AWS Elastic Beanstalk: A Quick and Simple Way into the Cloud - <AUTHOR> http://www.allthingsdistributed.com/2011/01/aws_elastic_beanstalk.html

<comment><USER2> This is great news, and it is certainly going to put increased pressure on existing platform vendors running on top of AWS to differentiate themselves. Amazon continues to climb up the stack :)</comment>


How to Actually Act Like a Local When Traveling - <AUTHOR> http://lifehacker.com/5983618/how-to-actually-act-like-a-local-when-traveling <comment><USER2> This might only be a tip for the young (or young-at-heart) but hostels, for all their associations with debauchery and loutishness, are frequently full of exactly the sort of people you'd want to spend time with. Interested, excited, informed people who want to have authentic experiences in the cities they're visiting.

It's not for everyone but if you'd like to meet people and get off the tourist track, that's my tip.</comment>


Show HN: "Do Things That Don't Scale" – A Curated List Inspired by an HN Thread - <AUTHOR> http://dothingsthatdontscale.com <comment><AUTHOR> Built the site after the below thread blew up with amazing real personal stories from founders and makers on HN:

[https://news.ycombinator.com/item?id=18400020](https://news.ycombinator.com/item?id=18400020)</comment>


Ask HN: How tarnished is this domain name? - <AUTHOR>

I have a project I've been pretty excited about, which is basically building a Hacker News for the education profession. I tried to register educatornews.org, only to find it had been registered a few months before. I saw that it wasn't being used, so I wrote to the registrant. He had no real plans for it, so he happily transferred it to me at no cost. He told me, however, that he had used it to run a mailserver and it might be on some blacklists.
I thought little of it until I emailed a friend about the project for the first time. My email was rejected, and when I looked at the rejection message, this is the error I saw:
The error that the other server returned was: 550 An address in this message (at educatornews . org) is listed on sbl-multi.rbl.spamrl.com. Please organise removal and retry.
I found a page that claims to help a domain get removed from the SURBL blacklist, but I have no idea how legitimate this is: http://www.surbl.org/faqs#whitelist
Does anyone have any experience dealing with domains that have been blacklisted because of use by a previous registrant? Should I try to get it de-listed? Should I abandon the domain and find one that has never been used? I don't want new users' registration emails to be blocked because of these issues. <comment><USER2> How important is the domain name to you? It doesn't sound terribly catchy.

That said - if you're just worried about the email functionality - educatornews.net is available. You could use that to send the emails.

<comment><AUTHOR> I'm open to other suggestions on the name, but I do like Educator News. It has a more professional ring than something like Teacher News. It's more active than something like Education News.

The last attempt I saw was called Academic Recess, and here is the HN discussion on that effort:

[https://news.ycombinator.com/item?id=4783912](https://news.ycombinator.com/item?id=4783912)

<comment><USER3> Which has a more professional ring to it,"Hacker News" or "Programmer News"?

Who are you trying to reach? Thise interested in teaching or those interested in pedantic job descriptions? To put it another way, which is a better submission guideline, "anything educators might be interested in" or" anything teachers might be interested in"?

The tarnished domain name might be evidence that it's not that good for reasons that aren't obvious. "Educator News" sounds like journal articles for academics on campuses not those on campuses.

Replicating Hacker News is hard because YC profits off the thinnest of the exhaust fumes it generates. If it throws off a single startup and that startup has only a mediocre exit, the direct cost of running HN for the next few years are probably covered. That's why it doesn't have ads and affiliate marketing or require an email address or Google ID. It's a capital investment in YC's infrastructure and their unique business model allows it to take its unique character.

<comment><AUTHOR> _Which has a more professional ring to it, "Hacker News" or "Programmer News"?_

I would love it if there was an equivalent term for teachers such as "hacker", but I don't think there is. I want to avoid the traditional "teacher's lounge". If you've never been in one, they can be interesting places. It can be really difficult to have a professional conversation about teaching in a teacher's lounge. There tends to be an atmosphere of venting and releasing frustration over sharing professional ideas. I know that doesn't describe every teacher's lounge, but there are many that do fit that description.

I have looked, my entire career, for an online discussion forum for teachers that avoids this mindset. I haven't found one yet. So in trying to build one, I am looking for something that connotes a more professional mindset. I am also well aware that a name is just a name, and what matters is the actual community that I and the moderation team develop.

 _That 's why it doesn't have ads and affiliate marketing or require an email address_

This is an interesting issue. I am only thinking of requiring email registration to cut down on duplicate accounts by trolls. I have always assumed this feature of HN creates more spam. I know HN has some strong anti- voting ring, anti spam submission algorithms. Any thoughts about whether requiring email registration would make less work for these spam-fighting algorithms? Is no email required just to make it easier to sign up, or to intentionally allow anonymity?

I have no intention of emailing users other than for registration purposes; that said, it would be easier to skip email registration altogether.

<comment><USER3> HN works for a lot of reasons, among them is that when in doubt it's about Silicon Valley and when in doubt someone will say quit whining and build your idea of what perfection looks like. The focus on creation and a default set of means for creation and the carrot of vast wealth and a context of cleverness all work to attract people into the pool of potential YC participants. There's a business model at the bottom of it that asks nothing more than reasonable behavior from an individual HNer..

Why isn't HN the HN for education? Those reasons are why an HN for education won't be.

</comment></comment></comment></comment></comment><comment><USER4> I would try delisting it first. Cleaning up can eventually happen and you'll be more prepared to deal with it anyway.

You can also check your MX record IP for blocks, I think DNSBL is still more common, anyway.

</comment><comment><USER5> You could get the .net or a slight variation for outgoing mail, at least until things are cleared up.</comment>


Why is Stack Overflow trying to start audio? - <AUTHOR> https://meta.stackoverflow.com/questions/386487/why-is-stack-overflow-trying-to-start-audio <comment> Nick-Craver I just wanted to chime in from Stack Overflow here and let people know: we are aware of the issue. And we're NOT okay with it. We're trying to sort out how to kill the audio behavior now. It's not very straightforward to find where it's coming from, but we are working on it. We've also reached out to Google for their assistance in tracking it down. If anyone can offer advice, we'll more than happily take it.

\- Nick Craver, Architecture Lead at Stack Overflow

<comment><USER3> Why are you allowing arbitrary javascript to be served to your users?

<comment><USER4> Not just arbitrary JavaScript, arbitrary JavaScript where they can't easily even see where it came from! Sheesh.

Could we require advertisers to sign their ad code to have a trail of where it came from, prevent tampering, and make it easier to pull the plug on bad actors?

The people bearing the costs of the internet ad economy aren't the people in any position to do anything about it. So there's very little pressure to fix anything.

Maybe if the US government started threatening to enact something like GDPR unless the a democratic industry gets its shit together.

<comment><USER5> Large adtech demand/sell side platforms do not want to remove these bad actors because they make money on percentage of spend. They are incentivized to increase volume and ad spend at all costs, and there is no regulation to stop them from doing otherwise by continuing to deal with shady companies and known malware techniques.

</comment></comment></comment></comment><comment><USER6> How We Make Money at Stack Overflow: 2016 Edition: Quality ads. "...we don't want to use an automated system that selects some ads for us. We looked at this. It didn't allow us the control we required to maintain the level of quality we want to maintain."

How We Make Money at Stack Overflow: 2019 Edition: Taking money from Microsoft and Google fingerprinting our users 100+ ways

source: [https://stackoverflow.blog/2016/11/15/how-we-make-money- at-s...](https://stackoverflow.blog/2016/11/15/how-we-make-money-at-stack- overflow-2016-edition/)

<comment><USER7> Your options, as I see them.

1\. Text based ads only (no third party js)

2\. HTML based ads but no js (run it through DOMPurify [https://github.com/cure53/DOMPurify](https://github.com/cure53/DOMPurify))

3\. Look for a js sandbox -- this _will_ break arbitrary js, will not be supported in all browsers, and will require dev work on your side:

      * Google Caja  https://github.com/google/caja

      * MentalJS  https://github.com/hackvertor/MentalJS

other options are available as well, in varying levels of maturity and support.

I think using a sandbox iframe is not going to be able to defeat browser fingerprinting, because the sandbox control options are not rich enough. You would need to block all JS.

<comment><USER8> > HTML based ads but no js (run it through DOMPurify > [https://github.com/cure53/DOMPurify](https://github.com/cure53/DOMPurify))

Or use iframe.sandbox, which was designed for it. [https://www.w3schools.com/tags/att_iframe_sandbox.asp](https://www.w3schools.com/tags/att_iframe_sandbox.asp)

<comment><USER7> Using an iframe sandbox has some issues:

1\. scrollbars and positioning can cause problems with iframes that an inline div doesn't have, especially if there are multiple small iframes on the page.

2\. As soon as you allow script in the sandbox iframe, then you are susceptible to these types of fingerprinting attacks. The fact that you have origin isolation doesn't really block what the ad was doing. This is because iframe sandbox was never designed to block fingerprinting attacks, it was design to create a separate origin that gave the dev broad control over features like 'allow js' 'allow access to origin', etc.

<comment><USER9> > _1\. scrollbars and positioning can cause problems with iframes that an > inline div doesn 't have, especially if there are multiple small iframes on > the page._

I'm not quite sure what you mean here, but I'm curious. Have any examples?

<comment><USER7> Ideally you would like the iframe to not be visible -- you don't want it to show scrollbars if the content overflows.

