IoT's killer app is not home security - <AUTHOR> https://techcrunch.com/2016/09/03/iots-killer-app-is-not-home-security/ <comment><USER2> The commercial excitement over IoT is all about offering 'services' you couldn't offer before. When your house is full of these devices, some people will pay extra for the 'enhanced tier' of service (even if the basic tier is offered for free). In cases where the business model isn't subscription-based, it's either made up by the high retail price of the device, or indirectly monetizing the data collected for 'market research' and the like.

IoT isn't about people hooking up jailbroken Kindles to one-way mirrors to show the weather. It's not about Ardunios and Raspberry Pis being used to collect some data, move some servos, and make a blog post about it. It's about big money to be made by introducing new monetization channels in places there were none before.

<comment><USER3> I've been saying that there are three "scammy" markets which tend to have a higher ratio of overpriced, scammy products, and they're the following:

* Health

* Education

* Office productivity

And now,

* Home security (New!)

The reason that I think these markets tend to be scammy is because their quality is mostly based on perception. And there's no easy way to drastically improve these, people tend to look for a magic pill. And you're right, security is certainly going to be one of them.

<comment><USER4> The first two bullet points on your list are very specific to an american perspective. As a dutchman I do not consider these scammy markets whatsoever.

<comment><USER5> $0.02:

As an Australian, I do agree with you, but only looking at them from what government services are provided. In terms of the industry, I think health/fitness is possibly the largest in terms of misinformation because no one wants to do simple exercise and eat well, everyone is looking for a shortcut to get bigger or smaller.

So I don't think that they're specific to the American perspective in a larger sense, but I do also see where you are coming from. Then again, neither of us are American!

</comment></comment></comment></comment><comment><USER6> I recently looked at the landscape of smart door locks, and came to the same conclusion as @Animats did in his comment. Actually, I would rephrase it to say _all_ smart door locks suck. All I really want right now is an RFID/NFC deadbolt, purely for convenience. Seems simple enough, and yet nothing secure exists.

So I'm now set on trying to build my own lock. I'm thinking of just getting a really nice, mechanical deadbolt, and then building something similar in design to Lockitron, where it just sits on top of the deadbolt, augmenting it with digital authentication. For the keycards I plan to combine a low power MCU with NFC and Ed25519 cryptography for authentication. I found a variation of the MSP430 chips with built-in NFC capability which are designed to run battery-less (they harvest energy from the NFC signal). My rough calculations suggest that they'll be able to soak up enough power to do an Ed25519 signature in 0.25 seconds; fast enough for me. I'll just have the lock send a random challenge to the keycard, it responds with a signature of the challenge, and then the lock can verify the signature and confirm that the card is legit. It should be simple enough to mold the MSP430 and supporting electronics into a thin 1" diameter disc which I can hook to my keychain or put in my wallet. Awesome! The lock itself is just another MCU with NFC capabilities, battery, and motor.

That setup satisfies my desire for a convenient, digital lock, while maintaining real security (Ed25519 with real random challenges, versus existing RFID solutions which use 48-bit keys, 3DES, suffer replay attacks, etc). I'm surprised these things don't already exist. I only had to spend an hour to find the MSP430 chip variation and sketch out this system...

<comment><USER7> What benefit do you hope to get from your smart lock? I stayed at an Airbnb with a simple electronic combo lock.

Plus: no key to pass me Plus: can change code for each new guest

It's not a smartlock tho but maybe I don't understand what a smartlock is. A friend as an internet connected lock

Plus: can open remotely (package delivery guy calls. From phone friend remotely let's him into garage Plus: can set time based codes (code only works on a particular day/time range)

Minus: it's on the internet and controlled through a third party service

What will yours do? I'd love one that's online somehow but secure

<comment><USER8> I'm not really sure why you need an electronic lock on an airbnb, you're either there to flip the place or you have an onsite person to flip the place, well in large numbers of airbnbs. The ones I can think of that don't need it wouldn't have internet generally. Interested in what you see as the benefit over one of those punch code locks that hold the keys that are like $14 on amazon or a schlage deadbolt for $150.

<comment><USER7> The benefit to a code lock for me over a box with a code that holds the keys is there's no key to lose nor any key to forget to return. I don't even have to carry the key when I go out. One less (three less?) things to worry about. I actually locked myself out of the last AirBnb I was at. I forgot the key and while that meant I didn't lock the door to the apartment there was also an automated door to the building. Going out it auto-opens, going in it requires a key. I just sat in front of the building for 30 minutes until someone else opened the door.

I've stayed at about 15 AirBnBs, most of them I didn't have to meet the owner. But, also most of them used a lock box with a code instead of just a door code lock.

</comment></comment></comment></comment><comment><USER9> Most of the "smart" door locks suck as locks.[1] Most are physically too weak. Most need regular battery replacement, although a few generate power from turning the handle.

If you want any real door security, you have to go to steel doors and frames, and multipoint locks. You can get door/frame/lock systems which look normal and operate like a regular door, but bolts go out the top, bottom, and sides into the frame, like a vault door.

[1] [http://schuylertowne.com/blog/smart- locks](http://schuylertowne.com/blog/smart-locks)

<comment><USER10> As an addition to your point, it's always worth noting there is no such thing as perfect security (at least not in any _useful_ way). As soon as you make your door much more hardened, there are other points of entry that will be used instead. It does you little good to transform your door into a foot thick slab of concrete if your window is still just a couple panes of glass, or someone can just take a sledgehammer to your wall next to the door and it's just a few sheets of plywood and some 2x4's.

Passive security measures buy you time, which in turn makes you a less lucrative target by requiring more effort and making it more likely someone will notice and intervention will arrive before the intruder has completed their goal. This applies equally as well to network security, and usually this comes up here because of analogies in discussions regarding network security, but it applies just the same no matter which direction you approach it from.

What this means in context is that it's often better to step back and look at what your real goal is. It's entirely possible a sign stating "guard dog on premises" (whether you have one or not) will prevent a lot more break-ins than a better padlock. On the other hand, if the convenience is what you are after, then you have a different set of criteria to consider.

<comment><USER11> _> As soon as you make your door much more hardened, there are other points of entry that will be used instead. It does you little good to transform your door into a foot thick slab of concrete if your window is still just a couple panes of glass, or someone can just take a sledgehammer to your wall next to the door and it's just a few sheets of plywood and some 2x4's._

Well sure, but like in all security it's about adjusting the attacker's effort/reward ratio. As I recall [citation needed], most burglaries are less than a few minutes, in-and-out affairs. Make it harder than that, and you can deter the low-effort attackers.

<comment><USER10> > Well sure, but like in all security it's about adjusting the attacker's > effort/reward ratio.

