Dynamic Languages are Unmaintainable - <AUTHOR> http://williamedwardscoder.tumblr.com/post/54327549368/dynamic-languages-are-unmaintainable-and-unit-testing <comment><USER3> One thing I've only come to appreciate during my professional development is that there are huge differences in the kinds of software people write and what's good in one scenario isn't necessarily good in another. A lot of people around here fall into the trap (myself included) of thinking that web programming is the entire universe of programming. That's not so, and the difference matters greatly.

If you're going to write a physics simulation, you're really going to benefit from some language features over others. I would argue that you especially benefit from static types because you control a lot of your stack and type checking can make your code very robust. On the other hand, if you're going to write a webapp, think about what you're doing: essentially slinging text around and taking random inpust from users, casting all of it to actual types, and shoving it into a data store (casting it again sometimes). What is the type system providing you in that scenario? Everything is cast at runtime _somewhere_.

<comment><USER4> > What is the type system providing you in that scenario?

Though the data flowing in and out of a web application is usually in string form, that doesn't mean that it needs to be treated as such in your application. You'll convert the string to a richer, more specific datatype and the static type system will help you correctly manipulate the data.

A nice blog post on the subject is [1] where the author explains how you can represent different kinds of strings (raw strings, SQL strings, etc.) using the type system.

[1] [http://blog.moertel.com/posts/2006-10-18-a-type-based- soluti...](http://blog.moertel.com/posts/2006-10-18-a-type-based-solution-to- the-strings-problem.html)

<comment><USER3> Thanks for that post, I think the point I was making was slightly different. I'm arguing that with web programming you lack the end to end control you might have in a closed system. You depend on all sorts of input from users, your data is stored in a database or nosql store that is outside your program's (and compiler's) complete control. It can change underneath you at any time. The argument that static typing can help you know that your code is correct is weakened in this environment. Internally you of course construct your code in a way that uses types and can verify that you are internally consistent. However, I'm saying that at a fundamental level, in a data-driven web app, the system as a whole is only marginally improved by this because your whole universe starts out with a bunch of typecast operations as the gateway to your codebase. These always are happening at runtime and are one "ALTER TABLE" (to pick just one example) away from failing spectacularly in production.

I'm not arguing one way or another that static typing is/is not good in this scenario. I'm just pointing out that the foundation of the system as a whole is not as solid as other programming scenarios where you have much more control.

</comment></comment></comment><comment><USER5> Having written a lot of scientific code in Python, I agree (partly).

The lack of static analysis is extremely irritating when you've been running a long old calculation for 20 minutes and it chokes on a misspelled variable name. You can often catch these with PyDev/eclipse, but not always.

I try to rewrite any code which isn't fast enough in C (or C++, using a few of its "features" as possible) and wrap it up as a Python module; this gives me the best of both worlds: the speed and type checking of C/C++, with the convenience of calling the code from a quick script or an IPython shell.

This approach is much easier for scientific code than for web apps, though, which do actually _need_ dicts and string parsing.

[[One web app option might be to cython as much of your pure python code as possible (including cdef'ing many of your local variables) as this will dramatically help typo checking - I don't know if this is particularly scalable though.]]

<comment><USER6> > when you've been running a long old calculation for 20 minutes and it chokes > on a misspelled variable name.

If you are writing C++, you can't hot edit and continue without re- compilation. With a scripting language and proper flow control, you can edit upon exception and resume.

<comment><USER7> > you can't hot edit and continue without re-compilation

But with recompilation you can. watcom allowed stepping back during debugging as long as the operation was possible to revert. From there patching up the code to include a new version of the function shouldn't be that hard. Not sure if anyone's actually done it, but it's certainly not impossible.

Ksplice works similar way if I'm not mistaken to do reboot-less kernel upgrades. (patching the functions part that is, not recovering the code that's already running them)

<comment><USER6> Ksplice is basically a binary (in ELF format) swap in kernel memory space.

What happens if your binary is faulty?

</comment></comment></comment></comment><comment><USER8> I use dynamically typed languages maybe 90% of the time, and completely agree. But here's the thing: for most projects - including ones in production - <USER2> doesn't matter because the app won't be large enough to not completely fit in a mental model.

If the app starts getting too large, then by all means rewrite it in a statically typed language. If you're getting to that point, a rewrite is probably warranted anyways; regardless of the language you choose, first versions are usually awkwardly structured and difficult to maintain anyways since features evolve faster than architecture.

<comment><USER9> I would also argue that you can get the benefits of a static type system with hardly any cost. Usually when people talk about dynamic vs static typing they imagine something like Ruby or Python vs Java, but there's no reason why you can't have a high-level, expressive language with static types.

All you need is a sophisticated type-system and smart type-inference that works everywhere (not just locally) and you'll be able to be just as productive as with today's popular dynamic languages but get all the benefits of static verification.

<comment><USER4> OCaml, F#, Haskell all come to mind. Regarding total type inference, I am not sure though that any of those can do completely away without some manual type annotations. I still like to declare type annotations (especially in Haskell, the syntax in ML is a bit too ugly) for top-level functions.

<comment><USER10> I can only speak about Haskell here, but how often do you need to provide a type annotation. I have never been in a situation (outside of the interactive prompt) where the compiler failed to infer the type. I do provide many type annotations for the sake of readability, but as far as I am aware the only effect these actually have on the code is providing additional restrictions on where a function can be used (that is to say, intentionally making the type signature less generic than it could be).

</comment></comment></comment></comment><comment><USER11> The argument between dynamic and static languages has gone one for years and there's been no conclusive answer that one is better than the other.

People have written 500kloc C++ systems and they've written 500kloc of TCL.

<comment><AUTHOR> Submitter here: Yes, and some of the claims are simply factually incorrect: the original work on refactoring OO programs was done in the context of Smalltalk, the code navigation we now have in IDEs was taken from Smalltalk (in fact, Eclipse started out as Visual Age Smalltalk) etc.

So I find the post "debatable"...

<comment><USER12> (blog author)

Well I thought refactoring went all the way back to Forth.

I'm sure that with some language xyz it worked out very well for some project abc and that obviously disproves my whole point and you can move on...

I found writing large projects in Python - a language I was very familiar with, expert even - to become very difficult to extend aka maintain after a long time. My post should be seen in the bigger picture of the post I was following up about "Scaling My Server", and others I have written.

<comment><USER13> Isn't "some language xyz worked out very well..." and "I found writing large projects in Python..." basically the same (anecdotal) argument?

<comment><USER12> Yes, but its a subjective post. If someone wants to say or blog "I use xyz and I can successfully maintain and extend large projects and it hasn't collapsed under a cognitive burden and too-specific unit testing" that'd be a cool counter data point.

<comment><USER13> Advocacy is cool now? Statistically you could come up with almost any methodology, sane or not, and find one project using it, unless you're going for outright cruel jokes like Befunge, INTERCAL or ITIL...

</comment></comment></comment></comment></comment></comment><comment><USER14> >> And here is that insidious problem; all your unit tests have frozen the interaction of your components. They have copied the API of your components and distributed it all over your test code base.

This is what I hate about the unit-test everything approach. There seems to be a class of developers recently that believe robustness is more important than anything else.

Often speed bumps in changing API contracts is a higher price to pay [0] than the kind of bugs which unit testing uncovers.

There are lots of things which are good in small quantities and very bad in large quantities [1].

Better to be able to iterate quickly, spot a few bugs with sparse unit tests and completely rewrite your _small_ components if they no longer fit the bill. There is a tendency (perhaps with those too familiar with large corporates) to try to de-risk with more and more robustness tests. With all of this robustness monolithic software flourishes, and you eventually lose the ability to iterate quickly; the ability to destroy and start anew.

[0] Form does not follow function, form is interdependent with function. Make the functionality robust and you make the form rigid! How will you find product-market fit when you are unable to move?!

[1] [http://en.wikipedia.org/wiki/Hormesis](http://en.wikipedia.org/wiki/Hormesis)

<comment><USER15> It's better to do the wrong thing quickly.

<comment><USER16> Eh, you'll have an annoying time putting a man on the moon with that attitude. But hey, your twitters will hockeystick better!

It all depends on your problem domain--the cost of failure for certain things (pacemakers, telco software, car engine ECU code, and so on) may be much, much greater than the cost of being super retentive in your development.

<comment><USER14> Yes, it depends on the domain but outside a few industries (and low-level code) software isn't a life-or-death matter.

Infrastructure is a different kettle of fish, while it might sometimes be a life-or-death matter, generally it's just safer to seek pure robustness here: monopolies with government connections do not need to fear losing competitiveness since they can (a) manipulate the rules of the market, and (b) bind market players with contracts.

I don't like your insinuation that I'm just talking about cool hockey-stick startups; in the domains in which non life-or-death, free-market business and software colide, losing competitiveness/product-market fit is the central failure mode. And you absolutely _cannot_ become robust against the market. You must either (1) become faster than the market, or you must (2) control the market.

<comment><USER17> True indeed but the initial comment of 'It's better to do the wrong thing quickly.' was stated without nuance or caveat so the reply rightly pointed out that this statement is true in certain domains and completely false in others.

</comment></comment></comment></comment></comment><comment><USER18> First of all, there are no silver bullets and no overall "better" languages. It depends on the situation, and a good software _engineer_ should be able to reason about the trade-offs of using statically/dynamically typed languages in each situation.

In this case, it is about shifting the costs to different stages of the projects lifecycle. Statically typed languages require more mental effort while developing, and, by definition, catch more bugs early in the process (compiler has more information to play with, and the programmer is required to be more thorough). Pushing it even further, formal proof systems require exponentially more effort at development time, and, in some cases, rewards it with the proof of software correctness (i.e. no bug-fixing costs at maintenance stage). On the other end of spectrum, dynamically typed languages allow for much faster development (which can be mission critical), but a rapid release comes with a price of long-term maintenance difficulties.

