Domain Squatter Tries New Business: Running Websites - <AUTHOR> http://www.alleyinsider.com/2008/3/domain_squatter_tries_new_business_running_websites <comment><USER2> Interesting, but I think he's way too late to that party.

These short, generic domain names (like perfume.com) had some value 10 years ago, when Internet search was still much more of a chaotic crapshoot.

Today, you could practically run a thriving ecommerce site from just a static IP if you spent a little bit of time on SEO. People go to google, type in "perfume" or "buy perfume" and go off to either the text-ad sites, or the top organic results.

Users have been trained on the idea that "domain guessing" is hopeless, and more than likely to land you on a pr0n site or ad site (like those domains are currently configured).

Also, for many of these e-commerce related sites, there is a large percentage of people who are looking to buy perfume+something else. If your site is so tightly optimized around 1 product class, I think you'll lose a lot of business to people who want to buy 3 products from 1 vendor, not 3 products from 3 vendors.

IMO, the majority of these domain squatters have so thoroughly skewed or ruined how people find products of interest that they have no hope of suddenly turning things around by turning these domains into what they should have done from the beginning.

<comment><USER3> Users? Trained!?!?!?!? Someone needs to stop hanging out with geeks :)

These domains ARE valuable - both for income generation and resale potential.

<http://www.usatoday.com/tech/news/2006-05-09-domainers_x.htm>

<http://www.google.com/search?q=domaining>

<comment><USER2> You're going to cite a USA Today article as some sort of conclusive proof of your argument?

The "value" is perceived, often by people who have no idea what they're doing (much like the examples in your USA Today article).

This is a lot like the "value" of various antiques, where antique dealers constantly buy and sell pieces amongst themselves. Did you hear the joke about the 3 antique dealers trapped on an island with a single King Louie VIII chair? They all managed to make a living...

<comment><USER4> Jakob Nielsen found that only 76% of people who wanted to do a search could actually do so. See <http://www.useit.com/alertbox/designer-user- differences.html> \-- it's quite long so search for "Getting to Google is hard"

<comment><USER2> Although it didn't break it down further, the article said that the other 24% of people trying to get to Google "...either completely failed to get to any search engine or ended up running their query on a different search engine". So, some of that 24% were able to execute a search, just not on Google. Let's be generous and say 10% used something else (like the MSN search that comes up by default in IE).

My personal non-scientific experience is that users who are so internet- clueless are also e-commerce-phobic... They won't put their credit card and personal data "into the intarweb". So, the value to a retailer of this group of folks that can't master ANY search engine is probably much less than the cost of developing and promoting these sites based on such great domain names.

<comment><USER3> Now _that's_ a good point I hadn't thought of! Hmm. OK, now I'm less optimistic about the Auctomatic deal. [that wasn't sarcasm, that was sincere]

I think the Plenty of Fish model (lots of traffic, high priced sponsorship ads and affiliate links to more targeted or efficient sites) is a better bet for high value domain names, given that characteristic that you pointed out about the people unable to find a search engine. They might not know what they're doing, but you can be darn sure they click on ads!

</comment></comment></comment></comment></comment></comment><comment><USER5> "each site will cost him between $1 and $3 million a piece" - are you kidding me? Just to build it out? Wouldn't you build a "test" site first before you invested a million dollars?

p.s. Congrats - to Auctomatic...

</comment><comment><USER6> What that man does is not domain squatting. He was wise enough to invest into (now) very valuable domain names, which he plans to develop.

<comment><USER7> Buying up vast amounts of prime real estate in an extremely overcrowded town and then wasting the property just to earn pennies a day while others desperately need it is not squatting either, huh?

<comment><USER8> the domains were bought almost 10 years ago. Geoff has only just joined and immediately y stopped the trading/squatting and started putting together a team to build products that leverage the domains. Hence the re-branding.

</comment></comment></comment><comment><USER9> Don't call us domain squatters. We're domain farmers. And you're just jealous. :-)

<comment><USER3> Hex, axod, :-) means it's a joke!

<comment><USER10> hehe never can tell for sure on the intraweb</comment></comment></comment>


What's wrong with OKCupid's matching algorithm. - <AUTHOR> http://blog.hiremebecauseimsmart.com/post/13178732106/okcupid-whats-wrong-match-algorithm

<comment><USER2> Minor point, but if you are using factual questions to filter out stupid people, asking for the "right" number of continents is probably not ideal. You (and I) might disagree with someone counting Eurasia (or North and South America) as a single continent, but it is not really an indicator of stupidity in the way that believing in astrology or thinking the earth is larger than the sun are.

According to the wikipedia article on continents, different models are taught in different countries, so you probably end up selecting for a different attribute than you thought.

<comment><USER3> People I don't want to date: Anyone who gets hung up on arbitrary definitions and is ignorant of other cultures.

That questions seems to be a pretty good filter, just not for the reasons he thinks it is.

(As I child – not in school but before – I learned that there are five continents: Africa, Australia, America, Asia, Europe. I don't think I was ever told in school how many continents there are. All we were told were names of certain landmasses to make sure we are all talking about the same thing when saying America, Antarctica, South America or Eurasia. Why bother counting them? That doesn't even make sense.)

<comment><USER4> See, but if you made that question mandatory, you'd weed out me, because I was taught in a different school in (probably) different country, and my set of default continents is different.

OTOH, I think I marked this question as irrelevant.

<comment><USER5> I wonder if the question exists just to filter out people who _don't_ mark it as irrelevant.

</comment></comment></comment></comment><comment><USER6> Hi. I work at OkCupid.

I can't address all the particulars raised in this analysis, but the biggest is essentially correct:

> _The worst side effect of the current scoring system, is that a spammer > could easily answer only the questions with obvious answers (basic facts and > display of non-bigotry) and get a decently high match percentage with a lot > of people. At which point, the spammer uploads a picture of an attractive > guy/girl, writes some generic profile text, and scams away._

The algorithm as described in the FAQ does suffer from this problem. However, we have enhancements that address the issue very effectively. The FAQ is slightly out of date, and shouldn't be taken as a complete, exhaustive description of how we make matches.

<comment><USER7> why not let people search by specific conjunctions of questions they've answered publicly?

<comment><USER8> Amusingly, you could. Create a new account, answer just those questions as "mandatory", and see who your matches are. That's a bit effort-intensive, obviously.

<comment><USER9> Effort intensive as a one-off, maybe.

If you're one of the aforementioned spammers, I assume you just set it up once in pywinauto and then go nuts.

</comment></comment></comment></comment><comment><USER10> > _The worst side effect of the current scoring system, is that a spammer > could easily answer only the questions with obvious answers (basic facts and > display of non-bigotry) and get a decently high match percentage with a lot > of people._

That is exactly what I did which led to my meeting my (now long-term) girlfriend. I was receiving about 5 profile views/week with 500 questions answered. I scrapped them all, answered 20 or 30 questions with non-offensive answers, and skyrocketed to 60-100 profile views/week.

<comment><USER11> I don't know what your view/message ratio is but I can't imagine any guy has any decent ratio. The thing I have noticed with online dating is this: girls get a gang of messages + views and guys get some views. This is true with all the guys I know who are on okcupid. The 60-100 views/week for you is what girls I have dated on there say they get in messages, which I'm sure you know is much harder thing to accomplish.

The art of online dating, IMO, is not in the questions answered but the messages sent and secondly how non-offensive your profile description is. Include keywords "Hiking, Laughing, Friends/Family, Good Beer" and you're in like gin.

My 2cents :)

<comment><USER8> Depends what you're looking for. But sure, adapted to your, um, target market.

</comment></comment></comment><comment><USER12> OKCupid would probably get better matches if it dropped the user submitted weights and ideal match preferences completely and instead used its database of people in relationships as training data for a proper machine learning algorithm.

The current approach is entirely oriented to give people what they think is important and what people think they want. It would probably be better to derive that from existing relationships (successes).

I would be a little surprised if people at OKCupid hadn't already thought about this. Whether there is actually any momentum to change the core matching mechanic or not remains to be seen.

<comment><USER13> I agree, I wouldn't be surprised if the weights people manually assign to the questions have very little correlation with the success of their relationships. People probably suck at knowing what they want.