That's exactly right (and a large part of my point). But if you have a fairly large unsecured window easily visible and a very secure door, there's a good chance that might just get smashed in and people will run in and grab a few high value items before running away. This probably isn't as crazy as it sounds to some, as I heard from a police officer not too long ago that in some cases cars just drive up to a property, someone jumps out and knocks to see if someone is home, and then they just kick the front door in, and run in and grab a few items. A more secure door will prevent that _exact_ scenario, but if they can tell the door is secure, what's to prevent them from throwing something through the window? They are already expecting a loud noise and possibly being noticed, glass breaking doesn't seem like it would deter them (other houses may look easier, but if you look more appealing for some other reason, that may be all that matters in this case).

What I really wanted to point out is that what's really protecting you in most cases is the _perception_ that it's hard to break in, and while reinforcing your door may meet that criteria in _your_ eyes, those that break into houses may have long ago dropped the idea that the door is the only, main, or even best way to break into a house.

</comment></comment></comment></comment><comment><USER12>
        IoT finding its footing in augmenting other systems rather than revolutionizing them

This is key. All the companies that are trying to start from scratch and build something big are failing or are hitting huge roadblocks due to high learning curves. On the other hand, those that are starting with simple, one-feature, even buttonless devices (philips hue, chromecast, echo) are the ones that are staying afloat.

I'm in this niche, and have been hit hard by this reality. IoT is _definitely_ coming, but right now it is SO young, immature and fragmented, that it takes a pretty skilled person to use it in any meaningful way.

People need to be educated, and the best (read: only) way to do that is to introduce them to IoT one piece at a time. And these pieces have to be reliable and consistent. Until then, the switch on the wall has nothing to worry about.

<comment><USER13> The problem with IOT is that it's the tower of babble. Interoperability will be the killer feature that will drive growth.

</comment></comment><comment><USER14> Adding more insecure devices to protect your home makes no sense. Whatever happened to the idea that fewer "moving parts" meant less likelihood of failure?

The selling point is that you can monitor all this stuff remotely on your phone, but really, what can you do about it? I don't see how this surpasses the (very expensive) services like Brink's and ADT who will contact law enforcement for you.

And yes, I've seen the ad where the guy is at the store trying to figure out what to buy and can look in his fridge from his phone. Whatever happened to making a grocery list before you leave?

<comment><USER15> To play devil's advocate, what ever happened to making a mix tape from songs on the radio to play in your large battery powered Walkman on the go?

"Why can't we just do it the old way" isn't the best argument for halting attempts at innovation. Before we can have the IoT we see in movies, we have to have gradual iterative progress in the way we think of/use the tech.

<comment><USER16> "Making a mix tape from songs on the radio to play in your large battery powered Walkman on the go?" was never a design principle, and "why can't we just do it the old way" is not the argument being made above.

<comment><USER15> The last line of the post I commented on: Whatever happened to making a grocery list before you leave?

Which summarizes to: Why can't we just do it the old way

To which I responded. Again, summary: it's silly to complain about new things being different than the things that came before them, and the only way to make the new stuff great is to make a bunch of new stuff and see what sticks.

<comment><USER17> > Which summarizes to: Why can't we just do it the old way

To me, that summarises to _Why can 't we do it the simple way?_

<comment><USER15> Again, why use a combustion engine that requires fuel when you can just use the horses we already have?

<comment><USER18> Horses are a combustion engine that requires fuel, and a fairly high maintenance one, low power-to-weight ratio combustion engine, at that.

On the plus side, they run on renewable rather than fossil fuels.

<comment><USER15> Point: missed.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> While his thesis for things that are related to home security in the face of an adversary are correct, there are a lot more cases that aren't so dire.

Gee, someone is banging on my door at 3AM in the morning. I'd really like to see who it is _WITHOUT_ being directly behind the door. Especially since it's most likely to be a neighbor or the police and greeting them with a shotgun is not likely to result in a positive outcome. A cam on my door that I can see from my phone would be kinda useful.

My water heater, washer, shower, etc. just broke. I'd really like to get continuous alerts on my phone that there is water filling up my house.

There are lots of things like this. They're grubby and mucky and an opportunity, but they are not high volume and they require more than 3 guys and a dog and some software.

<comment><USER20> To further your point, I live in a high-crime urban area in an apartment complex that gets broken into weekly by folks stealing packages and prowling cars. My apartment used to have no security, and it would have stayed there if I hadn't gotten into the open source Python 3 home automation engine [https://home-assistant.io](https://home-assistant.io). I got it up on a Raspberry Pi and fiddled with it for lots of things. Now, if my door opens or motion is detected and the alarm is armed:

* My stereo gets turned on by an IR LED

* A scary mp3 I threw together with dogs barking, sirens blaring, and monsters growling starts playing loudly

* My camera starts taking snapshots and saving them locally and emailing them to me

* All the lights in my apt. start blinking on and off

If I'm home, this will wake me up if my door gets compromised, and possibly scare off the perp. If I'm not home I will almost certainly get the alert (services are up 99% of the time), and I feel relatively confident that it will scare off a low-level property thief.

If professionals show up with SDR to jam my sensors, yeah they'll get in...I agree. But IoT home security is still good because some security is better than none, and there's no way I would have any security at all without it.

<comment><USER8> What software defined radio would screw up your sensors? The ones you listed above are all door or ir. Or did you just mean the motion sensors?

<comment><USER21> Camera and light switch are probably on wifi -> jammable.

<comment><USER20> Light switches and door sensor are zwave; jammable. However I could relatively easily rig up my own SDR receiver and detect jamming as a backup trigger.

</comment></comment></comment></comment></comment><comment><USER22> I most of the cases there is no need for I part.

What most people actually need is local in house system. They do not need leaches that suck on their data and they do not need products that stop to work in few years because company producing them and providing a "service" looses the interest.

</comment><comment><USER23> IoT will explode when 1) open hardware gains unprecedented trust between the user and their hardware, 2) users begin to prefer open source software because that's just how the most secure and user-first software is maintained, and 3) TBD open hosting.

1 + 2 = "my bulb is an open spec made by factory X running on transparent software maintained by people who care"

3 = "and I host it myself on Y"

3 is the missing link, and it's yesterday's self-hosting that hasn't made it to it's next incarnation. When we'd self-host our web site, we owned the box, owned the set-up and felt absolutely in control of the system. It may not have been as reliable or fast as a hosting service, but there is comfort in full ownership and full control. To their own detriment the shared hosting industry went to shit when they settled for their shady marketing eco-system (paid reviews, not unlimited unlimited quotas, cheap bad service). No one trusts shared hosting now, and so Squarespace and the like have gained popularity, but that's a fully corporate owned opaque service.

The closest to 3 we have now is AWS and Google Cloud and the like, but they are not made for normal users. Dropbox would have been a good candidate but they lose credibility with every word they speak (damage control clearly centered on themselves, ignoring customer complaints).