It's up to the developer to choose which approach is the most appropriate for the situation (amongst the myriad of other trade-offs, like performance, scalability, user requirements, existing infrastructure and so on).

</comment><comment><USER19> The thing about dynamic languages is that they have a type system too, but it's called "inheritance." When literally everything in your language is an object that ultimately inherits from Object, as it is in Ruby or Python or Javascript, it doesn't matter what "type" each of your objects is, it just matters that your objects define the fields you want to access and respond to the methods you want to call on them (And Ruby even lets you fail up the object tree with method_missing). Fixating on types is focusing on the wrong thing. You need to understand the object inheritance tree, not the types.

Whether or not that makes your code unmaintainable is up to you, it helps if you keep your classes small and give each of them a well-defined and documented purpose. But that's just good coding practice in general.

Also, static code analysis is nice, but it can't determine everything about your code; Turing proved that in 1936.

Meanwhile, by skipping the the compiler and linker, you can deploy enhancements and bug fixes to a running program without shutting it down and restarting it. For a rather long but enjoyable read on why this is important for long-lasting software, see: [http://steve- yegge.blogspot.com/2007/01/pinocchio-problem.ht...](http://steve- yegge.blogspot.com/2007/01/pinocchio-problem.html)

</comment><comment><USER20> Are so many bugs really caused by type problems? I run into type based errors in Python almost never. It is not hard to keep track of dynamic types, and takes the same effort (or less) than static typed programming. In both cases, you have to know what type you are working with, right?

If you have this problem you have probably been trained to be sloppy by compilers.

<comment><USER21> I often get burned by doing something like `key = "player" \+ playerId`. Unfortunately, playerId is an int, and I forget that even though most other languages besides C/C++ will convert that for me, Python will not, so I get a runtime exception. Same thing with `print "no space after this" \+ number`, because I get used to `print "space after this", number` and then sometimes I don't want the space and inevitably I forget to do `str(number)`.

Mind you, this is the sort of thing you usually discover quickly, but it's also the sort of thing that most other languages will catch at compile time.

</comment></comment><comment><USER22> Hey, you might not know this, but if you use a dynamic language with types you can actually use them to your benefit!

I've wrote a system in ruby that does clean type checking when I want it to and it cleans up the code and tests a lot.

Just because you're not taking full advantage of your language tools doesn't mean that "dynamic languages are unmaintainable"

<comment><USER4> How can you implement a static typing system in a language that is dynamically typed?

<comment><USER22> There is a difference between static typing and strong typing. Ruby is a dynamic language that is strongly typed. This will explain it better than I can:

[http://www.rubyfleebie.com/ruby-is-dynamically-and- strongly-...](http://www.rubyfleebie.com/ruby-is-dynamically-and-strongly- typed/)

</comment></comment></comment><comment><USER23> I use a strongly, statically typed functional language. Because my code has no mutable state, the type system of the program proves the program correct. So I don't have to write any tests at all and maintenance is easy.

<comment><USER24> Which type system proves program correctness? A good type system can guarantee that your program doesn't suffer from certain classes of errors but that's very very far from correctness. Unless you only write programs that don't have any goal at all besides being memory safe: Behold MemSafe 2.9: it doesn't do anything at all, and most importantly, it doesn't do it in a memory safe way!

<comment><USER15> All safe type systems provide proofs that implementations fulfil specifications, but most type systems aren't expressive enough to create interesting specifications. The notable exceptions being type systems in dependently typed languages.

</comment></comment></comment><comment><USER25> I'm thinking about writing about blog called 'Dogs Are Green.' I don't have any evidence, but it's my opinion.

</comment><comment><USER26> Bad programming practices (which usually come from the business, in the form of unreasonable deadlines, untrained or unskilled programmers given high positions, and politically mandatory use of terrible legacy systems) are unmaintainable. I've seen static typing fall down just as hard when the developers weren't good.

Static typing is right for some problems, but the idea that dynamic languages are inherently unmaintainable in some way that most static languages aren't is one that I find incorrect.

<comment><USER27> Compiler does help with a lot of things that you'd require unit tests for with a dynamic language.

Example: Runtime wouldn't be able to give you a protocol between how two classes would communicate. Say your service object that handles authentication. You would have to write unit tests so the two classes involved would know how to respond to each other.</comment></comment>


HTML5 compatibility on mobile and tablet browsers - <AUTHOR> http://mobilehtml5.org/ <comment><USER2> Ironically, half of this page is unreadable on Opera Mini 6.x

</comment><comment><USER3> Please set your site to be resizable in mobile browsers. It's not very useful if the text is too tiny to read.

</comment><comment><USER4> Why build a new site for it, especially ending up with lower readability, shitty contrasts and 20% of the page lost to a pointlessly huge signpost, instead of contributing to caniuse?

</comment><comment><USER5> Ironically, the link is nearly unusable in my android browser!

</comment><comment><USER6> I can't speak for anyone else but the only reason I'm browsing this site is so I can see a giant orange & white 5 emblem. I found one but it's a little hard to notice, they should consider making it two or three times bigger.

In fact, I don't know why all this space is being wasted by this stupid chart thingy. Maybe they should push the chart off onto another site so that they can stay focused on what is important about this one.

</comment><comment><USER7> Wow, very useful. Sure beats hunting for this information. Is this information anecdotal or have you guys actually done the tests in each environment?

It would also be nice to be able to actually select a device + version and then getting a feature set for it. Not a big deal though as this really saves time nonetheless.

<comment><USER8> Looks like this is a repackaging of <http://caniuse.com/>, which does test in each environment: <http://caniuse.com/#info_faq> using this custom-built site: <http://tests.caniuse.com/>.

No word at caniuse about devices tested, but if that matters then you have a bigger problem. It should be consistent if you have the same software version.

</comment></comment><comment><USER9> I feel like each browser is better than one another. (mostly)

</comment><comment><USER10> Unfortunately the site is badly broken in Firefox 3.6.

</comment><comment><USER11> IE9 for mobile seems very far behind in HTML5 compatibility. Is Microsoft going to use the excuse that "they are waiting to do things right", again, while everyone else plunges ahead?

<comment><USER9> Unfortunately, IE has always been behind and I don't think that's going to change anytime soon.

</comment></comment><comment><USER12> Of all of these features, the one I most want to see greater support for is Web Workers. I think this could be a huge boon for a variety of interesting client side work, and a nice complement to web sockets...

<comment><USER13> What are the use cases for web workers in mobile environments? I can't see any good reasons to be using up the viewers battery and limited prrocessing power that way other than for (maybe) backgrounding some of the processing for a web app.

On a non-mobile note: If you use my computer to run your map-reduce job without asking me first; I don't like you.</comment></comment>


Use AWS Lambda to self-host the comments for your blog - <AUTHOR> https://jimpick.com/2016/05/05/introducing-lambda-comments/ <comment><USER2> This is a great idea. I setup something similar for my brother's website contact form (host the site on S3 and then use lambda to shoot him an email when someone submits their data on the contact form). The costs for running his website are just a few cents a month (above the $0.50/month charge for hosting on Route 53).

For those who work in Python, there is a project called Zappa ([https://github.com/Miserlou/Zappa](https://github.com/Miserlou/Zappa)) that allows you to take an existing project in a framework such as Flask and "host" the whole thing with lambda. The project is still young, but I imagine this sort of thing could be very useful to people doing a hobby project that don't want to pay for full-time hosting, but want their site to be available full- time. Hopefully, we get to a point soon where this sort of framework is ready for production use, though I don't know that it's there yet.

<comment><USER3> Not to be an empty-calorie comment, but genuinely thanks for sharing that. Found it to be very helpful!

<comment><USER2> Glad you found it useful. The great thing about Lambda, I think, is the cost, which is so cheap as to be effectively free for a lot of uses (according to [https://aws.amazon.com/lambda/pricing/](https://aws.amazon.com/lambda/pricing/), the first million requests each month are free). So if you could design a web service to be deployable on lambda (via zappa or whatever framework), you can effectively host a website for close to no cost assuming you don't have a lot of traffic. On the other hand, you lose some of the control that comes with having your service run on a EC2 instance. For example, I like being able to SSH in to the server to troubleshoot things when they go wrong. But for a hobby project that I put together in a few hours, I might not care enough to pay for the EC2 instance.

<comment><USER4> Don't you need to use the API gateway on top of lambda? The pricing there seems like it doesn't go low enough for a lot of uses (1 million requests for $3.50 is fine, but if I only have 10,000 requests a month I am paying 100x what I need to). Or am I interpreting the pricing wrong and that 1 million requests could take 2 years to happen? Amazon pricing is way too confusing.

<comment><USER5> Correct me if I'm wrong, but do you really think $3.50 is too high for hosting a website?

<comment> vertex-four If you can write your site in PHP, nearlyfreespeech.net will host it for a total of 3 cents a day including mySQL, or roughly 90 cents a month.

Lambda is more flexible, but not as cheap.

</comment></comment></comment></comment></comment></comment><comment><USER6> We use Lambda for our contact form; it's great. Our website is completely hosted on s3/cloudfront so it's much cheaper and stable than running a dedicated machine.

If I get some time this weekend, I'll clean it and push it up to github.

[EDIT] Here it is. This has been working for us for almost a year. If there is interest, I can clean it up.

[https://github.com/cowholio4/lambda-contact- form](https://github.com/cowholio4/lambda-contact-form)

<comment><USER7> How does it work? You POST to the lambda service, and it emails the url parameters with the specified formatting? This requires a separate HTML form to be served from your website first, right?