That's not to say they're meaningless though; e.g., if someone puts "mandatory" for all his questions, that definitely says something about his personality, and should be used as a feature in the ML algorithm used for matching.

<comment><USER14> People may suck at knowing what they want, but I think it's more that people do not necessarily know what criteria they should want to select given their goals for finding someone.

Another problem is that a lot of users are probably more casual about the weights, such as selecting mandatory. (It's common for people to select an answer and then mark that same answer as unacceptable in a match, for questions in which it makes no sense for them to do that.)

</comment></comment></comment><comment><USER15> As a person with very strong religious views I've found the matching algorithm to be great at filtering out those with incompatible views. I think matching based on ethical, political, and religious views is the matching system's strength. The true weakness of the algorithm is that it matches poorly for personality. Two people can have very similar beliefs but be a terrible match in terms of personality. I would prefer an entirely separate score for that aspect.

<comment><USER16> Heh. Exact opposite here - I'm religious and just posted here about how bad I find it at filtering people by religion (or politics, for that matter) for me. Its ability to match _for me_ based on personality seems rather higher.

I'd suspected for a while TBH that there were odd effects from the balance of what questions were answered; some topics have more data coverage than others in the question pool and that (for me) seems to put a noticeable damper on its precision in other areas.

<comment><AUTHOR> > some topics have more .. coverage than others

I've noticed that too. There seem to be a lot of repetitious questions all aiming at or around faith vs atheism. "Do you believe in fate", "Do you believe in miracles", etc are talking about the same kind of thing.

</comment></comment></comment><comment><USER17> OKC has the worst matching algorithm on the Internet. I signed up for an account, spend a large amount of time to get my profile "100% complete", answered over 1,000 questions and was still consistently matched with people I had absolutlely no interest in dating at all. I can't count how many times I saw 0% compatibility scores, people hundreds or even thousands of miles from me(I'd specifically said no more than 30 from my zip code) and worst of all, several men(I'm not gay and didn't express and desire at all to meet men on the site). I deleted my profile after 6 months and when they asked me why I was leaving I told them how their matching process would be better using a random number generator. It's too bad because OKC is one of few free dating sites I know of that actually has a decent number of women using it.

<comment><USER18> That doesn't sound like a bad matching algorithm, it's more like you found a bug on the search form: distance and sex are presumably filters in the query, not input to the matching algorithm. And it sounds like a rare bug too, since if a lot of people were getting results of the wrong sex that would quickly become an issue.

<comment><USER16> I may be being harsh, but the comment sounds like a troll to me; he's describing horrendous, show-stopper bugs like failure to respect basic search filtering criteria which the apparently large number of HN readers with accounts on OKC have failed to report. I don't find the post in any way credible.

</comment></comment></comment><comment><USER19> I'd like to see an analysis between these two sets of data:

A) Dudes that have an opinion about the OKC algorithm

vs.

B) The amount of times they get laid each week

Jokes aside, I'm fascinated with this topic. For most of history, the likelihood of finding a mate was left to chance. Then OKC comes along and says it can leap past obstacles such as chance and geography to help you find your soul mate. That's an incredibly powerful idea.

</comment><comment><USER20> I would have thought that OKC would use some dynamic weighting scheme where the weights are not constant, but depend on how commonly people answer that question. For example, questions that just about everyone lists as mandatory wouldn't be weighted with 250, but with some number proportionately reduced to reflect the banality of the question.

Hmmm, I'm a bit disappointed or maybe I'm just missing something.

<comment><USER21> Yes that's how it works, the FAQ is out of date.

</comment></comment><comment><USER22> I guess I should have read the FAAAQ. I had no idea "mandatory" was being applied to the matching algorithm in such a naive manner. That sucks.

Of course, it doesn't really matter for me, anyway. I don't use OkCupid as a dating site. I use it as a way to find things like local libertarians, programmers, and other essentially platonic things. In fact, for a few years, I haven't even used it for that -- but that's how I did use it, so dating criteria are kinda irrelevant, which means answering questions is kinda irrelevant too. (I've answered quite a few just for shits and giggles, though.)

<comment><USER20> That's interesting, I have tried using OKCupid for dating, but it seems like all of my matches are women I might be interested in platonically, but not for dating.

It could be that OKC has developed a very good system for meeting new friends, but not necessarily for dating.

<comment><USER23> Out of curiosity, what qualities are desirable in a female friend that aren't in one you would date (aside from the obvious like "she's married" or "she's only interested in dating the wrong gender")

<comment><USER24> I'm guessing that it's the other way around; there are qualities that are desirable in a person GP would date that are not found in people who would still be great friends.

<comment><USER25> E.g., being physically attracted to them.

</comment></comment></comment></comment></comment><comment><USER26> They seem to have tweaked their algorithm after the Match acquisition. My ex, with whom I had about 65% match (she signed up after we broke up), suddenly one day became a 80% match. She claimed she hadn't answered any more questions, and neither had I.

I like OKC, but they don't do even basic filtering of profiles. If they just verified, say, a mobile phone, it would get rid of the vast majority of fake accounts.

</comment><comment><USER16> Interesting maths analysis. I'd certainly noticed that their ability to reliably rank inside a window of say, 80% and 95% was rather low, along with the ability to filter out deal-breakers. Frankly that remained a manual process, no matter how much data people had supplied, I never could do that reliably from the numbers alone. As a liberal Christian, I end up with quite a bit of filtering of filtering out of people with very great differences in either religion or politics which the algorithms simply didn't pick up.

So anyway, some tweaking done. Let's see if it has any visible effect...

</comment><comment><USER27> How about this: instead of showing you match %'s, they show you profiles and you rate them. Then use recommender systems [1,2] just like netflix. There are two immediate problems with this: you have the cold start problem [3] and also if you don't show random profiles, then you introduce bias into their rankings. The first problem could be solved with side information (you still answer questions) and the second with a nicely chosen exploration/exploitation trade off. PMF[4] for the win!

[1] [http://spectrum.ieee.org/computing/software/the-million- doll...](http://spectrum.ieee.org/computing/software/the-million-dollar- programming-prize)

[2] <http://en.wikipedia.org/wiki/Collaborative_filtering>

[3] <http://dl.acm.org/citation.cfm?id=1352837>

[4] <http://en.scientificcommons.org/42513739>

<comment><USER28> OKC does have this functionality, it's called quickmatch. I don't know how they use the ratings you give there, but I doubt they just let it go to waste.

<comment><USER16> Quickmatch has other problems though.

* If you're going to do it properly and give them meaningful data, a 'quick' skim is the exact opposite of what you want to do. Yet it's what the function is set up for; you can't even see a person's questions and answers, which have frequently (to me) proved far more revealing than the profile.

* Again, if you're doing it properly, rating someone highly sends them a mail saying 'someone's interested in you'. Which always looks to me like saying 'Someone's interested in you but doesn't have the guts / energy / enthusiasm to write you a proper message so has gone for the easy way'. Not a great intro.

With a bit of tweaking I agree it could give some useful seed data, but not much more; fundamentally I think the question-based approach is very good, but I think their scoring algorithm could benefit from refinement.

</comment></comment></comment><comment><USER29> This critique reminds me very strongly of Evan Miller's "How Not To Sort By Average Rating": [http://www.evanmiller.org/how-not-to-sort-by-average- rating....](http://www.evanmiller.org/how-not-to-sort-by-average-rating.html)

In both cases, the key observation is to realize that the _meaning_ of the numbers is more important than the numbers (or how they're calculated, per se). This point is kind of abstract--especially compared to the salient examples in both pieces--but if you're looking to understand _why_ this error is so common, look first to the fact that it's not an error of stupidity or insufficient maths.

You can sometimes avoid a big practical problem (e.g., an avenue to attack your system via diluting meaning ("spam")) by abstractly considering the meaning behind the structures available to you.

</comment><comment><USER30> I suspect that "doug" in the articles comments has it right. Users are happier to see dozens/hundreds of "matches" that they know aren't all that good despite saying 90% than if they saw 3 matches that were more correct followed by a huge drop down to 50-60%.

<comment><AUTHOR> I think it depends on your locale.

Spearfish, SD versus Brooklyn, NY for instance -- the Brooklynites could benefit more from algorithmic improvements.

