoints, so that "huge amount of traffic—some of it illicit or criminal—passed through its computer servers but wasn't traceable to the true originators."

He did keep track though of which VPN operator used which range at any given time, so perhaps the "true originators" could be traceable after all, assuming the VPN owners were willing to co-operate. In any case, he is only being prosecuted for (1), and the immediate reason for this is that a couple of US politicians were hacked with attacks originating from these addresses.

<comment><USER3> A prosecution seems a bit over the top for this... Setting up multiple companies to meet some rule isnt against said rule. And anyway, it's a company policy not the law.

<comment><USER4> It was done to deceive ARIN which is why it is being considered wire fraud.

<comment><USER5> So if I sign up for a service with different email addresses to use the 2-week free trial over and over, I will be guilty of wire fraud?

<comment><USER6> Yes, and they'd probably throw a CFAA violation in there too.

<comment><USER5> Wow! I shouldn't be surprised, yet I am, that three felonies a day was right.

</comment></comment></comment></comment></comment></comment><comment><USER7> [https://archive.is/2f9pz](https://archive.is/2f9pz)

</comment><comment><USER8> This story looks familiar. Oh wait: [https://krebsonsecurity.com/2019/05/a-tough-week-for-ip- addr...](https://krebsonsecurity.com/2019/05/a-tough-week-for-ip-address- scammers/)

</comment><comment><USER9> Relevant post by a former Mifco employee: [https://news.ycombinator.com/item?id=22360642](https://news.ycombinator.com/item?id=22360642)

</comment><comment><USER10> [https://archive.md/2f9pz](https://archive.md/2f9pz)

</comment><comment><USER11> I can come up with at least 3 distinct meanings for "amassed VPN clients" and I'm still not 100% sure which is correct in this context. I take it that clients here refers to "paying customers"?

<comment><USER12> > He said Micfo provides a legitimate service to VPNs, adding that whatever > his customers or their users do through Micfo servers is none of his > business.

From what I understand he was attributed many IPs by creating shell companies and rented these IPs to VPN providers.

<comment><USER13> Why pursue him? What he's done has been done by many others since years.

<comment><USER2> That's what I've been thinking as well. Creating "shell companies" (aka "Special Purpose Entities/Vehicles") is not illegal per se.

Perhaps he violated the terms and conditions of his contract with ARIN and should have had the assignments cancelled but where does the criminality come in?

<comment><USER14> If he misrepresented himself in order to gain a financial advantage then that is fraud.

Creating shell companies is not illegal, using a name fir yourself that isn't your legal name is not illegal, doing either of those things in order to trick people into giving you money is.

<comment><USER15> Not just financial advantage, all deceit where you intend to gain from it is fraud. Money just makes it more obvious what the gain was.

Are there grey areas? Sure. In particular there's a passive sort of deceit in which you let people assume things that you know aren't true, to your benefit. Mostly the law holds that it's their mistake for not asking, and anyway they'd usually be far too embarrassed to make a fuss if they realise their error.

I don't see that here, the plan was explicitly to trick the RIR into giving them resources they were otherwise not entitled to. Those resources were for everybody to share, they're stealing from you and it's appropriate to prosecute for fraud.

<comment><USER16> > I don't see that here, the plan was explicitly to trick the RIR into giving > them resources they were otherwise not entitled to. Those resources were for > everybody to share, they're stealing from you and it's appropriate to > prosecute for fraud.

The last time I looked which was a couple of years ago there was nothing in the ARIN TOS that said "you can only control one entity that applies for resources".

Joe Schmoe Enterprises, Inc, Joe Schmoe, LLC, Joe Shmoe Fishing Services, Inc are different legal entities even if Joe Schmoe, Jr owns all of them.

<comment><USER15> The TOS only entitles you to keep the service you already have, you need more paperwork to get more resources assigned.

I presume the specific problem will have been when Joe Schmoe lied on the paperwork for IPv4 delegation to Joe Shmoe Fishing Services not mentioning that Joe Schmoe, LLC already has also applied, as has Joe Schmoe Enterprises, Inc. I'm not in ARIN's region, so I haven't seen their paperwork, but analogous paperwork in RIPE for example asks you about Related Entities because you're not entitled to duplicate resources just by asking more than once.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> A related thread is [https://news.ycombinator.com/item?id=22360642](https://news.ycombinator.com/item?id=22360642).

</comment><comment><USER18> If anybody is interested I have a database of roughly 4B IPv4 addresses for sale:)

<comment><USER19> Could you please remove mine under article 17 of the GDPR? :D

<comment><USER20> Hmm, GDPR thought experiment: I make a database of public IPv4s by running a couple for-loops and subtracting private spaces. Can an EU guy who owns an IPv4 request to have it removed?