Very cool idea! Thanks for sharing it :)

<comment><USER6> Yeah, I didn't really make that part clear. You have to create an API Gateway.

Luckily, AWS lets you share API definitions so I added that to the repo. It's the swagger.json file. I'll try to get this all automated to make it super simple, but for now you just have to replace all those placeholders.

</comment></comment></comment><comment><USER8> Cool. It's great to see my project on Hacker News!

Feel free to ask me any questions here, or using the comment system on the blog post. :-)

<comment><USER9> Love the idea. For those who aren't as Lambda savvy you might want to provide some "real world" information on pricing. Ex: This code takes roughly 500ms to run, which means you should expect to pay $0.10 per 96,000 comments on your blog.

I know it's stupidly small costs (Lambda is wonderful for that), but some people still don't understand how to translate the pricing structure to "the real world".

<comment><USER8> Looking at the CloudWatch Logs, each comment seems to take approximately (Billed Duration): 400ms for the initial request, and 800-1000ms for the worker to concatenate the request into the published JSON.

It's running in the minimum size of RAM: 128MB

<comment><USER10> This is making me wonder whether we should be paying for GC or just having Lambda abandon workers whose heaps are full and spin up more.

<comment><USER11> Lambda doesn't destroy the instance at the end of the response. It keeps it running just in case other requests arrive. If that happens you might want GC or a worker eventually runs out of memory.

What could happen with Lambda and similar services is that costs will take back under the spotlight "old" languages that run with little memory and little CPU cicles. I'm even thinking about C. I'm not into Go, but that looks like another candidate.

Scenarios: those ubiquitous web services running on a single VM because it's more than enough. The customer has to pay for it all the time and could save money if the app can run on Lambda. Enough to pay more in developer time?

<comment><USER8> What surprised me with Lambda is that it 'freezes' the VM your code is running in, and 'unfreezes' it when more requests come in. Very clever - they can store a lot of frozen VMs on an SSD. It surprised me when I discovered that a cache I had written in my code was already populated!

I think most code running on lambda is not going to be CPU bound. In lambda- comments case it's mostly going to be idling as it waits for TCP/IP traffic to/from Akismet, S3, DynamoDB, Slack notification webhooks, etc.

</comment></comment></comment></comment></comment></comment><comment><USER12> Have you been able to quantify the exact pricing per month?

From the looks of the git repo it's at least 65 cents per month but then there's a number of other services with no price reference.

What would you estimate it would cost per month to host a blog that gets 50 comments per month and what would the cost look like at the end of the year given costs would rise over time due to needing to store more info.

For argument's sake, let's assume no AWS free tier.

<comment><USER8> I don't have "real life" numbers yet, since I just set it up yesterday. I've used up my free tier, so I should be able to get real numbers from Cost Explorer. I'm not sure if everything is tagged nicely for that.

On paper, it should cost under a dollar per month. The main cost is just the DynamoDB instance. I don't think it's going to consume much S3 storage.

I guess if your blog has a lot of traffic, the network transfer might add up -- but it's just little JSON files.

<comment><USER13> With the HN burst traffic, it would be good to report back costs after things settle down :)

<comment><USER8> Cost report:

[https://jimpick.com/2016/05/05/introducing-lambda- comments/#...](https://jimpick.com/2016/05/05/introducing-lambda- comments/#comment-BGy5U1MkSzCEAss7bcaVOg)

For 8000 visitors, it cost me $1.37.

The numbers might be skewed upwards a bit because somebody posted a gigantic blob for one of the comments to test if I had implemented a limit on the length (I hadn't).

<comment><USER12> Thanks for the solid numbers based on real data. At the time of this posting there's 103 comments too which IMO seems waaaaay high given 8k visitors due to the nature of the post.

Hard to say for sure but I wouldn't be surprised if a normal blog received 5-6 comments per 10,000 views.

</comment></comment></comment></comment></comment><comment><USER14> This is extremely cool. I'm starting to see a serious new trend, where automating around IaaS can completely eliminate the need for SaaS.

Why pay for a subscription comment service when it can be implemented as a script in the cloud that only runs on-demand?

</comment><comment><USER8> Here's a little timelapse video of the Google Analytics real-time page showing 4 hours of being on the home page of Hacker News. :-)

[https://twitter.com/jimpick/status/728712464687239168](https://twitter.com/jimpick/status/728712464687239168)

</comment><comment><USER15> Great work! The fact that data is stored in my account (to be read: under my control) instead of outsourcing to 3rd parties is a huge plus.

If you will be able to make it less "technical" and more "plug-and-play", I think this will be cool viable solution to integrate (to be read: for customers like ours, that uses serverless computing in enterprise apps -> [https://github.com/MitocGroup/deep- framework](https://github.com/MitocGroup/deep-framework)).

</comment><comment><USER16> I eliminated all spam and abuse from my blog by requiring comments to be PGP- signed :)

I did still get some comments too!

<comment><USER5> The statement in your website "On some level, the era of personal websites is over" made me sad and nostalgic. I'll keep it old-school by maintaining my own personal website.

<comment><USER17> I don't think that's true. It might at least be accurate to say there's an end to open comment sections and other abuse magnets.

Anybody can still make a site in a few minutes on a number of places, they just aren't going to solve the abuse problem themselves without using a hardened tool.

</comment></comment></comment><comment><USER18> I just finished setting up my personal site with Hugo+S3+Lambda yesterday. Lambda runs Hugo when the S3 bucket detects a file change, takes about 5000 ms per blog post which is fractions of a penny.

Although this adds a bit of complexity compared to Disqus it sounds like a fun solution to implement, potentially with the addition of a way to moderate comments.

<comment><USER8> A future project for me is to see if I can render the comments out to a string at the moment when Hugo is rebuilding my blog.

Then the comments would be in the DOM before the JavaScript is even loaded. I've done that with React apps before - it works great.

If that was working, I could rebuild the blog after every comment even, using a system like yours.

<comment><USER18> I think the serverless(ish) space is headed in an exciting direction overall, especially if we can drastically reduce wasted compute time. I'm watching your repo and hopefully will get inspired! Thanks for the reply Jim

</comment></comment></comment><comment><USER19> A tool that is utterly dependent on 5 aws-specific services is not what I'd call "self hosted".

It's also not "serverless" as the repo readme claims.

<comment><USER13> 5 AWS services that don't need patching or maintenance from a developer, seem serverless to me.

<comment><USER20> > seem serverless to me

Why do you feel the need for yet another marketing buzzword ? IMHO saying that makes one sound like an someone that don't know what a server is, but maybe it's just me. Just because you're not managing a server doesn't mean it doesn't exist, it obviously does, the code isn't running on each client but remotely.

<comment><USER21> > Just because you're not managing a server doesn't mean it doesn't exist

Wireless internet is still connected to the rest of the internet via a wire somewhere; the obvious point being made is that your phone or laptop doesn't need a wire. Serverless here doesn't mean that servers no longer exist, but that you are not working at the server level to accomplish what you're trying to do.

<comment><USER22> > Serverless here doesn't mean that servers no longer exist, but that you are > not working at the server level to accomplish what you're trying to do.

So, just like every PaaS everywhere, since long before the new buzzword.

<comment><USER11> Understood, but that means that Rails has been serverless almost forever because of Heroku. The console is simpler than the one of AWS and you deploy with git push. You didn't have to worry about the db because you only had PostgreSQL for a long time. And you could buy add on services to do almost everything. It just happened before the buzzword was born.

</comment></comment></comment></comment></comment></comment><comment><USER23> Lambda is great. Few friends and I just put up what we call LDAN (Lambda, DynamoDB, Aurelia, and Node) aka Lieutenant Dan. Pretty cool refreshing change that is in stark contrast to our larger EC2+MongoDB stack.

[http://ldan.io/](http://ldan.io/)

<comment><USER11> I went for the demo and I stopped right away when it asked me to login with Google or Facebook. I went to the repo and it's very light on documentation. At least I learnt about aurelia.io

</comment></comment><comment><USER24> I appreciate your realisation that spam and abuse are #1 implementation problems in commenting systems.

</comment><comment><USER25> One step closer to my dream of "Wordpress on Lambda"!

What other projects exist to run a blog on Lambda? Apart from going full in on a locally-compiled static site that I just upload to S3, that is? (Hugo, Hexo, Jekyll, etc) I'm imagining a full admin web interface that uses a Lambda- driven API, themes, a front page with dynamically generated content from the Lambda-driven API, etc.

<comment><USER26> Zappa is pretty cool, I haven't had a chance to use it myself but want to find a project to apply django-zappa ( [https://github.com/Miserlou/django- zappa](https://github.com/Miserlou/django-zappa) ) on django-cms or wagtail... not too sure how that'd work out though.

<comment><USER27> Zappa author here - Wagtail works great on Django-Zappa. I have also been slowly writing my own CMS, [https://github.com/miserlou/zappa- cms](https://github.com/miserlou/zappa-cms), although that's not ready for public consumption yet!

</comment></comment></comment><comment><USER28> As you describe the goals and features of your system, I think the AWS solution is too complicated, even over-kill, for what you are trying to achive. I use AWS extensively for the 'big projects', I also use it as a CDN for all projects, but for the small projects (in terms of complexity and capacity), I find it much simpler to implement a two-tier service. For example, for comments (form submission in general), it is much simpler to write a node app, host it on a free-tier and persist the data also on a free- tier (for example Heroku+Firebase). Parse.com was great b/c you could do it all in one tier since the offered server side logic.

Granted, if you ever pass the free tier limits, normally the price breaks of these PAAS providers are high so cost does not scale 'by the cent' like AWS; however, if you pass the free tier you must be making good traffic which should translate to good income so infra cost shouldn't be a problem.