But at the same time, you want to see all the content in the iframe. If you knew ahead of time exactly the layout of the text in the iframe you could do this, but it's harder when you have dynamically generated content inserted into the iframe, and now add to that wanting the page to be on different devices with different viewports, resolutions, users resizing the page, users increasing or decreasing text sizes for accessibility or changing default fonts.

And if you don't control the content, some of it may contain fixed size elements or absolute positioning inside the frame.

It's a really difficult problem that we were struggling with before ultimately giving up on trying to use iframes for this purpose. And when you make a mistake you either get ugly scrollbars in your iframe or part of your content is cut off when the user resizes the page.

<comment><USER10> Solving this problem requires the JS on the parent and child frames to cooperate and talk to each other about their sizes, so the parent can resize the iframe to match the size of its content. This is not something ad providers would bother to implement on their own, let alone in a consistent way.

<comment><USER7> Correct, there are solutions, but in our case none of them were feasible because we didn't control what was happening inside the iframe.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> Maybe it's to identify users behind a VPN as this is fingerprinting the device, not the connection.

That's why I think the idea of running each site in a container is so effective.

And while we're at it the container should just spit out random shit like different resolution, audio api, user agent, once in a while (unless the user turns it off) to thwart such attempts.

Unfortunately when the creator and maintener of 67% of all browsers is an ad company who is exploiting this in the firsr place, then there is no chance that this could happen

<comment><USER12> > And while we're at it the container should just spit out random shit like > different resolution, audio api, user agent, once in a while (unless the > user turns it off) to thwart such attempts.

Wouldn't that break the legitimate feature-detection uses for these APIs? Asking the user to identify and whitelist each call is impractical, especially since the fail-case in this scenario would be subtle (you'd still see the page but it might randomly be in the wrong mode, or images might be scaled incorrectly, etc). At that point you might as well just turn Javascript off.

<comment><USER11> Yes I thought about it that's why "unless the user turns it off" comment in parens. I think out of 100 sites I visit everyday no website needs to access the audio api without my consent maybe except one or two which i can whitelist. Same for user agent, I don't think it should break if the container says I'm running firefox v65 or v67, etc.

<comment><USER13> If websites had to ask permission to enable responsive features like screen size detection, then nobody would use them

<comment><USER14> Good! Then maybe they'll go back to writing normal html and let my user agent present it to me how I like and how my device best does

<comment><USER13> If that's how you feel, why not disable CSS?

<comment><USER15> It was already possible to write CSS that adapts to various screen sizes before CSS became a privacy issue (ie. before CSS 3); except it was called regular CSS, not responsive.

My guess is the difference between "regular CSS that adapts to screen size" and "responsive CSS" is that the former only has a single set of rules while the latter has different CSS rules that get enabled/disabled based on screen size.

Conditional rules -> different content gets loaded -> server gets notified of what rules are enabled -> fingerprinting

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> And this is why, even with the best intentions of site operators, my browser will continue to use the best ad-block tools I can get, and my networks will be protected by tools like PiHole.

<comment><USER17> This seems melodramatic for something as trivial as an audio request.

<comment><USER18> It's incredibly disrespectful. Nobody wants some random ad listening to their microphone. That they're trying it anyway indicates that they're hoping to get some people with browsers that don't block it, or trick some people into saying yes.

It's not harmful, as long as you're not one of the people who gets tricked. But it does indicate that they want to do you harm, and try to. That they failed doesn't make it all better.

<comment><USER17> It's probably just a mistake and not actually trying to collect anything.

<comment><USER18> You think it's hitting the JavaScript microphone API by mistake? How?

<comment><USER19> It's Google's fingerprinting for tracking you across the web. It won't actually listen to or play anything, it just opens it up to see if it's there.

<comment><USER18> We have no way of knowing that when a permission alert comes up. The only reason we'd ever allow it is if we were tricked or exploited.

</comment></comment></comment></comment></comment></comment></comment><comment><USER20> It's pretty obvious that the only real fix is to accept money in exchange for putting an image with a hyperlink on your website.

Anything involving javascript will do shenanigans for various reasons. Fingerprinting via any means possible is industry standard ad-network behavior at this point. No one in the industry could imagine doing any less - it's impractical, it's absurd. But targeting! But fraud! But the only fix is to just give it all up, go back to how it was done in the 90s.

</comment><comment><USER21> I wonder if the top brass at alphabet ever worry that their trillion dollar empire is based on fragile foundations like web audio fingerprinting, etc.

that sure would keep me up at night.

obviously, i know google does more, but it seems like a large chunk of their revenue must be dependent on shady technical tricks like these working.

<comment><USER22> They realized it was a risk so they built their own browser to have more control. And it worked. Only now, users are wising up and moving to Firefox.

<comment><USER23> Is firefox less fingerprintable?

<comment><USER24> I'm not an expert, but I'm running Firefox Nightly for exactly that reason.

[https://blog.mozilla.org/futurereleases/2019/04/09/protectio...](https://blog.mozilla.org/futurereleases/2019/04/09/protections- against-fingerprinting-and-cryptocurrency-mining-available-in-firefox-nightly- and-beta/)

<comment><USER25> What's your user agent like? I would imagine there are not many Nightly users out there.

<comment><USER26> Still there are a lot of information in your user-agent and metadata (OS version, platform, screen size, timezone, and more).

</comment></comment></comment></comment></comment></comment><comment><USER27> I like the comment on SO: "Deanonymizing via fingerprinting - illegal in EU"

</comment><comment><USER28> Why is this surprising to anyone? It is clear that ads use tracking mechanisms and cookies and this is no different.

Audio feature detection isn't even a novel techique.

I've seen trackers look at download stream patterns to detect whether or not BBR congestion control is used, I have seen mouse latency based on the difference between mouse ups and downs in double clocks and I have seen speed- of-interaction checks in mouse movements.

Just checking for the constructor of something an ad might legitimately use (like audio) is relatively benign to be honest and it is naive to expect ads to not do this and it is why I use an ad blocker even on sites without annoying ads

<comment><USER28> And as a fun fact networking timing fingerprinting attacks and work even if you don't have JavaScript enabled and I have been able to make a PoC that was very accurate (I did not release it but I did disclose some bits to relevant parties)

<comment><USER29> I hope "relevant parties" includes "browser vendors" and not "adtech companies" :)

<comment><USER30> Which one is Google?

</comment></comment></comment></comment><comment><USER31> I don't get the modern ad stuff, any reasonable person uses an adblocker anyway, because ads are often slow, problematic in terms of privacy and security.

The fact that even people of a big site like stack overflow _don't know_ where it comes from _instantly,_ is only further proof that using an adblocker is a resonable decision.

Maybe it is naive, but all ads should be in my eyes is a picture and something that counts the page views. And when you are a site that has ads as it's main income you should have at minimum one employee who knows and tests each ad before it gets accepted and put onto _your_ server.

Only then your customers will trust the ads you use and only then any reasonable person can even consider deactivating the adblocker for your site.

I am pretty sure somebody explored this idea before me, why doesn't it work?

<comment><USER32> It works, it just won't happen because all the structural incentives point to the status quo. Another reason to love our current crop of monopolists...

</comment></comment><comment><USER33> Has there been any serious thought / discussion about how the cat and mouse chase of the ads vs ad blockers is going to end?

It would be interesting to see where we are in ten years.

<comment><USER34> I think ad blocking is a misnomer. What people are trying to do when blocking ads is prevent marketing people from spying on them. And the performance and resource consumption that comes from that.

Personal opinion: Laws are needed to make what advertisers are doing illegal. Advertisers are spying on people to the extent where if the government did it they'd need a warrant.

<comment> yoz-y I disagree. The tech crowd is using adblockers to prevent spying and resource consumption. But majority of people running adblockers just don't want to see ads.

<comment><USER35> In most cases, I don't think it's ads as concept that's the problem. If websites only had static ads in the sidebar, I question how many people would bother with ad blockers.

But when ads block content; include flashing animations, audio, and video; and take up more layout space on a site than the actual content; _then_ people have had enough.

<comment><USER36> Are you disagreeing with the person you replied to? Your tone suggests that you are, but the content of your post seems to being agreeing.

<comment><USER35> I disagree that most people use ad blockers because they "don't want to see _[any]_ ads."

Meaning, if advertisers hadn't built more and more intrusive ads and had stuck with static ads that don't severely harm the UX, then I doubt most users would bother with ad blockers.

<comment><USER34> Yeah no one would care about magazine style ads with an ordinary click through link. Especially if clicking resulting something useful instead of being the browsing equivalent of jumping into a dumpster fire.

The advertiser arms race has resulted in a classic tragedy of the commons. That's my diagnosis of the problem. Traditionally regulation is needed to fix that. Exactly what that entails is beyond me.

</comment></comment></comment></comment></comment></comment></comment><comment><USER37> It's insane to me the extent to which companies will go in order to prevent cross-site scripting attacks.. and yet they're perfectly happy to include unvetted, potentially malicious JavaScript _on the same origin_ in the form of ads.

There is no reason these ads should be _anything_ other than a linked image.

</comment><comment><USER38> There's something up with my PulseAudio (maybe changing audio output formats?) that means i hear a very loud "pop" when pages try to do this.

e.g. Browsing to an arstechnica.com article, with speakers on but nothing else playing.

</comment><comment><USER39> How about stop letting remote sites execute arbitrary Javascript on your pages?