<comment><USER21> Regarding GDPR, I think IPs are considered "personal data" if you can identify the user from it.

Well, my understanding is any data is 'personal data' if you can use it to identify a user, can be combined to identify a user or can be aggregated to an identified user.

<comment><USER18> That is mostly, but not exactly right.

For example, list of addresses themselves are not personal data. Everybody has access to addresses, you can get them at the post office for example when you try to look up code for the address.

But a list of addresses _of creditors_ (ie. address + some non-identifying context information) is personal data.

I do not know GDPR well but given just that example I would say there is some more nuance.

</comment></comment></comment></comment></comment><comment><USER22> I wish HN had a filter which would block all posts which link to sites which require subscriptions.

<comment><USER17> If there's a workaround, it's ok. Users usually post workarounds in the thread, and did so in this one.

This is in the FAQ at [https://news.ycombinator.com/newsfaq.html](https://news.ycombinator.com/newsfaq.html) and there's more explanation here:

[https://news.ycombinator.com/item?id=10178989](https://news.ycombinator.com/item?id=10178989)

[https://hn.algolia.com/?sort=byDate&dateRange=all&type=comme...](https://hn.algolia.com/?sort=byDate&dateRange=all&type=comment&storyText=false&prefix&page=0&query=by:dang%20paywall)

</comment></comment><comment> _-___________-_ Hmm.

I "obtained" 2^32 IPv4 addresses pretty easily; not sure if it's legitimate or not:

      for addr in range(2**32):
        print('.'.join([str(addr >> (i << 3) & 0xFF) for i in range(4)[::-1]]))

Edit: Well, this was unpopular. In case it's too subtle, my point is that the title is terrible.

<comment><USER23> Your script doesn't seem to assign any of the printed IPs to ASNs registered to you, so your joke kind of misses the mark a bit.

<comment> _-___________-_ I added an edit to make it more clear, but I was talking about the title.

<comment><USER13> There's nothing wrong with the title. Obtained means "To get hold of; to gain possession of, to procure; to acquire, in any way".

<comment> _-___________-_ Which is quite literally what my script does :)

Think about if the title said "800K email addresses obtained illegitimately", and what you would interpret the meaning of that to be.

<comment><USER24> I would expect a database of valid email addresses had been compromised. Context of what is being "obtained" matters, of course. But the sum total of valid IP addresses is a fixed, finite, and well-known value. Can you write a script to generate all valid email addresses?

<comment> _-___________-_ I can, and it does eventually complete, but it might take a while.</comment></comment></comment></comment></comment></comment></comment>


Ask HN: Best outsourced web app developers? - <AUTHOR>

I have an idea for a web app that I would like to see developed from start to finish.
I'm looking for a reputable company that won't steal the idea and that takes pride in their work.
The idea is relatively simple but of course the devil is in the small details.
I'm prepared to fully fund this myself no worries there so I'm not looking to give up any equity in the idea.
As a side note, I'm curious if HN'ers think it's a good idea to outsource the whole ball of wax or if you think it could lead to problems down the road? <comment><USER2> Happy Cog (www.happycog.com) for UI, Thought Works (www.thoughtworks.com) for back-end

(Please note, I'm not employed or affiliated with either company in any way)

I'd imagine both are very expensive though, so I guess as always it's a case of "it depends on your budget" :)

</comment><comment><USER3> Anedoctal, but one of our clients is doing exactly what you're planning on doing. He's happy w/ the app we built so I think it's been working out well.

Imho, as long as you're dealing w/ someone reputable and have a clear scope set, the rest is fairly smooth sailing.

</comment><comment><AUTHOR> lhorie,

What is your company?</comment>


Rumble: Twitter over sneakernet - <AUTHOR> http://www.disruptedsystems.org/ <comment><USER2> If you want to build something like this without writing the tricky code, Couchbase Lite has peer to peer sync. Our big vertical for that is currently point-of-sale but the applications are limitless.

Here's an example photo share app: [http://blog.couchbase.com/photodrop](http://blog.couchbase.com/photodrop)

<comment><USER3> I admit I have only skimmed over the page, but...how does Couchbase create the connection? All I see is that you have to share a QR code with others, which is not really flexible compared to connecting ad hoc via Bluetooth and Wi-Fi.

<comment><USER2> In this app we use the QR code as an authentication token. The connection is handled via OS code. So BT or wifi, as you suggest.