<comment><USER28> Downvote all you want but IMO this is a Rube Goldberg machine that uses 5!!! AWS services to persist what? 5k comments for the entire lifecycle of the website?

The modern programmer is quite good at playing Legos with the myriad of micro webservices out there (which is good play/training) but has forgotten how to think like an 'engineer' must think.

<comment><USER8> Any working solution actually has thousands of components.

I'd defend this particular Rube Goldberg machine by pointing out that 99% of the time, none of my code is running on the server side - it's all Amazon S3. The only time my code runs in the cloud is when a comment gets submitted.

I'd argue that it's pretty easy to reason about. I've got some more blog posts coming. :-)

<comment><USER28> Don't get me wrong, what you've done is how we will build web stack solutions from now on: orchestrated microservices. My hopefully constructive critique is that as engineers we ought to find the best solution for a given problem, even at the expense of such solution not being universal. Take the myriad of tiny to medium websites that use WP, it is like renting an 18-wheeler to move one tiny box. The engineered correct solution would be a static site. Now, for a site with just a handful of posts and comments we should think of a much simpler solution for comments persistence.

In fact, after reading about your software I am inspired to think and try to come up with such solution, let's see :)

</comment></comment></comment></comment><comment><USER29> I used google sheets as my database for a similar setup with s3 and lambda. Sheets is completely is free AFAIK

<comment><USER30> Me too. And it has an API.

</comment></comment><comment><USER31> Very interesting! I'd like to migrate off Disqus, but I'd like to not leave my old comments orphaned. Do people know of any export services? (This may be an ill-posed question since comments arguably belong to their authors..)

</comment><comment><USER32> This is really cool. Nice one.

It will _desperately_ need a moderation queue.

Even smaller established websites get a ton of comment spam these days. I'd not even consider setting up any commenting system that doesn't have robust spam protection.

<comment><USER8> That's definitely on the To Do list.

I need to add a little authentication interface for the admin - the complexity starts to pile up. But I think it can be done nicely.

<comment><USER33> The admin interface could be something that runs local though, would save the time in terms of adding authentication.

<comment><USER8> I've already had to edit the JSON file on S3 to remove/edit a couple of comments. That was pretty easy to do from the command-line, but I think most people will want a web interface.

</comment></comment></comment></comment><comment><USER34> Pricing for AWS Lambda is complicated, but reading the examples clarifies things... a bit.

Is The Lambda free tier something separate from the free tier you get on first signing up for AWS? I used up my AWS EC2 free tier years ago and I don't think you are eligible again once you use your free tier. I wish they'd put regular pricing at the top instead, i.e. for someone who doesn't qualify for the free tier you start paying from request #1.

</comment><comment><USER35> Nice project.

I wish there was away to get stuff like this to work in a way that didn't take an all-or-nothing approach to noscript-filtering. As it is, now I have the option of no comments, or allowing scripts from: "s3-us-west-2.amazonaws.com", which almost might as well be "anywhere and everywhere". FWIW I see a similar problem with cloudfront and CDNs in general.

</comment><comment><USER36> I am not sure when this was written, but Lambda supports ES6 directly as of about a month ago. [https://aws.amazon.com/blogs/compute/node- js-4-3-2-runtime-n...](https://aws.amazon.com/blogs/compute/node- js-4-3-2-runtime-now-available-on-lambda/)

I think you can avoid the transpiling/babel dependency.

Great work!

<comment><USER8> Yep, I started it before that. I'd love to lessen the dependency on Babel/Webpack as much as possible.

I'm still using async/await, ES6 modules and some other more experiment ES- next features, so I think it will be awhile before Babel/Webpack can be completely removed. Of course, I don't really have to use those features. :-)

<comment><USER33> If the babel/webpack builds happen before deployment to Lambda, I'm not sure it really matters at this point... once we see Node > 7 or so drop, with ES6 module support, it might then be time to consider dropping babel, but it's going to be around a while, and still nicer in a lot of ways than alternatives.

</comment></comment></comment><comment><USER37> This is really cool to see! I have had this type of thing on a back burner for a long time. Glad to see someone wrote it.

I wonder if the author considered AWS SimpleDB instead of dynamo. Costs are a bit cheaper.

[https://aws.amazon.com/simpledb/](https://aws.amazon.com/simpledb/)

<comment><USER8> I'm not really using DynamoDB to store data. I'm using it to sequence parallel requests going into the 'worker' that concatenates things together -- so two simultaneous incoming comments don't clobber each other.

At the moment, I think only DynamoDB Streams and Kinesis event sources will batch events together and deliver them to a single function (instead of many parallel functions). It's hard to understand just by reading the docs.

[http://docs.aws.amazon.com/lambda/latest/dg/intro-core- compo...](http://docs.aws.amazon.com/lambda/latest/dg/intro-core- components.html)

I think the platform is evolving quickly, so I wouldn't be surprised if they come up with some more options in the future. I'm using DynamoDB streams since it's cheaper than Kinesis.

<comment><USER38> The problem with DynamoDB is it has minimum provisioned throughput requirements that would make this rather expensive for a blog that was not free-tier eligible even if it got no traffic at all.

In contrast, SimpleDB seems to only charge for actual throughput used.

<comment><USER8> Correct. I'm provisioning the minimum amount. I'd love to find a cheaper solution.

</comment></comment></comment></comment><comment><USER39> I wish more people added a comments section to the documentation of their software projects.

<comment><USER8> I think it might be possible to embed lambda-comments into an iframe that could then appear on GitHub README.md files, etc. It's just an untested theory for now. ;-)

<comment><USER40> I don't think you can. [http://stackoverflow.com/questions/11804820/embed-a- you-tube...](http://stackoverflow.com/questions/11804820/embed-a-you-tube- video)

You might be able to on Wikis though.

</comment></comment></comment><comment><USER41> You could also use elastic-beanstalk, which I think is also free for very low traffic sites.

<comment><USER8> AWS has a free tier that gives you some free resources for the first 12 months. After that, you have to pay.

</comment></comment><comment><USER42> Funny how it says at the bottom: "Error loading comments."

<comment><USER8> I haven't done lots of testing on it yet. I just found out that happens when browsing in 'Incognito' mode. Probably a bug.

<comment><USER8> I was using localStorage, which apparently you can't do if you are on Safari running in private mode. I've changed the code, and it should work now.

</comment></comment></comment><comment><USER43> Use a hosted service to self-host? Come on. Does it also have more cloud in it?

<comment><USER8> In the blog post, I do link to some projects you can run on your own server. Actually, it wouldn't take much work to modify the code in this project to run in a Node.js daemon. I might just do it anyways to make testing/dev easier.

<comment><USER33> Been working, slowly-but surely in terms of writing my own blog engine (static generator) and then publishing to gh-pages, but was considering using discus for comments... thinking of doing something similar as a docker contained service that I can throw up on my dokku server.

TBH, the thought of managing the attack surface of comments is kind of scary... Will definitely be referring back to this.

<comment><USER8> My approach was to just pump the entire comment through the "markdown-it" markdown processor, which promises to emit safe HTML. It's a popular project, so I'm banking on the fact that they go a good job of sanitizing in their pipeline.

</comment></comment></comment></comment><comment><USER44> Why not just adapt Isso for this? It already has a bunch of nice functionality.

I personally just delegate the commenting to github and render the comments with javascript through github api.

[http://ivanzuzak.info/2011/02/18/github-hosted-comments- for-...](http://ivanzuzak.info/2011/02/18/github-hosted-comments-for-github- hosted-blogs.html)

Here's a nice overview of how this works.

<comment><USER8> That's pretty cool.</comment></comment>


Debate about science at organizations like Google Brain/FAIR/DeepMind - <AUTHOR> https://www.reddit.com/r/MachineLearning/comments/8yvlzy/d_debate_about_science_at_organizations_like/ <comment><USER2> Nobel prizes have been won by both commercial and military labs. The idea that they don't do science is ridiculous. Moreover, just because your conducting empirical research and haven't explained your results yet with a theory doesn't mean you're not doing science.

Scientific results can come about through many avenues. Sometimes it's just pure curiousity, and sometimes it's because you're trying to solve a practical problem and end up doing research that yields breakthroughs.

And each environment has their negatives, it's not like academia doesn't have toxic politics, slaving of grad students, publish-or-perish, the race to get grants, etc

I mean he may bring up some legitimate issues but his whole 'I met a few people and let me extrapolate this to the industry as a whole' is itself anti scientific.

</comment><comment><USER3> So he's saying don't go to industry and waste your talents in intellectually lame projects, instead come do a PhD, it's more stimulating and rewarding. But what happens when the students get their PhD? There's very few academic jobs, they're gonna go back to industry no? And at some point in the write up he also says academia sucks, so I'm confused as to what his suggestion is, it seems to me that either way you are a servant doing "grad student descent", only that in academia you get to claim to have a bigger intellectual dick, but in industry you have more money. It feels like there's no good alternative.

<comment><USER4> ^ This

After my PhD I received a very nice industry position where I can do _more_ research than my friends who are professors. I don't have to sit in committees or teach: I'm employed to conduct research. I'm also fairly compensated, versus the slave wages I was paid in graduate school.

I am flying back from ICML in Stockholm, so it's hard to argue my company doesn't support my academic interests.

I like Simon but he's off-base here. And I don't even work for FAANG/Deepmind, where I suspect I'd have considerably more substantial resources. Industry is by no means perfect but it's a great landing spot post-PhD.

<comment><USER5> Do you consider yourself lucky or it's a normal career path for all PhDs?

<comment><USER6> Perhaps a better question ... how long is your situation going to last? Academia offers stability to an extent .. say post tenure. Industry does not imho.

