Beware the Pretty People - <AUTHOR> http://techcrunch.com/2015/02/28/beware-the-pretty-people/ <comment><USER2> No one has or should have stranglehold on nor should claim to own an industry (territorialism). Industries just are -they don't care who the constituents are. People come and go. Does it matter what it once was, and what it's becoming? No. Stop the provincialism and the bemoaning of the illegitimate successors. Things change. They are meant to. People will always try to seek success wherever it can be found, now it's tech, decades from now it will be something else.

I really don't get this. Most people acknowledge there should be a more even balance of women in technology. But, the diversity is only welcome if the women are other nerds? If non nerds want to come to the party, that's despoiling things?

No one owns industries. Yes industries have a history and there were important people who started industries, but they mature and they become part of the mainstream --stop bemoaning this. Accept that things which become mainstream have to acquire aspects of the mainstream.

Of course, this is tech crunch and always wants to eat their cake and have it too.

<comment><USER3> "Accept that things which become mainstream have to acquire aspects of the mainstream."

I guess my take away was that when weirdness becomes mainstream it becomes nothing more than a toothless affectation. That you should beware of the savvy newcomers who have learned how to adopt a style formed out of rebellion but will use it to push traditional objectives. They will push out the rule breakers while co-opting their mission statements.

So yeah, it's a pretty standard statement about any fashion cycle. The point of the article then is to warn the weirdos, the divergent thinkers who birthed this industry to not let the handsome dudes laughing at them get them down. It's a cute narrative about larger issues. It's about the status quo's tendency to prevent really weird and innovative ideas to take off out of fear it will spoil their comfortable fun. The people who show up after all the weird work is done weren't their in the start because they don't take risks like that.

It's a decent read. It's called "Beware of the Pretty People" and it is written for the freaks. Reminding them to keep on freaking people out, even when it's no longer the standard game plan.

<comment><USER2> You hit the nail on the head. Some people understand that for something to succeed, it has to become mainstream, but there are others for whom the original otherness _is_ their identity. It separates them from larger society, so when larger society takes on those signifiers, they feel threatened. Like the fashion cycle.

This article preys on people's weaknesses --like feeling that their values or lifestyles are being co-opted -as if that were bad in and of itself. If you have solid beliefs, what others do or don't do are irrelevant to you.

I don't think tech crunch really believes in what they say but rather they believe that what they say will resonate with their audience and will result in more income for them. They couldn't possibly care any less about the principles of technologists --whatever alignment there is, is coincidental. Let's ask this, have they ever run articles which would drive down their readership? They may run something with some ironic distance, etc. but that's just a form of co-opting their audience.

<comment><USER4> "tech crunch," believe it or not, is not a hive mind with a single view point. (OP here.)

<comment><USER2> I hope the irony isn't lost when tech crunch is one of the organizations which is not too different from the so called interlopers it decries. In other words, if not for tech becoming mainstream and significant tech crunch would not have much interest in reporting about tech. so it's not that they care about tech, they care about tech insofar as it affords them economic viability.

Do you see a 'tech crunch' of the mortuary industry? If embalming became the next big industry affording millions good earnings and made millionaires out of many, you'd see the same thing. And you'd see publications making much ado about nothing for reasons of self interest. Some times some of the things they would raise would raise valid questions but for the most part those publications would just ride the wave and decry the "posers" coming into the industry who didn't have to put up with decades of irrelevance and stigma --taking advantage of people's fears and weaknesses.

Just let people try and make a living wherever they see fit. Sure, they bring 'disruption' to the old guard, but so what. That's life.

</comment></comment></comment></comment></comment><comment><USER5> Funny how the nerd stereotype is used in different contexts.

In the context of diversity in tech, nerds are a subculture dominated by White males. This culture has a misogynistic dark side, and it is important to show that you don't have to conform to this subculture to succeed in tech.

However, in the context of the corporatization of tech, suddenly the nerds are the good guys. And funnily enough, nerd culture was actually part of the counterculture movement. The old guard of cyber-hippies need to stop the slide into corporate monotony.

<comment><USER6> There is an important thread connecting the two:

 _In the context of diversity in tech, nerds are a subculture dominated by White males. This culture has a misogynistic dark side..._

This is a popular and powerful attack line used by "pretty people" seeking power in tech. It's used to demonize the old guard. When the old guard tries to intellectually dispute it, as is their custom, one can then attack their person directly ("creep", "racist", "nerd").

It's a fairly general purpose attack that can be targeted at almost anything. One of the more dangerous places is in hiring and evaluation; witness how objective and meritocratic nerd hiring practices (e.g. hire-by-github, death by brainteaser) are now attacked. Similarly, the idea of an individual contributor is also under attack ("you can't have a 10x programmer, you can only have a 10x team"). Once objective measures are eliminated, we'll just descend into petty politics of the sort that "pretty people" are very good at.

<comment><USER7> Discriminatory behavior (sexist, racist, etc.) often persists, in my experience, because the perpetrators don't realize what they are doing. It's not that they think, 'I want to exclude women from tech jobs'; they blindly follow old patterns of hiring and other behavior. Humans naturally are very egocentric and have to work to see things from others' perspectives. When they do, they change; most people don't want to be sexist.

So of course many think it's meritocratic; they don't see the obstacles because they never experienced them. And of course some think they are victims of persecution; they don't see what they are perpetrating.

Here's an intellectual way to approach the problem: Stepping back from our society, if a system is truly meritocratic then why would 38% of a population[1] produce 90%[2] of the winners? And is it coincidence that the 38% group has controlled power, wealth, and privelege for hundreds of years, and still does in most other situations (governnment, non-tech business, etc.)?

[1] U.S. population is 77% white, so I estimate 38% white male. [http://quickfacts.census.gov/qfd/states/00000.html](http://quickfacts.census.gov/qfd/states/00000.html)

[2] Wild guess at the % of SV tech workers that are white male.

EDIT: Minor rewording for emphasis

<comment><USER5> _> Here's an intellectual way to approach the problem: Stepping back from our society, in some meritocratic system why would 38% of a population[1] produce 90%[2] of the winners? And is it coincidence that the 38% group has controlled power, wealth, and privelege for hundreds of years, and still does in most other situations (governnment, non-tech business, etc.)?_

That is actually the least intellectual way you could approach the issue. You are relying on people self-censoring (and we may see some downvotes to provide some real censorship). But I will give you the uncensored answer. There are, in fact, a number of possible reasons apart from the one you have in mind. Here are some.

1) Tech is meritocratic so it attracts men who are less physically attractive or socially capable, because they mainly need technical skill. This in turn makes the field less attractive to women.

2) Tech is a monotonous job with low social status, and so it attracts people driven by ambition and desire for money, who tend to be male.

3) Women are fundamentally less interested in technology because they prefer fields with human interest (though this doesn't explain the gap between programming and, for example, math or physics).

I have only really addressed the gender issue above, but I think that's enough to critique your original way of phrasing the problem.

<comment><USER8> "I think that's enough to critique your original way of phrasing the problem."

Then I don't think much of your thinking.

Making up scenarios that are trivially refuted by a moment's thought is silly. How about

4) Aliens come down every night and surgically remove the bits of women's brains that are used in programming tasks.

There, now I've _really_ addressed the issue. See why 'making stuff up' isn't actually some mark of intellectual superiority?

Or how about

1) How many jobs that are known for attracting socially adjusted, good looking men can you name where most of the winners are women?

2) How many high social status, well varied jobs can you name where most of the winners are women?

3) You defeat your point in your own parentheses.

You've addressed nothing. You've made up some nonsense and pretended to be smarter than the person you're responding to, but you've directly avoided addressing the actual point.

<comment><USER8> Right, so even in fields you've been able to pick, you've not been able to show that women are the majority of the winners. You can say they're a little less frequently trumped by men. But you still have minorities in both cases.

Where are all these competent women who are eschewing tech because of the lack of hot guys? Which fields are they dominating?

<comment><USER9> Health care- nurses and new doctors (still more legacy male doctors). Although the strict quotas on doctors distort things.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> The headline didn't match the rant.

My first thought, reading that, was of Shai Agassi, the founder of Better Place, the battery-swap electric car company. Years ago I went to a meeting in SF where he spoke, and saw that that he was very good looking, spoke very well, and had a business plan that was total bullshit. Several heads of state and many investors were convinced by him. In the end, he burned through about $800 million and only put about a few hundred cars, built by Renault, on the road, before the bankruptcy.

That's what I was thinking when I read the title.

<comment><USER11> Everything you say about Better Place is true but give the man a little credit. He emerged from the hacker culture in Israel and was a programmer himself for a long time before moving to the US in '96.

</comment></comment><comment><USER12> I find the overall attitude to be fascinating, and self-defeating. They refer to the pretty ivy league people elbowing in, basically; taking over.

Well what use do I have for those people exactly? They can't stop me from building what I want to. They have no say in the matter, no influence over me. They only become part of my equation if I allow it. For $30, or $50, or $200 per month I can build _almost_ anything I care to in the software realm. Today my biggest limitation is time.

The tech industry is lacking in (or no longer dominated by) geeks, nerds, weirdos? Even if that's true: 1) who cares 2) it has no impact on me 3) that would be the fault of the geeks, nerds and weirdos that are allowing themselves to be told what to do.

I'm going to build whatever the hell I please. If I allow one of the so-called pretty ivy league type to stop me, then I have nobody to fault but myself.

I don't _need_ venture capital. I don't need pretty ivy league types with freshly printed MBAs. I need sales, and a product worth paying for that makes sales possible.

Customers provide growth capital. Anything else - including allowing the types dreaded by this article to be on the playing field - is optional.

</comment><comment><USER13> I've been developing software professionally for 25 years and it's always been a business. The suits have been exploiting the nerds for a long time. Welcome to capitalism!

</comment><comment><USER14> Apropos this article, today I received a box of "vintage" hardware and software manuals. It's a hobby, ok? But amongst them was an original photocopy of this article from psychology today, circa 1980:

      http://www.textfiles.com/news/hackpape.hac

In which the LOTS user "gandalf" bemoans the isolation and singlemindedness of the typical Stanford hacker, and the rebuttals from those he describes. It was an interesting bit of the social story that underlies the "weird" folk tradition.