</comment></comment></comment><comment><USER4> Check out LTE direct for a potential future technology that would have a much better range than wifi and bluetooth, which could potentially make this sort of thing workable.

<comment><USER5> You could also use the upcoming LoraWAN, 802.11ah, Bluetooth 2016 (with 400% range) technologies or even packet radio... but I think using the internet (with tor) whenever its available would be a smart move.

<comment><USER3> The problem with most technologies is that they are not supported by every mobile device or by every OS, or are even not supported by the hardware. For a network where a high number of nodes is relevant, wide-spread use is crucial.

</comment></comment></comment><comment><USER6> That's cute. It's basically USENET over Bluetooth.

Unfortunately, it can't use WiFi effectively, because Android doesn't allow symmetrical WiFi. You can only connect to an access point; handsets can't connect to each other. If two handsets are connected to the same access point, there can be communication.

It does not, apparently, have encryption.

<comment><USER7> I thought Android has p2p wifi (e.g., [http://developer.android.com/guide/topics/connectivity/wifip...](http://developer.android.com/guide/topics/connectivity/wifip2p.html)). Is this not true in practice?

<comment><USER8> Android's "p2p" wifi is an implementation of wifi direct, which has one device host an AP and the other connect as a client. Real ad-hoc mode is only possible on rooted devices, and google has been ignoring this issue for years.

[https://code.google.com/p/android/issues/detail?id=82](https://code.google.com/p/android/issues/detail?id=82)

<comment><USER9> It almost seems like Google went out of their way to disable ad-hoc Wi-Fi on Android.

[http://www.thinktube.com/index.php/tech-en/android/wifi- ibss](http://www.thinktube.com/index.php/tech-en/android/wifi-ibss)

</comment></comment></comment></comment><comment><USER10> Could this be used in a large crowd? Such as a protest, or a concert? What are the scaling limitations? How does a message decide to stop propagating - wouldn't it just circle around a large crowd indefinitely?

<comment><USER11> I'm also curious how they decide to expire messages out of the database. Presumably each device doesn't carry around every message ever sent since the beginning of time; that doesn't seem like it would scale well.

<comment><USER12> And yet, everyone thinks bitcoin will scale just fine.

<comment><USER13> Not every bitcoin client needs to carry the whole blockchain for bitcoin to work.

<comment><USER10> Step one, here's how you can implement this wonderful protocol!

Step two... here's how you can hamstring the protocol, so you can use it in real life.

Hey - are we losing any of the benefits of the ideal protocol when we hamstring it?

SHHHHHHH!

</comment></comment></comment></comment></comment><comment><USER14> Any ideas on how concepts of identity, administration, and content ownership work in networks like this? Who decides to delete an inflammatory piece of content in a completely decentralized system? Can a fate like that which befell Usenet be avoided?

I could suppose a system where identities are pinned to a key that is stored from the first time the user is identified (because a "packet" is seen from them).

But how does that stop a determined attacker from broadcasting out his fake Alice identity, so that the real Alice can no longer spread their messages?

</comment><comment><USER15> Usually, I don't make jokes here, but that name reminded me of this (fake?) app: [http://www.nydailynews.com/news/national/rumblr-tinder- fight...](http://www.nydailynews.com/news/national/rumblr-tinder-fighting-app- launch-beta-nov-9-article-1.2427623)

Edit: Actual site [http://app.getrumblr.com/](http://app.getrumblr.com/)

</comment><comment><USER16> I am the developer of this program and I just noticed this thread. If you have any question about how it works I will be happy to answer.

</comment><comment><USER17> So this is like firechat with a buffer?

<comment><USER3> This is like FireChat, but actually secure, does not leak data to any servers and works very well offline. And it is FOSS!

<comment><USER18> Maybe I'm skimming too fast, but it looks like apart from transport layer encryption (wifi/bluetooth), this uses just the nullCipher?

[https://github.com/Marlinski/Rumble/blob/master/app/src/main...](https://github.com/Marlinski/Rumble/blob/master/app/src/main/java/org/disrupted/rumble/util/EncryptedOutputStream.java)

Hm, looks like group-chat uses shared secret, AES CBC without any form of authentication? So I guess it's not just using null cipher. I'm not sure if I'd go as far as to call it "actually secure", though?

[https://github.com/Marlinski/Rumble/blob/262a8b0a618c9f90457...](https://github.com/Marlinski/Rumble/blob/262a8b0a618c9f90457f548cc81c359ca11e0d0b/app/src/main/java/org/disrupted/rumble/network/protocols/rumble/packetformat/CommandProcessor.java#L107)

<comment><USER3> I am missing your point. Do you consider CBC with random IV value insecure? Could you elaborate on that?