</comment><comment><USER40> A little bit of corporate newspeak (and digging):

Ad URL: [https://static.adsafeprotected.com/sca.17.4.95.js](https://static.adsafeprotected.com/sca.17.4.95.js)

JS Domain: adsafeprotected.com

Domain Owner: Integral Ad Science, Inc[0]

Google's recent stance on the matter of fingerprinting[2]:

>Chrome also announced that it will more aggressively restrict fingerprinting across the web. When a user opts out of third-party tracking, that choice is not an invitation for companies to work around this preference using methods like fingerprinting, which is an opaque tracking technique. Google doesn't use fingerprinting for ads personalization because it doesn't allow reasonable user control and transparency. Nor do we let others bring fingerprinting data into our advertising products.

The important part being: _Nor do we let others bring fingerprinting data into our advertising products._

The same company advertises their fingerprinting capabilities:

>Browser and Device Analysis: We analyze the technological fingerprints of browsers and devices in order to uncover bots fraudulently posing as human users. We can validate what type of mobile or desktop device a browser is running on, providing additional context with which to identify fraud.

And it is this fingerprinting that gets them selected as a Google Brand Safety and Viewability Preferred Measurement Partner[1]

>New York, NY – Integral Ad Science (IAS) has been selected as a preferred partner in Google's Measurement Program for both brand safety and viewability. Partners were selected after meeting rigorous standards for accuracy and using reliable methodologies to measure KPIs that matter for marketers. The program is designed to make it easier for advertisers to source trusted, third-party measurement providers.

The gist of it being that Google has heavy cognitive dissonance, with their advertising wing rewarding partners that fingerprint users (against their own policies), and the Chrome team barely managing to introduce some anti- fingerprint measures, which are clearly not enough.

[0]: [https://integralads.com/capabilities/ad- fraud/](https://integralads.com/capabilities/ad-fraud/)

[1]: [https://integralads.com/news/google-selects-ias-brand- safety...](https://integralads.com/news/google-selects-ias-brand-safety- viewability-preferred-measurement-partner/)

[2]: [https://blog.google/products/ads/transparency-choice-and- con...](https://blog.google/products/ads/transparency-choice-and-control- digital-advertising/)

<comment><USER41> > Google has heavy cognitive dissonance

Perhaps, but I think some of that behavior only appears dissonant. Like the NSA, Google often uses carefully constructed language that is designed to sound like a statement about a topic of concern without saying anything actually useful. For example:

> Google doesn't use fingerprinting for ads personalization

The only reason to add "...for ads personalization" is if they _are_ using fingerprinting for for other purposes. This could include other ad-related purposes like attribution.

Google claims about not using _specific_ data for a _specific_ purpose are probsabl7 true. They simply fingerprint (and probably correlate) everything else.

</comment></comment><comment><USER42> If you don't use an ad blocker you should expect your browser to behave in strange ways.

If you don't use an ad blocker you should consider your computer compromised.

<comment><USER43> It's been known that ads are commonly used to spread viruses / invasive tracking for years. And I've used adblock for almost 10 years!

Honestly, how are still allowed to execute javascript at all?! I get it if the ad-manager still executed javascript, but how is it okay to let random 3rd parties run js on your website?

</comment></comment><comment><USER44> Why can't Google come up with an AMP for ads? That will transpile a restricted javascript (or whatever) into a runtime that just doesn't do these things?

This would get rid of the greasy ads, and Google could focus on making tools that allow site owners to filter by "features used in ad", and ad developers could actually return to delivering ads, rather than collecting fingerprints?

<comment><USER15> > That will transpile a restricted javascript (or whatever) into a runtime > that just doesn't do these things?

They already invented that: [https://github.com/google/caja](https://github.com/google/caja)

"Caja uses an object-capability security model to allow for a wide range of flexible security policies, so that your website can effectively control what embedded third party code can do with user data."

</comment></comment><comment><USER45> As a website publisher, is there an ad network available for me to use that doesn't allow advertisers to run JavaScript?

If so, what kind of rates can I get?

</comment><comment><USER46> I guess it's part of Googles Ads's endless battle against "robot" clicks. A site as big as SO should not use Google ads, but instead use their own ad service. Just make an automated system where people can signup and show an ad. Make it cost 1$ per 100 page views. That would probably earn SO two orders of magnitude more then they get from Google Ads.

<comment><USER47> > $1 per 100 page views

Eh, that's like 10x average CPM nowadays. And advertisers usually are paying per click, not impression.

<comment><USER46> As an advertiser, yes, but on Google Ads you know that 90% of those will be fake ¹. And as a publisher on Google Ads you only get something like 1$ per 10000 impression ². Advertising directly on SO you know all views are not only legit, but also target at developers, so I think advertisers are willing to pay more. While most advertisers are paying per click, the whales only care about impressions, not clicks (TV commercials).

1) Measured by analyzing the traffic I got from Google Ads 2) That's what I get from Google ads as a publisher, but you used to get a lot more in the epoch, like $5-10 CPM

<comment><USER47> Is such a high fake impression rate common on the display network?

</comment></comment></comment></comment><comment><USER48> Programmers make these tools. When challenging said programmers who work for companies that promote this kind of behavior (G) they suggest that they work for these evil companies because their job is interesting and it pays well.

This practice could stop tomorrow if the best and brightest of us decided so.

<comment><USER49> I doubt that. If "the best and the brightest" wouldn't do it, the second best and second brightest would be asked. At some point, somebody will do it. Also, isn't Google already selecting for moral flexibility? I find it hard to believe that a principled developer would start at Google, much like a pacifist engineer wouldn't work at a Pentagon contractor. So they are getting the best and the brightest whose limits of what they won't do because of personal ethics don't include ad tech, surveillance etc.

I'm not so sure that education would help either, it's my impression that ethics is just individually set. Of the people that understand Kant's categorical imperative, some will act accordingly and others will ignore their knowledge because doing so gets them more money.

</comment></comment><comment><USER50> Does Microsoft (ad owner) or Google (ad provider) perform the fingerprinting in this case?

<comment><USER51> Google

<comment><USER52> It seems that the specific script comes from [https://integralads.com/](https://integralads.com/) as stated by another commentator. I think the blame is to be shared here.

integralads is guilty of developing and selling this technology. Microsoft is guilty of buying it and using it Google is guilty of serving it. And why not also StackOverflow is guilty of offering that space to advertisers without enough vetoing of their ads.

After reading about integralads I'm not even sure if the purpose is to fingerprint, it seems to be more targeted towards detecting fraud, which does not require fingerprinting necessarily.

My point is that it's not as easy as pointing to one company and blaming them. This is a problem that concerns anyone on the Ad space.

</comment></comment></comment><comment><USER53> This issue (along with many others) is due to one simple fact -- the internet is still primarily about _presentation and rendering_ not _information_. We had both client-side template-based rendering and Semantic Web initiatives -- these failed for various technical and non-technical reasons at the time, but I'm hoping we go in that general direction again at some point. Nobody else should be able to (definitively) decide what information I want and how it should be presented to me. We only get the Internet that the majority are willing to put up with.

</comment><comment><USER54> Aside from the obvious usability benefits, this kind of thing makes it abundantly clear why much of the web has gone to javascript dependent SPAs. If you need JS to run the site, then you also have to leave it on to be tracked/fingerprinted.

Kind of makes sense why companies like Google and Facebook have invested so much in creating open-source front-end frameworks. The ROI is probably phenomenal.

I get that stackoverflow isn't an SPA, it just made me think of this point.

Side-note: you can block JS on stackoverflow and still view answers. That works for 98% of my usecase for the site.

<comment><USER55> > If you need JS to run the site

... Then I move on. Those dorky little crapware widgets are basically never worth looking at in any case, and I do take that sort of strategic tooling decision as a signal that I probably don't want to accept the 'bargain' being offered.

<comment><USER54> That's fair, my point is that in many cases (a rapidly growing number of cases), the entire site is JS. If you need to service, then you have to accept the tracking.

</comment></comment></comment><comment><USER56> Gosh, it's incredible the length they will go to de-anomize user data. I guess I will think better next time a website I like ask me to add them to my ad blocker whitelist.

</comment><comment><USER57> Seems like classic fingerprinting behavior from Google Ads. It's unfortunate and hope they fix it quick but most importantly figure out a way to prevent it in the future

</comment><comment><USER58> I would love for this to be illegal.

<comment><USER51> Thank God we live don't live in a direct democracy

</comment></comment><comment><USER59> Tangentially related anecdote: I came across a site the other day that requested access to the MIDI API for no apparent reason. Is this a common tracking vector? The available MIDI interfaces can say something about the system but in 99% of cases (the 99% that don't have any physical MIDI interfaces) I don't imagine that you'll discover anything other than operating system family.

</comment><comment><USER60> Has anyone made a plugin that does a DOS on each ad server(s) detected? Then, we have built-in DDOS on the ad servers, if enough users install it.

<comment><USER61> While the idea is cute you do realize that would have criminal repercussions for people who install said plugin in certain countries.

</comment></comment><comment><USER62> Is this a scandal?

<comment><USER51> It's 2019, everything is a scandal

<comment><USER63> And everyone is outraged.

</comment></comment></comment><comment><USER64> Always use ublock (origin)

</comment><comment><USER65> It's ok. SO's policy on abusive ads is to mention it on mets and hope a moderator notices and then acts upon it.