</comment><comment><USER15> It's funny, this article seems to be rather full of irony. At the beginning of the article, I started miss when a lot of the tech scene was a little more grass roots, but maybe that's just rose colored glasses. Obviously, things have gotten more sophisticated since the days of simple computers like the TRS-80 and while it's not possible to totally grep everything in a modern OS, I do miss some of the hacker ethos that may have waned when the web went big. That being said, I find it a rather perverse juxtaposition to take about governments and Wall Street abusing the tech industry and then hold up he examples of Uber and bitcoin as movements counter to this. While there may have been some inefficiency in the Taxi medallion system, Uber seems to thrive on skirting labor laws and relying on the perhaps misplaced hype surround the "gig economy." Bitcoin is also not a terribly appropriate choice; while the idea of the blockchain is novel, the technology is kind of wasteful (all of energy required to move the blockchain along, probably coming from non- renewables), it's built on arguably shaky financial grounds (nothing like a sovereign to back it, it's often theorized to be a Ponzi scheme), and Wall Street is getting into it big time. Both of these seem to be part of the "pop tech" the author is rallying against.

I would rather see kids encouraged to hack all things (not just web sites and walled garden mobile app) to keep the old school tech culture alive, and I certainly feel the need to make sure things like GNU continue, as it, amongst other things, have provided the means to rally against big corporations controlling access to the interesting bits of technology (like being priced out) back in the day. I personally feel as though copyleft is important from this perspective, though this is probably a somewhat controversial opinion. One thing the author doesn't mention as something we should focus on, is if we want to keep the tech industry from locking us out of technology as we know it, I think we should also work to make sure tech giants and other corporations don't strong arm standards organizations and force development into walled non-free gardens, especially like with Google and Apple's threatening moves with regards to the internet (i.e. iOS locking out competing browsers, Google trying to completely lock out others from gTLDs like .dev).

EDIT: Just to be clear, I also find the equating of "pretty people" and the use of "nerd" around a lot of the culture surrounding technology both click- baity and ad hominem.

<comment><USER16> It's actually a _lot_ easier to get started hacking now, in the age of Javascript and the web, than it was 25 years ago. I remember begging my dad to buy me Think Pascal when I got a computer so I could learn to program. Computers cost about $2500 then, and the compiler itself was about $200. Now one of the best languages to learn, Javascript, comes free with excellent developer tools in every web browser, which comes free with a computer that can be bought for <$1000. If you want to play with server side stuff you can put it up on Heroku, again for free.

I think the big problem is that this has reduced the barrier to entry to nothing, and so standards have gone way up. To do a professional-seeming webapp, it's not enough to hack out some HTML as a high-school student. You need a professional designer, and professional front-end engineer, and professional back-end engineer, etc.

<comment><USER17> Rasberi Pi 2 $35 crummy usb drive $6 Keyboard from thrift store $2 Mouse from thrift store $3 Monitor from thrift store $10

A functional computer for $56. Not the best but probably a lot faster than the one you paid $2500 for.

</comment></comment></comment><comment><USER18> There's a deep, wonderful irony in someone writing on _TechCrunch_ about possible disturbances in the sanctity of software development.

</comment><comment><USER19> "But we still tend to measure their success wholly in terms of millions raised, billions in valuation, revenues, profits, and timeline to IPO. That's not genuinely subversive. That's not truly disruptive. That's establishment talk."

</comment><comment><USER20> I don't actually hold this opinion, because I don't know the truth of it, but I remember reading a comment about women in tech that entertained the idea of why there isn't many women in tech. The opinion was that women are more socially aware than men. CS/tech with its mainstream stereotypes of nerds wasn't something that most women wanted to be associated with. If I entertained the thought put forth by this TC article, I can perhaps predict an influx of women in CS/tech due to it becoming more "socially acceptable", because of the changing stereotypes.

An oversimplification, but entertaining nonetheless.

</comment><comment><USER21> I'm still not sure what the title has to do with the actual contents of the article, but the basic premise contained therein isn't exactly ground breaking - people want to make money from tech, regardless of how much they care about culture or product.

The last few paragraphs are a bit more interesting. Understandably, lots of people are now seeing that you can gain things from your work or financial input into something that aren't just financial. For some people, non profits will provide greater rewards than for profits.

</comment><comment><USER22> LOL What an article. "Now that the tech industry is cool, the pretty people are taking over, flooding out of top-tier universities with MBAs and social graces and carefully coiffed hair, shouldering the misfits and weirdos out of the way." Good luck with that :) Don't judge the book by its cover! "While we do, though, we need the weirdos, the rebels, the counterculture, to be gathering together and founding companies." Not sure what misfits and weirdos they mean maybe "Pretty People"

<comment><USER23> Techcrunch puts out so much garbage and fluff these days that I just don't bother anymore.

<comment><USER24> I have personally long argued that TechCrunch should be outright banned from HN.

</comment></comment></comment><comment><USER25> Reminds me of something I heard Buffet say once in an interview with (I think it was) Maria Bartiromo: On Wall St we get the innovators then the imitators and then the swarming incompetents.

I think it's really this applied to the Valley - and I think what you're seeing is people who don't have tech chops, but they've seen what tech success brings and they want that, so they have to sell something else and in this case it's charm, good looks or good taste in shoes.

</comment><comment><USER26> If non-technical pretty-people pass your technical interview, you've failed.

</comment><comment> post- There are a lot of problems with this article, but I want to focus on this paragraph:

> What's more, there has never been a better time to try to found a genuinely > subversive company than right now. Consider Y Combinator's new openness to > not-for-profit startups. Consider the remarkable recipient list of Reddit > Donate. [[http://www.redditblog.com/2015/02/announcing-winners-of- > redd...](http://www.redditblog.com/2015/02/announcing-winners-of-reddit- > donate.html)] It seems to me that there is a hunger for real change out > there. A huge audience. You might even call it a market.

I'm not sure that I trust Jon Evans' \-- or any one person's -- assessment of subversion. The whole point of subversion is to overturn ("vertere") the status quo from below ("sub"), while this article seems content to maintain the current systems of marginalized nerd-dom (which has always been a suspect category) and capitalism (which is interesting and because as a system it preferences what's mainstream and marketable -- Evans has contradicted himself again).

When Evans writes, "Consider the remarkable recipient list of Reddit Donate," in support of his call for subversion, he glosses over the fact that the list includes some of the most mainstream nonprofits in the world (plus two well- known psychoactive research organizations). I'm not saying that these charities aren't doing good things -- I think it's fair to assume that they are -- I'm saying that supporting them can't be viewed as an act of subversion, and that assuming limited resources, support for them means lost support for other _actually subversive_ organizations that mean to do just as much good in the world.

"It seems to me that there is a hunger for real change out there." But change doesn't mean patching what exists; change -- subversive change -- means offering a replacement.

</comment><comment><USER27> Oh my God. In 1996 or around that time, a friend who was a CS major at one of the major US universities mentioned in a passing that he was seeing a lot of Business School types in CS labs trying to do coding exercises. It changed within 2 years in his view. He thought it was a sign that tech industry was going to take off.

</comment><comment><USER28> Personally, I like the vast majority of nerd culture as I received it. Lots of focus on text, do-o-cracy, intellectual games. ESR's "portrait of a hacker" harmonized with me well when I read it - it did not influence my life, but I found it to be pretty astute.

I am sad to see it passing, but I also know that Change Happens.

</comment><comment><USER10> The "pretty people" thing may have started with Facebook. When Facebook was in downtown Palo Alto, I'd see their employees come out at lunchtime. The men were hunks and the women were hot. I suspected they were hiring based on Facebook pictures.

</comment><comment><USER29> "I believe capitalism is excellent … up to a point. (I don't believe anyone who has travelled in the developing world as much as I have can reasonably think otherwise.)"

Is the author suggesting capitalism is doing good or bad things for the developing world?

<comment><USER4> Good. (Or at least that was the intent.)

</comment></comment><comment><USER30> It isn't a zero sum game. People looking to make a quick buck don't stop misfits from playing with computers.

As if one must be a social misfit or physically misshapen to be involved with computers in the first place, which is itself a ridiculous premise.

<comment><USER31> This is a zero sum game to some extend: employers will prefer to hire beautiful people even if they're less proficient than social misfits. On average and a grand scale, this is catastrophic.

</comment></comment><comment><USER32> Here's an interesting Dilbert short I saw that seems to be relevant to the headline: [https://www.youtube.com/watch?v=gzanWSGXqGc](https://www.youtube.com/watch?v=gzanWSGXqGc)

</comment><comment><USER33> This article went so many weird places randomly.</comment>


Guessing smart phone PINs by monitoring the accelerometer - <AUTHOR> https://www.schneier.com/blog/archives/2013/02/guessing_smart.html <comment><USER2> I came across an interesting solution to this while paying at a restaurant in Ecuador: they used an Android device which randomized the position of the numbers of the on-screen keypad before each transaction.

The original intent is to make it much harder for onlookers to guess your pin based on finger movements. This could however apply equally well to the usecase of the article.

It is a bit of a usability trade-off though as you can't enter a pin using muscle memory alone anymore, as you must first understand the current keypad layout.

<comment><USER3> Interesting! I'd love to see what happens when somebody studies that. That surely creates a much larger inter-digit delay as people hunt for the right numbers. So I'd bet it's harder if the attacker can't also see the screen, but easier if they can.

<comment><USER4> This is also standard in certain secure facilities and I've visited companies that use them. They're called scramble pads. I think you get better at entering the numbers, and you wait until you see the sequence before going for the pad.

<comment><USER5> I believe scrambling should work the best if you scramble the keypad for every digit entered, rather than for the whole of them at once. Otherwise at least the same key presses should be immediately recognisable?

</comment></comment></comment></comment><comment><USER6> "Figure out" means, in this case, classify. So it can tell which of 50 is 'the one'if its in that set. That's a hell of a long way away from decoding your PIN from the tens of thousands possible.

<comment><AUTHOR> This was a paper from 2013 though, 7 years ago. I'm sure they've more than made it a proper technology now, with all the compute power and deep learning and what not. Maybe unrelated, but WhatsApp does monitor your phone accelerometer data 100% of the time, even when it's in the background. An app doesn't even need to ask for permission to get access to the accelerometer data, so there's not even a pop up of any sort.