<comment><USER18> Well, as far as I can figure out, there's no authentication of the plain/cipher-texts? Just an attempt at blind decryption? [ed: encryption without authentication is almost always a bad idea - I'm not clear on what's the status of the various Android versions - but I _think_ you should be able to use AES-GCM -- which of course is a stream cipher. Not sure if one would want to frame that in order to try to leak less info about message lengths or not. I suppose one might frame the plain-text messages in 1k blocks or something before encryption, and unwrap the padding after decryption (of an authenticated cipher).]</comment></comment></comment></comment></comment>


Sendgrid files for IPO - <AUTHOR> https://techcrunch.com/2017/10/19/sendgrid-files-for-marketing-email-ipo/ <comment><AUTHOR> While unprofitable, losing $3.9m on $79.9m in 2016 doesn't seem that bad. I'm sure they've been working hard to get that in the green.</comment>


Crowdfunding passed in the Senate and here's what they changed - <AUTHOR> http://www.scottbrown.senate.gov/public/index.cfm/2012/3/senate-passes-brown-merkley-bipartisan-crowdfunding-bill

<comment><USER2> How much does this really change the game for any company that long-term thinks it may take VC money? Doesn't stuff like this crud up cap tables and drastically increase the legal cost of obtaining the protections VCs typically demand? Won't the best prospects among startups avoid crowdfunding, creating an adverse selection problem among available companies to fund through it?

<comment><USER3> Yes, it seems like "crowd money" is another form of dumb money, which many people say entrepreneurs shouldn't bother taking. Crowdfunding really plays to the "misunderstood genius who the angel establishment refused to fund" story.

Of course, we're all probably thinking about silicon valley style startups. It's possible that crowdfunding will be used for lifestyle businesses as well (not that that's a good idea either).

<comment><USER2> I think the "dumb money" meme deserves some suppression too. Also, after a few seconds more thought: one reason current low-net-worth investors are a problem with VCs is that they're unaccredited, and unaccredited investors incur liability for companies (as I understand it they can more or less claim at any moment to have been ripped off by the company).

That's not a problem you have if the investments are explicitly aboveboard.

</comment></comment></comment><comment><USER4> _"For investors with an income of less than $100,000, investments will be capped at the greater of $2,000 or 5% of income. For investors within an income of more than $100,000, investments will be capped at 10% up to $100,000."_

Is the cap per investment or per person? E.g., if I make 100k, does that mean I can invest 5k total, or no more than 5k in any one company?

Also, is this an annual cap? What happens if I invest in January and the investment appreciates (or depreciates)? Does my cap move with MtM, or just record the cost?

Finally, isn't the "10% up to 100k" part redundant, since someone who is earning 1 million is an accredited investor by the traditional definition? Or is the 100k similar to the 2k, in that it's one part of a greater of function?

<comment><USER5> From the bill-

(B) the aggregate amount sold to any investor by an issuer, including any amount sold in reliance on the exemption provided under this paragraph during the 12-month period preceding the date of such transaction, does not exceed-- `(i) the greater of $2,000 or 5 percent of the annual income or net worth of such investor, as applicable, if either the annual income or the net worth of the investor is less than $100,000; and (ii) 10 percent of the annual income or net worth of such investor, as applicable, not to exceed a maximum aggregate amount sold of $100,000, if either the annual income or net worth of the investor is equal to or more than $100,000;

EDIT- Wait, what if say your income is $150k but your net worth is only $80k? Section one says it applies if either net worth or income is less than $100k, but section two says it applies if either is greater than $100k. Hmmm.

<comment><USER4> So Grandma with $50k could invest in 25 start-ups at $2k each? I suppose if they each have at least a 8% probability of more than 10-bagging it...

<comment><USER6> No, she could invest $100 in 25 startups or $2500 total (5% of $50K). The limit was on total investment.

</comment></comment></comment></comment><comment><USER7> Can anyone explain why 25 Democrats + Bernie Sanders (Independent) voted against the bill? [http://politics.nytimes.com/congress/votes/112/senate/2/55?r...](http://politics.nytimes.com/congress/votes/112/senate/2/55?ref=business)

Do they want to protect unsophisticated investors from being tricked? It seems like it's a really positive movement in support of small, innovative businesses.

<comment><USER2> Yes; it rolls back investor protections. To understand the concern (you don't have to agree with it to understand it), stop assuming that all or even most of the people who take advantage of Crowdfunding will be businesses run in good faith, or that there will be any effective way to impute reputations to all, most, or even _any_ of the people offering equity on these sites.