<comment><USER66> As a community elected moderator ([https://stackoverflow.com/users/16587](https://stackoverflow.com/users/16587) ) I can tell you with certainty that moderators have no control over ads; only the development (and maybe the community team). In this case we would do the same thing the OP did, in addition we would reach out in Stack Overflow chat to the community team do inform them of the situation.

<comment><USER65> Well perhaps you should get your story straight because on this page:

[https://meta.stackexchange.com/questions/329763/were- testing...](https://meta.stackexchange.com/questions/329763/were-testing- advertisements-across-the-network)

which is being prominently announced in a yellow "featured on Meta" box you can read:

"If you see any ads that are inappropriate or have any questions about this experiment, please let me know by starting a new question and tagging it with advertising"

and

"If you wish to report an advertisement, please take a screenshot of the ad and paste the URL (if possible) along with the site where you saw it to a comment or answer. I'll report it to the ads team and we can track it down to investigate."

Screenshots? Start a new question with a tag? Track it down? Shouldn't you cut to the chase and have a "report this ad" button built-in so you can immediately be alerted to malware/abusive/inappropriate ads? Perhaps it's not moderators who have the power here. As a non-moderator/employee I couldn't care less what you call the people who do it; it seems entirely inadequate. Run the ads now and if enough people complain or it gets embarrassing - <USER2> google and/or microsoft spying on users - then publish a theatrical apology. No, that doesn't work for me.

No, my ad-blocker is never coming off.

</comment></comment></comment><comment><USER67> this is the time to appreciate uBlock Origin's advanced mode, since 3rd party JS is blacklisted by default [https://github.com/gorhill/uBlock/wiki/Advanced- user-feature...](https://github.com/gorhill/uBlock/wiki/Advanced-user- features)

</comment><comment><USER68> "Probably it tries to use the AudioContext for browser fingerprinting. – Bergi 11 hours ago"

</comment><comment><USER69> If you're a newcomer to this long thread, pls CTRL+F manigandham and read all his comments as a primer. Lots of misinformed couch-comments here. If you'd like to reasonably rant about ad-tech (and that's welcome), understand the value it provides first.

</comment><comment><USER70> I've been noticing horrible battery drain on my iOS devices lately. The battery monitor in settings says the worst offender is "safari audio". I wonder if it's something similar.

</comment><comment><USER71> If this is caused by accepting JS enabled ads. What's to stop the ad from changing the dom or redirecting the browser to a SO fishing site

</comment><comment><USER72> I don't get how it can get the fingerprint to be so unique as to attribute ads. Most mobile browsers are exactly the same, you have the same screen resolution and so on. And most desktop browsers when maximized are the same resolution. I mean there must be groups of thousands of users for each combination of fingerprinted features. So it's not all the way down to the person, right? It's just correlations?

<comment><USER73> No, it's not all the way down to the person. Yes, it's just correlations. Even if the fingerprint was so unique and it went down to 1 user, it wouldn't be able to actually identify that person's name etc.

The most likely use-case here is ad fraud detection anyway.

<comment><USER74> > The most likely use-case here

I'm not so sure. There's a lot of market value in knowing that User 2341423 went to Site A, then Site B, then bought this item, etc.

</comment></comment></comment><comment><USER75> It now makes sense that you're rewarded for staying logged in.

</comment><comment><USER76> Ultradisgusting case on StackOverflow: 99.999% top answers are edited by moderators - they just promote yourself with free content.

We need a real alternative - without stupid ads and master-slave karma-based community relations.

</comment><comment><USER77> Is there something I can use to randomly fuzz every tab individually as I browse the web?

They can track me through websites and I don't want that. Already using ublock origin.

<comment><USER78> Not exactly what you asked for but got this from mozilla today: [https://blog.mozilla.org/firefox/hey-advertisers-track- this/](https://blog.mozilla.org/firefox/hey-advertisers-track-this/)

</comment></comment><comment><USER68> Post closed due to wrong category.

</comment><comment><USER79> Did anyone checked how much data from our data plan cede to advertising? I bet it's 30%-40%.

<comment><USER80> I have been using uBlock Origin for about three years and I browse the web heavily (4-6 hours/day). In that time it has blocked 13% of requests (10% on mobile).

I don't have enough info to quantify the amount of data blocked though.

<comment><USER81> It's often the case that what is blocked prevented more scripts to be pulled, which scripts could pull even more scripts and so on. Those subsequent waves of scripts are not counted as blocked because they never had a chance to be pulled by the first wave of blocked scripts.

I have a tweet in my timeline which illustrate this: [https://twitter.com/gorhill/status/934474012377444352](https://twitter.com/gorhill/status/934474012377444352)

<comment><USER80> Makes sense, thanks.

How does uBlock calculate the "blocked since install" percentage?

</comment></comment></comment></comment><comment><USER82> "It's not very straightforward to find where it's coming from, but we are working on it."

This encapsulates the entire problem with the current state of digital advertising in 1 simple sentence.

<comment><USER83> But you know, we wouldn't stop serving ads until we work it out... no no imagine the loss in revenues.

<comment><USER84> Let's be adults here. This is SO, and I imagine you've used and enjoyed the use of their services just like the rest of us. Support them by letting passive ads sit on the edges of the page, and appreciate that they are actually trying to solve this issue.

<comment><USER85> They could "solve" the issue by not having third party ads. Of all the sites on the internet, StackOverflow has the demographics that any advertiser would crave. How large of an inside ads sales force would you need to target higher than average income earners?

How large reputable sites trust third party ad servers is a mystery to me.

Besides, native ads that could be served from StackOverFlows own servers would be harder to block.

<comment><USER5> That's just not how digital ad campaigns are run. Advertisers, agencies, media buyers and the rest of the supply chain don't negotiate with individual sites like that, not at any scale that can sustain a site like SO.

<comment><USER86> No. They _already do this_. This is how ads have been run on SO forever. The new ad network ads that they've started with are an aberration from SO's own _established practice_.

<comment><USER5> No they don't. They use their own adserver (bought from adzerk) to physically serve the ads, but they have always come through RTB connections to ad exchanges.

There are private marketplaces and "automated guaranteed" deals to isolate their inventory in _its representation and pricing_ from the rest of the market but the actual campaigns they get exposure to, and the creatives delivered, aren't special to them.

<comment><USER87> I've seen plenty of SO-specific ad campaigns being run on the site.

<comment><USER5> They run house-ads for their own jobs board and products, and they will have private marketplaces inside the exchanges, but those campaigns and creatives will still go through the standard adtech supply chain with all the JS-based layers added on.

[https://www.stackoverflowbusiness.com/advertising](https://www.stackoverflowbusiness.com/advertising)

They do sell job postings and have sponsored tags so it's not all network ad revenue, but that's a minority of the income. Since they released their Q/A SaaS product now, maybe they'll shift to selling that as the primary revenue stream.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER88> TLDR: A case of invasive fingerprinting triggered by a Microsoft ad delivered by Google.

<comment><USER88> Are all fingerprinting techniques used in the wild pretty generally well- known? Do any browsers have an option to blindly return a standard set of values regardless of actual client capabilities/metrics? (i.e. make it difficult to achieve more granular results than browser agent).

I know Mozilla made an anti-fingerprinting announcement recently but IIRC all it does is check scripts against a blacklist: [https://blog.mozilla.org/futurereleases/2019/04/09/protectio...](https://blog.mozilla.org/futurereleases/2019/04/09/protections- against-fingerprinting-and-cryptocurrency-mining-available-in-firefox-nightly- and-beta/)

<comment><USER89> There's an option in Firefox, yes. privacy.resistFingerprinting or something, you can search for it. It tends to break a number of sites, iiuc.

</comment></comment></comment><comment><USER90> It's most likely for web scraper detection. State of the art was using video codec availability as fairly reliable data point, and I haven't seen audio being used for this. Quite interesting.

<comment><USER91> What makes you think it would be for web scraper detection vs user fingerprinting?

<comment><USER90> Because they had a lot of trouble with sham sites generated by their content.

<comment><USER92> They literally provide full website dumps of all the content: [https://stackoverflow.blog/2014/01/23/stack-exchange-cc- data...](https://stackoverflow.blog/2014/01/23/stack-exchange-cc-data-now- hosted-by-the-internet-archive/) (yes, the post is old, but they still update the archive).</comment></comment></comment></comment>


ScyllaDB Open Source 3.0 - <AUTHOR> https://www.scylladb.com/2019/01/17/scylla-open-source-3-0-overview/ <comment><USER2> I'm interested in the [http://seastar.io/](http://seastar.io/) networking library that the Scylla guys built. Looks like it runs on DPDK and might be a nice way to do user mode networking. Anyone tried using it in other projects?

<comment><USER3> Yep! Talk to Kefu Chai at RedHat. He's using Seastar to rebuild Ceph. Here's his presentation from Scylla Summit 2018 back last October:

[https://www.scylladb.com/tech-talk/redhat-on-rebuilding- the-...](https://www.scylladb.com/tech-talk/redhat-on-rebuilding-the-ceph- distributed-storage-solution-with-seastar/)

<comment><USER4> Do you need to have a certain network card for DPDK to work? Can I just rent a random dedicated server, install DPDK and get userland networking?

<comment><USER3> Here's a list of DPDK supported NICs:

[https://core.dpdk.org/supported/](https://core.dpdk.org/supported/)

</comment></comment></comment></comment><comment><AUTHOR> They need to get rid of that email registration to download the software.