<comment><USER7> >but WhatsApp does monitor your phone accelerometer data 100% of the time

Source for this? Did anyone call them out on it? What plausible reason is there to have it on 24/7?

<comment><USER8> I was also curious. I found a relevant reddit discussion:

[https://www.reddit.com/r/lgg6/comments/7yxk0a/whatsapp_insan...](https://www.reddit.com/r/lgg6/comments/7yxk0a/whatsapp_insane_accelerometer_usage/)

</comment></comment></comment></comment><comment><USER9> I suspect issues like this are one of the reasons why iOS locked down accelerometer access in Safari. Motion sensors have a lot more potential for malicious use than most users think.

<comment><USER10> I was going to say Apple must have became aware of such flaw a year ago (iOS 12.2). However checking back on the article I see it is from 2013! So for all this time nothing has been done, Apple reacted last year, and Google has done nothing. Worrying.

<comment><USER11> It still works in iOS.

</comment></comment></comment><comment><USER12> This stuff is so fascinating... and so frustrating. Now browsers have accelerometer data behind a permission prompt. It makes total sense given stuff like this but it used to be a nice little way to create immediately playable games, apply visual parallax-y effects... and now we have permission prompts sat in front of that.

I guess I'm not blaming anyone here, just amazed that there isn't _any_ data source that doesn't leak something sensitive!

<comment><USER13> I don't see the issue there: it is good if my browser tells me what is going on and leaves the decision to me.

Of course in an ideal world we would be able to trust the sites we visit enough to not jave our browsera protect us, but that is not how a ad financed web worka sadly

</comment></comment><comment><USER14> Why can't Android manage to do basic security things, like disable the accelerometers during keyboard input?

<comment><USER15> I wish iOS didn't show each character as you type your password. HOW is that even helpful, let alone not having an option to disable that?

<comment><USER16> I use it all the time to correct password mistakes: I would be really irritated if that went away: in fact, I frequently use devtools on my laptop to change password inputs to text inputs

</comment></comment></comment><comment><USER17> Someone add (2013) to this

<comment><USER18> They ask us to use the Contact link in the HN footer to ask them to do so.

</comment></comment><comment><USER19> Unbait, unBS yourself:

After five guesses it could spot Pins about 43% of the time [...] these results were produced when Pins and patterns were picked from a 50-strong set of numbers and shapes.

(2015)

</comment><comment><USER20> How do you get the accelerometer data?

Surely if you have enough privilege to get that, you could just get input data directly?

<comment><USER21> By requesting access to it. To a user that just installed a e.g. step counting app that wouldn't be suspicious.

Otherwise on Android apps would need to request accessibility feature access to be able to monitor keyboard input into other apps (and there is an explicit warning), or, which is most common, request an overlay permission and start a "phishing overlay" if a targeted app is started by the user.</comment></comment>


Ruby Kaigi 2014: Day 2 - <AUTHOR> http://brewhouse.io/blog/2014/09/19/ruby-kaigi-2014-day-2

<comment><USER2> I find it surprising that ruby is considering adding optional static typing to ruby 3. I'm not opposed to this decision, I'm just surprised considering the highly dynamic nature of ruby.

<comment><USER3> like for python, this has always been an idea in the air.

I.e. consider this discussion from 2001[0], where Guy Decoux (a great rubyist who sadly passed away years ago) showed off his local fork with multimethods, and matz basically said "I'm not too much in favor, but let's discuss".

[0] [http://blade.nagaokaut.ac.jp/cgi-bin/vframe.rb/ruby/ruby- tal...](http://blade.nagaokaut.ac.jp/cgi-bin/vframe.rb/ruby/ruby- talk/16957?25476-25912+split-mode-vertical)</comment></comment>


SF Bay Area Rental market for office space braces for blow - <AUTHOR> http://www.sfgate.com/cgi-bin/article.cgi?file=/c/a/2008/10/03/MNJ6139RQA.DTL <comment><USER2> I have never looked at commercial real estate in the Bay area, but given what I've heard about residential RE, I can't imagine that this could be anything worse than a correction. It sounds like a great time for well funded companies that are at or near the end of their corporate leases to shop around for a nice upgrade. :)

</comment><comment><USER3> Honestly, I'd be more worried about New York.

</comment><comment><USER4> Excellent, lower costs for startups.

</comment><comment><USER5> The question is: To rent or buy?

<comment><USER6> Is real-estate your core business? Why the heck would you ever buy your office if it isn't?</comment></comment>


Practical Go benchmarks - <AUTHOR> https://stackimpact.com/blog/practical-golang-benchmarks/ <comment><USER2> The majority of the performance difference between strings concat and builder in your example is explained by memory allocation. Every loop of concat will result in a new allocation, while the builder - which uses []bytes internally - will only allocate when length equals capacity, and the newly allocated slice will be approx. twice the capacity of the old slice (see: [https://golang.org/src/strings/builder.go?#L62](https://golang.org/src/strings/builder.go?#L62)).

Therefore, 500,000 rounds of concat is about 500,000 allocations, while 200,000,000 rounds of builder is ~ 27.5 allocations (=log2(200000000)).

I would suggest a different benchmark to approximate real world usage:

        func BenchmarkConcatString(b *testing.B) {
            for n := 0; n < b.N; n++ {
                var str string
                str += "x"
                str += "y"
                str += "z"
            }
        }

        func BenchmarkConcatBuilder(b *testing.B) {
            for n := 0; n < b.N; n++ {
                var builder strings.Builder
                builder.WriteString("x")
                builder.WriteString("y")
                builder.WriteString("z")
                builder.String()
            }
        }

Which still shows a significant performance advantage for using builder (-40% ns/op):

        BenchmarkConcatString-4     20000000            93.5 ns/op
        BenchmarkConcatBuilder-4    30000000            54.6 ns/op

<comment><USER3> Won't the compiler just ignore the "builder.String()" line unless the return value is actually used?

<comment><USER4> Easy fix, use the anonymous variable;

        _ = builder.String()

The compiler should not optimize that out.

<comment><USER5> That's absolutely the same as the statement without assignment from a data flow POV. However, the compiler will likely not optimize it away since it would be too burdensome to proof that strings.Builder.String() does not have any side effects. The Go compiler prides itself with fast compilation speed, so I would not expect it to perform cross-package control/data flow analyses.

</comment></comment></comment></comment><comment><USER6> I would mention that, gc (the official Go compiler) makes special optimization for string concatenation operation (+). If the number of strings to be concatenated is known at compile time, using + to concatenate strings is the most efficient.

        package a

        import "testing"
        import "strings"

        var strA, strB string
        var x, y, z = "x", "y", "z"

        func BenchmarkConcatString(b *testing.B) {
            for n := 0; n < b.N; n++ {
                strA = x + y + z
            }
        }

        func BenchmarkConcatBuilder(b *testing.B) {
            for n := 0; n < b.N; n++ {
                var builder strings.Builder
                builder.WriteString(x)
                builder.WriteString(y)
                builder.WriteString(z)
                strB = builder.String()
            }
        }

Result:

        goos: linux
        goarch: amd64
        BenchmarkConcatString-2    	20000000	        83.7 ns/op
        BenchmarkConcatBuilder-2   	20000000	       102 ns/op

<comment><USER7> Note that this is directly contradicted by another commnent[1] on this post, where three fixed strings are concatenated with +=, yet that was still slower.

Perhaps the use of += as separate statements is the difference, but one would hope that gc wasn't so fragile as to be unable to identify those sequences as identical.

\---

[1] [https://news.ycombinator.com/item?id=16533650](https://news.ycombinator.com/item?id=16533650)

<comment><USER6> The optimization made by gc is only valid for the form: s0 + s1 + .... + sn.

</comment></comment></comment><comment><USER8> String benchmarks are so broken.

They way he uses b.N is wrong. b.N is different for different loops so he's e.g. timing 100 iterations of string '+' with a 1000 iterations of builder.WriteString()

Also the compiler can completely null out no-op functions (without side effects) so in benchmarks it's a good idea to assign the value being calculated into e.g. a global variable.

The corrected code is: [https://gist.github.com/kjk/6a7d7135ae1e5fa6cd1f0db23d2eaf4d](https://gist.github.com/kjk/6a7d7135ae1e5fa6cd1f0db23d2eaf4d)

An example of correctly benchmarking:

        func BenchmarkConcatString(b *testing.B) {
    	for n := 0; n < b.N; n++ {
    		var str string
    		for i := 0; i < 100; i++ {
    			str += "x"
    		}
    		gStr = str
    	}
        }

After fixes it paints significantly different picture:

        go test -bench=. -benchmem
        goos: darwin
        goarch: amd64
        BenchmarkConcatString-8    	  300000	      5148 ns/op	    5728 B/op	      99 allocs/op
        BenchmarkConcatBuffer-8    	 1000000	      1046 ns/op	     368 B/op	       3 allocs/op
        BenchmarkConcatBuilder-8   	 1000000	      1177 ns/op	     248 B/op	       5 allocs/op

<comment><USER9> Thanks for pointing it out. Should clearly not depend on the number of iterations. It's fixed now.

<comment><USER10> I think there's another bug in the generateSlice function if the intention is to create a slice with n random numbers.

        func generateSlice(n int) []int {
            s := make([]int, n)
            for i := 0; i < n; i++ {
                s = append(s, rand.Intn(1e9))
            }
            return s
        }

As it is now, the function creates a slice with n zeros followed by n random numbers. I suppose you meant to say make([]int, 0, n). You could just as well assign directly to each slice element instead of using append, which would be more efficient.

I made the exact same mistake quite a few times myself.

<comment><USER9> Yep, that meant to be capacity, not length. Corrected. Thanks!

</comment></comment></comment></comment><comment><USER11> While I don't doubt that strings.Builder does is quicker than += concat for many iterations, to make it a fair comparison you probably need to pull out the string at the end rather than just writing to the buffer. It's also not obvious for example what the difference is with just 2 strings to join if I need to join two strings together 40 trillion times or whatnot.