3 could be 1) a new self-hosting local box that has it's own app or something that's fully contained and in your house. 2) A cloud provider that has managed to detach their corporate interests from their shared infrastructure (like amazon and google have towards developers). Consumers don't want their IoT console cluttered with ads or "recommended items for you" and the last thing consumers want is for Google to mine their personal IoT information. Or 3) a standardized open source cloud platform where users can take their data from one provider to another while enjoying full ownership (local backups), privacy (full encryption), and portability (zero lock-down).

<comment><USER20> 3 is the open-source [http://home-assistant.io](http://home-assistant.io) engine hosted on a local Raspberry Pi and accessed remotely through a DD-WRT OpenVPN. It's here now, and it's amazing.

<comment><USER23> Exactly. When this (and the like) goes mainstream, and I can buy standard- based hardware, IoT will explode. Consumers do not trust corporations, and will not let them in their home. (This might sound counter intuitive because corporations are all over our homes, but consumers don't want that, and IoT is extremely personal -- it's _the_ home.)

<comment><USER24> My prediction is that 3 will not happen, and what happens in its place is going to perpetuate the tech giant oligopoly. With the tech giants getting into the business of collecting any remaining missing data points using IoT, it is only a matter of time before most of us are inside houses which are periodically sending data to servers at Amazon, Google et. al.

Their marketing might of course is hard to match. But they are also more likely to know more about your present needs with the trove of data at their disposal. Which cloud provider is going to match that?

Respected experts like Andrew Ng talk about data being a 'defensible barrier'[1] . Under this euphemism lies practices such as 'creating products which do not produce revenue but are intended for data collection'. Yes, folks at HN have known about these things for a long time, but my point is the stamp of endorsement for these disturbing practices from people who are regarded as authority figures, and the general absence of debate around these practices.

[1] [https://www.youtube.com/watch?v=4eJhcxfYR4I&t=21m30s](https://www.youtube.com/watch?v=4eJhcxfYR4I&t=21m30s)

The cloud providers and their ilk will be quickly driven out of business with revenue-less products which 'complete the picture' for the tech giants.

[https://www.fastcompany.com/3061546/Amazon-dash- buttons](https://www.fastcompany.com/3061546/Amazon-dash-buttons)

Self-hosted is possible. But that is going to make an explosion in IoT's popularity unlikely.

</comment></comment></comment></comment><comment><USER25> I agree that the security of IOT devices is petty terrible in its current state.

However the author seems to make a mistake in generalizing that "It doesn't take a professional to realize his particular house of cards [home security system] is about as fragile as they come."

The average person does not understand the danger of IOT, and this is where the most damage will come from.

<comment><USER26> Physical security doesn't have the same parameters as digital security though. The pool of attackers on the internet is much larger and more sophisticated than those looking to break into the average person's home.

To put it in more concrete terms. The door to my home has 2 deadbolt locks. I would be highly surprised to learn that either can't be picked in a short period of time by someone with enough skill. That said the probability of that happening to my door is relatively low. The same level of exploitability in a web browser though is much more likely to be a problem.

In short the pools of likely attackers for my home is quite different from the pool of attackers for my digital presence. The primary concern I have with IoT is it's potential to expand the pool of attackers for my home.

</comment></comment><comment><USER27> my guess is that companies are pushing this (rather than customer pull) because:

1) product differentiation, more vague tick boxes on the product comparison chart that your competitors don't have.

2) vendor lockin/ecosystem lockin. If the devices are not going straight to a remote server you'll need a "hub". your brandA lightbulbs will only talk to a brandA house hub which is incompatible with brandB security locks.

3) product churn. (did you really really need to replace your ok tv with one that does 3d? lots of people did).

4) clip the ticket. build a platform that involves transactions and take a cut.

5) data. paraphrasing: if you aren't paying for it, you aren't the customer you're the product.

none of these really sound like a utopia for the average person.

<comment><USER28> There's also the "Star Trek factor" (I just made us this term). Tech people grow up watching or reading science fiction and then try to build the stuff for real, because it would be cool.

We'll have to see if ordinary people find it _useful_.

</comment></comment><comment><USER29> I have had a HAI Omni Pro in my house for nearly a decade, it is a UL listed Fire/Burglary and automation system. It has never faulted or rebooted except when I needed to change its backup battery. There are Omni's running that where made in the 80's.

It has a Ethernet port and a documented TCP protocol that uses 256 AES. I have an iOS app that talks to it directly, which means no lag in controlling it.

Beyond Security and Fire, it controls my lights, HVAC, garage doors, sprinklers.

It is one of the most reliable computing systems I have used. The recent IoT stuff is a joke compared to my Omni, unfortunately I think HAI got left behind and ended up selling out to Leviton and there seems to be little progress since then.

</comment><comment><USER30> Laws and regulations may remedy the racket that IoT is now. I'll believe it when I see it.

</comment><comment><USER31> IoT reminds me of the fiber optics craze of the late 90s. No one knew what the killer application for fiber was back then but every company was in it. Eerily similar to whats going on now with IoT.

</comment><comment><USER32> I think the article does a decent job of highlighting some of (what I hear as) the primary concerns surrounding IoT, namely:

1\. WiFi needs to always work

2\. Internet connection needs to always work

3\. Power needs to always work

4\. Stability of software and firmware

5\. Trustworthiness of software and firmware (including data leakage, privacy, etc)

Simultaneously, though it rightly points out that IoT is still very much in its infancy, I think it misses a very important observation: there will absolutely come a day when IoT is unavoidable. Not as in you can't avoid encountering it, but as in you can't avoid _owning_ it. There will, (I think anyways) without a doubt, be a day when devices that the average Western consumer considers necessary for everyday life -- things like refrigerators, electric meters, thermostats, and so on -- are effectively impossible to buy "dumb". Every analysis and meta-analysis of IoT that I've seen has been incredibly bullish on it, and I think that's an indication of how much economic incentive there is for it. Given that, I'd say automobile ECIs are the proof in the pudding for the assertion that IoT will be unavoidably ubiquitous. As an experiment, try to find a new car that you can personally can actually buy, that doesn't have a computer in it. As the median Western consumer, that's not possible. So I'm pretty convinced that for IoT, non- participation will not remain an option.

So then the question is, what do we do about those 5 issues? I tend to look at stuff like this from an economic perspective; clearly device producers haven't seen enough market pressure to give a shit about any of them. Right now, the only pressure device creators are demonstrating is a profound push to get something, anything, to market. It really is an internet of shit.

That being said, even the bare minimum is really hard here. You're talking about a system architecture that our existing infrastructure simply isn't cut out to handle. Think about the challenges involved in deploying a reliable authentication system to a web-scale application, and now imagine doing it in a way that can't necessarily rely upon a central server. It's far easier to just "punt" on the second half of that, assume the traditional web paradigm (trusted third party server), and call it a day. And make no mistake, for a commercial device, authentication is absolutely required, even for home WiFi network: not everyone wants every person in their house to control, for example, their locks. Or, alternatively, imagine an AirBNB host being forced to give their guests unfettered access to their IoT vibrator (yes, they exist). These edge cases are everywhere, and they make authentication of some sort or another an absolute requirement.