<comment><USER5> Why?

<comment><USER6> Agree it's annoying (I'm one of the co-founders) but it's the minimal 'eval' to make sure users succeed to maximize the value from their downloads. We mainly push them to slack and to share monitoring and logs with us, until they get to prod

<comment><USER7> It also means we can't automate installation of ScyllaDB.

<comment><USER8> Most of our users automate it. When you register, you are given access to the repository file for your preferred distribution. Once you have the repo, you can just apt-get it into every one of your nodes.

Also Scylla provides non-gated access for AWS users with ready-to-consume AMIs

<comment><USER7> Oh, that's good to know!

</comment></comment></comment></comment></comment></comment><comment><USER9> Congrats to the Scylla team! These features and performance improvements are pretty huge for people working with Apache C* that want to evaluate Scylla. Compatible storage formats will certainly make evaluations much easier. Also, hope the Scylla experience with MVs is better...

As far as compatibility w/ Apache Cassandra 3.x+, is there anything outstanding?

<comment><AUTHOR> [https://docs.scylladb.com/using-scylla/cassandra- compatibili...](https://docs.scylladb.com/using-scylla/cassandra- compatibility/)

The big remaining item is lightweight transactions.

<comment><USER10> What's a light weight transaction?

<comment><USER11> A compare-and-set request. E.g., I can read version 3 of a row, and write version 4 _if the current version is still 3_ , so that if someone else writes version 4 I don't clobber whatever they just did.

<comment><USER10> That's a really succinct definition. I like it. Thank you.

<comment><AUTHOR> To be clear, "lightweight transactions" are a Cassandra specific term, nobody else uses that. Compare-and-set, atomic updates, or just transactions are the normal terms.

</comment></comment></comment></comment></comment></comment><comment><USER12> From everything that I've heard about this (being an wire copy compatible with Cassandra) and it's performance. I'm pretty excited about this!

<comment><USER3> Would love to hear your feedback! Ping me on Twitter @PeterCorless

</comment></comment><comment><USER10> Anyone using this in production? Any thoughts or tips on how to adapt traditional MongoDB workflows to this?

<comment><USER13> We are (Numberly) running it in production indeed and our use cases keep on increasing!

As glommer and PeterCorless mentioned, I'd be happy to share thoughts and learnings about it.

Feel free to show up and ask questions mate: you can easily find me on the community Slack channel, freenode IRC or Twitter.

<comment><USER10> Which slack channel? I'd love to join.

<comment><USER13> This one: [https://scylladb-users.slack.com](https://scylladb-users.slack.com)

<comment><USER10> Is it private? I might be dumb but slack doesn't seem to give me a signup option.

<comment><USER13> Sorry, should be better using [https://scylladb-users- slackin.herokuapp.com/](https://scylladb-users-slackin.herokuapp.com/)

</comment></comment></comment></comment></comment></comment><comment><USER14> Get ScyllaCloud barrier to entry a bit lower. $200/mo is too much for tinkering. Even better if there is an autoscaling option available.

<comment><USER15> It certainly is pricey for tinkering, but it requires a decent chunk of block storage and I was shocked how expensive that is when I looked the other day. It unlikely to be news to most, but I've been on private cloud and DCs for a long time and it seems everyone is charging huge amounts of money if you need large filesystems; not even slow but cheap options. Maybe Scylla needs to be backed by S3 rather than XFS :)

<comment><USER16> Scylladb uses local storage (not EBS) for sane performance. XFS is required for async reads/writes.

</comment></comment></comment><comment><USER17> I also find ScylaDB C++ code nicely educational (at least for me). It is using modern idiomatic C++ with a healthy mix of boost library.

For example:

[https://github.com/scylladb/scylla/blob/master/db/view/view....](https://github.com/scylladb/scylla/blob/master/db/view/view.cc)

</comment><comment><USER18> Awesome. Can't wait for the Amazon hosted version.

<comment><USER3> Note: Our new Scylla Cloud runs on AWS; it uses our Enterprise 2018 release, not the latest 3.0 Open Source. Yet would love to hear your thoughts! [https://www.scylladb.com/product/scylla- cloud/](https://www.scylladb.com/product/scylla-cloud/)

<comment><USER19> I think he's being sarcastic.

</comment></comment></comment><comment><USER20> I hope this versión do not loss data :/

</comment><comment><USER21> According to their [https://www.scylladb.com/open- source/](https://www.scylladb.com/open-source/) page:

Server License:

\- Free Software Foundation's GNU AGPL v3.0

\- Commercial licenses are also available. Contact us for more information.

Driver Licenses:

\- Apache Cassandra drivers: Apache License v2.0

Third-party drivers:

\- Licenses will vary. See the individual driver documentation for details.

Documentation License:

\- Creative Commons Attribution-ShareAlike 4.0 International

This angers me very much, they are lying about being OSS which was started by OSI ([https://opensource.org/](https://opensource.org/)) as a response to GPL/AGPL/FSF/RMS's non-open policies, when in reality only their client drivers are OSS but their servers are _commercial or AGPL_.

I say this, as someone who has spent years working on and consciously giving away popular DB software as zlib/MIT/apache2 with my project - which is now run in production by Internet Archive, top 300 global site, and others ([https://github.com/amark/gun](https://github.com/amark/gun)) - just to see more and more other DBs steal "OSS" label to falsify marketing, and more and more DBs become "open core" crippleware. We need more people to keep campaigning against these outright license lies and the faux-humble "I can't survive as OSS unless you pay for commercial license" junk, if you can't survive doing OSS then _just don 't_ do OSS!! Lying you are OSS but actually AGPL instead is just a shady ploy to get more dev/biz clicks.

<comment><USER22> As for mangodb, I still qualify this as open source. I don't care about what OSI says. For me as long as I can read the source, and modify it for my business, it's fine. It doesn't need to be free as in free beer.

<comment><USER23> Well that's exactly the issue...you can't modify it or use it for your business if you compete with Mongo corp

<comment><USER22> I thought I could modify as long as I either pay or give money to mongodb?

<comment><USER24> Michael from MongoDB here again. MongoDB Community is still free to view, download, modify, etc. The SSPL change affects no-one besides those offering the licensed software (MongoDB) as a public service.

<comment><USER3> Michael: Would love to speak with you about this very point. Ping me via LinkedIn: [https://www.linkedin.com/in/petercorless/](https://www.linkedin.com/in/petercorless/)</comment></comment></comment></comment></comment></comment>


Ask HN: Quasi-Legal Startup Idea. Thoughts? - <AUTHOR>

Right now several states allow the sale of food out of ones home with very few restrictions. This is even allowed at the federal level within certain limits (sales volume, typically). We've been throwing around a new startup idea that would likely cause the selling of food out of a person's home to be quite easy and probably pretty lucrative. While I'm not against this personally, this IS illegal in some states (to include California). We could try to free ourselves of the liability through a Terms of Service agreement, but we're afraid it will appear that we're encouraging people to break the law.
Am I thinking too far into this? Should I, as a small startup, be concerned with such legal issues when just starting out?
Point to consider: Supper-clubs continue to gain popularity (even in California where it's almost certainly illegal) and despite how easily the activity could be stopped, they seem to enjoy a worry-free existence. <comment><USER2> dgunn - We came across similar issues developing the first online notary service notarynow.com. In some states its fine, other states have a problem with it. I would pursue the states where it is legal, make sure your terms and conditions are locked down, and go for it. If users from other states pick it up, its a good problem to have. Paypal, Uber, AirBnB and my company have all been able to get regulators on board after the fact.

Its scary to have to think about getting shut down by the government for an idea that everyone will love, but I think in the end you can succeed. You will also have a hard time getting a lawyer to say yes (and probably won't get a legal opinion). If it takes off, dealing with regulators and supermarkets (who will want to shut you down in the name of consumer protection) will be a good problem to have.

<comment><AUTHOR> Thanks a lot for the comment mchusma. It's definitely scary to start something that may be shut down. We wouldn't worry so much if the state we expect to be in (CA) wasn't one of the states with the problem. We're still considering moving forward after wrapping up our current project. Hopefully some more research will clear things up futher. Thanks again.</comment></comment>


You used Python for what? - <AUTHOR> http://speakerdeck.com/u/jtauber/p/you-used-python-for-what From the Boston Python Meetup group last night - @jtauber presented a few different projects, including an Apple ][ emulator in Python! <comment><USER2> I too use Python for my various noodlings where I don't have a pressing need to use some other language... or even if I do, I'll draft it in Python first to get my head around the problem space then think about porting it later.

Some unusual stuff I've done in Python that I happen to have online:

<https://gitorious.org/bdflib> is a library for working with bitmap fonts in the "BDF" file-format, one of the traditional X11 font formats. Among other things, given a font with some base glyphs and some combining glyphs, it can automatically generate all the pre-composed glyphs Unicode defines.

<https://gitorious.org/macfontextractor> is a library for extracting FONT and NFNT resources from Mac OS Classic resource forks. It loads them into the data structures defined by bdflib above, so you can save them out to BDF files. Currently it only supports resource forks in MacBinary-encoded files, but it shouldn't be too hard to extend it to work with AppleSingle, AppleDouble and native resource-fork support.