Nice collection of microbenchmarks though. Interesting to see magnitude differences from e.g. regexp compile

</comment><comment><USER12> Fun fact: the crypto rand "number" benchmark depends on the number you pass into it:

        BenchmarkCryptoRand27-8   	 5000000	       388 ns/op
        BenchmarkCryptoRand28-8   	 3000000	       356 ns/op
        BenchmarkCryptoRand29-8   	 5000000	       335 ns/op
        BenchmarkCryptoRand30-8   	 5000000	       327 ns/op
        BenchmarkCryptoRand31-8   	 5000000	       331 ns/op
        BenchmarkCryptoRand32-8   	 5000000	       322 ns/op
        BenchmarkCryptoRand33-8   	 3000000	       480 ns/op
        BenchmarkCryptoRand34-8   	 3000000	       474 ns/op

for benchmarks like

        func BenchmarkCryptoRand32(b *testing.B) {
            for n := 0; n < b.N; n++ {
                _, err := crand.Int(crand.Reader, big.NewInt(32))
                if err != nil {
                    panic(err)
                }
            }
        }

This is because the crypto/rand library is very very careful to give you unbiased random numbers.

</comment><comment><USER13> The string benchmark has the issue that the amount of work done varies with each pass through the loop since the string just keeps getting appended to. A proper benchmark like the ones in the comments here do the same amount of work for every loop.

</comment><comment><USER14> Note that you can also get the number of bytes processed per second by calling the SetBytes method. This is very useful on some bench (hashing, base64, ...):

      func benchmarkHash(b *testing.B, h hash.Hash) {
      	data := make([]byte, 1024)
      	rand.Read(data)

      	b.ResetTimer()
      	b.SetBytes(len(data))
      	for n := 0; n < b.N; n++ {
      		h.Write(data)
      		h.Sum(nil)
      	}
      }

</comment><comment><USER15> > The following benchmarks evaluate various functionality with the focus on > real-world usage patterns.

I can't say I write much code that does one thing many times in a really tight loop. It would be a lot more interesting if the code combined multiple functions into the loop body in a better attempt to simulate "real-world usage patterns."

<comment><USER9> Good point, thanks! The idea behind these benchmarks is to make the results usable in real-world programs, rather than benchmarking real-world programs. I rephrased that sentence to avoid any confusion.

</comment></comment><comment><USER16> I always wanted to ask this. I'm a full stack developer with good knowledge on Java and JavaScript. I'm currently reading Golang especially for its concurrency idioms. It is good and easy to write concurrent code but people always come and say about actors which are very good when compared with channels. I have never used actors before.. Whats your thoughts on this?

</comment><comment><USER5> Even though this is clearly a benchmarking game, I don't like that it does not explain how the things benchmarked against each other sometimes have drastically different usecases.

I can assure you that someone is going to use these numbers to argue that crypto.Rand needs to be replaced by math.Rand BECAUSE SPEED, or that MD5 should be preferred over SHA2/3.

</comment><comment><USER17> It's worth noting that the first number in a benchmark result is how many loops (for n := 0; n < b.N) that Go used to find the results.

The nanoseconds, bytes, and allocs per operation are the important part.</comment>


Instagram reaches 27 million registered users, shows off upcoming Android app - <AUTHOR> http://techcrunch.com/2012/03/11/instagram-reaches-27-million-registered-users-shows-off-upcoming-android-app/

<comment><USER2> I love that Instagram has been able to grow and be successful without needing much of a website. While they do have a website it sure doesn't do much beyond sharing a photo. This definitely sends a message that designers, developers, and startups can't ignore. Path is another startup that sets this example. Not too long ago the thought of being a hot tech startup without much of a website was crazy to imagine.

</comment><comment><USER3> I don't know why Facebook doesn't come up with some image filter of their own. Facebook would easily absorb Instagram's differentiator.</comment>


Pattern Recognition and Machine Learning [pdf] - <AUTHOR> https://www.microsoft.com/en-us/research/people/cmbishop/ <comment><USER2> I don't see a PDF?</comment>


Log viewer for Apache, IIS, Nginx - <AUTHOR> http://www.apacheviewer.com

<comment><USER2> Gamer nation needs log viewer for Nginx or/and Apache?</comment>


Grails 2.0.0M1 is available - <AUTHOR> http://grails.org/blog/view/admin/Grails+2.0.0.M1+now+available%21

<comment><AUTHOR> don't forget to check out what's new at [http://grails.org/doc/2.0.0.M1/guide/introduction.html#whats...](http://grails.org/doc/2.0.0.M1/guide/introduction.html#whatsNew).</comment>


South Korea's online trend: Paying to watch a pretty girl eat - <AUTHOR> http://edition.cnn.com/2014/01/29/world/asia/korea-eating-room/index.html?hpt=hp_c3 <comment><USER2> _She easily polishes off four large pizzas or three kilograms (6 lb) of beef in one sitting_

What on earth , that is like 9000 calories or over 4x the recommended daily calories for an average woman. That is more than a professional athlete or bodybuilder would eat.

Even with a fast metabolism, it seems impossible that somebody could eat that much without getting very fat , very fast.

Even if she ran for 8 hours a day every day she would only use about half of that.

There must be something else going on here.

<comment><USER3> Your stomach is not a combustion engine nor a magic bag of holding. If you eat more than you can digest, you will poop out incompletely-digested food.

Please resume your regularly scheduled insane internet calorie conversation.

<comment><USER2> But your stomach should be able to stretch to the point where it can digest far more calories than is required to maintain yourself, either that or repture.

<comment><USER4> The stomach is strechable far beyond the substinence limit.

</comment></comment></comment></comment><comment><USER5> > _For Park, online eating is not just a niche hobby but a significant source > of income — she makes up to ₩10 million ($9,300) a month from her broadcasts > alone._

> _Afreeca TV, the publicly-listed social networking site that hosts her > channel, allows users to buy and send virtual "star balloons" which can be > monetized after the site takes a 30-40% commission._

30-40% seems like a massive commission. She's losing out on about $5,000 a month, or $60k a year. That's significant. Live streaming and virtual payments are commonplace at this point, so I imagine there are many options out there. Her fans will follow her wherever she goes.

<comment><USER6> Like apple's (or amazons, or any number of other companies) 30% share of revenue from AppStore sales? They're even better than most salesman commissions I have seen which typically have a base salary until a sales target then offer up to 50-80% of any sales above that

<comment><USER5> A little different. Not very many ways to get an iPhone app onto and iPhone and get paid for it. Streaming video is anyone's game. iPhone apps are Apple's game.

</comment></comment></comment><comment><USER7> North America's online trend: Watching a bearded guy and his friends eat bacon and amalgamated fast food

[http://www.youtube.com/watch?v=m9FRSghXhDM](http://www.youtube.com/watch?v=m9FRSghXhDM)

<comment><USER8> That's a recipe and cooking. There's only a few seconds of eating.

<comment><USER7> "Watching a bearded man and friends obsess over fat. Bacon fat."

</comment></comment></comment><comment><USER9> This is probably her friend [http://www.youtube.com/watch?v=s99Vt2KgeXY](http://www.youtube.com/watch?v=s99Vt2KgeXY)

<comment><USER10> does he have any more videos, this man should be viral

<comment><USER9> I found this one [http://www.youtube.com/watch?v=dXl0HY3ujqA](http://www.youtube.com/watch?v=dXl0HY3ujqA)

<comment><USER11> Now I'm getting into it. I want to see him finish eating it. Simply because I don't believe he'll do it.

</comment></comment></comment></comment><comment><USER12> Rule 34; given enough Internet, "Paying to watch a pretty girl <verb>" is guaranteed to be a thing...

</comment><comment><USER13> I heard about something like years ago, but in America. Does anyone else remember?

/edit Found her!

[http://en.wikipedia.org/wiki/Donna_Simpson_(internet_celebri...](http://en.wikipedia.org/wiki/Donna_Simpson_\(internet_celebrity\))

<comment><USER14> You mean the 'Crying While Eating'[1] meme?

[1]: [http://knowyourmeme.com/memes/crying-while- eating](http://knowyourmeme.com/memes/crying-while-eating)

</comment></comment><comment><USER15> I went into the article assuming it was going to be the usual "Here's a strange thing done by a few people that we're going to call a trend".

Assuming that viewership at Afreeca TV is split among rooms equally, they're talking about 150,000 people watching these eating rooms daily on that site alone. Impressive.

<comment><USER4> > _I went into the article assuming it was going to be the usual "Here's a > strange thing done by a few people that we're going to call a trend"._

Hmm, you'd be surprised. Check out following for bizarro trends in Japan for example...

</comment></comment><comment><USER16> Honestly, my first thought was 'demographic dividend', but it doesn't look like South Korea's gender ratios are skewed at all.

[http://www.nationmaster.com/country/ks-korea- south/Age_distr...](http://www.nationmaster.com/country/ks-korea- south/Age_distribution)

<comment><USER17> There's some gender imbalance. Marriage and fertility rates have also been falling steadily in recent years, you aren't that far off.

Most of people I know here still get married for all the wrong reasons (social status, money, family and social pressure, ...), and you need to add the fact that career-wise, males are typically lagging 2-3 years behind females because of the military conscription.

Antiquated Confucian values and breakneck development of the country are a terrible mix in my opinion, and I believe it'll affect the society in ways that are more extreme than anything we've seen elsewhere (the comparison with Japan is easy). But I reckon that Korea is also able to react quickly, sometimes with drastic measures, let's see.

</comment></comment><comment><USER18> Is this like the Japanese eyeball-licking trend? Find one or two weirdos and assume all the kids are doing it?

<comment><USER11> No. these trends are legitimate. It's not everyone. Nobody says that. But it gets enough fans that it is a legitimate trend.

Just like ASMR is a kind of weird trend in America, and now around the world.

To me, it's not weird at all that many people find it interesting to watch. I certainly type up "Chocolate ASMR" into youtube and watch a lot of those videos of people eating chocolate quietly for fun.

</comment></comment><comment><USER19> I wonder what the North Koreans think about this! It could be some amazing psyops.

</comment><comment><USER20> It's not that crazy. They look like this when they eat. [http://www.youtube.com/watch?v=_IFCPWv5n2Y](http://www.youtube.com/watch?v=_IFCPWv5n2Y)

</comment><comment><USER21> People will get into just about any fad these days it seems. Well, this world is bizarre. There is just too much free time in some places and just too much hunger in some.