<comment><USER7> Statistically, most PhDs will work in industry because academia is a pyramid. Do PhDs get higher paid jobs in industry than academia? Unsure.

Entry postdoc salaries in the UK are on par with industry outside London (£30-40k). Over time industry will probably pay more, but professors earn £60k minimum so they're hardly underpaid.

Being a postdoc is something of a sweet spot. You get paid enough (finally) to enjoy life a bit, you have immense working flexiblity and you aren't lumbered (yet) with the bureaucracy of the university system. The only way to advance is usually to take on teaching loads and more admin.

But.. postdocs are almost always contractual, lasting 1-3 years. This has benefits: most people do a couple of postdocs before getting tenure and it allows you to move around the world if you like. Academia is only permanent if you get tenure, and even then it's still dependent on your research output and teaching performance. If you got a job in a grad scheme, you'd have a more stable job after finishing your PhD.

Getting tenure is hard. This is absolutely not the normal route for PhDs, as much as they think it is. There are far fewer permanent positions than there are postdocs, so it's not uncommon for people to move abroad just to get a stable job.

<comment><USER8> Unrelated slightly, and I'm not European, but do postdocs/professors really make less than SE1s at FAANG in the UK?

<comment><USER7> Speaking from experience as a postdoc, we earn less for sure, but from what I can see a postdoc in the US earns about the same. In the rest of Europe things are a bit different. At the extreme end, in Zurich you might earn 100k CHF as a postdoc if you're lucky (but you pay 30EUR for a pizza). Even at really top- tier places like TUM, you're going to be on 35-40k EUR.

A typical professorial scale in the UK (most universities publish this information publicly) ranges from £60-120k.

You have to realise two things. First, that FAANG are crazy outliers. Second, that UK universities are publicly funded and with few exceptions, justifying six figure salaries from the taxpayer is difficult. A lot of professors make good money on the side by doing consulting.

I believe this is different in the US, as a lot of universities (like Stanford) have huge private endowments. I'm not sure how it works at places like Oxford where the university owns half the centre of town.

A senior engineer in London or a tech hub like Cambridge might make six figures, but that's after several years probably. For engineers, there are much higher salaries to be found elsewhere in Europe in places like Munich.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> DeDeo's argument seems to be a philosophical one:

 _If you want to build machines that monitor people and sell them more ads faster, go for it. If you want to find problem where you can take a working- class job, model the man or woman who does it, and build a net to put them out of a job without compensation, be my guest._

A major divisive narrative I see in ML/AI is whether philosophical questions as to the ends of the work are worthy of time.

This is starkest in the debate about providing ML based solutions to governments. Some group says "we're not on board philosophically" the others shrug and move on.

I don't think this is much different than any other engineering/science discipline honestly.

So I think DeDeo, as part of academia is trying to say: Academia has knowledge as it's ultimate goal, corporations just have profit and product. So therefore:

"But if you want, at some point in your flourishing career, with your mind and your soul, to join the two-thousand year old parade of intellectual progress, you are not going to do it at Google."

The strongly negative response, I think is in part because it's derisive of corporate work, but also because there seems to be a bias for the idea that "I'm not interested in the philosophy around why I am doing this work"

</comment><comment><USER10> I think it's weird and unfair to say that research is lesser because it has a tangible goal. It's like saying engineers' discoveries matter less than theorists'.

<comment><USER9> The argument that "basic" or "pure" science is better or more enlightened than "applied" science exists in every field and is as old as science itself.

</comment></comment><comment><USER11> I don't know much about Simon DeDeo, but is there any reason that I should believe that he can make a fair assessment of Google Brain/Facebook/DeepMind?

<comment><USER11> Not sure why this was downvoted, but maybe it came off a bit rude or critical. I'm not trying to criticize DeDeo, but I did a quick skim of his work and couldn't find that much overlap between what Google Brain does and his research.

</comment></comment><comment><USER12> It may be because I don't use Twitter, but I found that extremely difficult to follow. It's unfortunate this debate didn't land somewhere more conducive to long-form discussion.

</comment><comment><USER13> How about IBM? There are a number of companies doing fundamental research. Check out any academic journal.

</comment><comment><USER14> University of Kansas is actually KU no UK. That's Kentucky.</comment>


Show HN: Open source license generator from the command-line - <AUTHOR> https://github.com/nishanths/license <comment><USER2> Nice work. I feel like I saw something another project like this a while back, but I don't believe it was written in Go. Its nice to just be able grab a binary.</comment>


Ask HN: What SaaS products do you pay for personally? - <AUTHOR> Ask HN: What SaaS products do you pay for personally?
Saw this question asked from the perspective of startup SaaS tools, but I'm wondering what subscription-based services folks use personally. I actually thought I spent more than I actually do.
My List
Monthly:
Github,
Sprint.ly,
MindMeister,
Evernote, Spotify
Annual: Pandora (still undecided b/w Pandora and Spotify), iTunes Match, Yahoo Email/POP Access (don't judge) <comment><USER2> Freshbooks, Shoeboxed, Github, Amazon Prime, Shoprunner, Twilio.

Netflix, Pandora.

</comment><comment><USER3> Digital Ocean, Fastmail, Feedbin, Lastpass, Pinboard, Pushover.

Those last 2 were one-off payments. I also subscribe to Netflix and Audible, not sure they count as SaaS.

</comment><comment><AUTHOR> OP here. I find it interesting that despite paying $80 / yr for past 5(?) yrs, I completely forgot I pay for Amazon Prime (thanks for the reminder!).

Does that mean it's easier to maintain renewals for SaaS offerings if the service includes high levels of premium/add-on/normal purchases?

Dunno, but I'm going to re-read Dan Ariely's Predictably Irrational :)

</comment><comment><USER4> Google Music, Basecamp, Harvest, Linode, Cloudflare, Dashlane, Amazon Prime, GitHub... too many

</comment><comment><USER5> SaaS: Lastpass, Flickr, Amazon Prime, JungleDisk

Media subscriptions: Netflix, Google All Access Music, Audible.

</comment><comment><USER6> I don't pay for any SaaS. This isn't any kind of judgment I'm passing, I'm not trying to say "noone should psy for SaaS" or anything like that, just weighing in my own preferences.

</comment><comment><USER7> Amazon Prime, Sirius XM, Private Internet Access, and Carbonite.

</comment><comment><USER8> Github, DigitalOcean, Spotify, Amazon S3

</comment><comment><USER9> Amazon S3 Storage, Fastmail EMail

</comment><comment><USER10> [http://getcloak.com](http://getcloak.com)

</comment><comment><USER11> Freshbooks, Amazon Prime (seems like a majority so far), pnc payroll

</comment><comment><USER12> Github, Amazon Prime, DNSimple, Railscasts, Spotify, Amazon AWS

</comment><comment><USER13> Wideo, cakemail, 123contactform, startitup, google enterprise

</comment><comment><USER14> \- FreeAgent for my company books

\- CrashPlan for backups

\- Also a usenet binaries supplier

</comment><comment><USER15> Amazon S3, Netflix, Todo.ly

</comment><comment><USER16> Digital Ocean.

</comment><comment><USER17> GitHub

Basecamp</comment>


Cool stuff you can do with netcat - <AUTHOR> http://en.wikipedia.org/wiki/Netcat <comment><USER2> Poor man's skype:

sender

        arecord -f cd -c 2 | lame -b128 - - | netcat -u your-ip 6881 | mpg123 -

receiver

       arecord -f cd -c 2 | lame -b128 - - | netcat -u -l 6881 | mpg123 -

<comment><USER3> I used to do this with a friend in the days when modems tied up phone lines. You have to pass a much lower number to lame's -b option, though.

</comment></comment><comment><USER4> If you love nc, also check out socat (<http://www.dest-unreach.org/socat/>)

<comment><USER5> Or ncat (<http://nmap.org/ncat/>). My personal favorite useless example is the persistent webserver:

        ncat -lkp 8080 --sh-exec 'echo -ne "HTTP/1.0 200 OK\r\n\r\nThe date is "; date;'

</comment></comment><comment><USER6> Don't forget easy ssh host hopping.

ssh -oProxyCommand="ssh host1 nc host2 22" host2

<comment><USER7> Interesting. Thanks for the tip! I'd never heard of ssh host hopping, but have been doing 2-3 sequential ssh logins for years. I always wondered if this was possible somehow! I found this nice tutorial that explains your tip in detail:

[http://sshmenu.sourceforge.net/articles/transparent- mulithop...](http://sshmenu.sourceforge.net/articles/transparent- mulithop.html)

This made all the time I've spent on HN in the past week worthwhile! :)

<comment><USER8> At $EMPLOYER, I have a script that takes a description of the network topology, converts it to a sequence of Host stanzas and writes them to ~/.ssh/config. The source file is simple enough that the sysad team can keep it up-to-date when they change the network configuration, and most people just have to run the 'update' script occasionally to have Super SSH Powers. It's quite popular.

<comment><USER7> Don't suppose you'd be willing to post this uber-script somewhere?

<comment><USER8> Unfortunately it's not really self-contained enough to post; the most complicated thing in it is basically a copy/paste of the "Dijkstra's Algorithm" sample-code on Wikipedia, though.

</comment></comment></comment></comment></comment><comment><USER7> Anyone want to give a few examples of cool things they _actually_ do with netcat?

<comment><USER4> I use it for:

\- creating quick and dirty proxies (nc > fifo > nc). (edit: you can also bridge udp->tcp this way, which makes proxying UDP through an ssh tunnel possible)

\- making simple GET requests (printf "GET / HTTP/1.0\r\nHost: www\r\n\r\n" | nc host 80, or save the full request and pipe that to netcat)

\- checking if a port is open (nc -p 8080 host, tends to be quicker than nmap and less to type)

\- dumb file transfers ('nc -l port > file' on one machine, 'file | nc host2 port') on another (or using tar for directories). Usually I use ssh/scp, but sometimes that nc trick works just fine..