<https://gitorious.org/python-blip> (now renamed Python BPS, I couldn't change the URL) is a diff/patch tool for arbitrary binary files; a bit like bsdiff or xdelta. It produces less space-efficient diffs than bsdiff, and it's much slower than xdelta, but the BPS file-format is vastly easier to implement than either of those.

<comment><USER3> Not coincidentally, 'drafting' is what led me to first use Python. Prototyping and working out the architecture/logic of a piece of code is very fast in Python.

Many libraries (standard and 3rd-party) are generally well-designed and are of a very high quality (ex. django, twisted, sqlalchemy, numpy)

</comment></comment><comment><USER4> I always find it fun and interesting to see people implement random known "x" software in a language I really understand. As the presentation says, it really does help me learn something once I see it in Python, or Ruby for that matter. Both languages seem to help me grasp code.

</comment><comment><USER5> I'm really not a fan of the UI on speaker deck presentations. Clicking seems to advance or retreat somewhat randomly (I guess based on which side), the buttons are non standard and tiny and close together, etc. A regular PDF or video or keynote/ppt is much easier.

<comment><USER6> I found it pretty easy to use the left and right arrow keys, assuming you have a keyboard available to you.

<comment><USER5> Yeah, I was using an iPad (new), and the presentation was approximately thumb- sized, so left/right of the presentation made less sense to me.

</comment></comment></comment><comment><USER7> I once wrote a C parser & interpreter in Python. :)

<https://github.com/albertz/PyCParser>

<comment><USER8> This is neat. I used Eli Bendersky's pycparser a few years back to create a static analysis suite for C. Does your project support C99?

<comment><USER7> What parts of C99?

It is quite incomplete. But on the other side a bit loosely on the grammar, so it might work.

I wasn't able yet to interpret any bigger projects. One goal was to interpret CPython (<https://github.com/albertz/PyCPython>) and I got pretty far but I lost interest in it a bit (I remember that I got stuck when interpreting `goto` because there was no easy equivalent in Python, but I found a solution recently: <https://github.com/albertz/playground/blob/master/py_goto.py>).

I successfully used this however to create ctypes interfaces for header files on the fly. E.g. <https://github.com/albertz/PySDL> uses it.

And for doing some analytics, it might also work good enough.

</comment></comment></comment><comment><USER9> At my last job we used Python to write the UI for controlling train brakes (electronically controlled pneumatic railway brakes). Worked really well for us since we did a buttload of testing (with robotframework <http://code.google.com/p/robotframework/> and a bunch of other things).

</comment><comment><AUTHOR> This was presented last night (2012-03-22) by @jtauber at <http://meetup.bostonpython.com/events/56404642/> \- great event!

</comment><comment><USER10> Is this a presentation or a video or both? I could swear the way it is presented it looks like a video. But I don't hear anything. I'm unsure what this is :[

<comment><USER11> It's his slide deck from a presentation. There is no audio.

</comment></comment><comment><USER12> I've done some basic Python coding to create custom MIDI Remote Scripts for use with unsupported MIDI controllers in Ableton Live.

I never actually learned it in a conventional method, just jumped into programming these scripts and looking at other people's scripts for reference.

Now that I've taken a basic course on objective-based coding, I'd love to go back and learn Python for real.

</comment><comment><USER13> My roommate did a 3 part blog post on Exporting Non-Exported functions in Windows PEs with Python:

[http://burrowscode.wordpress.com/2010/02/18/exporting-non- ex...](http://burrowscode.wordpress.com/2010/02/18/exporting-non-exported- functions-in-windows-pes/) [http://burrowscode.wordpress.com/2010/02/20/code- snippet-to-...](http://burrowscode.wordpress.com/2010/02/20/code-snippet-to- scan-pe-for-functions/) [http://burrowscode.wordpress.com/2010/02/22/exporting-non- ex...](http://burrowscode.wordpress.com/2010/02/22/exporting-non-exported- functions-in-windows-pes-part-3-of-3/)

Couldn't tell you what it does exactly, but I remember him thinking it was weird he did it in Python

</comment><comment> brown9-2 Tangent, but I really wish Speakerdeck wouldn't make each slide transition a new history location. I don't want to have to hit back 30 times after viewing 30 slides to get back to the page that linked me there.

<comment><USER14> Interesting. This doesn't happen here (Chrome on OS X).

<comment> brown9-2 I'm using the same combination. Either they just changed something, or I was hallucinating five minutes ago :)

</comment></comment></comment><comment><USER15> During my studying at the University I wrote the most of homework in Python including pseudo-random numbers generators etc.

Then I found an interesting job at financial startup where people liked Django/Python combination so I used it there too. Business logic was far clearer to read than Java code from other system parts I saw (I had to describe writing documentation and diagrams describing some details of "how it works").

</comment><comment><USER16> I'm not an expert on this, just a linguist who happens to code a lot, but there is some serious work on the complexity of frequency ordering. The algorithms proposed by R. Rivest (1976, Communications of the ACM) produce near-optimal frequency orders online, so if you can settle for "near optimal" then the problem is hardly traveling salesman as this author claims.

<comment><USER17> Even with a traveling salesman problem you can get "near-optimal" results with an algorithm that has a reasonable run time. It's still important to note that you have such a problem though, as the fact that you're settling for "near optimal" needs to be understood.

<comment><USER18> You can actually find the global optimal solution for surprisingly large real world instances. They do tens of thousands of cities.

Lots of interesting stuff here. The Concorde solver is probably the state of the art. <http://www.tsp.gatech.edu/concorde/index.html>

</comment></comment></comment><comment><USER19> I'm currently using Python to write a compiler for a language I'm playing with (which, incidentally, looks a lot like Python, but is statically typed). Targeting LLVM IR, it's worked out nicely so far.

</comment><comment><USER20> I like doing codegolf in Python because it just feels so perverse. My golfed BF interpreter was _way_ shorter than his :)

<comment><USER21> Python lends itself quite nicely to code-golfing, that's true. In fact I am constantly amazed of how terse Python code can be, despite the significant whitespace stuff.

      from os import*
      r='s=[0]*8**5'
      p=0
      for c in read(0,9**9):r+='\n'+' '*p+dict(zip("><+-.,[","p+=1|p-=1|s[p]+=1|s[p]-=1|write(1,chr(s[p]))|s[p]=ord(read(0,1))|while s[p]:".split('|'))).get(c,'');p+=c in'[]'and 92-ord(c)
      exec r

I know, it's a JIT compiler, not an interpreter, but still... :)

<comment><USER20> Man, that's slick - similar how I did it, but even shorter :)

</comment></comment></comment><comment><USER22> Nice one jtauber... :-)</comment>


DSLR cameras should become iPhone docks - <AUTHOR> http://ilyabirman.net/meanwhile/2012/02/07/1/ <comment><USER2> _Unfortunately, DSLRs are painfully outdated. With them you can't tweet or email photos, you can't crop or adjust them and you can't organize your library. And to get your photos anywhere, you'll need a cord or a compatible card reader. This is ridiculous given that it's 2012._

I don't want to have my phone in my camera - I certainly don't want phone calls interrupting my pictures. Actually, yes I can do quite a bit of editing from my DSLR and it's not even a top-of-the-line model. I don't mind transferring my photos over USB and storing them on cards, but if I _was_ in a big hurry I would get a wi-fi enabled SD card or battery pack to offload my pictures/video automatically I shoot them. These products have already been on the market for several years.

My DSLR generates files that are about 22mb/shot or ~225mb/min for video. I really don't want to be trying to send that sort of data over a cellular connection. And although the idea of a swappable data-processing module such as a phone is basically a Good Thing, I really don't want to be locked into a single manufacturer's platform.</comment>


Tail Recursion - <AUTHOR> https://functional.christmas/2019/12 <comment><USER2> > Tail recursion is a special way of writing recursive functions such that a > compiler can optimize the recursion away and implement the algorithm as a > loop instead.

Typically I think more like this: a compiler will compile the tail call into a jump-like construct. Tail recursion is then just only one application of this. The compiler won't need to recognize that it is a case of recursion or a loop. Tail call optimization (TCO) is the more general form.

See Scheme from 1976:

LAMBDA, The Ultimate Imperative, by Guy Lewis Steele Jr. and Gerald Jay Sussman, MIT AI Memo 353

[https://dspace.mit.edu/bitstream/handle/1721.1/5790/AIM-353....](https://dspace.mit.edu/bitstream/handle/1721.1/5790/AIM-353.pdf)

</comment><comment><USER3> Recursion is the fundamental looping facility. Every kind of loop can be translated to recursion. That's why I think all languages that should be compiled to has it.

Translating one looping facility to another is usually very painful. Translating a looping facility to recursion is less painful :)

Edit: as an exanple: try compiling the common lisp loop macro to python for loops. I am not even sure it is possible. Compiling it to recursive functions (of which python lacks the tail recursion optimized kind) is however a pretty straightforward, but still very much nontrivial, problem.

<comment><USER4> (nonsense deleted)

<comment><USER5> Python for loops aren't actually bounded: if the iterator you're looping over doesn't terminate then neither will the loop. It also only calls the iterator's next() method once per loop, so it's possible for the body of a loop to affect future iterations by mutating the iterator.

<comment><USER4> You're right, of course. I had completely forgotten that.