</comment><comment><USER22> Does she really eat all that food or some of it and the rest of it is thrown out by a magic finger trick? she would have quite an economic incentive to do that.

</comment><comment><USER23> I knew this had a context : [http://www.youtube.com/watch?v=9J9X9VvYQXU](http://www.youtube.com/watch?v=9J9X9VvYQXU)

<comment><USER11> the OTHER videos are the context for THIS video.

</comment></comment><comment><USER24> Reminds me of that episode in Desperate Housewives where girls were paid to clean their own homes in a sexy maid costume.

</comment><comment><USER25> Brad Pitt eats in lots of movies, maybe a western equivalent?

<comment><USER11> The western equivalent would be either Competitive Eating or going to any steakhouse in the country.

</comment></comment><comment><USER10> I googled 먹방 and now I am feeling very hungry late at night. Feels like Epic Meal Time but with Korean food.</comment>


Ask HN: What next? Seeking ideas for my next project - <AUTHOR> This question is kind of the inverse to "Marketing gal/guy looking for technical co-founder".
I'm trying to figure out what I want to do next. I'm looking for ideas, interesting projects you need help on, market needs you've already tested, things you would like to see in the universe, pain points, etc. I give priority to large and difficult problems -- they're just more fun.
I'm a full-stack engineer -- I've worked for a large tech company, I built a successful startup that was acquired.
I'm in SF. <comment><USER3> With a successful exit under your belt and a large tech co name on the resume, go out and raise a $1.2M seed for the "Foursquare for time". I'll happily be user #1.

There are many people both in my professional life and personal life that I'd like to connect with more often, but not enough to warrant a pre-scheduled meeting. I wish I could "check in" to being free (say around the lunch hour), and allow that status to be seen by certain people in my "yeah, we should get together again soon" bucket. There's no need for them to say no or come up with an excuse. If they're free and nearby, we hook up and I don't eat lunch alone. If not, no worries...I needed to eat lunch anyway.

Here's your deck: [https://speakerdeck.com/chadokruse/10speak-pitch-deck-the- mo...](https://speakerdeck.com/chadokruse/10speak-pitch-deck-the-mobile- calendar-public-domain). See this thread for why we failed: [https://news.ycombinator.com/item?id=6931130](https://news.ycombinator.com/item?id=6931130)

If you have an interest in democratizing philanthropy (similar to how AngelList democratized angel investing), always interested in meeting new co- conspirators: [https://angel.co/kyn](https://angel.co/kyn)

</comment><comment><USER4> How about this? I see a lot of breaking news websites (or blogs that post a story whose details they "update as details come in" have no way (ok, maybe I just haven't come across it) of retaining their readers - a way to subscribe to subsequent updates. So that means busy Bob will either completely forget to come back to the story letter or that he will search for the story again and go read on a competing publication.

So maybe a way for people to subscribe to these "developing stories"? An example implementation in WordPress would be that it adds next to the publish button a checkbox for indicating that this is a developing story. On the user end, all such posts show normally but with an email input and relevant messaging informing the user that the article will be updated as details come in and that they can be notified of them.

<comment><USER5> I've noticed that Martin Fowler's '[bliki]([http://www.martinfowler.com/bliki/)'](http://www.martinfowler.com/bliki/\)') accomplishes this. He publishes a post in one or two paragraphs, and then updates them over the subsequent days. And in my RSS reader it shows up as a new post every time he makes an update, but points to the same page - <USER2> to a new section therein, so you can start reading from where you left off.

<comment><USER4> Yup, for RSS there are ways to implement this out of the box. I was thinking more about regular people who don't know or use RSS, people that publishers would like to retain over the course of reporting a developing story. How do you think this could be accomplished?

</comment></comment></comment><comment><USER6> My idea is not that difficult to get to MVP, but here it is anyway: In a nutshell: an inverted ecommerce site, where you ask for the best phone under $200, no contract, and this and that are important to you, and people bid and tell you their recommendations and why (along with buy links / affiliate links).

</comment><comment><USER7> Airbnb for meeting rooms :)

</comment><comment><USER8> Hmmmm if you're at this stage, I recommend going to Open Data and Civic Hacking meetups. At least in Chicago I've been finding a very high ratio of important problems to technologists who are willing to tackle them. You'll have a blast, meet lots of interesting people, and actually do something that contributes to general welfare :).

Since these problems are so applied and the datasets can be varied, you would definitely not be at a loss for "large and difficult".

</comment><comment><USER9> Enterprise management for Macs and mobile devices - especially for companies without central offices, with a fair few remote workers, and with a mix of owned and BYOD.

Sure, there are systems out there, but they just don't appeal, somehow. (Sorry, it's a visceral thing.)

</comment><comment><USER10> Hi there! If you like C, I'm working on a small (like REALLY small) virtual machine called Carp.

I've no idea what I'm going to do with it, so feel free to chip in!

[http://github.com/tekknolagi/carp](http://github.com/tekknolagi/carp)

</comment><comment><USER11> My new venture may be of interest to you: I launched [http://www.dimeideas.com](http://www.dimeideas.com) to help people with drive and motivation but not as much direction.

</comment><comment><USER12> What industries are you interested in?

<comment><AUTHOR> Healthcare, consumer internet, real estate, enterprise data, sharing economy, travel, journalism...

There are more, I've done projects/experiments in a bunch of these areas.

<comment><USER13> In health care there is a LOT going on and it could really push your limits in terms of your technical skills - especially within hospital health care and global health / global health policy arena. It also requires you to partner up with a health care professional which makes for an interesting viewpoint beyond SF tech :)

</comment></comment></comment><comment><USER14> Here are some consumer products I would like to see but don't want to build myself (mostly because I prefer working on enterprise instead of consumer products):

1\. A better music discovery service. I've tried using Pandora, Spotify, Soundcloud, several radio stations, and other services. But so far none has given a satisfactory answer to "give me songs that are similar to this song". Spotify does an OK job at this, but the same songs keep repeating, and similarity seems to be defined mostly based on artist. But what I want is _songs_ that actually sound similar, not stuff by the same artist. The best solution for me so far has been to search YouTube for mix videos (e.g. chillstep mix) and listen to it. However, constantly searching for new mixes and keeping the YouTube video open is quite annoying. I understand that the space is crowded, but the music discovery problem hasn't been solved at all. At least not for me.

2\. A better way to organize my life and habits. I don't use calendar apps because they don't work the way I organize my life. I have my own system, done in a text editor: I have "template list" of tasks and habits such as exercise, meditate, project A, project B, book C, etc, ordered by "priority". These are ties to long-term OKRs. Each of those also has a time span associated with it (30min, etc). I organize my life by week, one file per week. Each weekly file contains all days of that week. I then put the above templates/blocks into the days, planning one week ahead. Many days look similar, defining what I call "habits" (another template). There are no _absolute_ times, just relative times (e.g. tasks that are worth a total of 10h per day). Not having absolute times gives me flexibility in moving stuff around when needed. I manually check off the things that are done each day.

3\. Algorithmic healthy meal optimization. I enjoy cooking healthy food and I get recipes from sites such as [http://fitmencook.com/](http://fitmencook.com/). I want to be able to define my intake of certain nutrients (XX protein, YY calories), and the service should give me recipes, minimizing my shopping list for different ingredients. In other words, achieve the right nutrition while buying the minimum amount of different products, making shopping easy and convenient.

4\. This one is a bit fuzzy, but if done right I believe it can change the world. Come up with a way to meet "relevant" people (let's say in terms of business or hobbies, but could also be personal) in real life that is not creepy. I believe the key elements are taking away the fear of rejection (e.g. Tinder), semi-anonymity (until all parties mutually agree), taking away friction to initiate something (e.g. people are willing to attend organized events/activities, but not organize something themselves, also due to fear of rejection), overlapping social graph connections, and a way to make it non- creepy. How to put these elements together? I'm not sure, but something is there.

<comment><USER15> Quite interesting ideas.</comment></comment>


Is this rotating cube interface user-friendly? - <AUTHOR> http://ux.stackexchange.com/questions/11229/is-this-rotating-cube-interface-user-friendly

<comment><USER2> I can't recall where I saw a site navigation laid out in a cube but I thought it was unique when I first encountered it. What I didn't realize was the increased engagement the cube navigation led to. It was something new and interesting...I suspect that will be the case with other users too.

The closest thing I can find that resembles it: <http://www.paulrhayes.com/experiments/cube-3d/>

The author posts that this solution is for a "form that is too long", sometimes that is unavoidable (imagine a mortgage application). A cube based form could help user drop off by cueing the user to what was finished, what is next, and how much is remaining.

</comment><comment><USER3> Simultaneous 4 form information in 24 hour days 1 cube rotation.

</comment><comment><USER4> I've been playing with a similar interface that I think would be an interesting way to navigate through comments. It's best when viewed with an iOS device, since it supports touch control, but it works on a modern desktop web browser too by click-and-dragging:

<http://oqodo.com/cube.html>

</comment><comment><USER5> dupe, and a dupe that was killed no less - <http://news.ycombinator.com/item?id=2996087>

<comment><AUTHOR> it's actually a very cool demo. I hadn't thought about using CSS transforms this way before.</comment></comment>


Internet threatens rare species, conservationists warn - <AUTHOR> http://news.bbc.co.uk/2/hi/science/nature/8579310.stm

<comment><USER2> _The internet is becoming the dominant factor overall in the global trade in protected species_

The internet is becoming the dominant factor in _everything_.

</comment><comment><USER3> What I don't understand is why would it be the internet's fault people are buying and selling illegal stuff. It is just an instrument for people who used other ways before the internet existed.

And besides that how is the internet making poaching easier? You need somebody to physically and illegally hunt the creature (internet doesn't help here) and somebody to receive the creature through customs and some means of transportation (again the internet doesn't help here). So the only thing internet helps is faster searching and maybe paying for said creature. I doubt this was the most difficult thing before the internet came around.</comment>


BufferBox (YC S12) launches deal with transit system - <AUTHOR> http://business.financialpost.com/2012/10/26/startup-roundup-bufferbox-deploys-in-go-stations-builddirects-4m-funding-and-a-doc-on-startups/

<comment><USER2> Very clever move. Ideally located, (presumably) with security cameras etc already there, and provided by a transit authority- which are almost permanently cash-strapped.