</comment></comment><comment><USER31> It is crazy to think that a matching algorithm based on answers to seemingly pointless questions can predict the success of a future relationship. There is no substitute for interpersonal connection in real life. Those looking for love and meaningful relationships should get off of their computers and meet people in person. This is the problem with the majority of dating sites out there-too much focus on the online experience of users rather than the offline interaction. The internet is a great way to network and meet new people but nothing can replace spending time with a person in real life to determine whether or not you will get along with them.

<comment><AUTHOR> CJM, it's just a sort & a gauge to guide search. Not a formula for relationship success.

</comment></comment><comment><USER32> I don't think matching algorithms will EVER work, short of human-level AI. The only matching algorithm that works is the human brain.

So, I think that the right way to go is to just increase the speed and accuracy with which a human can look for matches. Some ideas here: [http://ideashower.posterous.com/idea-dating-site- slideshow-a...](http://ideashower.posterous.com/idea-dating-site-slideshow- audio-voiceovers)

</comment><comment><USER33> The other problem is that many of the questions are redundant, ambiguous, or otherwise poorly constructed. I end up skipping a lot of them just because of this.

</comment><comment><USER34> I've been a user of okcupid, on and off, for several years.

at this point, I dont really even look at scores anymore. I can tell based on profile text alone whether I'm likely to get along with a person.

but this is age and experience, not math.

I'd rather okcupid had a feature that tells me what things are going to cause fights between a person and myself after we date for a while :)

<comment><USER35> > _I can tell based on profile text alone whether I'm likely to get along with > a person._

 _but this is age and experience, not math._ //

Arguably your brain is running an algorithm that can be expressed mathematically, we simply don't know the exact nature of the algo.

Age is largely irrelevant, it's mainly a first pass indicator for experience. Your experience is probably largely a statistics based algorithm with some unsound choices caused by your psych make-up thrown in to keep things interesting.

</comment></comment><comment><USER36> This reminds me of the recent Dinosoar Comic. It seems like everyone thinks they can make a better dating site these days: "BaguettesAll4Me.co.uk is complete! ... I realized my perfect woman won't say 'ew that's weird' as she watches me eat a whole baguette" <http://www.qwantz.com/index.php?comic=2088>

</comment><comment><USER37> > At least they're not using a non-linear Bayesian splitting tree didactogram

This seems like a weakness to me. I'd love to be able to choose between different algorithm for matching features and set some relevant coefficients. It'd be fun to see the profiles that have a minimum hamming distance from mine, or whatever.

<comment><USER38> You should make a dating site advertising that as its key feature.

Most everyone who would join it would be a giant nerd, even moreso than OkC, but that'd significantly increase average compatibility!

<comment><USER33> Unless it was a gay dating site, that would also worsen the endemic problem with dating sites: namely that there are far, far more men than women on them.

<comment><USER39> Actually back when I was using OKC I didn't have a problem finding women -- it was just that there were few dateable women.

I expect that to change though - one (of the many) differences between men and women is womens dating worth as a date falls in her twenties while the typical male sees his dataing value go up.

<comment><AUTHOR> [http://blog.okcupid.com/index.php/the-case-for-an-older- woma...](http://blog.okcupid.com/index.php/the-case-for-an-older-woman/)

<comment><USER39> I read it back before I settled on OKC.

I am still not interested in an older woman (or a fat one, or a fundie or a single mom). If I wanted to date my mothers friends I would give them a call.

</comment></comment></comment></comment></comment></comment><comment><USER40> it's probably not a big deal from their perspective, since 99% of people wouldn't realize to do that.

It's essentially good enough for them, since the mainstream audience wouldn't realize that, and if a few geeks figure out a way to cheat the system, then that's fine too, since they need all the help that they can get

<comment><USER41> There are other, more popular ways to game the system that have nothing to do with the algorithm (cf. [http://www.reddit.com/r/IAmA/comments/ekd1o/iam_my_own_okcup...](http://www.reddit.com/r/IAmA/comments/ekd1o/iam_my_own_okcupid_wingman_i_have_a_fake_profile/)).

</comment></comment><comment><USER42> Hmm, this does make me wonder about some people that I'm "almost perfectly" matched with. We potentially had too many mandatory questions matches, but a lot of the more subtle things got lost?

</comment><comment><USER43> Props for using Chris Rock's "I take care of my kids."

</comment><comment><USER44> Dear OK Cupid: Just because I weigh 280Lbs, it doesn't mean that I want to date a girl that weighs 250LBS...

<comment><USER45> Two way street. 125 pound girl might not be accepting of someone more than double her weight.

<comment><USER44> Who said anything about 125lbs, thats a far way away from 280... I joined but only got recommendations for people my size, but when I go out in public my choices are always varied. Its not just an algorhythm, a feature for random suggestion should be added.

</comment></comment></comment><comment><USER46> What's wrong with OKCupid's matching algorithm for me is that I can't get to use it at all! I just can't log in. I've been trying for the last 2 months, they just keep saying "Sorry, we're having technical difficulties right now. Check back later.". I have searched news for an explaination of a major OKCupid outage and found nothing. Is it just me?

<comment><USER47> They may have blocked your ip address.

<comment><USER46> Yikes! Looks like that; I've tried logging in via a proxy and it worked. Never thought they would filter me out this way, saying it's "technical difficulties".

Is there a way to contact them? They don't reply when I sent via Feedback form is not answered. I seriously thought they have gone out of business (however improbable it might be, being acquired just this year for $50 million)

<comment><USER48> There is no way of contacting them. I've had this problem myself, too. (I eventually changed IP address when I moved address.)

</comment></comment></comment></comment><comment><USER49> no role for stochastic processes in generating matches? so sad...

<comment><USER50> A stochastic input (ie: people) to a linear system is going to look pretty much the same as a stochastic input to a stochastic system.

</comment></comment><comment><USER51> Assuming OKC's target market is the relative majority in English-speaking countries it really doesn't take much crazy math to find matches, as in the matching facility is not going to be as important as the random number generator (or trained monkey) that is filling in the matches. All that really needs to be taken into account are features of the prospective match that the two individuals WANT to be taken into account(age/height/race/income level/political/religious). It isn't that complicated, especially since one of OKC's tactics is to use quizzes/'looking for friends' to break the stigma of online dating.

What is the stigma of online dating?

Obviously the implied answer is that if you are using online dating then you cannot find a date IRL. Or perhaps a kinder answer would be that you have too much going on to find a date IRL. This is the same principle as a meat-market nightclub/singles bar where the bouncer lets the guy with the two attractive women in, but the pack of forever-alones get locked out. Then the slightly wealthier gentleman pays $ to the nightclub to get in, for the opportunity to pay $ to one of the attractive women (in the form of a drink) for the chance to talk to her and (hopefully) get sex/affection/phone #.

Of course this is all crazy, but it is a way in which many bars/nightclubs/online dating works. If OKC can attract attractive women with quizzes/validation/'looking for friends' and associated kitsch, they have it made.

</comment><comment><USER52> The only online dating site that was worth a moment's time was Facebook, and then they removed the search facility.

OKCupid was interesting, but not a magic bullet. It was then bought by Match, which consists primarily of marketing and poor website construction.

Online 'dating' is a social problem more than a computing problem and, as such, no good solution will ever exist. Anyone male thinking of sinking time into one would be better served by simply getting out more, taking classes, adopt a dog and walk it, etc.

<comment><USER53> I have to agree with you in a sense that this is a social problem (but of course that's what's interesting with graph integration and social media now). As a guy who took Attraction classes (or PUA training as some might know it) and created a much higher success rate for myself by negating the traditional online dating sphere I do believe time is probably better spent offline-- however, I still think the computing angle of this and the way in which society is already headed, this is one of those holy grails of the internet.

<comment><USER52> That reminds me... I had a female friend who would likely be considered attractive to most. She was yammering on about how terribly _interesting_ this guy was who she met online. He kept asking such interesting questions, and gave her a "personality test" about a cube in the desert, and a ladder, and...

Several months later, when I was reading The Game, he got around to describing exactly this 'test'. I laughed for quite some time.

Apparently, PUA cheesiness works online, as well.