</comment></comment><comment><USER9> I actually got in trouble trying to use netcat for something quite legitimate in my former job at RandomBigCorp... Oops.

<comment> Tuna-Fish Please elaborate?

At my current place of employment, "hacking tools" are banned. On that list is netcat. It is installed on every unix desktop and server, and I use it daily. I have decided to just not point out the stupidity of this -- they might do something that's even more stupid as a response.

<comment><USER10> I've always found that it's better to ask for forgiveness than permission in a large bureaucratic technically simplified corporation, otherwise I'd get nothing done. Ask, and they say "no".

<comment><USER11> It's always wise to exercise discretion: <http://db.tidbits.com/article/8886>

Yes, that Randall Schwartz.

<comment><USER12> It's too bad you can't expunge lawyers' fees. Yikes.

And no blame, but it's probably a good idea to say, "We're scanning for weak passwords" first. The sysadmin at the library I used to work at ran password crackers occasionally, and sent out an e-mail once saying that he suddenly knew a lot of staffs' boyfriends names. It's a delicate issue.

</comment></comment></comment></comment></comment><comment><USER13> If you add the live_console gem to a rails app, you can use netcat to run IRB against the live application. You can change the app's state from a console, like flushing a cache or even making a patch, without having to restart the app.</comment>


Why One Of Google's Wildest Designers Left For A Bank - <AUTHOR> http://www.fastcodesign.com/3032630/why-one-of-googles-wildest-designers-left-for-a-bank This also marks the close of the current Project Ara missions at dscout. Signup to get involved with our next research project: https://dscout.com/ara <comment><AUTHOR> This also marks the close of the current Project Ara missions at dscout. Signup to get involved with our next research project: [https://dscout.com/ara](https://dscout.com/ara)</comment>


A peek under Bitcoin's hood: Writing a client that can create a transaction - <AUTHOR> http://www.samlewis.me/2017/06/a-peek-under-bitcoins-hood/ <comment><USER2> Article says

> _This is also why address reuse in Bitcoin is encouraged as to sign a > transaction you need to reveal your public key. If you don 't reuse an > address after sending a transaction from the address, you don't need worry > about the private key of that address being exposed._

Shouldn't that say "address reuse in Bitcoin is _discouraged_ "? Otherwise I don't think I understand what he's trying to say.

<comment><USER3> Address reuse only becomes a problem in the theoretical case that someone can determine the private key from a signature. This would only happen if there was some sort of breakthrough in cryptoanalysis of elliptic curve cryptography, which while theoretically possible, is unlikely.

<comment><USER4> The idea is that you don't want to be secure now, but also in the future. The ECC Bitcoin uses is vulnerable to Shor's algorithm, and thus quantum computation. Quantum computing at that scale is a fair ways off, most likely, but on a timescale of a couple decades or more, a successful attack seems quite reasonable.

Bitcoin can soft-fork, allowing address generation with a different algorithm. It's not any sort of existential threat to Bitcoin. But it does require that you move your coins to a new address if you reuse an address, else you are vulnerable.

</comment></comment></comment><comment><USER5> Very cool. This could be used to implement offline wallet with minimal amount of third party code.

One issue I'd like to point is I wish the author used proper random generated private key. Examples on the internet have a nasty habits of being copy pasted and reused verbatim :(

<comment><USER6> Not using cryptographically safe random key is very stupid, even though it is only an example. It should be very trivial to fix this example.

I think in python the right way is to use the os.urandom() function.

</comment></comment><comment><USER7> Hi Sam,

If you're reading the comments, can you do this treatment but for Ethereum and the smart contracts built on top of it?

I find that your article gives a good explanation especially for beginner to understand from the code perspective.

<comment><USER8> FWIW, I was looking at eth code in the weekend and it's pretty accessible (I was looking at go -- I've read that eth python should be even more readable).

The address part is very similar, even simpler, than bitcoin. It's the same elliptic curve, same way to build private/public keys.

For the address, it uses a different hash function, Keccak256, and then it's just serialized in hex. Code here [1]. Pointers to key generation [2, 3].

[1] [https://github.com/ethereum/go- ethereum/blob/release/1.6/cry...](https://github.com/ethereum/go- ethereum/blob/release/1.6/crypto/crypto.go#L181)

[2] [https://github.com/ethereum/go- ethereum/blob/release/1.6/acc...](https://github.com/ethereum/go- ethereum/blob/release/1.6/accounts/keystore/key.go#L169)

[3] [https://github.com/ethereum/go- ethereum/blob/release/1.6/acc...](https://github.com/ethereum/go- ethereum/blob/release/1.6/accounts/keystore/key.go#L138)

<comment><USER9> Keccak256? Isn't that just SHA3 with a digest of 256 bits?

<comment><USER8> I'm unsure. I think this came before sha3 was defined so some parameters may have changed. But the core is essentially that.

<comment><USER10> There are minor padding differences but that's it.

</comment></comment></comment></comment></comment><comment> ryan-c Looks like there was bitcoin left in the address he published the private key for until about 30 minutes ago. I hope that was a deliberate giveaway.

[https://blockchain.info/tx/2685ff794de17cebdf94eb0f111e8b8c0...](https://blockchain.info/tx/2685ff794de17cebdf94eb0f111e8b8c03529a9ae628909cef4090663b54e565)

<comment><AUTHOR> I did deliberately leave that there in the hope someone might take it using what they'd learnt from the article. there's a short note about this in the conclusion to the article. From the "non whole" fee amount it looks as though someone might have just used some sort of wallet software to take it though, which is a shame.

</comment></comment><comment><USER11> >> 0xFACEBEEF and sent it 0.0005 BTC.. 1 month later and someone had stolen my 0.0005 BTC! I guess people must occasionally trawl through addresses with simple/common private keys.

This made it worth reading the article. Such cyberpunk!

<comment><USER12> For fun[1], you can occasionally trawl through addresses with _any private key_!

[http://directory.io/](http://directory.io/)

[1] For various definitions of "fun."

<comment><USER13> Their FAQ (unlisted on the main page) is interesting as well..

[https://directory.io/faq](https://directory.io/faq)

</comment></comment></comment><comment><USER14> This is an excellent writeup! If any readers are looking for an already- written and tested bitcoin client library and can use javascript, [https://bitcoinjs.org/](https://bitcoinjs.org/) is great. I wrapped a simple cli tool around the library to make the 'coindust' npm package to do simple operations with bitcoin addresses and public bitcoin APIs.

</comment><comment> ryan-c I am actually really surprised it took a month for someone to swipe the BTC he sent to an address with a private key of 0xfacebeef. That could be found via an incremental search in under an hour of CPU search time on one computer.

I note that compressed public keys are not being used in these examples - it's highly recommended to use them, since they reduce transaction size and cost.

Regarding weak keys - there have been a lot of weak key generation techniques in bitcoin where hiding the public key won't do you any good.

<comment><USER15> Just a warning for people, I was playing around with BTC the other day and not generating random entropy from urandom, just putting in a short string.

I found my BTC was stolen immediately when I did this. It wasn't a lot of coins, since I was just testing, but it certainly cost me some debugging time as I wondered how the extra transaction had occurred.

Basically, someone out there has already generated the keys corresponding to short strings and is keeping an eye on any transactions on them. Maybe more than one group, who knows?

<comment><USER10> There are many of us with bots sweeping weak keys. Some of us give the coins back to a safe address, some people just keep it. It's like finding money on the sidewalk.

<comment><USER16> A lot of people are equating this to theft. While I can see their point, the concept of ownership in bitcoin is closely tied to control of the private keys. In this case many people control certain weak private keys so in a way you are giving your money away by sending to these addresses.

<comment> ryan-c Taking money from someone who did not intend to give it to you is a dick move, regardless of legality or technical difficulty of doing so.

<comment><USER10> If it can be taken, somebody is going to take it. It can be people that intend to keep it, or could be a person to intends to give it back. If you left a bunch of money unsecured, which would you prefer? Not having it taken isn't an option if you use a weak key.

</comment></comment></comment></comment></comment></comment><comment><USER17> Can someone explain why bitcoin adresses can be created (offline) without blockchain-validation for duplicates?

Even if the chances are very small I mean...like....gone is gone...no bank to call for a false transaction.

<comment><USER18> Bitcoin addresses are basically a public key, so you can generate them offline the same way you can generate pgp keys, openssl keys, SSH keys you use to access GitHub etc.

The chances of a collision are so astronomically low that our sun will probably run out of fuel and explode before two identical keys are generated.

<comment><USER17> With the comfort of a public blockchain at hand why not eliminate this case at address-creation time?

<comment><USER19> Let's do some back-of-the-envelope calculations.

Let's say the probability of someone cloning a Velociraptor within the next 20 years is 1 in 1 trillion. Let's say that given a Velociraptor has been cloned, it has a probability of 1 in 1 million of escaping. Let's say that given a Velociraptor is on the lam, it has a 1 in 100 billion chance of breaking into your house. Let's say that if there's a Velociraptor in your house, checking for it increases your chance of survival by 1%.

Let's assume there are 1 quadrillion Bitcoin addresses created.

Under the assumption of correct implementation, checking for velociraptors in your closet is literally more rational than checking for duplicate addresses.

Now, there is some value in checking for duplicate keys as a safeguard against implementation bugs, but that's best covered by generating a billion addresses on your own and checking for duplicates within your personal set.

<comment><USER13> From now on, I'm going to start my explanations about how Bitcoin addresses work with opening a closet to look for velociraptors.