In short: bring it to New York, please. But expect them to get dented late at night.

<comment><AUTHOR> Thanks for the comment! In your opinion, where would be the most ideal location in New York?

</comment></comment><comment><USER3> These are similar to Amazon lockers in seattle right? Interesting business model (would love to hear more about it somewhere)

<comment><USER4> It looks like Amazon Lockers are available in SF as well. What differentiates BufferBox from Lockers?

<comment><USER5> Lockers are just for Amazon packages. BufferBox has partnered with many shipping companies.

<comment><USER3> Amazon lockers though are free to use I think. This added cost of the service has to be factored in to people's mental price-comparison. How much is it likely to cost?

<comment><USER6> in their pilot, they used a "Credit" system. I think it worked out to a couple bucks a package.

The service is free till the end of 2012. I imagine partnering with shipping companies is in the works. If I recall correctly, the founders are also partnering with some major retailers (I believe Wal-Mart Canada was mentioned), so this could mean free BufferBox services or just a partnership for locker placement. I doubt it's simply locker placement, why would Wal-Mart want you to pick up your Amazon packages in their store?

Contrary to the parent, the company hasn't partnered with any major shipping companies, but a courier company to handle the fulfillment to the actual BufferBoxes.

</comment></comment></comment></comment></comment><comment><USER7> I've worked in close proximity to these guys, but the math behind their business still boggles me.

There are about 10 slots in their largest box, and they are charging $4 per slot. The average package will occupy the slot for a day before it is picked up. This gives a max revenue of $40/day/box, or $1200/month/box. Slash that figure in half because it is impossible to have all slots occupied simultaneously all the time, and you get $600/month/box.

If they can turn this into a profitable business, they are truly visionaries that see what others cannot.

<comment><USER8> I think the pricing right now is mostly to encourage behavioural change. A more sustainable model would be subscriptions (e.g pay $10-$15 a month like a P.O Box and get your mail on your way from work instead of delivered to your house without notifications on arrivals etc) and I think once they see enough repeat behaviour they would go there right away.

Still wonder why they don't just encourage that behaviour right away by giving people free for a number of months then encouraging them to pay once trial period is over. Will probably hasten behavioural change process (people like to make maximum use of free whilst building dependency unintentionally).

Anyway, I'm just a lowly idiot. Def don't know as much about their biz as they sure do.

</comment></comment><comment><USER9> I wouldn't have thought this would have ever got of the ground with potential security issues. An underground station would be the perfect place to plant explosives. In London they don't even have rubbish (trash) bins in the stations.

Perhaps only pre-approved retailers can deliver to it. That system's still open to abuse though.

<comment><USER10> Coin-operated lockers are commonplace in commuter stations - this is no different. Your argument seems like a problem specific to the UK, or other countries with such draconian laws.

<comment><USER9> I don't think it relates to law, just common-sense after decades of terrorist attacks in London. [http://en.wikipedia.org/wiki/List_of_terrorist_incidents_in_...](http://en.wikipedia.org/wiki/List_of_terrorist_incidents_in_London)

I'm guessing that the risks are far lower in the US

<comment><USER11> In this case, GO Transit runs a commuter rail network (on the surface) so underground bombings shouldn't be a concern.

<comment><USER9> OK - we have left luggage in large train stations but all bags are subject to security inspections. They have to go through a TSA body scan ;)

</comment></comment></comment></comment></comment><comment><USER12> While it's mainly designed for packages, I use it for all my mail now. Would have a hard time going back to not having it.</comment>


How the scrapped ID card database will be destroyed - <AUTHOR> http://www.bbc.co.uk/news/uk-politics-11719764

<comment><USER2> "But 200 computer terminals in five "back offices", where officials processed applications and ran background checks, will be spared the crusher. Instead, workers will have to "provide file locations of extracted data" so that the Home Office team can put together an "audit record of data deletion"."

Seems to me that this is where the compromise will be. Asking "workers" to "provide file locations of extracted data"? What's the chance that some locations will be missed? And why do they not already have a registry of all locations where private data is copied?

Also, it's far easier to compromise a computer (do it remotely over the internet) then some piece of card scanning hardware (more likely to need physical access).

<comment><USER3> Not to mention:

 _But, in another twist, the document also reveals that not all identity data will be destroyed - some will be kept for the purposes of investigating fraud._

</comment></comment><comment><USER4> Security theatre, and like security theatre at airports it masks the reality that in all probability nothing of substance is actually happening.

And of course we trust all of these people to get it right and for nothing to slip through the cracks. The threat is as much about what happened in the past as what happens now. What guarantees are there that some employee didn't make their own copy of the data and take it offsite? What about backups?

<comment><USER5> There's quite a complex set of processes behind the way HM Government systems are managed. They can't just throw backups away, they have to prove that they've been disposed of in-line with HMG policy.

As for guarantees, there are no more than there would be that someone at Google hasn't done that, but what HMG does have is a fairly strong vetting standard, that these people will be under.

<comment><USER4> The 'proof' is just a form being filled in, I doubt there is a government overseer who does a directory listing and then observes the destruction of that specific drive.

And none of this theatre can rectify historic breaches.

<comment><USER5> Where do you get the idea that this is just a case of filling a form in?

</comment></comment></comment></comment><comment> mike-cardwell The only people who have the ID cards are the ones who volunteered in the first place. They clearly don't care about their privacy so why bother going to all this effort?

<comment><USER6> So that in five years, if Labour wins, they can't just throw the "on" switch.

This is basically poisoning the wells and salting the fields.

<comment> mike-cardwell I'm totally for getting rid of them. I just don't think they need to go through all this effort for the sake of people who don't care about their own, or anyone elses privacy. Just Ebay the machines.

</comment></comment></comment><comment><USER7> Wow, a government getting rid of an intrusive system? I never thought I'd see the day.

Next week we're going to hear that they are taking down all the CCTV cameras!

<comment><USER8> Somehow, I don't think we will...</comment></comment>


Unencrypted patient medical information is being broadcast across Vancouver - <AUTHOR> https://openprivacy.ca/blog/2019/09/09/open-privacy-discovers-vancouver-patient-medical-data-breach/ <comment><USER2> In my part of the US, I can overhear loads of PII by just tuning my VHF transceiver to various public safety frequencies. I hear drivers license numbers, medical info, all sorts. I hesitate to think that there's a better alternative though. I'm terrified that the UK is moving to LTE rather than the current trunked radio. The amount of damage caused by comms failing in a major emergency (or even just dead zones) massively outweighs the risk of a little data loss at present. If there are more reliable communication methods that preserve privacy, then we should be using them, but I'm not sure they exist at the moment.

edit: to be fair, it should be possible to encrypt some of the traffic, but things should fail open, not closed, or people will die.

<comment><USER3> Meanwhile the rest of the world has moved on to digital, encrypted communication.

Mobile phones continue to work during a disaster as long as the base station batteries hold out and that's with cheap base stations serving very large amounts of idiot users using the cheapest of the cheap handsets limited by regulations. Why wouldn't you be able to make this work indefinitely with a limited amount of trained users using selected, powerful expensive handsets.

In other words, a bunch of poor excuses made by coincidentally those same people who love to profess that privacy doesn't matter as long as it's someone else's privacy.

<comment><USER4> Agreed about privacy, but the "Mobile phones continue to work during a disaster" is a very optimistic view.

It was no a disaster, far from it. In Belgium, few years ago, a fire under a bridge broke an bunch of fibers from the main telco operator.

Result on a region of about 200,000 inhabitants:

      - no radio (on my usual station), first thing I noted that morning.
      - no internet
      - no TV (comes via internet)
      - no cell phone coverage
      - no land-line either
      - emergency calls impossible (by cell-phone or land-line)

This started early in the morning and was only solved in the afternoon for most people. We are over-reliant on some technology with many single point of failure we do not even know about.

<comment><USER5> That sounds insane. Any network other than very basic ones should have physical redudancy, ie. not being in the same duct or even travelling close to eachother. Hell, our local MAN network here does it! Thats in a city with 130k inhabitants, they actually made the network backbone out of redundant rings.

I would hope most telco networks would be somewhat resilient.

<comment><USER6> A former employer of mine tried to have redundant connections. They had two fibers from two different providers, going separate paths from their Dallas office, etc. However, the 2nd provider utilized a 3rd provider as a regional carrier. And for about 100 miles between Dallas and Chicago, the fibers were run in conduits that were side by side. We discovered that when a single backhoe took down phones, data, etc, to all our southeast Region offices. (it also affected many others). Found out the hard way, that the 2nd providers redundant uplink also went through the same connection. Good luck tracing your fibers all the way from end to end.. Most of this stuff is all contracted to 3rd parties, and most don't want to give you detailed maps.

<comment><USER7> Companies often sell services to each other, too. So what you think is a redundant connection may just be a link on the same fiber, resold.

</comment></comment></comment></comment></comment></comment><comment><USER8> I saw Balint Seeber give a fascinating talk about discovering the use of unencrypted pagers in hospitals, with messages full of personal information available too anyone with an SDR (and his particular brand of persistence to work out how to discover the modulation/encoding to get the text out.)

It's mentioned in passing in this talk description from 2011:

[https://2011.ruxcon.org.au/2011-talks/all-your-rfz-belong- to...](https://2011.ruxcon.org.au/2011-talks/all-your-rfz-belong-to-me- hacking-the-wireless-world-with-gnu-radio/)

" ... and security-through-obscurity in hospital pager systems."

I'm 99% certain I saw him give that talk at Dorkbot in Sydney, which make it maybe 5 or more years earlier than that...

<comment><USER9> "discovering" is an odd word to use there. I'd say "noticing".

PDW has been going since 2003 and I only mention it because I can't remember the name of the DOS software that preceded it...

[https://www.discriminator.nl/pdw/index- en.html](https://www.discriminator.nl/pdw/index-en.html)

<comment><USER8> I only worded it like that because of the way he described his long and often unfruitful efforts over several years before he finally hit upon the right keywords and documentation to describe what he was seeing over the air...

<comment><USER9> That's a confusion born of not spending enough time hanging out with sneaky folks doing shady shit.