<comment><USER53> This is quite off topic but because of how well known 'The Game' is, it should never be used as a how-to as it once was but more of an inside look at what such a life entails. Quite a few girls have read such books, and actually look out for such tells to identify frustrated chumps--and well the "chessyness" and the hyper convoluted dating approach of that time just doesn't cut it anymore (I've seen some old techniques done, and successfully, but it's not advisable haha--but again a lot of these things are built upon psychological understandings), and it's a big reason why that field has really had to evolve in the past few years. Simple common sense and psychological and biological foundations seem to be the way to go.

</comment></comment></comment></comment><comment><USER54> Now a good way to single out the Hacker News Readers would be to identify males in the computer software industry who suddenly and significantly updated their profile questions shortly after November 23'rd 2011....would love to see some real data on how much action these users are getting!

</comment><comment><USER55> What I hate about OKCupid is that all the girls I've met only wanted sex. I.e. we have sex, it's all fun, and then they leave saying to call them back whenever I feel like having fun again. It's just not serious.. I clearly checked "Long time relationship".</comment>


Uber remotely locked down offices during police raids, shutting off computers - <AUTHOR> https://www.bloomberg.com/view/articles/2018-01-12/uber-looks-great-when-the-police-barge-in <comment><USER2> I honestly don't see a problem with this. If it weren't for the fact that it's a company this this site hates it would be hailed as a marvel innovation against states that are increasingly cavalier about disrespecting people's digital rights and privacy. If the police have all the proper warrants there's no reason they can't seize the locked servers and workstations and compel them to unlock them after the fact.

To me this just falls under the category of unauthorized access. If my threat model included people physically present using force to access my sysadmins' computers I would be implementing the same security with a company-wide lock- down triggered by a panic button on every machine.

<comment><USER3> Did you read the article? Please explain why you think it's unauthorized access.

>> When the call came in, staffers quickly remotely logged off every computer in the Montreal office, making it practically impossible for the authorities to retrieve the company records they'd obtained a warrant to collect. The investigators left without any evidence.

<comment><USER4> Determining authorized access is a process. Processes take time.

Just because some people in uniforms show up at your door and demand access, doesn't mean that's the entire process. Even if they have a nice piece of paper from a court, it's just the start of the process.

What if its just a ruse and they aren't really cops? What if they are cops, but the government is corrupt? What if the warrant was obtained in a faulty manner?

This sort of measure allows the company to engage with the process in a less disadvantaged way.

<comment><USER5> It also conveniently gives Uber more time to cover up whatever illegal activities they may have been up to.

This is the whole point of why police conduct raids:

 _...to use the element of surprise to arrest targets that they believe may hide contraband or other evidence, resist arrest, be politically sensitive, or simply be elsewhere during the day._

[https://en.m.wikipedia.org/wiki/Police_raid](https://en.m.wikipedia.org/wiki/Police_raid)

<comment><USER6> How does it give them more time? Shouldn't the goal of seizure is to remove access to something to someone and remove him the capacity to alter evidence?

If he refuses to comply or try to alter the evidence while complying, sure, they are guilty and I'm pretty sure there's a legal process for this situation, but at this point right now if they seized the data, they can no longer alter it.

</comment></comment></comment></comment></comment><comment><USER7> Or with a different spin.

Locking your computers that are no longer in company possession is a common Enterprise control. They take protecting your data seriously!

If the authorities need the data on the computers the will surely present a properly scoped warrant!

<comment><USER8> As I understand it, Ripley's purpose is to destroy evidence in anticipation of a lawfully conducted search. If so, this would likely contravene anti- spoliation laws in the U.S., among other jurisdictions. See, e.g., [http://apps.americanbar.org/abastore/products/books/abstract...](http://apps.americanbar.org/abastore/products/books/abstracts/5190497_chap1_abs.pdf)

<comment><USER9> Destroy Evidence is strong phrasing. The evidence still exists, its just no longer within the scope of the police warrants. My interpretation of the article is that the information is all stored on Uber's US-based servers and the tool remotely revokes the satellite offices' connection to the servers, probably also shutting down the machines so nothing is left recoverable in memory.

In weaker, but likely relatively accurate words: They're logging all of their remote users out of Google Drive so the authorities can't access the spreadsheets there. In essence. That's what I'm reading.

Point being, Uber could still be compelled to present the evidence in court, and Uber may comply with that compulsion. Does a Canadian warrant give the Canadian government the right to access information stored on a server in the United States? The answer to that is an emphatic No. Does it give them the right to possess an API key which would allow them to access information stored on a server in the United States? Does this change if it could be reasonably expected that the information was, at some point, in the ephemeral memory, not even a hard disk as far as we know, of a computer on Canadian soil?

I really don't know. We all knew the global power of the internet would begin to raise questions like this, and our legal framework simply hasn't dealt with them yet.

<comment><USER10> Well firstly, no cloud storage system works with 0 locally cached data. What Uber are essentially doing is deleting evidence covered by the warrant by deleting the local copies. The evidence may exist elsewhere, but that doesn't mean that deleting the evidence covered by the warrant is any less illegal.

Once the warrant is served, anything done to delete anything off that computer is obstruction of justice, it doesn't matter what the mechanism of storage is- whether it's RAM, Hard Disk or floppy disk.

Secondly, the warrant is what compels uber to give access to the evidence, there's no 'We don't feel like it right now, go to the courts to try something else'. The ability of the authorities to gain evidence through other legal avenues provides literally no defence for uber in failing to comply with a warrant.

</comment></comment></comment></comment><comment><USER11> If the authorities had a warrant, why wouldn't they just take all the locked computers with them back for further investigation? Then they would have been able to have a judge order Uber to unlock the computers for forensics.

Uber's actions are similar to shredding evidence of tax evasion, which in the case of Arthur Anderson during the Enron scandal, resulted in federal obstruction of justice charges, and a strengthening of federal powers for charging of similar actions.[0]

Note: I am not a lawyer, nor a resident of Canada, so I am not sure if my proposal above is legal within that country. But it would seems to me that actions similar to the above have taken place in the USA in the case of tax evasion with probable cause.

[0] [https://blj.ucdavis.edu/archives/vol-5-no-2/document- destruc...](https://blj.ucdavis.edu/archives/vol-5-no-2/document-destruction- after-enron.html)

<comment><USER12> > "Uber's actions are similar to shredding evidence of tax evasion"

But Uber didn't delete or otherwise destroy the evidence. It locked the evidence while preserving it, so that it can provide the required amount of data if / when properly served with a warrant.

<comment> mark-r The whole point of the warrant was that the government suspected Uber of hiding evidence. Allowing them to pick and choose the data they unlocked from the servers would be counter-productive.

<comment><USER13> In Canada, like in the US, warrants have to be specific about what exactly the police are looking for. If the warrant really was "give us all your data so we can see if you're hiding something", that's not legally okay, and I can't blame them for trying to prevent the disclosure.

</comment></comment></comment></comment><comment><USER14> This article doesn't specify exactly the legal problem here. Maybe the article just lacks key details, like how Uber violated the warrant or the legal repercussions they could face.

The article vaguely makes it sound like Uber acted within their rights and the police just don't like that they didn't find a bunch of unlocked computers to rummage through, by virtue of what it omits. I don't have a problem with that. If their warrant amounts to a fishing expedition, it actually sounds like harassment of Uber. A warrant should specify something you have some likelihood of finding. If the police walked away empty handed and Uber doesn't face charges for destroying evidence, it seems like they had a bad warrant to begin with.

</comment><comment><USER15> So, what else this horrible Uber does? Maybe it locks office doors at night so that random people cannot enter and take whatever they want?

<comment><USER16> More like, putting all documents in their lockboxes (which exist for a good reason) _when the police show up during normal business hours with a warrant_.

<comment><USER17> Details on the specific warrants are scarce in the listed article, but if the police had a warrant for specific data, it seems strange that they would be raiding satellite locations. Moreover, with a properly scoped warrant, my understanding is that authorities may seize locked devices and compel Uber to unlock them.

While I am loathe to defend Uber, these measures appear designed explicitly to prevent police fishing expeditions, which I am fully in favour of, and to serve little further purpose.