My hope is that someone (and by someone, in all honesty I'm talking about my own project [1]) can come along and say to device producers:

1\. I understand how hard it is for you to make _any_ IoT device.

2\. I'm going to make it substantially cheaper for you to do that, but...

3\. The privacy and security I've baked into my system is inseparable from your economic benefit as a device producer.

The idea is to evolve that into:

4\. You cannot be competitive in the IoT marketplace without privacy and security.

At this point, with how completely and totally horrendous the industry has been in these areas so far, I think that's the only viable way we can achieve those goals without a tremendous amount of growing pains.

[1] The project is called Hypergolix, and at this point it's basically "Dropbox for Python objects, geared towards IoT, with an emphasis on social, and secured via end-to-end encryption". We're in the process of getting a private alpha shippable, to be followed soon by a public alpha. It all works, and it's all open source, but there's some necessary stuff we need to iron out in the coming weeks. Our outdated landing page is [https://hypergolix.com](https://hypergolix.com), but a better preview of the developer experience is on our very incomplete docs page: [http://pyhgx.readthedocs.io/en/latest/index.html](http://pyhgx.readthedocs.io/en/latest/index.html) . The whole project is backed by a crypto protocol known as Golix: [https://github.com/Muterra/doc-golix](https://github.com/Muterra/doc-golix)

<comment><USER32> To expound a little on this combination:

> There will... be a day when devices [are] necessary for everyday life... are > effectively impossible to buy "dumb".

> As an experiment, try to find a new car that you can personally can actually > buy, that doesn't have a computer in it.

The reason I'm convinced this is the case is simply economics. Solid-state electronic controls are very often simpler, cheaper, and more reliable than mechanical ones. When it comes to, for example, thermostat in your refrigerator, on your hot water heater, etc, the reason the economics have, thus far, worked out in favor of the mechanical controls it that the external costs associated with solid state electronics -- the software development, the upkeep, the initial electrical design, etc -- have been too high to justify them (in many cases). But as those external costs decrease, which they (through maturation of the IoT field) inevitably will, the solid-state electronics will be increasingly economically competitive, until eventually to have competitive margins as a device manufacturer, you have to go the connected route. When I say "impossible to buy dumb", I'm not suggesting that every refrigerator is going to have a Google calendar on it or something, I'm talking about all of the little things you take for granted. Don't underestimate the banality of automation.

Cars are a particularly apt example because the exact same thing happened to the automotive industry with the advent of the ECU. The added technical complexity of their computer control was initially only economically justifiable in performance vehicles. As time went on, and ECUs progressed and matured, they became cheaper and cheaper, until even the cheapest new cars were forced to incorporate them to be competitive in the market.

</comment></comment><comment><USER33> IoT isn't anything other than what already was. It's decentralized compute, plain and simple.

</comment><comment><USER34> This was interesting look at home IoT is used in home security today and it's current downfalls. However, the items that seem IoT specific are ones that are issues in implementation, not application.

To frame what I mean when I say "IoT specific", I'm pointing out that many of the examples that he highlights are also the downfall of traditional security systems as well. If you have remote monitoring, and you internet/telephone line goes down, IoT or not, you've lost the service end of discussion.

      It doesn't take a professional to realize his particular
      house of cards is about as fragile as they come. It is built
      on the assumption that one's WiFi will always work, their
      internet connection will always be up, power will always be
      on, and every piece of software and firmware is stable and
      trustworthy."

Power loss on traditional security, wifi loss on traditional security, hard wire cut on traditional security, all of these will take their toll as well, not just on an IoT system.

Onto the IoT specific related items. The implementation issues that he highlights; having to have your app open to record footage. Your cellphone being at the bottom of you bag and you can't reach it. These are all problems that can happen already. If you can't reach your phone when the security company calls you to notify of a break in, this is the same problem.

I understand why there is a lot of distaste for IoT, and all the security pitfalls that happen. However this is not an inherent issue to the concept, rather is a breakdown of implementation of security protocols that are not being followed and a lack of learning from traditional systems that isn't being applied.

After thinking about this for a while there are ways to bolster an IoT security or monitoring system: > Power / connection required for signaling. So rather than waiting for a system to signal something is wrong, wait for a heartbeat to die. > Battery back up: Pretty obvious. You should have a way to at least keep your systems for a period while you get power restored > Multiple links to a central service. WiFi and Cellular, monitor for connections going down and built in trouble shooting to notify the user if there is one or the other > Centralized data center for always on recording, pay an additional $10/mo for the ability to store your data elsewhere or offer local 24 hour recordings in the security base station in your home like many dash cams have now.

As for security concerns I look at it this way. Remote connections are something we've got down pat, assuming everyone follows it. Blaming IoT on being inherently insecure is like blaming the database password leaks on mysql rather than an open port and plain text user name / passwords.

I think IoT security has a place and purpose that offers benefits over a traditional system, we're just waiting for the right implementation.

<comment><USER35> We could make useful devices right now, there's just more money to be made without it.

A) Use existing open protocols: WTF do I need an app to get alerts. Doesn't email still work fine?

B) No cloud connectivity: No, camera, You don't need to store everything on the internet. My NAS can store it just fine. Or my backup usb drive, or whatever. If you want that as an option, sure, but quit trying to pretend that it's the only way this can be done. Same with you fridge. You don't need to store that grocery list online, it can just be emailed directly to me, TYVM.

C) Manual overrides: If my door won't unlock because servers are down, give me a physical key as well. I've read some companies faq's saying that if the internet is out, or their servers are down, you'll just have to call their customer service. No no no no no. Give me a key override. I'm not going to stand outside my own house while you try to get your servers going again. And what if your company goes under?

D) Open Source: If a bug comes out that renders my door-lock unusable, I want to know that I can patch it. We know the manufacturer sure isn't, using history as a guide. Why would you buy next years model if this years model didn't have security flaws?

Building a robust system isn't hard, it's just not profitable. All of these failure-points aren't there because we can't solve the problem, they exist because they are more profitable to leave unsolved.

<comment><USER34> I agree that a robust system isn't hard. I don't agree that it's not profitable. If you don't make an app, that cuts down on your bottom line, not paying to make the app or the programmers to maintain it. From there you can just tack on additional services easily. Local storage for everything as they do now with security. Just give the users a micro SD card slot, say you can record everything right here. Charge them for a cloud connection / storage. Charge them for remote monitoring.