</comment></comment></comment></comment></comment><comment><USER20> Wrt transactions, I don't understand why you need to send yourself the unspent BTCs. Why does it make things significantly easier?

<comment> iso-8859-1 Because the miner almost always expects a fee, so why not just infer how high it is and you don't need to spend block bytes on it?

<comment><USER20> Ok, but the unspent output takes space as well. I think you could just replace it with the fee. Not sure if I'm missing something or if it was just an arbitrary design decision.

<comment><AUTHOR> It has to do with the way transactions and the blockchain ledger works, reread the transaction part of the article and it might make more sense. Basically, transaction outputs can either be spent or unspent, you can't half spend an output (or perhaps more accurately, you can't spend a previous output twice).

<comment><USER20> Yes I understand that's how it works, but I don't get why it's important. Surely you could double spend an output as long as you don't exceed its value; and that looks easily verifiable.

<comment><AUTHOR> Ah, my bad. Sorry if I was being condescending in my previous reply then.

I suspect it was a design decision, yeah. If outputs could be spent multiple times then you'd need to traverse the chain of outputs backwards to see how much an output has left in it. Bitcoin's implementation is less complex and more elegant, imo.</comment></comment></comment></comment></comment></comment>


The Apple Product Cycle - <AUTHOR> http://www.misterbg.org/AppleProductCycle/ <comment><USER2> <http://news.ycombinator.com/item?id=97752>

:(</comment>


Apple is removing Alex Jones and InfoWars' podcasts from iTunes - <AUTHOR> https://www.buzzfeednews.com/article/johnpaczkowski/apple-is-removing-alex-jones-and-infowars-podcasts-from <comment><USER2> As a reminder to everyone: the constitutional guarantee to freedom of speech means that the _government_ cannot censor any views (outside of certain exceptions for threatening language, and the like). It does not mean that a private entity has to enable speech that they find objectionable.

<comment><USER3> So you support the idea that Verizon and AT&T should be free to block whatever content they wish, correct?

<comment><USER4> No, because ISPs are natural monopolies ([https://en.wikipedia.org/wiki/Natural_monopoly](https://en.wikipedia.org/wiki/Natural_monopoly)). The government allows them to have a regional monopoly in exchange for investing in the infrastructure. As such, there's no easy way for competition to happen. (You would have to invest in a new infrastructure. Notice how you never have two cable companies or two DSL companies unless it's one company selling under two names). The reason net neutrality is a big deal is because ISPs want their cake and eat it too. They like the protections of a natural monopoly but they don't like the regulations that comes with it.

So ISPs dictating what content is acceptable would be like your garbage collection company refusing to collect political flyers for an opposing party or something. Even though it's not technically the government, I would see it as a government sponsored entity.

Now if you want something compariable, consider the bakery refusing to serve a gay couple. Even though I support gay rights, I agree there with the Supreme Court that a private entity should not be forced to endorse speech they do not agree with. And that would be what Apple is doing here.

<comment><USER5> Apple and Google have a monopoly on the App store(s).

</comment></comment></comment></comment><comment><USER6> I think Apple is completely in the right here. They are enforcing a policy and if people don't like that they don't have to find podcasts through iTunes.

Luckily podcasts are designed to be decentralized, so even if Apple gets too trigger-happy with banning certain podcasts, that won't affect anyone's ability to still subscribe to those podcasts.

<comment><USER5> I think Apple is completely in the wrong here. They are unnecessarily censoring. They should not censor, they must not censor. If this crook called Alex engaged in nonsense and hate-speech it should be the state's obligation to sue him.

<comment><USER5> Wow, being pro censorship is mainstream now?

<comment><USER7> Sadly there's a very popular group of people pushing for censorship in their partisan political battles online.

</comment></comment></comment></comment><comment><USER8> Although I'm happy seeing this kind of content removed, I'm really afraid of a future where private corporations have such a definitive influence of free speech. They set their own rules, and it's dangerous.

<comment><USER9> Alex Jones has the complete and total benefits of free speech - he can continue saying whatever he wants without any repercussions from the government. Apple making a decision like this isn't influencing free speech in the slightest.

<comment><USER10> Free speech is not a concept that only exists in your constitution. It's a mistake to bring up the First Amendment in these cases just as much as it is to think that Free Speech only refers to the First Amendment or repercussion from the Govt.

</comment></comment></comment><comment><USER11> I agree with most of the comments here. Private entities such as Apple should be free to work with whomever they want on their platforms.

However, i feel if this was some left-leaning podcast, the same people supporting this removal would be outraged.

<comment><USER12> Unfortunately the concept of a principled stance seems to be a casualty of the current political polarization. It will come back to bite everyone on the left/progressive side of politics too because companies want to avoid being linked to any sort of controversy no matter what the position is and the left/progressives have lost any advantage in tech saviness.

A recent (local to Australia example) was this woman fired over pro-abortion tweets ([http://www.abc.net.au/news/2018-07-30/cricket-australia- sack...](http://www.abc.net.au/news/2018-07-30/cricket-australia-sacks- staffer-over-abortion-tweets/10051972)). The same people cheering about someone getting fired for anti-ssm tweets were up in arms about this.

That said I also agree that apple should be able to do business (or not) with however they like, the problem is the level of control we gave them in the first place. Everyone publishing and subscribing to iTunes is responsible for this. Site's like InfoWars especially should have seen this coming.

</comment></comment><comment><USER13> Interestingly this only happened after pressure from CNN, after they successfully got Facebook and Youtube to punish Infowars [1]

[1] [https://www.salon.com/amp/fox-news-tucker-carlson-runs-to- al...](https://www.salon.com/amp/fox-news-tucker-carlson-runs-to-alex-jones- defense-cnn-is-trying-to-squelch-his-point-of-view)

</comment><comment><USER14> I've never listened to it, and in fact I have no idea who that guy is or what he talks about, except that he's supposedly a conspiracy theorist. For those of you who have, what made his show so objectionable (to Apple, anyway)?

<comment><USER15> He supports POTUS.

<comment><USER16> So does Fox News and their content is available everywhere.

<comment><USER17> Fox News is problematic, may be even extreme (Sean Hannity et al) but I would not put them in the same league as InfoWars. At least not as long as Shepard Smith gets airtime there.

See also [https://www.youtube.com/watch?v=LHjFS5f1IT0](https://www.youtube.com/watch?v=LHjFS5f1IT0)

<comment><USER18> If we are to complain about Hannity, then we have to include Maddow. Assuming we are trying to be intellectually consistent. She's just as "extreme" but from the other side.

<comment><USER17> Classic false equivalence. You are right that Maddow is similar in style, but on a fact-to-fact based comparison, Hannity is some orders of magnitude more extreme.

</comment></comment></comment></comment></comment></comment><comment><USER19> A slippery slope, but yeah, that rubbish had to go.

<comment><USER20> The only thing rubbish here is blatant disregard for freedom of speech (Didn't really expect anything different from the fools here). There are platforms that are monopoly and they control free speech at this point.

<comment><USER21> "Freedom of speech" does not include the right to demand that third parties are partners in your activities.

Infowars is and should remain free to publish content independently of these providers, which they can easily do.

<comment><USER20> We are living in a state of monopoly and EU laws agree with that. How can you then throw away freedom of speech! Just cause the goons on this forum are pissed, doesn't mean that guy should be banned. 48% of population voted for trump!

<comment><USER22> > _We are living in a state of monopoly_

In what sense? Apple has a minority of the market. And podcasts are decentralised.

> _48% of population voted for trump_

My friends who voted for Trump would find it insulting for anyone to assume they are therefore InfoWars nutters.

</comment></comment></comment></comment></comment><comment><USER23> Here is a thread on Reddit that explains it more:

[https://www.reddit.com/r/technology/comments/94xu2n/apple_is...](https://www.reddit.com/r/technology/comments/94xu2n/apple_is_removing_alex_jones_and_infowars/)

He's basically lying to sell products when he lied about Sandy Hook being fake the victim's families got doxed by his crazed fans.

He also claimed the government was putting chemicals in the water that turns frogs gay, implying that the same chemicals turn people gay, etc.

This is really hurting people and it is getting out of control.

Apple cannot associate with this podcast for fear that they will be sued for listing it on their podcast lists.

For people not in the USA, Alex Jones is a chicken little conspiracy theorist claiming that the sky is falling but it is not. He claims we live on a prison planet that Nazi alien lizards that shapeshift control. Quite a bit crazy like him is also David Icke and others.

</comment><comment><USER24> Their platform, their rules.

Good on Apple I say.

<comment><USER25> Exactly, now let's make open decentralized app distribution platforms that cannot be censored like this.

<comment><USER16> Go right ahead. And then watch as nobody uses them.

Because nobody other than a fringe minority actually wants free speech in all its deranged, violent, racist, mysgonistic, cruel, abusive forms. The majority of us just want a nice, safe space free from the nasty side of humanity.

<comment><USER26> So your theory is that most people want supposedly-benevolent fascism, rather than liberty and freedom?

<comment><USER16> That's called a false equivalence. And this is not a "theory" its facts on the ground.

People have spoken with their actions. Facebook, Google, Youtube, Instagram, Apple etc etc continue to grow, prosper and not be subject to any major criticism whilst still happily removing content.

<comment><USER26> That's thanks to walled-gardens, advertising, and a lack of the average user's ability to use adequate replacement services. Quite frankly it's not likely for the average user to learn about DuckDuckGo, MillionShort, or Exalead. We're starting to see some small pushback against Alphabet's YouTube, but there aren't that many places that will ever have a viable alternative. Dailymotion's the closest - but they're not all that close.