</comment></comment></comment><comment><USER18> That's pretty interesting. It must be extremely risky for local employees to alert the main offices to lock down. I'd imagine obstruction of justice isn't a crime your average employee would risk.

<comment><USER19> Alerting the central offices isn't a crime, and whoever is in the central offices can vanish behind a wall of bureaucratic malicious compliance.

<comment><USER20> It most certainly is a crime if it's done with foreknowledge of what the central office will then do, which is clear-cut obstruction of justice.

And from all reports, employees were specifically trained to do this, and they knew why. Open and shut case.

<comment><USER21> Are you a lawyer?

</comment></comment></comment></comment><comment><USER22> Seems like a reasonable way to prevent overly-broad fishing by law enforcement. If they have a warrant they can request information through legal channels.

The raids are just theatre.

<comment><USER23> Uber has already been seen to act adversarial to law enforcement, raids are utilized to try and limit Uber's ability to conceal information. I have no doubt in my mind that Uber would willingly fail to comply to requests for information.

<comment><USER24> The mirror image of your argument is just as applicable:

Law enforcement has already been seen to act adversarial to private interests, remotely logging out of computers is utilized to try and limit law enforcement's ability to obtain information beyond the scope of a warrant. There is little doubt that law enforcement would willingly take information beyond the scope of the warrant and later find a way to use it against them.

<comment><USER25> > Law enforcement has already been seen to act adversarial to private > interests

If enforcing law is seen as adversarial to private interests, then those private interests are by definition, against the law.

<comment><USER26> Really? By that logic the private interest of a lot of non-white drivers of staying alive must be against the law. The time for hero worship and blind trust is over.

</comment></comment></comment></comment></comment><comment><USER27> I'm by no means a fan of Uber, (and I'm not in Canada) but keeping information from plain sight != hiding evidence.

Come back with a better warrant.

</comment><comment><USER28> This is exactly what I'd want a company holding my personal data to do. There are lots of problems with Uber, but this is one of the good things.

</comment><comment><USER29> """The name is an allusion to "Aliens," in which Sigourney Weaver's Ripley character says "Nuke the entire site from orbit.""""

Oh gosh, what a meeting that must have been with the devs who came up with this codename. This should go down in Tech History.

<comment><USER30> Actually this is pretty common, I use names from my favorite movies in code all the time. Star Wars, Harry Potter, etc. Especially when it fits the project or functionality.

<comment><USER31> My dog's name is Bishop, same source.

<comment><USER32> My last laptop was Nostromo, same place of inspiration.

</comment></comment></comment></comment><comment><USER33> See also [https://news.ycombinator.com/item?id=16124165](https://news.ycombinator.com/item?id=16124165)

</comment><comment><USER34> Judges that sign off on search warrants will not be happy with this and will very much want to know what Uber is so concerned about hiding from proper law enforcement. In essence, judges that sign warrants will smell something very fishy here and they will not be happy. Uber is, of course, free to piss-off judges. However, they are not free from the consequences of pissed-off judges. Uber has also shown that they are just fine with handing employees over to the mercy of pissed-off judges, something at an individual without a stellar legal team is unlikely to view as a walk on the beach.

</comment><comment><USER35> Impressive (and stupid) I'm really astonished to laughter by Uber more and more. They're trying to be a darknet company operating in clearnet... Make up your mind you shady fellows

</comment><comment><USER36> I really hope some law enforcement agency will someday classify uber as a: "organized crime group". I don't mean the drivers --- but management is doing absolutely everything to obsruct law enforncement (for example --- making it virtually impossible for transport inspection to call Uber vehicles).

</comment><comment><USER37> Article is a bit vague. It doesn't mention the police (it seems they were tax inspectors), and although it does say they had a warrant it doesn't seem likely that police with a warrant wouldn't have just seized the machines.

</comment><comment><USER5> From now on the police should cut power and network access to Uber's offices just before they conduct their raids.

</comment><comment><USER38> Another article from Bloomberg that speaks on this [1]

[1] [https://www.bloomberg.com/news/articles/2018-01-11/uber-s- se...](https://www.bloomberg.com/news/articles/2018-01-11/uber-s-secret-tool- for-keeping-the-cops-in-the-dark)

</comment><comment><USER39> So far, I haven't been super against most of uber's law flouting: taxi service stuff, tax stuff.

However, as they grow, as they get autonomous cars, as they get autonomous drones, once they get to the point where there could be more serious consequences, I'd like to see more accountability.

</comment><comment><USER40> I really hope justice is served one way or another. This action by Uber feels really shady to me (much worse than Google's tax evasion loopholes). What would be the consequences if something like this happened in a European country such as Germany?

</comment><comment><USER41> Hope uber gets banned and lyft takes their spot. My recent trip to canada was pretty shite using uber.

</comment><comment> Paul-ish Couldn't law enforcement cut internet access before the raid to prevent this?

<comment><USER42> Then you just lock your machines down when there's no internet access.

</comment></comment><comment><USER43> Why are governments around the globe so keen in taking down Uber?

<comment><USER37> In many cities and countries the taxi industries have successfully 'captured' the regulatory authority, and now the regulations mainly exist to restrict competition.

</comment></comment><comment><USER44> In my opinion it's not your job to willingly provide self-incriminating evidence. I have no idea if that legally applies to corporations (particularly in Canada) but this seems like a precaution I would expect every business to take.

You would hope they wouldn't _need_ to take it, but if I were CEO of a company I would order the computers shut down even if everything were above-the-book.

Of course, maybe that's why I'm not CEO of a company. Who knows.

<comment><USER45> (My post is about England. I'm not sure abot other countries.)

That's true if they've just come knocking. But at the point they have warrants you're risking prison.

Court orders are orders, and they are to be obeyed in full and on time.

<comment><USER46> You've never been through the family court have you?

<comment><USER45> Here's a reasonably recent document from the President of the Family Court division in England.

[https://www.judiciary.gov.uk/wp- content/uploads/JCO/Document...](https://www.judiciary.gov.uk/wp- content/uploads/JCO/Documents/Reports/view-7-changing-cultures.pdf)

> What I fear is an even greater cause for concern – and it is for me a real > concern – is something symptomatic of a deeply rooted culture in the family > courts which, however long established, will no longer be tolerated. I refer > to the slapdash, lackadaisical and on occasions almost contumelious attitude > which still far too frequently characterises the response to orders made by > family courts. There is simply no excuse for this. Orders, including > interlocutory orders, must be obeyed and complied with _to the letter_ and > _on time_. Too often they are not. They are not preferences, requests or > mere indications; they are orders. This principle applies as much to orders > by way of interlocutory case management directions as to any other species > of order. The court is entitled to expect – and from now on family courts > will demand – strict compliance with all such orders. Both parties and non- > parties to whom orders are addressed must take heed. Noncompliance with an > order by anyone is bad enough. It is a particularly serious matter if the > defaulter is a public body. Non-compliance with orders should be expected to > have and will usually have a consequence: see Re W (A Child), Re H > (Children) [2013] EWCA Civ 1177.

But you're talking about a parent ignoring court orders, I guess, in which case this one is more relevant: a mother made false allegations of abuse against the father, and continued to do so; and removed the child; and continued to do so; and she did those things after being ordered not to, and she got a (suspended) prison sentence as a result: [http://www.bailii.org/ew/cases/EWHC/Fam/2017/3358.html](http://www.bailii.org/ew/cases/EWHC/Fam/2017/3358.html)

> The judge had indicated that she was prepared to authorise disclosure of her > Judgment to the Judge at the Kingston Crown Court, and that if the 1st > Respondent objected she would be required to make her objections known. On > 25th January 2016, the judge ordered her judgment may be released to the > sentencing judge. The 1st Respondent received a four-month sentence, > suspended for six months on 27th January 2017.

EDIT: And here's a direct link to the cases he mentions at the end of the para I link above: [http://www.bailii.org/ew/cases/EWCA/Civ/2013/1177.html](http://www.bailii.org/ew/cases/EWCA/Civ/2013/1177.html)

</comment></comment></comment></comment><comment><USER47> Misleading headline here on HN; the source article correctly used past tense, since this system is no longer used. The comments comparing this to "shredding" and "destroying" evidence are also misleading; Ripley did not destroy information.