Agree with manual overrides there is no reason to not have a key. I'm surprised you've read about that because that's against regulation in commercial security. If power goes down there should be a battery backup to power it and keep the key card / door security working OR it turns off and you can't lock your doors. Better to keep unlocked than have someone burn alive inside.

The beauty of IoT is how it can be easily expanded and connected should you choose to. There is nothing preventing companies from implementing the same idea to the payment system. Charge enough for securing those IoT devices once they reach out into the world and I think you can have a real system on your hands.

<comment><USER35> > I don't agree that it's not profitable.

I'm open to your opinion on that, but if that's true why is it not being done? There's a _lot_ of companies making IoT stuff, but it's really hard to find any of them making robust systems. The lack of profitability is the only way I can reconcile that. If you have another idea, let me know.

> I'm surprised you've read about that because that's against regulation in > commercial security

Looking now, I see a lot of companies switching to local bluetooth connections. That's definitely an improvement to the last time I looked (years ago).

> The beauty of IoT is how it can be easily expanded and connected should you > choose to.

I agree! but not if we keep pushing closed-off systems and protocols

<comment><USER34> I guess my opinion comes from the idea that there hasn't been a product or company that exemplifies a basic/robust system as we have both described. Everything has had the flashy app, or cloud connectivity, which in itself is a cost. If you're able to build a basic system completely contained, mark that up, you have just a regular hardware product, doesn't need to be IoT. Now, if you want remote monitoring, or backup systems you can start charging for that. Which, I might add, traditional security companies already do. And what many IoT companies seem to consider "essentials" rather than "extras". I think once the idea is shifted from user base / experience towards a goal to hit the actual benefits (ease of expansion / cheap data monitoring ) then we'll start to see IoT really explode.

</comment></comment></comment></comment></comment><comment><USER36> It's always porn and games.</comment>


Security isn't a feature. Security is the product - <AUTHOR> http://www.opine.me/security-isnt-a-feature-security-is-the-product/

<comment><USER2> Security will be the product as soon as there are users who will pay money for it. Given how users seem to respond to security breaches, companies are quite right to treat it as a minor side feature.</comment>


Elchemy – write type safe Elixir using Elm-like syntax - <AUTHOR> https://wende.github.io/elchemy/ <comment> lf-non Love the concept.

But please don't use fonts with ligatures in code snippets on the homepage. Especially when these code examples are actually screenshots which people can't copy.

Ligatures may be "obvious" to developers already familiar with the syntax of the language, but can make things very confusing for beginners, esp. in FP languages that lean heavily on operators etc.

I am really glad that the docs/roadmap etc. are on Github. Github is really the gold standard when it comes to programmer friendly aesthetics.

<comment><USER2> Maybe this isn't targeting new users, then.

His preferences supersede your sensibilities since its his website, don't you think?

<comment><USER3> Parent did say "please".

<comment><USER2> I never said he was rude!

You can politely ask the wrong questions sometimes.

</comment></comment></comment></comment><comment><USER4> Why would this target Elixir instead of Erlang or BEAM byte code directly?

Putting a language on top of a language on top of a language does not seem that smart to me.

<comment><USER5> Yeah I would expect to see it compile to bytecode. It seems pretty wild to transpile to a language to compile to bytecode to run in a vm when there is already bytecode and a vm to execute against.

Transpiling is common in js only because there isn't/wasn't a standard like webasm.

<comment><USER6> Similarly, despite the existence of LLVM and the simplicity of the various assemblies, tons of languages target C, mostly to facilitate easier interop with native libraries and because pretty much everything has a C compiler. Perhaps there were similar reasons to compile to Elixir, but I honestly can't think of any. It might just be for faster compiler development, at least until the featureset of Elchemy begins to significantly diverge from that of Elixir.

<comment><USER7> First of all thanks for all the interest and a good question! While obviously it would be possible to compile directly to Erlang, or even to Core Erlang it would just add a lot of additional work to do. Elixir adds a phenomenal amount of functionality that made making Elchemy easier. And thanks to building it on such a high level we can leverage most of the Elm tooling goodness as well as Elixir's. Another very important factor is familiarity. People much rather like an environment they already know and it would be silly to try to recreate things like Mix or ExUnit yet again. Another important aspect is the familiarity of the output. Elchemy's priority is producing fully readable Elixir code, which not only adds another layer for learning the language's characteristics as well as a 'belt and braces' for experimenting with it in existing projects - the time cost of removing Elchemy from a project written in it is way smaller than rewriting the logic from scratch

<comment><USER5> awesome - thanks for the reply. Makes sense. I work with elixir full time and the type-safety bugs me. I'll check this out when I can find some time.

</comment></comment></comment></comment></comment><comment><USER8> Or if you'd rather have typeclasses: [https://github.com/purerl/purescript](https://github.com/purerl/purescript)

<comment> lf-non Purescript by example[1] is the most approachable introduction to Functional programming that I have seen (yet).

Even if you don't intend to ever use Purescript itself for application development, the book is worth a read, as an introduction to FP concepts, especially if you are coming from a Javascript/Web-dev background.

[1] [https://leanpub.com/purescript/read](https://leanpub.com/purescript/read)

<comment><USER9> I largely agree, but it's not without its warts :) [https://github.com/paf31/purescript- book/issues/99](https://github.com/paf31/purescript-book/issues/99)

<comment><USER8> It's also a bit out of date, but nobody's perfect. :)

</comment></comment></comment></comment><comment><AUTHOR> Elchemy looks fantastic, especially if you have some frontend in Elm already or you use it in Node microservices. The only thing concerns me that it won't get enough traction and support and will eventally get abandoned, so here's some Q's.

1\. What's the genesis of this project?

2\. Do you use it internally, is it backed by any company?

3\. Is it already handling some production code?

Thanks!

<comment><USER7> Hi there, First of all, thank you for the post! It really made my day to see us land on HN I'm glad you like the idea. About the traction, I think I've got a mentality that makes it a little bit more bearable - even if it turns out nobody wants to use the project, I know I will so I'll always try to develop it and spend at least a weekend on it from time to time.

Regarding the questions: 1\. It's quite a long story which I'd be willing to tell one day, maybe at some conference. Basically, the idea started from 'typed elixir' which was a small POC project of mine. The Idea was to introduce type inference and annotations using only Elixir's macro system. It had a type inference algorithm I wrote in Prolog (to this day I'm still amazed how easy this language made it) and a bunch of hacky macros. However, after about half a year into development, I realized it's not a project that can be done singlehandedly and that there is simply too many compromises and hackishness to it. Half a year later on a LambdaDays 2016 conference in Kraków, Poland during a rather boring talk I've wrote a simple transpiler of Elm to Elixir as _a joke_ just to find an entertainment. But the longer I developed the joke to more apparent it started to be it's actually something completely doable and with a great potential value.

2\. Unfortunately no, not yet. It is being developed by me and sporadically by two other members of my company, but it's in no way supported by any big player. We'd love to get an interest like that though. If by any means some company representative is reading that and considering, please don't hesitate to mail me!