<comment><USER8> To be fair people said the same thing about ebay. Any sort of quality crowdfunding site will be able to prevent fraud through a mix of identity verification and leveraging their users expertise to weigh in on a businesses viability. (At least that's the model we're using)

<comment><USER9> I think you and I both know that there is no shortcut way to evaluating the viability of a startup company.

EITHER you will put them through a Y-combinator-like interview and evaluation process, with sophisticated evaluators and a lot of man-hours spent per company, OR you aren't doing shit to evaluate them and you're going to be hosting scammers left and right. There is no shortcut.

<comment><USER8> You crowdsource the viability and the platform makes sure they're a real company and verifies their legal status. Who better decide whether or not a company has a viable idea than their potential customers or users? In fact, I can't think of a better way to assess the viability of a company than to put it out there in front of 1000's of eyes to see.

The truth is that the Y-Combinator evaluation style, or other more tradition financing routes for that matter, aren't the end all be all. We're working our tails off to leverage our users knowledge and make a system that roots out any sort of scammers.Crowdsourcing isn't a short cut, it's just a decentralized system versus our current more centralized one. In fact, I suspect more man hours will be put into assessing viability through a crowdsourced model just because of the sheer number of people.

<comment><USER9> Scammers are going to slaughter you.

Company: "We're going to cure cancer!"

First 20 crowdsourcers, all paid by company: "These guys are totally legit! I visited their offices! Saw a hamster that was totally cancer-free!"

Next 500 crowdsourcers, not paid by company: "Looks legit! Take our money, please!"

Company founders: {fly to Switzerland in their ROFLcopter, having committed no crime whatsoever}

1000 or 100,000 or 100,000,000 eyes looking at a subject shallowly are not a replacement for one set of eyes looking at a subject deeply. The great thing is, the marks won't even realize they've been scammed for years or perhaps ever, due to the long delay between providing money and expecting results.

<comment><USER3> I think a more subtle approach might work better, like promising a distributed social network written in Rails.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> Will this make Kickstarter illegal in any way? I mean are people still free to give money (capped of course) without having to receive stock in return?

<comment><USER2> Kickstarter isn't an investment vehicle.

</comment></comment><comment><USER11> > SEC-registered crowdfunding portal.

This is interesting to me. Where can I find more information about the specifics of this?

<comment><USER8> I'm actually working on a crowdfunding for equity site that we're going to be launching here in the next couple of weeks. I had the opportunity to read the bill and it stipulates that those of us acting as crowdfunding intermediaries be either broker dealers or this new class of financial institution called a "funding portal"

From here on this is pure speculation. Basically, the gist that I've gotten from the various SEC officials making comments on the bill is that a funding portal is going to a be very loosely regulated compared to other financial intermediaries. Mostly funding portals will exist as a way for the SEC to keep tabs on us to prevent fraud, and to make sure we're meeting all our various reporting requirements to the Federal and State level governments. Again, all of this is speculation based off of the various committee hearings, and comments from SEC higher ups regarding the crowdfunding bill.

Edit: I also should have included that the SEC is using "funding portal" as a way of limiting the scope of our activities. It prevents us from doing things like actually performing the money management functions etc.

</comment></comment><comment><USER12> this is pretty exciting. Although, I am still curiou about the portal and timeline for this.

</comment><comment><USER9> This sounds like an excellent - and legal! - way to fleece the public with fake startup companies.

If you have a legit company, you better get in now, because it won't be long before a wave of scammers is busy promoting their new "give us $2,000 and MAKE MONEY FAST! Approved by Congress!" schemes.

Those of you who have flexible ethics should consider it yourselves. For a couple thousand dollars you can easily work up a website and suitable promotional materials, form a corporation and so on, and then you just wait for the money to roll in. Cure for cancer! Spaceship to Mars! Cold Fusion! Doesn't really matter, just make sure you emphasize that the investment may not pay off. If you can keep it going for a while it should provide an excellent source of income for a couple of years, before you regretfully announce bankruptcy.

<comment><USER12> That is a bit dramatic. I don't see how this opens people up to any additional scams than are already out there. What it does is provide another avenue to get money from people who have it into the hands of the people who need it.

It's like y-combinator for the little guy.

<comment><USER9> Yep, that will be exactly the angle to push. You too can get rich just like venture capitalists, with as little as $2,000 down!

It will just be a sad, unhappy coincidence that none of their investments ever pay off. Oh, too bad, you just got unlucky. But if you put another $2,000 into my next company, we're definitely going to make you rich, rich, RICH!</comment></comment></comment>