<comment><USER48> Ok, we've changed the title to use the article's subtitle.

The submitted title was "Uber remotely locks computers during police raids to block information access". Since the site guidelines ask submitters not to use article titles when they're misleading or linkbait, I assume the submitter was trying to helpfully follow the rules. It's better to use representative language from the article itself, though, to avoid blunders—and in this case the subtitle can easily be shortened.</comment></comment>


Chrome has transcended version numbers - <AUTHOR> http://www.codinghorror.com/blog/2011/05/the-infinite-version.html <comment><USER2> That upgrader using binary differences (courgette) is impressive. From 10 megabytes to 78 kilobytes. I wonder why Linux distributions such as Ubuntu still download the entire new packages on an upgrade. A lot of upgrade time and bandwidth could be saved by only sending the differences. And it would reduce load on the mirror sites.

Edit: did a bit of looking around and it seems to be planned for Oneric Ocelot

[https://blueprints.launchpad.net/ubuntu/+spec/foundations-o-...](https://blueprints.launchpad.net/ubuntu/+spec/foundations- o-debdelta)

<comment><USER3> > _I wonder why Linux distributions such as Ubuntu still download the entire > new packages on an upgrade. A lot of upgrade time and bandwidth could be > saved by only sending the differences. And it would reduce load on the > mirror sites._

Speaking as someone who has worked on this problem for my own projects [1], I think I can answer this.

Fedora/Yum already supports downloading a binary diff between rpm packages to reduce download size, but this also requires keeping a cache of previous rpm's to run the patch against. There are multiple reasons why you can't rely on binary diffs against the files actually stored on the system, most namely for files like /etc/* that are more than likely modified since installation.

But the real problem with binary diffs is that unless you're doing what Google does to ensure that people stay up to date, the number of binaries you need to diff against grows very quickly, and there are a lot of edge cases to take care of.

For example, let's assume some package A has been released as version 1, 2, and 3. When A has a new release 4, you obviously want to build a diff against release 3, but then you also most likely need or want to build a diff against 2 and maybe even 1 to take care of people who haven't already upgraded to 3. And even if you build a diff against _every single version ever released_ , you will still always need to provide a full version of the package as well for two cases:

1\. New installations, or reinstallations, of the package.

2\. When the user has cleared their package cache to save room.

And even beyond that, creating diffs involves a lot more effort and knowledge on the part of the packaging team because they not only need to _know how_ to build those diffs, but they also need to keep track of old package versions to build those diffs against.

The end result is that you trade download bandwidth and time on part of the server and end users for a lot of effort, time, and storage space on part of the packagers and distro mirrors. For mirrors that are already encroaching on 50GB for a single release of Ubuntu and/or Fedora, adding a whole bunch of binary diff packages will most likely grow the repository size by at least 30-50%, if not more, depending on how many old versions you diff against.

The question then becomes: does this trade off actually make sense, or does it present further roadblocks for contribution from packagers and donated mirrors?

[1]: If you would like to see how I handled this sort of task, I have a Python library I wrote to handle the client side updating. I know it's not the entire piece of the puzzle because it doesn't cover generating the updates, but it might be useful for someone else. <http://github.com/overwatchmod/combine>

<comment><USER4> > When A has a new release 4, you obviously want to build a diff against > release 3, but then you also most likely need or want to build a diff > against 2 and maybe even 1 to take care of people who haven't already > upgraded to 3.

You wouldn't need a diff for every combination (1->2, 1->3, 1->4, 2->3, 2->4, 3->4 in the four version case), just the three diffs 1->2, 2->3 and 3->4\. Then if someone has v2 you send out the diffs for 3 and 4 and have the client apply both in order to make the updated package ready to apply. The saving in space and number of diffs stored will grow as the number of versions grows.

This will be a little less efficient in terms of bandwidth use on average when people are skipping a couple of versions, but will make little or no difference if people are upgrading in a timely manner (so are only moving in single version steps most of the time) and will save space over storing diffs between all versions.

As well as the diffs I would store checksums for each version and have the client send the checksum for the version they have just-in-case, to avoid sending a diff (sending the file package instead) if the reference file seems corrupt.

Also if you store diffs for both directions you can serve old versions of packages (in case people need to roll-back due to some unexpected incompatibility, or they are developers needing to build a test environment with older library versions) without storing every version completely. This increases the diffs per package, but not nearly as much as storing one diff between every version (for 11 versions, 1 diff per change is 10, diffs in both directions is 20, diffs between all versions totals 45 (or 90 for both directions), for 21 versions those numbers are 20, 40, 190, 380).

<comment><USER5> In my experience, diff + diff + diff = super-long update process. It was done for many game updates up to several years ago, and an update from the box version through 3 patches could take up to an hour. The install, meanwhile, would take 20 minutes or so at most.

edit: not that I don't think this can be improved, nor that the updating software they used was any good. Just sayin'.

<comment><USER4> Often with game updates to get around the fact that patching the compressed multi-asset files directly would not be efficient (as a change early in the file would mean the rest of the file to the end would need patching unless they had the foresight to use something like gzip's rsync-friendly option), the patch would unpack the compressed resource files, patch them, then recompress. Depending on how granularly the assets are distributed amongst the installed files and how many of them were being touched by the patch this could be a lot slower than just reading the compressed file from CD to hard- drive which is what the installer would do.

Of course this means that if using the multi-diff method of update distribution you would need to be careful about your selection of compression arrangement to avoid the same inefficiency (unless the saving in bandwidth for the client and the package storage servers is far more important than a bit of extra time spent on the updates client-side)..

</comment></comment></comment></comment></comment><comment><USER6> Maybe people are looking wrong at Chrome version numbering. Take GNU Emacs for instance. At some point the developers realized that their software would never be the subject of a change in nature big enough to change the major version number, so they ditched it. Now we have Emacs 23 but it's actually Emacs 1.23, and nobody complains.

I think it's really a non-issue and it's not really worth talking about: Chrome just doesn't display the '1.' (or '0.' depending on your view point ^^) in front of its version number :-).

<comment><USER7> Yeah, its more a release number. It makes sense to use a single positive integer and simply increment it every release.

Having said that, though, I quite like Semantic Versioning[1]. The advantage it has over a single incrementing counter is that you know when API compatibility changes.

[1] <http://semver.org/>

<comment><USER8> Right. Think of a new version of some software that drops support for a deprecated part of an API in a minor release. I did get screwed by that happening with a Latex package, xy-pic, some years back.

<comment><USER7> Yeah. Painful. Thats the kind of thing semantic versioning aims to solve: within a major release, all minor and patch releases must maintain backwards compatibility. Patch releases may not change the API at all; minor releases may add to it but not remove things[1]. Major releases may drop backwards compatibility by removing or modifying API items. Seems like a reasonable system to me and would avoid the problem you mentioned.

[1] I guess it can deprecate things, as long as they are still available for use.

</comment></comment></comment></comment><comment><USER9> This is exactly the sort of visionary engineering needed to break the field into the next stage. This isn't just a quantitative difference, it's a revolutionary qualitative difference!

Our online infrastructure is _broken_ in ways we're dimly aware of, because it has always been that way. In the same way that people trying to do business demand network, electric, and roadway infrastructure that once didn't exist, we will someday demand software infrastructure with features that do not exist today.

Chief among these will be security features. If Google plays their cards correctly, they can create an ecosystem that stays ahead of the black-hat hackers. By correctly incentivizing white-hat hackers, they could expose and patch security holes fast enough to ruin the economics of the black-hats. This infrastructure will enable Google to make more money, resulting in a virtuous cycle.

If the infrastructure can be extended to the server-side, with web app frameworks that receive security updates with equal rapidity, then Google can establish a secure, smoothly running "toll road" -- an infrastructure subset relatively free from problems faced by the rest of the net. That could be worth billions.

(We'll know this strategy is winning if/when Microsoft starts doing it too. Once that happens, we'll be in a new era of computing.)

<comment><USER10> > if/when Microsoft starts doing it too

They already do it with Automatic Updates. Turn the update dial to 11 and let your machine apply them at night. I don't believe they provide binary diffs for updates, but I believe it's for logistical reasons rather than technological (e.g., title updates over XBL are surprisingly small).