3\. Depends on what we mean by production - is it running as a node of a huge Erlang system? - no, and probably won't be for some time. It's still a relatively young project with a lot of space to develop, it is slowly approaching maturity though and I think after we introduce an official way of handling side effects it's going to get much more traction. If the question is of "Is there anything big written already in Elchemy?" then kind off. I'm pretty sure that the biggest project written in Elchemy today is... Elchemy itself. Being self-hosted was very important to me and it is even a part of the CI pipeline right now. The moment of it being able to compile itself and execute in Elixir was a huge milestone in the development and a definite point in time when the project stopped to be just a Proof of Concept. We are currently working on a demo game written in Elm on the frontend and Elchemy on the backend. Its purpose is to demonstrate the maturity of the project, but also pinpoint some possible shortcomings that we might have missed. That's the main reason for starting the Elchemt DevBlog on Medium ([https://medium.com/elchemy](https://medium.com/elchemy)) to share on the progress and possibly discuss different choices we still have to make

As it's already becoming quite long-ish feel free to join our Gitter chat ([https://gitter.im/elchemy-lang/Lobby](https://gitter.im/elchemy-lang/Lobby)) or to mail me!

Cheers

</comment></comment><comment><USER10> This is awesome and important work! I hope that this project can move independently of Elm's development once it gets enough interest though.

<comment><USER7> We are hoping for that as well. Elm although making an amazing foundation might cause problems in future when introducing backwards incompatible changes for instance. We are trying to keep the safe distance from Elm development not to be too tightly coupled, but still making use of the awesome stuff Elm's team is doing

</comment></comment><comment><USER11> Looks like your playground is based off Ellie, which is a great choice. However, it seems that there is an issue with downloading the Elm compiler. I'm getting a network failure from ellie's CDN(NAME_NOT_RESOLVED).

Other than that, thank you for this, it is super interesting to me as I am a huge fan of both languages, and lack of type safety has always been my only misgiving with Elixir/Erlang. I'll have to take a spin this weekend.

<comment><USER7> Sometimes the CDN is acting naughty

That's true. The idea of how Ellie was brought to life is outstanding. Huge shoutout to Luke Wetsby for letting us use his codebase for Elchemy

Feel free to share your thoughts and concerns on GitHub or by email! We'd love to hear your opinion and concerns

<comment><USER12> <3 thanks

fwiw the latest release moved the compiler back to the server. the ghcjs stuff proved too difficult to deliver a good experience to everyone. a naughty cdn was just one of many woes.

</comment></comment></comment><comment><USER13> Looks like it's targeted more towards the Elm crowd with npm install instructions than the Elixir crowd with no hex/mix install method.

<comment><USER14> Elchemy creator here. Quite the opposite to be honest. I come from Elixir background. It's just that npm is much more reliable when it comes to global system-wide installations

<comment><USER15> Are you saying Mix/Hex is unreliable or are you saying npm is on more machines globally?

<comment><USER16> He's talking about installing a package globally on your system. That's the -g flag

</comment></comment></comment></comment><comment><USER17> So I'm confused, is Elchemy its own language that compiles to Elixir? Or a way to add static types to existing Elixir code?

<comment><USER7> The former. It is a language almost identical to Elm that compiles to a readable Elixir output. It has all of Elm's advantages - the type system, readable error outputs. On top of that, you can use all of Elm's tools like editor plugins or elm-format so there is no 'reinvent the wheel' syndrome

</comment></comment><comment><USER18> What would be interesting is to have a subset with managed side effects and purity elixir i.e. something like Elm does at the frontend, the Elm experience is amazing and what annoys me in erlang is having too much effects around

</comment><comment><USER19> "Beautiful and fully readable output code"

beautiful ... ? readable ... ?

neither ... yes

</comment><comment><USER20> Great name!

</comment><comment><USER21> As someone who writes Erlang for a living, I highly recommend rust as a well typed alternative to Erlang, that still keeps all of the things that make Erlang great. I do love Erlang, but working on a large codebase can be frustrating when nothing is speced or commented, and even when it is speced it's usually part of a gradually typed codebase with very non descriptive types.

<comment><USER22> Can you recommend a good web framework/micro-framework?

I was using actix-web, but last I heard it has to many unnecessary `unsafe`s.[0]

[0] [https://www.reddit.com/r/rust/comments/8s7gei/unsafe_rust_in...](https://www.reddit.com/r/rust/comments/8s7gei/unsafe_rust_in_actixweb_other_libraries/)

<comment><USER23> The author is responding and taking care of many of them. I'm confident this is a temporary issue, or at least it seems like it's going correctly to me.

<comment><USER22> Oh, cool. Good to know

</comment></comment></comment></comment><comment><USER24> Inception.</comment>


Hacking UFO Tech, SETI, and the Boundaries of "Respectable" Science - <AUTHOR> https://hackernoon.com/hacking-ufo-tech-seti-and-the-boundaries-of-respectable-science-aeaf126ce979 <comment><AUTHOR> Buried lede IMO (if factual):

 _I can say that I have personally spoken to researchers from top universities (Stanford, MIT, Harvard) who have seen the "artifacts" that the article references, and other similar ones that are even more secretive (and perhaps more functional)._</comment>


Physicists Dream Up the Antilaser - <AUTHOR> http://www.wired.com/wiredscience/2010/07/antilaser/

<comment><USER2> That's... pretty vague. If it's a "time-reversed laser", it's implying this is a beam which can be projected which cancels out light it encounters:

> _"By just tinkering with the phases of the beams, magically it turns 'black' > in this narrow wavelength range," says team member A. Douglas Stone, a > physicist at Yale University. "It's an amazing trick."_

If it's a _material_ :

> _Instead of amplifying light into coherent pulses, as a laser does, an > antilaser absorbs light beams zapped into it._

> _Stone and his colleagues thought up the antilaser while wondering what > might happen if they replaced the material inside a laser that reflects > photons — the "gain medium" — with a material that absorbs light. In the > right configuration, the absorbing material sucks up most of the photons > sent into it, while the remaining light waves cancel out by interfering with > one another._

then it's... an electrically-operated optical switch? Why not just state that?

If it's an optical switch, it's pretty awesome, granted, but the article doesn't seem to be implying that except in a very low-importance way (and still ambiguous about beam / material). They even mention that, as it only absorbs a specific frequency, it can't be used (efficiently) in solar panels... which implies you can extract energy from the absorbed light?

WTF Wired, make more sense.

<comment><USER3> _Even though the antilaser absorbs perfectly, it does so only at specific wavelengths of light..._

That would make it more than an optical switch, which switches broad bandwidths of light on or off. This implies that it is a perfect "notch" filter (absorbs only a specific frequency/wavelength) that can also be turned on and off. Notch filters are very important in communications technology. Being able to turn a perfect notch filter on and off is very interesting.