</comment></comment></comment></comment><comment><USER6> [https://www.youtube.com/watch?v=-PX0BV9hGZY](https://www.youtube.com/watch?v=-PX0BV9hGZY) for anyone who doesn't know it already

</comment><comment><USER7> A nice and clear explanation of why tail recursion is necessary and how it works. I usually don't like mathy examples, but it worked fine here. I especially liked the section on trampolines as I didn't know how transpilers usually did that. Well worth the read.

</comment><comment><USER8> This Stack Overflow answer[1] presents an interesting way to do tail call optimization in Python using the Y combinator.

[1] [https://stackoverflow.com/a/18506625](https://stackoverflow.com/a/18506625)

<comment><USER4> > _tail recursion in Python using the Y combinator_

Small correction: this answer does _not_ use the Y combinator to optimise tail recursion in Python (and this would be impossible). Instead, it _modifies_ the Y combinator to do this, by using an iterative loop in its implementation.

<comment><USER8> Yes, I wasn't very precise with my wording, and you seem to have responded to an even more imprecise version of my comment which I immediately edited.</comment></comment></comment>


Antares launch scrubbed due to loose umbilical - <AUTHOR> https://twitter.com/OrbitalSciences/status/324626934090842112

<comment><AUTHOR> One of the umbilicals on the second stage prematurely separated.

Definitely a bummer. Way to play it safe.

</comment><comment><USER2> > Antares launch fails

"Fails" isn't very accurate -- the launch never took place, the system detected and anomaly and prevented the launch. A launch scrub isn't a failure, it's a postponement.

Also, the linked tweet doesn't call it a failure -- that's the submitter's choice of word.

<comment><AUTHOR> True, not a failure, thanks for the correction.

The tweet came from Orbital Sciences, the developers of the Antares rocket. I figured this would be enough.</comment></comment>


Git Completion BASH - Turn your console into a git environment - <AUTHOR> https://github.com/git/git/blob/master/contrib/completion/git-completion.bash

<comment><AUTHOR> The killer feature in my opinion is the branch name in the prompt you get, e.g.

        john@rhino src (master) #</comment>


Brexit: 70 Percent of Tech Workers Considering Leaving UK - <AUTHOR> http://www.silicon.co.uk/workspace/brexit-70-percent-tech-workers-leaving-uk-211969 <comment><USER2> It doesn't mean they'll actually carry through with it. How many people threatened to emigrate to Canada after Trump got elected?

The options are: move to a non-English speaking country (assuming those countries don't shut off their borders with the UK). Or try to get a visa to emigrate to Canada, USA, Australia or NZ. Canada is probably the easiest, as you can get in as a skilled worker, if you fit the criteria and you're prepared for a long wait.

<comment><USER3> Shouldn't Ireland be on the English speaking list?

It's true that the Irish is the official national language, but the country is officially bilingual with English as the other official language. In practice, Ireland is an English-speaking country with a large Irish language presence (about 40% consider themselves competent in Irish).

For comparison, that's about the same relationship that English and Spanish have in the Los Angeles/Long Beach/Santa Ana area, or in the Miami/Fort Lauderdale/Pompano Beach area.

<comment><USER2> >Shouldn't Ireland be on the English speaking list?

Yes, of course. I should know that as I'm from there :)

I kind of just lump Ireland with the UK in my mind (as part of it is in the UK, and the people and culture are virtually identical to Scotland).

</comment></comment></comment><comment><USER4> Have you been to the UK? That's peoples normal state of mind at any given point in time.

</comment><comment><USER5> A survey of 200...

That's hardly sufficient sample size. Also, how where those 200 selected.

<comment><USER6> Why is it not adequate? Surely one cannot say without knowing their sampling method.

<comment><USER5> Ok. Fair enough. But if you imagine all the potential possibilities as to why, when, etc. then it hardly seems reliable. I can't imagine that in London alone 200 represents the depth and breadth of ppl.

</comment></comment></comment><comment><USER7> Sample size is way too small…

But as a British national, I'm actively in the process of looking at elsewhere</comment>


Ask HN: Do you now any implementation DB on blockchain - <AUTHOR> I want to create ann app that  will work on mobile phone and want to use decentralised DB  such as blockchain maybe you know some ready implementation? <comment><USER2> > [...] want to use decentralised DB such as blockchain

Blockchain _is not a database_! It's a document timestamping service.

<comment><AUTHOR> what is difference it still contain data</comment></comment>


An aerosol particle containing enriched uranium encountered in upper troposphere - <AUTHOR> https://www.sciencedirect.com/science/article/pii/S0265931X17308111 <comment><USER2> Very interesting, here's the full article: [http://sci- hub.tw/https:/www.sciencedirect.com/science/artic...](http://sci- hub.tw/https:/www.sciencedirect.com/science/article/pii/S0265931X17308111)</comment>


The unbearable lameness of web 2.0 - <AUTHOR> http://blog.koehntopp.de/archives/2978-Die-unertraegliche-Lameness-des-Web-2.0.html#en

<comment><USER2> Very valid points - but I suspect the main barrier to this kind of thing is that every single "social" site out there wants to be _the_ aggregator and sees others only as potential input for its own service.

Smart aggregation would require some degree of collaboration and standards, and anyone supporting it risks making their own service a subordinate source.

Even though this kind of thing would be extremely useful to users, companies will only embrace it if the added value helps driving users to their own service more than to others.

<comment><USER3> In other words: if you're the current market leader (FB), then there's no reason to support other social graphs.

<comment><USER4> How would that even work in practice? What's the use case that's not already possible via <http://graph.facebook.com> (besides hoovering up emails).

Besides, if they did somehow integrate further you'd all be crowing about how Facebook was doing an embrace / extend / extinguish maneuver.

</comment></comment></comment><comment><USER5> From the article: "my ass has round corners too" ... priceless.

If you do web design work in an Enterprise, you pretty quickly run into people who don't understand that there are fundamental differences between web apps and desktop apps.

What Web 2.0 does is it lets us get around some of those limitations. When Web 2.0 is done right, the Ajax is going to mean that they can work on an 'online app' without loading pages all the time (or rather, without appearing to load pages all the time).

Combine that with some of the database in a browser capabilities, and, in theory, you could get around even more of the limitations. E.g. user closes the browser window before hitting submit means the data is lost = annoyed users = poor usability. But if you use the offline storage to save the fields then it isn't lost after all. Hooray!

But yes, Facebook is retarded. Build a better one I dare you. ... Please.

<comment><USER6> > From the article: "my ass has round corners too" ... priceless.

Interestingly, in the German, he used a completely different example:

"What the devil is the whole web 2.0 crowd doing all day? I mean, other than sitting around in St. Oberholz [1], sucking down Bionade [2] and Twittering their brains out?"

[1] Berlin equivalent of Red Rock Coffee in Mountain View

[2] Trendy organic fruit soda

<comment><USER7> Yes, I did not know how to translate that concept properly into US english, because it references Berlin-specific things. Thanks for the help!

<comment><USER8> Not as topical, but the ass reference was the best sarcastic comment to date about the proliferation of rounded corners since people really started complaining about them 7 years ago.

</comment></comment></comment></comment><comment><USER9> This is not a problem with a simple solution. People can handle Twitter (one- way subscriptions); people can handle Facebook (reciprocal friendship.) But they are annoyed at having more than one service. Which one is the winner? Which one replaces the other one? If I drop one then I abandon all my contacts on the other! Argh!

The easy technological solution is a site that offers complex, configurable relationships, but can people handle it? Probably not, or at least, not yet. So we have reached the current equilibrium of multiple services, with Facebook the winner, and a minority of people choosing integration or choosing to manage accounts separately on more than one service.

Perhaps the day will arrive when people are ready for more sophistication in managing relationships on a social networking site. If Facebook times it right and adds relationship configuration options at roughly the right pace, they can stay on top and supplant Twitter entirely for social networking. Or perhaps the current situation reflects the limit of what people want to cope with. I'm sure Facebook is researching the question and deciding which way to bet.

<comment><USER10> The main point of this article is that it's possible to do the filtering without having a single social network.

"Yes, it is possible. Each of these services has an API, and I have to authorize them against each other anyway. So could these services use their APIs and offer useful filtering preferences to me, pretty please?"

I think this, along with the ability to show what pieces of information are most important, would be a killer features. The network that could implement this would do a lot of the elimination of noise that plagues using multiple social networks.

</comment></comment><comment><USER11> Has anyone actually done some studies about what the best predictors of interestingness are? We tend to assume that if our friends like something that we'll like something, but is that really the case?

<comment><USER12> That was precisely what I was thinking while reading the article. Facebook already does a bit of multidimensionality, e.g. 'So and so and 12 others like this.' The problem is, being in Utah, a huge portion of the social scene is Mormon. So vast swathes of my social graph jumped on board the LDS fan page, with the result that I get PMs and ads from Mormon.org. A lot. Perhaps I am an outlier here, and everyone else's social profile coincides nicely with their own personal interests. But I doubt it. Freelancers end up friending their clients, employees friend their coworkers, tenants friend their landlords, and we expect all these varied interests to work as predictors for one another?

The problem with using our friends' activities as predictors of interest is that Facebook has no way to distinguish between strong and weak friendships[1]. There is a marked difference in my life between Facebook friends and meatspace friends.

[1] - Sure, they can determine which of my friends I spend the most time talking with on Facebook. But that says more about our relative Facebook activity than the quality of our friendship.

<comment><USER13> What about click-through rate? I'm pretty sure Facebook uses this in determining what to show on your newsfeed, and it's a percentage, so it's not based on quantity.