Of course, MS also hasn't figured out how to update components in-place while they're being used, so expect your machine to be restarted in the morning. :-/

<comment><USER11> Chrome needs to be restarted after updates, too.

<comment><USER12> I wouldn't put it past google to be working on fixing that too.

</comment></comment></comment></comment><comment><USER13> > Somehow, we have to be able to automatically update software while it is > running without interrupting the user at all. Not if -- but when -- the > infinite version arrives, our users probably won't even know.

For what it's worth, this is already available in Erlang (although it was built in for different reasons, closer to getting the fluidity of web applications updates on just about any server software): two versions of the same code can live in parallel in the VM, and there are procedures for processes to update to "their" new version without having to restart anything (basically, you switch functions mid-flight and the next time an updated function is called the right way, the process just switches to the new code path).

You need follow a few procedures and may have to migrate some states, but by and large it's pretty impressive. And it could certainly be used for client- side software. The sole issue I'd see would be the updating of a main GUI window in-flight (how do you do that without closing and re-opening it?). But I doubt this one changes _that_ much in e.g. chrome these days.

<comment><USER14> Following ideas from both erlang and android, each gui screen within the application would be attached to a single process. When a new screen is opened the process is killed and a new process starts. If new code has been loaded the new process will switch.

<comment><USER13> Screenwise is not really a problem, you can just delete and reload the controls the next time the thing becomes visible. To get back to chrome, you could even swap the JS engine and DOM: leave the old one running in existing tabs, switch new or reloaded tabs to the new one, that's pretty much seamless.

The issue I have is for the "static" chrome around the mobile parts: title bar, URL bar, that kind of stuff. There isn't much opportunity to switch that to a new process, I think. Especially if there are changes to make to the UI.

<comment><USER15> Fortunately, those don't actually need to be changed very often (no matter what the Chrome team says). As long as the rendering, JavaScript, and other parts that touch untrusted data stay up to date, you're probably fine with a URL bar that hasn't had today's unfashionable components removed.

<comment><USER13> I did note that in my original comment, but you need to note the following: if the software never _needs_ to be restarted, you _will_ find somebody who never restarts it. The result is that sections of the code base may get out of sync, resulting in nonsensical behavior. 6 months from now, somebody _will_ push code which does not work anymore with right now's awesomebar (or whatever), and the results may be minor or may lead to significant loss of state and information.

</comment></comment></comment></comment></comment><comment><USER16> There are disadvantages to constant, automatic updates.

I had a call from someone who'd been using Chrome to regularly print a web page, and one day it just stopped working. The site hadn't changed, but for whatever reason the latest version of Chrome just didn't render it. And of course trying to install an older version of Chrome was quite difficult.

(In Google's case they do now have a way to disable the updates, but not all software is so good about it)

<comment><USER17> I experienced this yesterday. My website renders differently now than it used to on Chrome last month. Firefox and IE still look "correct". I used to think the auto-update feature on Chrome was great, but now I'm not sure. I can see why some companies still stick to IE 6 internally. It's stable.

<comment><USER18> Please consider reporting the bug so that we can fix the problem:

<https://bugs.webkit.org/enter_bug.cgi?product=WebKit>

We have a large number of tests, but sometimes we miss things. :(

</comment></comment></comment><comment><USER19> I stopped looking at Chrome's version numbers (unless I have a specific issue or question about Chrome) back around 9. That's because 9 was the last development version I used... The features I need are all in the stable release now. When 10 came out, my 9-dev turned into 10-stable and I didn't pay attention from there.

At this point, I don't even bother 'updating' (read: close the browser and open it again) for up to a week or 2 after an update comes out, unless I need to close my browser for some other reason.

</comment><comment><USER20> Oh, how I wish I had this issue with Android! I'm currently locked at version 1.6...

<comment><USER21> No doubt Google would be glad to develop and update Android in the same way... if we could only get the carriers to step aside.

</comment></comment><comment><USER22> I run the Canary build so I get an update every day.

[http://googlesystem.blogspot.com/2010/07/google-chrome- canar...](http://googlesystem.blogspot.com/2010/07/google-chrome-canary- build.html)

It's impressive how stable the nightly has been.

<comment><USER23> Is the canary build stable enough? It seems to have a lot of impressive features.

<comment><USER18> The Canary build goes out automatically without being looked at by a human, so there's a very real possibility that it will be unstable. Currently there's some strange crasher in the PDF viewer, for example.

You can install Canary "side-by-side" with another channel, so you can switch back to something more stable if canary goes pear-shaped.

<comment><USER24> And with syncing everything from extensions to preferences stays consistant between the two.

</comment></comment></comment></comment><comment><USER25> John Boyd would be proud. Everything else being equal, the team with the fastest OODA loop usually wins: <http://en.wikipedia.org/wiki/OODA_loop>

</comment><comment><USER26> Apples App Store, for both Mac and iOS, could learn a thing or two from this, their software update experience is awful, requiring you to re-download whole multi-gigabyte apps sometimes for minimal updates.

<comment><USER27> Not only should Apple do this for iOS apps, they should do it for Xcode. It's 5GB EVERY TIME, it's like a conspiracy...

</comment></comment><comment><USER28> Microsoft actually went to great length to build an update mechanism that doesn't require reloading. It seems this is not so useful after all, and it's not being used: <http://jpassing.com/2011/05/01/windows-hotpatching/>

</comment><comment><USER29> There are software systems which do get updated while running though, but perhaps it requires a change in software architecture more than just (very clever) diff tools. Erlang systems, for instance, can have the concept of hot code swapping baked in to them in a more predictable way because that requirement is part of the base system - application life cycle is built in to the platform, not on top of it. Of course, for systems such as telecoms switching, the complexity and cost of this was worthwhile. For browsers... perhaps not. Cost/Benefit analysis is probably the usual trusted friend. What would we hope to gain (and how would we measure it) by letting browsers never restart?

</comment><comment><USER30> So how do you roll back with Chrome when it breaks a plugin for example?

I guess this means for ignorant users this is good but for power-users we are having more and more control taken away from us.

Personally I disable all of Chrome's phoning home because it's impolite and does it too many times per day and I have no easy way to verify exactly it's sending all those times.

<comment><USER31> It seems as though Google is trying to eliminate this by supporting their own plugins. Flash has been shipping with Chrome for a while, and a PDF reader has been shipping for months.

Those two plugins have 90% of people's plugin needs covered.

</comment></comment><comment><USER32> Would they really stop at Chrome infinity ? I'm pretty sure they would make a version aleph one next. And so on.

</comment><comment><USER33> That's a great improvement over a generic binary diff. I remember Symantec was doing something similar for their AV definitions updates. In fact they got some patents: <http://www.symantec.com/press/2001/n010207b.html>

</comment><comment><USER34> This is slightly offtopic but Wordpress built-in update feature only works in you have ftp on your server. If you've disabled FTP for security reason updating becomes a manual process. I wish the WP devs would use patch or some other, CLI friendly, solution.

<comment><USER35> If you install the ssh2 PECL extension, the updater will also allow you to update over SSH/SFTP.

</comment></comment><comment><USER36> Made a similar observation yesterday. Only times that the Chrome version has mattered in my recent experience have been with regards to the recent WebGL security hole and with Native Client.

</comment><comment><USER37> Here is how I see things:

1\. Updates should not only be applied in sequence.

It is better to produce a binary diff between any two versions, and apply only that (one) binary diff. The reason for this isn't efficiency, but semantics. Updates not only fix things, but break things. Meaning, updates corrupt application state (data), both in-memory and on-disk. It can be disastrous to apply an intermediate update that removes state, only to realize that a future version reversed the semantics and needs to use that state (which was available, but is now gone).

Peserving backward compatibility is important, which means the ability to skip some version updates is necessary. To the extent possible, reversing updates is important too.

2\. The ideal update system should apply updates live, not offline.

With a model that accounts for updating the entire state of an application, updating live is possible. The reason most updates are not applied live yet is that the model is not descriptive enough to change the entire state of the running application.

Notable state that should be updated, but often isn't, is continuations and the stack. This is why GUI applications need to be shut down to update.