Modulation of light (lasers) is an obvious potential application, especially if it can be done very rapidly - direct modulation of lasers is somewhat tricky. [http://www.molphys.leidenuniv.nl/~thooft/laserweb/download/l...](http://www.molphys.leidenuniv.nl/~thooft/laserweb/download/laser_modulation.htm)

...of course, they have to build one first.

</comment></comment><comment><USER4> Interesting note, one of the physicists mentioned in the article is Chong Yidong, one of the co-maintainers of emacs.

</comment><comment><USER5> One possible application would be, I think, detection of certain materials provided that antilasers are cheap to build. In other words, cheaper replacement for spectral analysis.

</comment><comment><USER6> This sounds like nothing more than a tuned resonator, like a dichroic mirror or a Fabry-Perot resonator.</comment>


Ask HN: Open-source tool for communities/groups to help each other during Corona - <AUTHOR> Looking for recommendations for an opensource tool that could easily/quickly be setup and configured to support individuals that belong to small groups/communities to share information and communicate with each other.
E.g. a neighborhood  where someone who is isolated due to Corona virus and sign-up and request supplies/assistance.  And where interested people can post offers/information (with moderators).
Self hosted so that privacy is maintained (i.e. not Facebook).  Preferably on a low-cost service like DO or Heroku. <comment><USER2> There are a lot of spreadsheets going around for this. I hope we can get it together for tooling to help manage this by the time the need for this arises.</comment>


Withered Palm: The Decline and Fall of a Technology Giant - <AUTHOR> http://www.thebigmoney.com/articles/money-trail/2009/12/13/withered-palm

<comment><USER2> The point concerning building an ecology of products is key.

Part of the persistence of the blackberry is accountable to its adoption in the business world which is very hesitant to change, especially in IT.

Apple, in many ways, is trying to tie down consumers as RIM does with blackberries. iTunes - iPod/iPhone - Mac is a (nearly) black box solution that is hard to extricate yourself from, especially for the average user.

Palm started too late with too little resources and simply cannot swim fast enough upriver. Shame.

</comment><comment><USER3> An interesting possibility for Palm is an acquisition by Microsoft, which has been struggling with Windows Mobile.

<comment><USER4> It's hard to see how that makes sense. The selling point of WinMo is that you can "take all your Windows stuff with you", and that developers already familair with desktop Windows can easily reuse their skills. Microsoft is all about spreading the Windows ecosystem all the way from the datacentre to the living room to the pocket. Why would they introduce an incompatible product into the mix?

</comment></comment><comment><USER5> From what I've seen, the Pre is a great phone and webOS is a very nice operating system. So, it pains me a bit to agree somewhat with the author. People want apps these days, and Palm is never going to be able to get developers with a niche device, even if it is damn nice.

<comment><USER6> it's commendable that palm was willing to think so far outside their established boundaries when creating the pre. they completely scrapped their existing offerings and started over again.

but i'm guessing that, at this late date, they don't have the resources to pull it off. if they were sitting on a stockpile of billions the way apple is, they might be able to give the industry a real run for its money.</comment></comment>


Oracle releases new JavaScript framework - <AUTHOR> http://www.oracle.com/webfolder/technetwork/jet/index.html <comment><USER2> I'm so happy they released this! Few things give me more pleasure than ignoring something engineered at Oracle.

<comment><USER3> Thanks for giving me a spray my cup of tea all over my monitor laughing moment :-)

</comment></comment><comment><USER4> Demo [1] not working for me. White page on load. OS X 10.10.5, Chrome 46.

[1]: [http://www.oracle.com/webfolder/technetwork/jet/public_sampl...](http://www.oracle.com/webfolder/technetwork/jet/public_samples/WorkBetter/public_html/index.html)

<comment><AUTHOR> Disclaimer: Not affiliated with Oracle JET.

Hmmm, it works for me after waiting for a few seconds, using the same configuration. Is there an error popping up in your console?</comment></comment>


The Facebook Algorithm Mom Problem - <AUTHOR> http://boffosocko.com/2017/07/11/the-facebook-algorithm-mom-problem/ <comment><USER2> I find a lot of sites feel like they're overtuning their recommendation engines, to the detriment of using the site. YouTube is particularly bad for this - given the years of history and somewhat regular viewing of the site, I feel like it should have a relatively good idea of what I'm interested in. Instead, the YouTube homepage seems myopically focused on the last 5-10 videos I watched.

<comment><USER3> Youtube is definitely over-weighing the last few videos. Then again, it's likely optimized for a different market segment. Especially with how many children are given tablets. Like, brief intense fascination with many subjects in general is genuinely _hard_ to optimize for, especially when a huge portion of your market has long-lasting intense fascination with a few subjects.

<comment><USER4> YouTube would rather you fall into a trance of continuing your recent viewing habits rather than providing a personalized library. It just makes better business sense.

<comment><USER5> Why does it make better business sense?

<comment><USER6> Because they aren't trying to help you enjoy videos over the long-term, they're trying to keep you from going over to Facebook where _their_ addictive algorithm will take over and reduce your likelihood of returning to YouTube!

It's a classic race-to-the-bottom. If YouTube lets Facebook keep you addicted, you won't get to the long-term.

[http://timewellspent.io/](http://timewellspent.io/) is good for perspective

<comment><USER5> Yes, but that has an unspoken assumption that recent habits are more additive than longer term ones. I find that suspect; after all, you've already shown that you'll go back again and again to these kinds of videos, whereas you might spend a couple of hours watching a bunch of videos of a kind that you'll never be interested in again.

Personally, I find YouTube terrible at keeping me engaged. Even when I _want_ to keep watching videos, their sidebar fails to show me anything I want to click on at least 1/3 of the times.

<comment><USER4> _Yes, but that has an unspoken assumption that recent habits are more additive than longer term ones_

This is too fine a point. A user will "select" a default choice by doing nothing, and it's in YT's interests to provide default choices that reward the company. This has been researched for decades and is supported by, among other things: [https://en.wikipedia.org/wiki/Status_quo_bias](https://en.wikipedia.org/wiki/Status_quo_bias)

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> tl;dr, as I understand it: when family members Like your Facebook content in relative quick succession, FB apparently interprets it as a signal that it is family-specific content. I didn't see any metrics but this seems plausible.

I think I'm more of a fan of FB than the average web geek, probably because I used it at its phase of peak innocence (college years) and have since weaned myself off to the point of checking it on a less-than-weekly basis. I also almost never post professional work there, nor "friend" current colleagues. Moreover, I've actively avoided declaring familial relationships (though I have listed a few fake relationships just to screw with the algorithm). But wasn't the feature of making yourself a "brand page" and/or having "subscribers" (which don't count toward the 5,000 friend limit) supposed to mitigate this a bit? I guess I'm so used to keeping Facebook solely for personal content (and using Twitter for public-facing content) that I'm out of touch with the sharing mechanics. That, and anecdotal experience of how baby/wedding pics seems to be the most Liked/Shared content in my friend network.