I remember that in the 90s, the local PD had learned that some folks would listen to scanner traffic to figure out when their rowdy parties were going to be broken up, so everyone could hide and make the scene look calm by the time officers arrived. So they stopped using voice radios for this sort of call, and instead switched to their Mobile Data Terminals.

Which was even better, because MDTMON had an alert feature where it'd sound the PC speaker when your keywords (say, your street name) showed up in the decoded traffic. That freed up one partygoer from scanner duty!

POCSAG/FLEX were even more of a treasure trove, but that's a story for another day.

</comment></comment></comment></comment><comment><USER10> I'm a hospitalist (internal medicine employed by a hospital). I'm fairly certain that what they are intercepting are pages from the ER to admitting or consulting physicians.

In the US, this would be a HIPAA violation but I'm not sure of the Canadian law. We still use pages at my hospital, but no PHI, only room numbers in the ER for admissions are paged and then you log into the EMR. We use HIPAA compliant texting apps to communicate PHI.

<comment><USER11> HIPAA is such an awesome law. I have to work with it daily as an engineer, and I'm continually amazed that the US government requires so much security. Normally the US is extremely hands off when it comes to privacy and security. Congress almost never passes laws that have such far reaching scope. And HIPAA actually has teeth, with significant penalties for companies who don't comply (and of course people can sue as well over the violation).

I think aspects of it could definitely be improved. I see HIPAA violations at doctor's offices all the time - but they are usually still fairly minor, and doctors and nurses grow concerned quickly as soon as you mention a possible violation.

<comment><USER12> How are you fond of this law? It's so obviously a pointless waste of money. As a fellow engineer who has worked with it I cant wait ffg or its repeal - and I see that coming.

<comment><USER13> I'll bite. What would be the options for keeping our PHI from being freely shared everywhere? You have to know that Facebook would love a piece of that.

<comment><USER14> First of all, I don't think HIPPA actually prevents PHI from being shared. If Facebook were to become a business partner of a hospital, and maintain HIPPA compliance themselves, hospitals can share data with Facebook.

To tackle the problem HIPPA tries to solve, that is making sure that data sharing is secure and only with the intended parties, I want to see stronger enforcement of liability. Granted, the US doesn't have a great track record on that, seeing Equifax get away with what their doing. But I think that's the system that needs to be improved.

Instead of government dictating what "secure" means, different approaches can be experimented with on the market with strong enforcement of liability providing the necessary incentives.

<comment><USER15> > hospitals can share data with Facebook

Then Facebook would become a Business Associate and would have to protect information in a variety of very strict ways and could face a fine of up to $10,000 per patient record, per violation. If they had 25 million health records and decided to target advertising to those people on two separate occasions, then they are liable for a fine of up to $500 billion. So sure, let Facebook get into health, it wouldn't take long for them to run afoul of the law given their move-fast-break-things attitude.

<comment><USER14> Is targeting advertising based on health data a violation if the advertiser is a business associate and is not directly exposing the data to any non-covered entities?

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> Pagers are great.

They're a lot more resilient than the cell phone network, especially if there's a mass disaster.

They tend to work better in basements or deep in buildings.

They don't get annoying amber alerts (important in Canada where they're all sent as Presidential/ICBM), constant "IRS" or "Dell" call spam from your area+exchange code (ie: lookalike numbers that seem internal to your hospital) or SMS spam.

These are excellent features if you're on-call, but _must_ respond to anything.

<comment><USER17> One way pagers are also privacy friendly - base stations are not aware of your location.

</comment></comment><comment><USER18> > VCH was unaware of the radio broadcasting component of the pager system(s) > in question until several weeks ago

I'd like to know how they think pagers operate.

<comment><USER19> Hopefully the privacy commissioner is aware of this stuff works as well

</comment></comment><comment><USER20> Happens in Australia too, probably the easiest signals to find (i.e. strongest) using my $10 RTL-SDR besides broadcast FM. Plenty of names, emails, addresses, phone numbers, medical conditions, security alarms being triggered etc. Other interesting finds are SCADA messages, some from Pizza Hut etc. Regulations here allow reception as long as you don't take any action based on what you receive so that's nice.

</comment><comment><USER21> Sarah Jamie Lewis's Twitter thread (unrolled):

[https://threadreaderapp.com/thread/1171148964264992768.html](https://threadreaderapp.com/thread/1171148964264992768.html)

</comment><comment><USER22> Key management between emergency services remains a hard problem. Paramedics often don't have hands free to type information into a terminal, so they use radio, which means keying their handsets, and then classifying the keys for different security levels. e.g if you need to talk to SWAT and other teams, you are going to need a separate channel and key. Police have an interesting case with that as well, where techs that use or distract their hands during stops are a safety issue.

Military communications for a given mission are mainly all in the same security domain so key management is relatively easy. Co-ordinating key management for daily use between police forces, ambulance services, hospitals, fire stations, and other responders is non-trivial.

I do suspect the best possible privacy solution would be a regulation that made personal and health information acquired without explicit consent inadmissible in a civil court case, regulatory tribunal, or other government process, and heavy fines for using it for insurance and credit and licensing other decisions by regulated/protected businesses. Not so much GDPR regs, but just removing legal leverage from the data.

We still need technical security and privacy controls, but creating legal liability for the people who hold and exploit it is the real solution. Agencies can't hide behind, "machine learning," and "random checks," for targeting people. There will be some hard cases, but if you use PII/PHI without explicit informed consent and collection, use and disclosure for specific purposes, you should be handicapped legally, imo.

<comment><USER23> I upvoted you, but want you to consider how there can be dramatically worse bad actors than the government or legitimate companies (the insurance/credit/licensing stuff you mention): people end up in the hospital sometimes because someone else wants to hurt them. Simple example: spousal/partner abuse. More extreme but easily plausible in Vancouver: gang violence.

If I failed at a hit, and I can watch the POCSAG traffic and see the that the guy I tried to take out is in a coma (and not dead), and is in room 404 at Vancouver General Hospital, that's very valuable information.

<comment><USER16> I've found with most hospitals that finding out a patient's location is as simple as asking.

Maybe some people get identified as "VIPs" and it's not so easy. Dunno if every random gun-shot victim makes that, but if your "hit" was more an "accidental" car wreck, you can probably ask and find out where they are.

<comment><USER24> You can do better than that. Put on some blue scrubs and carry something complicated looking. Look hurried. You'll be admitted into almost any healthcare facility.

<comment><USER23> You're both right, and healthcare definitely has a lot of fun threat modelling exercises you can do. I suppose the big thing that the pager monitoring stuff gives you is a live stream of some significant fraction of _all_ the patients coming through, not just a specific target.

</comment></comment></comment></comment></comment><comment><USER25> I had read, and maybe I'm misguided, that the law in the US was that you could listen to this stuff as an experiment with your amateur radio license and mess around with all the decoding you wanted... It was just illegal to disclose to anyone anything you heard or read. Actually I don't think the amateur license may have had much to do with it at all, but anyway... I played with it for a minute and mostly saw automated messages about housekeeping needs, but I did occasionally see names, some kind of ID number but I don't think it was a SSN, and sometimes little "love you" notes and quite a lot of "please call me back". I got pretty bored with it pretty quickly that day.

<comment><USER26> > you could listen to this stuff as an experiment with your amateur radio > license

A license is only required to transmit. There is no license required to receive (how would that work, anyway?).

<comment><USER27> > how would that work, anyway?

[https://en.wikipedia.org/wiki/Television_licence](https://en.wikipedia.org/wiki/Television_licence)

Ask all of those countries.

</comment></comment></comment><comment><USER28> I am not too surprised. A lot of emergency services use analog radio. Pretty much works with all radios, and no setup before hand unlike with encrypted radio. No need to negotiate things with other agencies either.

</comment><comment><USER29> A few notes:

* In Canada, we have jurisdictional privacy law. In this case BC FIPPA. This is different than in the US where the few privacy laws that exist are mostly sectoral, such as health (HIPPA). [https://www.oipc.bc.ca/guidance-documents/1466](https://www.oipc.bc.ca/guidance-documents/1466)

* In Canada, only only one party has to agree to agree to record a telephone conversation.

* In Canada, it is not illegal to have a scanner and listen to phone calls even, hence the need to encrypt them faster up here. POGSAC decoding was done in the middle of the 90s with my local #2600 group. It even easier now with RTL-SDR. [https://twitter.com/cqwww/status/1171113297011019781](https://twitter.com/cqwww/status/1171113297011019781)

* I've been in two states of emergency in my life. Cell phone switches go down in minutes. You want to have your amateur radio licence, an amateur radio, and battery, on standby for when this happens. Practice setting up a data connection to is, as the internet goes away quickly as well. Get your ham radio licence, it's free, and you have your call sign for life. It's a nerdy thing to have except in an emergency, where you quickly turn to hero if you're the only person in your area capable of communicating with emergency services.

</comment><comment><USER30> I wonder how much security issues relate to the data formats that are often used to exchange medical information. I believe northern American nations mostly use HL7, while European countries tend to prefer Dicom.

HL7 was around since 1987, while Dicom is older than TCP/IP I believe. I think requirements for data exchange fundamentally changed in the last 30 years and at least Dicom is just horrible to handle.

True, you could upgrade it with putting everything in a crypt container, but that is just a quick fix.

This is a case where I fully support software engineers that say that we need to fully reimplement these formats. It is good to have standards here, but many manufacturers of medical devices have their own proprietary adaptations anyway. It shouldn't mean to throw everything learned from these formats away. Just maybe it should all be reevaluated.

<comment><USER31> HL7 is just text, if you're not sending it over SSL then it's arguably easier to decipher than a simple webpage when looking through the packets!

The current thing is called FHIR though and instead of sending text HL7v2 messages directly to a port over SSL now we can use a web service, HTTPS, and exchange JSON messages.

<comment><USER30> Oh really? I always thought it would mainly be an image container like Dicom, which is in practice abused to exchange text just as well. Haven't had the pleasure to work with HL7, I was just tormented by Dicom and have always been told that HL7 is just the American version of it.

<comment><USER31> All of my legacy interfaces for an EHR vendor are HL7v2 based. It's pretty simple to work with but our lack of external libraries leaves me tinkering with opening ports and reading data manually too much.