Scheme's call/cc (call-with-current-continuation) solved making changes to continuations and stack state decades ago better than Erlang. Erlang cannot force stacks unroll or continue from arbitrary points.

3\. Updates must be produced with source code and programmer input.

Updates should not be produced with binaries as input.

The reason is the need to account for application semantics, which binaries do not expose in the detail source code does. Although automated, sophisticated semantic-diffing based on control-flow can be developed, it is sometimes inconclusive whether an update will break things.

4\. It is necessary for programmers to provide live update guidance.

In the cases where producing provably safe dynamic updates is not possible, it is input from the programmer that can clear any conservatism of the safety certification process.

Tools are needed for programmers to reason about the semantic safety of their live updates, integrated in the development process. Including tools that help transform application state between versions.

</comment><comment><USER38> I'm a big fan of their frequent updating even if the version bumps do get out of hand. Thanks Google for continuous improvements and updates!

</comment><comment><USER39> Being a software developer sometimes feels like an especially thankless position -- if you're doing your job well, users never think of you.

<comment><USER40> Unlike what job? Aircraft mechanic? Pilot? Street cleaner?

</comment></comment><comment><USER41> > But even Google hasn't figured out how to install an update while the > browser is running.

I don't think it ever displayed that dialog on OSX.

<comment><USER42> The screenshot you're referencing is from OS X! If you don't quit Chrome for a while, then open "About Google Chrome", that dialog or something very similar will display.

<comment><USER41> Oops, my bad! I do quit Chrome accidentally from time to time (Cmd-Q being neighbor to Cmd-W).. Thats probably when Chrome is updating.

</comment></comment></comment><comment><USER43> Updated icon deserves it is own version number and release cycle if it is by google (chuckle)

</comment><comment><USER44> Making the side tabs acceptable-looking would be worth a real version number.

<comment><USER45> File a bug or feature request: <http://code.google.com/p/chromium/issues/entry>. Complaining on forums is not likely to get you very much.

</comment></comment><comment><USER46> Preach on, brotha!

<comment><USER46> as an aside: I definitely was agreeing with him. jeez, you guys are difficult.

</comment></comment><comment><USER47> Jesus, the 90° rotated "8" that should be an infinity sign is ugly as hell.

Edit: wording

</comment><comment><USER48> Chrome crashes more than any other browser I've used, but the best thing about it is that they have even made crashes seamless.</comment>


Cars and the Fourth Amendment - <AUTHOR> https://newramblerreview.com/book-reviews/law/a-century-of-cars-driving-the-fourth-amendment <comment><USER2> An old parking enforcement technique is to put a chalk mark on a car's tire: if you come back after two hours and see the same car with the marked tire you know that it has parked too long and can be ticketed.

The 6th circuit recently ruled that is an unconstitutional search[1]: a government agent is physically intruding on a private area (your car) and searching it for information (how long it's been there).

Neat stuff.

[1][http://www.patc.com/articles/2019_taylor_v_saginaw_chapman.p...](http://www.patc.com/articles/2019_taylor_v_saginaw_chapman.pdf)

<comment><USER3> That puts them in a weird, paradoxical position:

1) Illegal: Placing a mark on your tires that will quickly fade with time and invades your car just enough to reveal whether you adhered to the limits.

2) Legal: Monitor the area with video surveillance and take pictures of every license plate that ever parked there, with timestamps and a photo of the occupants, and store that information for eternity, to be shared with any LEO who wants it.

(2) _feels_ a lot more invasive than (1), but courts consider (2) okay because it just uses stuff visible to the public, while (1) actually physically modifies your car.

Edit: See also the conflict with the long-standing, uncontested practice of leaving a fingerprint on a car's tail light at the beginning of a stop before observing any wrongdoing that warrants such a "search": [https://news.ycombinator.com/item?id=19730452](https://news.ycombinator.com/item?id=19730452)

<comment><USER4> Strange how a chalk mark is illegal, but placing a ticket under the windshield wiper, or sticking a "vehicle to be towed" sticker on the window isn't.

To add: I'd personally much rather local LEOs use the chalk method than the camera method.

<comment><USER3> In fairness, the argument is about what you can do to a car _before_ you have evidence of wrongdoing, and the sticker/tickets happen _after_ they have observed an infraction, so that's less problematic in the context of the ruling.

Edit:

>To add: I'd personally much rather local LEOs use the chalk method than the camera method.

Me too!

</comment></comment></comment></comment><comment><USER5> It's going to be interesting how it will work with self driving cars. Arguably the police will push for some kind of police only "pull over and stop" feature they can aim at any car which I'm sure will get absued. If you're in a self driving taxi you'd arguably not be the one abliged to pull over, rather the taxi's virutal driver is the one that needs to pull over. In fact with perfect self driving the passenger might not even be remotely aware of being asked to pull over. They could be asleeep, watching video with headphones on, playing VR games, anything to pass the time.

Also scary to me is the ability to use a self driving car as a slow moving cruise missle. They have a much longer range than drones. It seems only a matter of time before someone decides to use one in that way or other scary ways.

<comment><USER6> > Also scary to me is the ability to use a self driving car as a slow moving > cruise missle.

To what, hit a person?

<comment><USER7> [https://en.wikipedia.org/wiki/2016_Nice_truck_attack](https://en.wikipedia.org/wiki/2016_Nice_truck_attack)

86 people were killed, 458 hurt.

<comment><USER8> Don't see how these two things are related.

</comment></comment></comment></comment><comment><USER9> Cars are an interesting area because I immediately thought of our digital presence as an even more modern area of struggle for an expansive interpretation of our rights. If cars are an area of contention, in a sense, as a portable piece of our homes and persons, then our data and digital presence should similarly be considered our persons, "papers and effects" under the fourth amendment.

<comment><USER10> I don't if I'd want to go in that direction because "behavior" can lead to probable cause... so probable cause to look at your phone too?

<comment><USER9> If the fourth amendment doesn't apply to your phone, then your phone can be looked at anytime by authorities with no need to cite probable cause, nor a warrant. Or am I missing something?

<comment><USER11> I don't think digital technology needs to apply here at all. Before there were phones, were authorities able to stop you and look through your personal papers or briefcase or other personal effects you were carrying, without probably cause or a warrant? I don't think. A phone isn't any different, it's just a lot smaller than a briefcase.

<comment><USER10> Good question. Hopefully someone is familiar with this scenario and could provide opinion on it.

</comment></comment></comment></comment></comment><comment><USER12> A friend was and LAPD detective for 35 years. He said it gets _a lot_ more sticky in regards to RVs, because then you can claim is _is_ your home.

<comment><USER7> I'd love to hear more anecdotes about this if you have any.

<comment><USER13> [https://www.youtube.com/watch?v=Wfr0g7__9YA](https://www.youtube.com/watch?v=Wfr0g7__9YA)

While not legal advice, it's pretty much exactly what the GP was describing

Edit: corrected clip to the correct scene</comment></comment></comment>


The Management Myth - <AUTHOR> https://www.theatlantic.com/magazine/archive/2006/06/the-management-myth/304883/ <comment><USER2> I think of concepts like "barriers to entry" or "differentiators" or "channels" or "positioning". These words all have important meanings and implementations which can impact whether a business succeeds or fails. They can all drive strategy. These aren't things one learns by studying philosophy. And, yes, understanding those things can lead to "out of the box" thinking relative to others who lack such insight.</comment>


Apple has no 7-inch iPad planned for 2012, iPad 2 price drop coming - <AUTHOR> http://www.bgr.com/2011/12/23/apple-reportedly-has-no-plans-for-a-7-inch-ipad-ipad-2-price-to-drop-when-ipad-3-launches/

<comment><USER2> They should just try to eliminate the bezel. That would remove a lot a real estate and weoght.</comment>


Visualize bike rental data in Clojure - <AUTHOR> https://functional.christmas/2019/17 <comment><USER2> Quil looks cool but it's a shame it only supports JDK 8, like many other things. I use Clojure2D as it seems to work fine on JDK 12

</comment><comment><USER3> Thank you for the article! Another great library for visualizations in Clojure and ClojureScript is [https://thi.ng](https://thi.ng)

<comment><USER3> Apologies for the broken link. It's [http://thi.ng](http://thi.ng)</comment></comment>