Instagram, Facebook, and Twitter are too tightly controlled, but the very few alternatives are primarily grassroots efforts with small communities who are genuinely scared of being forced to shut down by server providers with an agenda - so they keep as much data as possible encrypted and only bring people in by invitation. Not to mention, a social network lives or dies on the users themselves - and frankly speaking, the average grandma isn't going have an easy time going on Gab to look at pictures of her grandkids. Many can deal with Instagram or Facebook.

So no, people have not spoken with their inaction. They have been led to believe that this is all there is. They have been given an ever-shrinking Web that is a complete disappointment compared to the openness and opportunity of the 1990s.

</comment></comment></comment></comment></comment></comment><comment><USER27> I wish Silicon Valley believed in free speech instead of being jackbooted thugs. Let the individual decide if they want to consume media or not. I'm getting sick and tired of the outrage mobs trying to censor everything they personally find objectionable.

</comment><comment><USER28> He should just put a .torrent up of the video after the show, have his followers upload it to YouTube, and have a form they can report the URL back so he can embed the video.

He won't get ad revenue, but he'll still get to his message out.

<comment><USER29> I think Alex Jones is way more about the ad revenue than his message.

</comment></comment><comment><USER30> Good for Apple. It's terrifying that we need to rely on corporations rather than our elected representatives to make the right choices, though.

<comment><USER22> > _It 's terrifying that we need to rely on corporations rather than our > elected representatives to make the right choices_

I find the idea of the government restricting speech more terrifying. That's why we have the First Amendment. I will fight for Alex Jones' right to spew his garbage. But I'll also defend Apple's right, and in my eyes obligation, to not actively promote him.

<comment><USER31> Be nice to actually see what garbage is involved here so that I can determine for myself if I agree with you. Not possible though because it appears that Facebook did not specifically state which posts or videos violated their policies or in what way.

</comment></comment></comment><comment><USER32> Probably be down-voted for this, but I find it funny, lots of people here support Apple. No matter how trash the podcast author was, I'd imagine there'd be an outrage if this were a move by Google.

I'm not a fan of either, but interesting to observe the polarized reactions depending on the corporate in question.

<comment><USER33> > I'd imagine there'd be an outrage if this were a move by Google.

> but interesting to observe the polarized reactions depending on the > corporate in question.

You're interested to see the polarized reactions _you 've imagined_ :)

Apple gets plenty of criticism on HN, just for different things to what Google gets criticism for.

There's no reason to believe Google would be heavily criticised on HN if they took the same action Apple is taking here.

People are sophisticated enough to consider context in their reactions to things.

</comment></comment><comment><USER34> All the people here supporting Apple's decision with an argument "it's a private company, their rules" are the same people moaning when Apple, Google, Facebook or others do the same thing that affects them.

<comment><USER35> Relevant article from the socialist Current Affairs magazine: [https://www.currentaffairs.org/2018/01/everyones-a- leftist-o...](https://www.currentaffairs.org/2018/01/everyones-a-leftist-once- a-corporation-tramples-on-them)

<comment><USER36> You can definitely dislike Apple's decision to ban Alex Jones and not clamor for regulation.</comment></comment></comment>


A positive proclivity for exciting activity - <AUTHOR> http://webpoet.wordpress.com/2008/04/22/a-positive-proclivity-for-exciting-activity/

<comment><AUTHOR> all about zivity's latest upgrade; is it more pleasurable for you? ;-)</comment>


Workflow automation for continuous delivery by Puppet - <AUTHOR> https://puppet.com/project-nebula <comment><USER2> I love Puppet and this looks really promising. I wonder how this ultimately compares to CircleCI or Travis though.</comment>


Beijing to Judge Every Resident Based on Behavior by End of 2020 - <AUTHOR> https://www.bloomberg.com/news/articles/2018-11-21/beijing-to-judge-every-resident-based-on-behavior-by-end-of-2020 <comment><USER2> Another day, another _Black Mirror_ episode becomes eerily closer to our present reality.

[https://en.wikipedia.org/wiki/Nosedive_(Black_Mirror)](https://en.wikipedia.org/wiki/Nosedive_\(Black_Mirror\))

<comment><USER3> Did you mean to look to another episode? That one is about being judged by other individuals, resulting in low (or high) ratings due to petty superficial interactions. The article is about being judged by the government, leading to low ratings based on political dissent (or for fare-dodgers, if you believe that).

<comment><USER4> I thought of the same episode. Either way it seems very dystopian no matter who is providing the ratings to influence citizen's prospects.

</comment></comment></comment><comment><USER5> Kinda over-interpreted, it's essentially a state-run TransUnion credit score plus background check. It's primarily targeting at people who borrow a lot money then escape to other cities or abroad to avoid paying the debt. The political suppression part that media is obsessed with is still largely determined by the existing legal system which considers certain anti-CCP behaviors as crime.

<comment><USER6> There are important differences between this and a TransUnion credit score.

* The government may not discriminate based on a person's TransUnion score, except for limited circumstances where it is directly relevant.

* The government may not discriminate businesses based on whether they serve people with poor TransUnion scores.

Until the Western media is sufficiently assured that this cannot happen, they are (IMO quite rightly) suspicious about the potential of abuse of the infrastructure built to support this by the state. Unfortunately, the exact reasoning why tends to be forgotten, and the suspicion comes across as vague fear, uncertainty, doubt.

</comment></comment><comment><USER7> _This_ is the actual privacy concern that I worry about. It's not some company using machine learning on my emails to show me ads, or tracking my face when I enter their stores so they can mail me better coupons, or figuring out that I use my voice assistant in the afternoons to get wine delivered.

I can opt out of those. Not always easy, or convenient, or comfortable, but I'm unaware of hardly any commercial relationships that I'm forced to engage in. Most of the complaints I see about corporations taking over our lives are either people complaining about a government-granted monopoly (Comcast) or complaining because they want the benefits of that relationship without any cost (Google).

For me, it's the government and the people who love it for "all the good it can do in the world" deciding that a great use for all those police and military and taxes and guns and bureaucracy is to dig as far into my life as they possibly can (which is a long, long way) to ensure that I'm doing the "right" things, and to make my life a living nightmare if I disagree.

Because then what do I do? Flee the country? What if that government decides "nah, we don't want people to leave"?

Things like this and cops shooting unarmed people and the military droning middle eastern countries and private prisons and civil forfeiture is why I lean libertarian. Yes, I know that's a dirty word. My social capital score just dropped a bit!

<comment><USER8> I'm worried libertarians are throwing out the baby with the bathwater.

A democratic government is great, but just like corporations, it needs to be held accountable.

That's why I donate to the ACLU. It helps keep government accountable for their abuses of power.

Also, paying for news sources keeps journalists shining a light on corruption.

Also education. An educated populace is a populace that's hard to control.

These are some of the things authoritarian governments (that you're afraid of),go after first as they try to seize power.

Pol pot did it, Stalin did it, North Korea does it.

These are also unironically some of the things that conservatives/liberatarians seem to dislike.

<comment><USER9> I used to donate to the ACLU, but once it started actively throwing due process rights under the bus in the service of highly left-leaning fundamentalism I stopped donating.

</comment></comment></comment><comment><USER10> I'm in a quandary. Is it better to have the government judging or businesses? Fuckbook, Goggle and Microslurp collect more data about you and in ways that any bureaucracy could not emulate.... Does it matter who watches us? Do we want someone watching?

</comment><comment><USER11> I mean, how else are you going to get people to stop spitting and cutting in lines en masse.

</comment><comment><USER12> Welcome to the future

</comment><comment><USER13> Cool, hopefully they can get some tips from the US, which has been doing this for a long time via credit agencies and secret FBI, Homeland Security, and NSA databases.

> unable to move even a single step

Hey, it's a no-fly list.

[https://www.chicagotribune.com/news/opinion/commentary/ct- pe...](https://www.chicagotribune.com/news/opinion/commentary/ct-perspec-tsa- airport-security-muslim-profiling-0816-20180815-story.html)

Let's consult Wikipedia:

> The No Fly List is different from the Terrorist Watch List, a much longer > list of people said to be suspected of some involvement with terrorism. As > of June 2016, the Terrorist Watch List is estimated to contain over > 2,484,442 records, consisting of 1,877,133 individual identities.

That doesn't sound good.

> Otherwise, the software would calculate a "risk score" and then print a code > on the boarding pass indicating the appropriate "screening level"

Well, at least when the US calculates "risk scores" for its citizens based on secret information and then denies them travel based on that, it's guaranteed to be good and noble, unlike when those darn Commies do it.

<comment><USER4> I can't tell where you draw the line. Would you share your alternative to credit scoring information for private money lenders? And government watch lists?

</comment></comment><comment><USER14> Western money and technology enables the Communists to suppress the population of China. Until the Communists are overthrown then the Chinese people will always be prisoners.

<comment><USER15> Seems Western people always apply their principles to Asia, HN is not an exception.

<comment><USER16> Pretty hard to come up with your own principles when you're either dying of hunger or by tanks...

Gross generalization, but the point still stands.

<comment><USER15> Sound familiar, was this the story that happened in Vietnam, Iraq, Afghanistan, Syria?

</comment></comment></comment></comment><comment><USER17> Alex Jones/Infowars has been warning about this for a long time.

[https://www.infowars.com/infowars-was-right-facebook- using-c...](https://www.infowars.com/infowars-was-right-facebook-using-chicom- social-score-for-users/)

[https://www.infowars.com/journalist-unpersoned-by-chicom- soc...](https://www.infowars.com/journalist-unpersoned-by-chicom-social-score- no-travel-no-property/)

[https://www.infowars.com/democrat-2020-candidate-wants- govt-...](https://www.infowars.com/democrat-2020-candidate-wants-govt- sponsored-social-credit-system-comparable-to-chinas/)</comment>