<comment><USER14> Click-through rate might be slightly more accurate than simply pushing everything, but it's not an ultimate solution because it too makes assumptions about your usage. The one assumes you want everything equally; the other assumes that your desires can be perfectly correlated to your clickthroughs. But that's not true for anybody; what's worse, the reason why it's false is different for everybody. (What if the people who interact with me are more active than the people I actively seek out, and Facebook misinterprets my responses as active interest? What if I'm simply innocently stalking a girl obsessively but actually find her updates bland and individually unworthwhile? One must think of the stalkers, especially if one is hoping to make money on the Internet.)

The real issue is that cases like those of anthuswilliams above you are unique and difficult to replicate. That's one of the noted problems with music recommendation services like Pandora too: What matters isn't _what_ users tend towards but _why_ , and _why_ is a question that can't be effectively computed. It's more freeform.

I think the real solution would be a site that actively helps a user be responsible for himself. Something that doesn't simply indicate _what_ features are available, but _why_ users might want to use them to sort out their friends. Contrary to what the OP says in his blog post, that is possible today, but it requires responsibility on both the parts of the reader (who must sort his inputs neatly) and the publisher (who must figure out where to publish what). And web sites presently don't feel it's worth their time to help you with that task.

</comment></comment></comment></comment><comment><USER15> Very interesting article... The point on Languages is a major pain point for everyone in Europe and, probably, for everyone that lives outside english speaking countries (and probably for some of them too). I find amusing that nobody approached it more seriously... I understand it's not an easy task...

<comment><USER16> Language detection is faily easy to do: Help yourself to my word frequency by language data files at: <http://www.knowledgebooks.com/determine_language.jsp>

<comment><USER15> That's very interesting. Thank you very much.

</comment></comment></comment><comment><USER17> I am continually amazed at the quality of Google Translate. That translation was incredibly readable with maybe two or three errors. This used to be black magic just a few years ago!

<comment><USER7> If you refer to the translation in the lower part of the article: That's a rather free translation of the upper part of the article that was done by me, the original author.

I am a native german speaker.

</comment></comment><comment><USER18> Twitter and google are indeed aware of the importance of tends and context. They may not be where the op would like to see them yet, but there's clearly work being done in that direction.

Facebook, on the other hand, doesn't really seem to be doing much with its data. But it does have an extremely powerful API, so, maybe someone could try taking this matter into their own hands.

</comment><comment><USER19> This is one of the reasons I started Qwerly (<http://qwerly.com/>), so the web would have portable contacts between sites and a meta-graph across all platforms.

<comment><USER20> This guy makes some interesting points... it would probably not be too hard to extend qwerly into that direction and make it very immediately useful... "meta-follow people across networks, with de-duplication"...

</comment></comment><comment><USER7> [http://www.slideshare.net/padday/the-real-life-social- networ...](http://www.slideshare.net/padday/the-real-life-social- network-v2?from=embed) looks pretty promising.

</comment><comment><USER21> You might wanna take a look at Summify (<http://summify.com>) It aggregates, de-duplicates and ranks your streams.

<comment><USER22> My6Sense (<http://www.my6sense.com/>) does something similar.

</comment></comment><comment><USER23> Should be titled "The unbearable lameness of Google." Google has all the technology needed to implement what he wants, including autotranslation, but Google doesn't know a human interface from a hole in the ground. Wave was incomprehensible to mere humans. When they hold the contest for most boring social network design on the web, Buzz will win hands down.

</comment><comment><USER24> Tangentially:

In the real life, friends rarely go through the formal notion of "accepting the other as a friend" (aka send/accept friend requests). Friends are those who I talk to gladly and often. Simple as that.

</comment><comment><USER25> Social networks don't really need to filter content by languages, as the author suggested. A better alternative is to integrate a translation service like Google Translation API to remove the language barrier.

<comment><USER26> I think I'd prefer Chrome's approach to have the content translated in the browser. That way I know that the content is being machine translated and it can be undone.

</comment></comment><comment><USER27> The symptoms reminds me of FriendFeed. Every "friend" is over-sharing and dumping duplicated and trivial stuff into a main stream. The overlay problem became so huge that everyone abandonded it.

</comment><comment><USER28> I wonder if Web 3.0 will miss Silicon Valley.

I've found that the less technical and "webby" people are, the more they understand Web 3.0

A lot of that is that, in Web 3.0, perhaps 70% of what's necessary for Web 2.0 is superfluous... Perhaps nice to have, but frankly, the next generation systems need a community the same way that "The Terminator" needs people.

</comment><comment><USER29> Twitter has never called itself a social network.

</comment><comment><USER30> Since it's that easy, build it yourself.</comment>


Bootstrapping: Advice you can actually use today - <AUTHOR> http://blog.alexblack.ca/bootstrapping-advice-you-can-use

<comment><USER2> few other tricks helpfull for bootstrapping : 1\. outsourcing. if done right can be a great money saver. 2\. crowdsourcing: you can get cheap and high quality work for most services a business needs using crowdsourcing. see :[http://www.ebizq.net/blogs/enterprise/2009/09/crowdsourcing_...](http://www.ebizq.net/blogs/enterprise/2009/09/crowdsourcing_5_reasons_its_no.php) 3\. design you processes for outsourcing: for example: customer support given using web chat can be cheaply outsourced, prevent accent and company image problem when outsourcing support , more efficent than phone based outsroucting because the support person could answer people in parallel , and you get an archive of questions and answers , that might appropriate for service automation.</comment>


Top 5 Startup Focused Blogs that Every Founder should Know - <AUTHOR> http://startupmeme.com/2007/03/30/top-5-startup-focused-blogs/ <comment><USER2> All great blogs, but these are blogs _about_ startups not blogs _for_ startups.</comment>


Ethereum API – Issue your own cryptocurrency Token - <AUTHOR> https://medium.com/bloopi/step-by-step-issue-your-own-cryptocurrency-token-c7b2a158c40a <comment><USER2> Any plans on supporting Bitcoin Cash?</comment>


Show HN: Orthogami – Turn voxel models into foldable papercraft - <AUTHOR> https://github.com/mikolalysenko/orthogami

<comment><USER2> Fun! I've been working on a similar free software project to unfold generic STL files for laser cutting: [https://github.com/osresearch/papercraft](https://github.com/osresearch/papercraft)

The problem is that most models on thingiverse produce designs that are very, very difficult to fold up. Even low-poly things (like the Stanford Bunny) are almost impossible.

</comment><comment><USER3> Not open source, but a popular piece of software for converting 3d models to paper:

[http://www.tamasoft.co.jp/pepakura-en/](http://www.tamasoft.co.jp/pepakura- en/)

</comment><comment><USER4> Cool! I will try to draw something with this builder[0]

[0] [http://voxelbuilder.com/](http://voxelbuilder.com/)

</comment><comment><USER5> Awesome! Do you have a picture of the fully-built Mario?

</comment><comment><USER6> This is basically magic to me. Really cool.

</comment><comment><USER7> Really cool!</comment>


Dropbox tone-deaf? Hardly - <AUTHOR> http://scripting.com/2014/04/10/dropboxTonedeafHardly.html

<comment><USER2> Maybe I'm not understanding what it means to be a board member, but did they _hire_ her, or did she buy enough shares to have a direct say in the company's future?

Also, does it follow that having a former government official on the board gives you an "in" with the current administration?

</comment><comment><USER3> Revolving doors that's all. Remember Colin Powell? He's on the board of Bloom Energy. Slowly Silicon Valley is infiltrated by ex-politicians and cabinet members.</comment>


What's eating Java? - <AUTHOR> http://www.google.com/trends?q=scala%2C+java&ctab=0&geo=all&date=all&sort=1

<comment><AUTHOR> Looked at the trends for various different languages. Obviously, the trends are for all searches on Google - not only those related to the programming language. I couldn't find another language that was rising where Java is falling.

</comment><comment><USER2> It's still a LOT of work to get a J2EE app up and running... Java isn't going anywhere, but as far as the web goes, I see a move to lighter solutions like Grails.

<comment><USER3> It takes a ton of work to get Grails up and running too.

</comment></comment><comment><USER4> Perhaps it stopped being hip, "sold out" and now is considered the standard for boring CRUD enterprise applications.

<comment><USER3> That happened around 2002-3.

The main problem is: Sun died and Oracle does nowhere near a good job at marketing Java or making it better.

</comment></comment><comment><USER3> Oracle?</comment>


Quality has nothing to do with testing - <AUTHOR> http://rasmusson.wordpress.com/2008/06/10/quality-has-nothing-to-do-with-testing/ A reminder for software people that testing and QA often have little to do with the quality of your product. <comment><USER2> "quality" comes from development

"quality assurance" comes from testing, where you're checking to make sure the product is quality, to make sure development actually produced quality code.

</comment><comment><AUTHOR> quality does not come solely from development

quality comes from 1000s of little things you and your team do, when creating software.

some times that involves development. testing plays a role (albeit a very small one)

but quality, quality assurance, whatever you want to call it , is much much more than just code and test</comment>


Ask HN: Which are the well written open source programs? - <AUTHOR>

We learn a lot from other hackers code. What are the open source programs/code you liked? please also share the quality/thing you liked. Thanks. <comment><USER2> I once added some custom functionality to MediaWiki, and was very pleasantly surprised by the codebase's organization and the readability of the code.</comment>