The beginning of a HL7 (2.4) message with the header and patient ID node might look like this (this example looks like an ORU^R01 inbound lab result)

MSH|^~\&|GHH LAB|ELAB-3|GHH OE|BLDG4|200202150930||ORU^R01|CNTRL-3456|P|2.4

PID|||555-44-4444||EVERYWOMAN^EVE^E^^^^L|JONES|19620320|F|||153 FERNWOOD DR.^^STATESVILLE^OH^35292||(206)3345232|(206)752-121||||AC555444444||67-A4335^OH^20030520

Just a list of offsets using |^~\& seperators sent directly over a port.

The JSON/FHIR versions are nicer even if they are more verbose.

<comment><USER24> HL7 is so awful. My introduction was is seared into my memory as I hadn't realised the various line break methods allowed/used.

I have dealt with a vendor who's existence began is still heavily propped up by their HL7 broker service. It seems rather lucrative.

<comment><USER32> HL7 is the manifestation of all that is unholy and wrong.

</comment></comment></comment></comment></comment></comment><comment><USER33> rtlsdr + gqrx + multimon-ng

pole around 929.600mhz and you'll eventually find a shitload of phi in most metro areas. you'll probably also find a ton of industrial traffic, and the occasional weather and sports scores.

it's also not far fetched to think it's used as a means to broadcast to/from field operatives. most pager lines offer an smtp gateway, so a bit of "spam" could have a intended recipient anywhere in the region, or possibly country based on network.

<comment><USER34> I was just about to buy an SDR rig to play around with, so the timing of your comment is wonderful. I have been looking off and on for a year now and there are just too many choices. I have my tech license, but then I had two kids and haven't been able to go for general yet. I've been bored not getting on HF, which is where I hear all the "action" is. So what SDR would you recommend I get if I also wanted the ability to transmit HF one day?

<comment><USER35> I don't think it's economic to buy an SDR rig with the intention of maybe transmitting on HF one day. Most HF digital modes are audio-jack based, meaning that you connect any radio, particularly a used one that you can get cheaply on eBay, to your computer via a line-in/line-out connection. You do not need any fancy SDR stuff going on; popular digital modes like FT8 put the entire band in the space of one normal voice conversation. So no special equipment whatsoever is necessary to use digital modes.

One time I had my audio misconfigured to use my microphone instead of the line-in, and I had my radio disconnected from the computer to tune the antenna. As I was listening through the radio's built-in speaker, my computer properly decoded a number of FT8 transmissions... through the microphone. You really don't need anything expensive or interesting to do SDR stuff on the HF bands.

People that buy the "real" ham SDRs are doing things like contesting, where they really need to see entire bands, or even multiple bands, at once. And they're paying over $10,000 for that.

The cheap "hacker" SDRs are largely inadequate for ham work. They are OK, but not great. They don't have proper frontends, so transmit a lot of out-of-band garbage. They don't have niceties like an antenna matching network, or even a power amplifier. I have a KX3 which has a maximum transmit power of 12W. But these hobbyist boards will max out in the mW range. It is adequate for some digital modes, but even then, it's pretty low. I typically run FT8 at 1-3W. So generally, would not recommend these for someone new to the hobby. Buy an RTL- SDR stick for $20. Listen to some stuff. When you get bored, find a proper HF radio in the $300 range and use that. If you then decide you want to spend $10,000 on the hobby, then you can start looking into the SDRs ;)

</comment></comment></comment><comment><USER36> "didn't seem to rely on any radio connection"

What did they think it relies on? Fairy dust?

</comment><comment><USER37> this is pretty much every hospital in america too

<comment><USER38> Do you know that, or are you speculating?

Edit: Huh, I guess you might be right. [https://www.beckershospitalreview.com/cybersecurity/man-s- an...](https://www.beckershospitalreview.com/cybersecurity/man-s-antenna- picks-up-phi-from-pagers-at-5-hospitals.html) (2018)

<comment><USER39> I have absolutely seen this sort of thing in a major US city.

</comment></comment></comment><comment><USER40> Happening in the majority of the hospitals in Seattle as well.

</comment><comment><USER41> While the findings are solid and the denial is despicable corpspeak, I fear the data is still way safer this way than letting the same kind of contractors build a "secure" app and then finding all that data neatly ordered in an open S3 bucket or MongoDB a year later.

Nobody's gonna put up an antenna over years collecting all this noisy stuff.

On top, my condolences for the hospital IT staff having to exchange thousands of real pagers with real doctors, and train them again over the course of several months, all for a pretty synthetic finding that took them a couple of hours.

Builders vs. breakers all again... Well, you got your attention, guys.

<comment><USER36> > Nobody's gonna put up an antenna over years collecting all this noisy stuff

What do you think all the antennas on embassy buildings are for?

</comment></comment><comment><USER42> Going over the timeline, I find these things very odd:

> _2018-11-12: Sarah Jamie Lewis reaches out to Vancouver Coastal Health > Privacy Office (VCH-P) with information about the breach._

> _2019-03-04: Sarah Jamie Lewis meets with two journalists and demonstrates > the pager breach. This meeting was not recorded and this meeting is never > followed up on._

> _2019-07-23: During an interview with journalist Francesca Fionda, on Open > Privacy's research into Swiss election systems, Sarah Jamie Lewis discusses > the pager breach._

[...]

> _2019-08-15: Sarah Jamie Lewis reaches out to the Office of the Information > and Privacy Commissioner for B.C. (OIPC), offering to help aid any > investigation they wish to undertake in regards to this data breach._

They waited _nine months_ before contacting the provincial Privacy Commissioner? They contacted journalists before the OIPC?

* [https://www.oipc.bc.ca](https://www.oipc.bc.ca)

<comment><USER43> There is no official way for 3rd parties to make breach reports to OIPC-BC (nor is there a legal requirement for VCH to report to them) - it was only after Francesca raised the issue during a meeting with the commissioner(regarding breaches in general) we were informed they would be interested in this, and were given an avenue to contact them in a way that an investigation might be authorized.</comment></comment>


Guy Steele: "How to Think about Parallel Programming: Not" - <AUTHOR> http://www.infoq.com/presentations/Thinking-Parallel-Programming <comment><USER2> When I watched Guy Steele's earlier talk on the same subject (below), the scales fell from my PL eyes.

When he showed that user-definable, verifiably associative combination operators can provide magnificent opportunities for automatic parallelization, I was ripped out of my head and found myself unable to squabble about the different features of my favorite languages. Even Lisp (the prototype [1]) falls significantly short, since linked lists are most naturally processed by a single thread of execution.

It's clear to me now that when the massively multicore era hits, there will be a significant opportunity for a totally new breed of PLs and for programmers to (re)implement a new wave of software. I hope to be ready when that time arrives.

"Organizing Functional Code for Parallel Execution; or, foldl and foldr Considered Slightly Harmful" <http://vimeo.com/6624203>

[1]: Clojure does seem to be anticipating this future, however

<comment><USER3> The operators don't have to be _verifiably_ associative -- I'm pretty sure that's impossible to verify, in general, thanks to the halting problem -- but it would be nice to be able to declare operators associative.

Clojure looks like it could easily be made to support the kind of thing Steele is talking about: its immutable vectors are implemented as trees of array chunks, to which you could apply an associative operation in parallel.

<comment><USER4> aren't verification and definition of associative operators two different problems?

I mean, while you can't generally prove that an operator is associative, you can have probably tell that they are associative by construction.

<comment><USER5> _I mean, while you can't generally prove that an operator is associative, you can have probably tell that they are associative by construction._

From the construction of matrix multiplication, it is far from obvious that it is associative. And this is a simple example.

</comment></comment></comment></comment><comment><USER6> The first part is fun! Brought back great memories of hacking IBM 1130's at Teledyne Ryan while in high school.

He's wrong when he said that machines of that vintage didn't know about stacks: the whole Burrough B5000 series of machines were entirely stack-based (and programmed in an extended Algol--decades ahead of their time).

</comment><comment><USER7> I'm so happy to live in a world where I can stream a talk like this that happened yesterday at a conference I'd not be able to attend.

The motivation at the beginning with the punchcards and the following PDP-10 "poem" for computing the sin() function left me skeptical about what was to follow, but it turned out to set an excellent stage for the remainder of the talk. By the time he got to the "big deal" ideas at the end, I was well prepared to accept his thesis.

Don't miss this talk. Take the time to watch it.

One nice bit: he admits that if he knew 7 years ago what he knows today, Fortress might have started with Haskell and been pushed 1/10th of the way towards fortran, rather than starting with an object-based foundation and writing side-effect-free functional domain-specific-languages on top of it.

</comment><comment><USER8> This was the best keynote at Strange Loop in St. Louis this year. It was wild sitting in a room with that many people all laughing about the unbelievable metaprogramming he had to do on punch cards. I'm hoping 2011 Strange Loop is as good as this year.

</comment><comment><USER9> Guy Steele had some really great presentations (this one included) over the last years: <http://bit.ly/hy5n0S>

</comment><comment><USER10> I didn't see the point of the talk (and was very annoyed by it) until minute 31. That's when the topic starts, in my opinion.

<comment><USER11> You'd probably prefer the talk linked to by guns, then. It's an expanded and deeper version of the latter half of this talk.

</comment></comment><comment><USER12> Yeah, I kind of agree. Saying there should be better parallel programming tools is only slightly more useful than saying that the hardware people should come up with a way to improve single-threaded performance.

</comment><comment><USER13> "Guy L. Steele Jr. believes that it should not be the programmer's job to think about parallelism, but languages should provide ways to transparently run tasks in parallel."

And who makes the languages? Programmers!

I get what he's trying to say... He's trying to say that someone should stop and make it easy for the rest of us to do parallel programming.

And I think someone will eventually do just that. But as usual, I don't think someone writing a blog post about it is going to push someone into it. Either they have the drive to do it, or they don't. "Somebody else should do something about this!" never works.

<comment><USER14> Even in C++ it's pretty trivial to parallelize a loop with openMP.

The compiler could do it automatically but it's only a single line preprocessor directive.

<comment><USER15> Is it? Adding the directive is easy, but verifying that it does not change program semantics can be far from easy.

A parallelizing compiler must do the latter before doing the former.</comment></comment></comment>