<comment><USER8> > _But wasn 't the feature of making yourself a "brand page" and/or having > "subscribers" (which don't count toward the 5,000 friend limit) supposed to > mitigate this a bit?_

If you have a page, Facebook wants to milk you, so they've got this weird algorithm that pushes your posts to only a small fraction of the page's followers, expecting you to start "promoting" them.

Basically they screwed "organic reach".

Oh, and about 3 days ago I created a second Facebook account with the purpose of connecting with software developers and my English-speaking friends (I'm Romanian). I did this thinking that I don't want to share semi-private pictures of family with strangers, or to spam my family and friends with programming stuff.

But only 24 hours later they've disabled my account because of "security concerns", without notice and now I'm waiting on their support to reply after I've sent them my picture for validation.

And another thing - the online parents group from my son's school is on WhatsApp. They tried a Facebook group, but the problem is that when important announcements happen, not all parents receive notifications, so they resorted to something that works.

Facebook is freaking terrible.

<comment><USER9> > If you have a page, Facebook wants to milk you, so they've got this weird > algorithm that pushes your posts to only a small fraction of the page's > followers, expecting you to start "promoting" them.

While this does enable Facebook to force brands to buy advertising, it is also an user-friendly change.

Nobody who I have spoken to about this thinks that "like/follow" = "I want to see everything they post" on Facebook. People like restaurants they had a nice dinner at and want to publish their support, it doesn't mean they want to see the daily special every day. Even if they "follow" you, it doesn't mean it should show up before a friend's holiday pictures today, and tomorrow there is already new content.

The reality is that most facebook users do not care about the posts from pages they like/follow, even if they pressed the button some time ago. An automated filter that keeps these posts from showing up is good for the user experience.

It's the same as "facebook friends" \- they aren't real friends, just people you met once at a party in college. It might be interesting to see a post from them once in 10 years when they get married or move to a new country, but not their daily life. The same applies for brand pages - a like should give you once in 10 years access to their feed, but not more.

<comment><USER10> I wasn't aware that facebook does partial publishing/pushing from Pages.

I'm co-admin for an org's official Page (and Group). Our bylaws require advance announcement of various things, like meetings and resolutions. We've been using our official Page just like our mail listserv, assuming all our subscribers are getting all of our announcements.

Frankly, this sucks. Minimally, it violates the UX design principle of least astonishment.

<comment><USER11> > We've been using our official Page just like our mail listserv, assuming all > our subscribers are getting all of our announcements.

They will get it if they access your page directly, or subscribe to notifications from your page. It's the same with a personal profile, I believe — not everyone will receive your posts on their news feed unless you've interacted with them a fair bit.

</comment></comment></comment></comment></comment><comment><USER12> Site down for me: [http://webcache.googleusercontent.com/search?q=cache:FcwargQ...](http://webcache.googleusercontent.com/search?q=cache:FcwargQcuogJ:boffosocko.com/2017/07/11/the- facebook-algorithm-mom-problem/+&cd=1&hl=en&ct=clnk&gl=se&client=safari)

<comment><USER13> Not all heroes wear capes -- thank you!

<comment><USER14> Someone should make a browser extension that will automatically (or provides a button to quickly) load the cached version when a site is down

Edit: I just made a super simple bookmarklet that does it: [http://mikelyons.org/2017/06/12/Google-Cache-Javascript- Shor...](http://mikelyons.org/2017/06/12/Google-Cache-Javascript- Shortcut.html)

<comment><USER15> You can also write `cache:` in front of the URL. Works in FF, probably also in Chrome.

<comment><USER16> Looks like this is a Google search feature - didn't work for me in FF with DuckDuckGo as default search engine, but worked when I added !g to the end.

</comment></comment></comment></comment></comment><comment><USER17> I'd like Facebook to have an option to see all posts, without filtering, just as they're posted. It's not hard, it's a simple UX, but it's just not there.

<comment><USER18> I believe that option already exists[0].

[0] [http://imgur.com/a/gg2DH](http://imgur.com/a/gg2DH)

<comment><USER19> not on ios mobile

<comment><USER20> If it's anything like the Android version, it's hidden in the settings.

Hamburger menu > Scroll way down to the "Feeds" section > "Most Recent"

</comment></comment></comment></comment><comment><USER21> I feel like these are just shitty models. A good recommendation model would get features like "is_mom" and learn that "is_mom" is a shitty predictor of relevance.

Similarly with Amazon, products should have some sort of 'elasticity' score where it should learn that recommendations of inelastic products is a waste of screen real-estate. I mean, I doubt the model is giving a high % to most of those recommends - it's likely more a business/UX issue in that they've decided it's worth showing you low-probability recommends instead of a cleaner page (or something more useful).

Youtube, on the hand, seems to be precision tuned to get you to watch easy to digest crap. You consume the crap voraciously but are generally left unfulfilled. This is a more difficult problem where you're rewarding naive views rather than a more difficult to discern 'intrinsic value' metric. As a 'long term' business play the model should probably weight more intellectually challenging content just like fast food restaurants should probably figure out how to sell healthier food because by pedaling crap you're only meeting consumer's immediate needs, not their long term ones.

<comment><USER22> I feel like Youtube's algorithm is horrible. My kids were listening to kids songs on it, and there's an advertisement for a Son Of Sam podcast.

</comment></comment><comment><AUTHOR> Yesterday I sent one of my friends a link to an old - 4.5 years old, from 2013 dec - entry he wrote as a Facebook note. There were 70+ likes, 30+ commenters and 110 comments on it.

He added a new comment yesterday - I only saw it, because I randomly decided to read through the comments.

Those who commented on it should have received a notification - well, in the end, 2 people got something.

This is how you effectively kill conversation - which dazzles me, because keeping conversations running = engagement, which is supposed to be one of the end goals.

I get the "need" of a filter bubble, even though I'd simple let people choke on the amount of crap they'd get if follow would actually mean get everything - they may learn not to like things without thinking.

But not sending notifications at all? Why? Why is that good?

<comment><USER23> On the other hand, I get more (and less relevant) notifications the less I'm active.

$friendINeverTalkTo has commented on $PostByPageIDontFollow is NOT something I want to get notified about. Neither is

XYZ has uploaded a photo

<comment><USER24> My guess is the point of those notifications is that it gives them an excuse to add points to the addictive little red number. It's not because they think you'll actually care.

<comment><USER25> I saw that as well. If you click on of this useless notification, they invent a new one around 30mins later which would not have existed otherwise.

</comment></comment></comment></comment><comment><USER26> Facebook also has a serious problem in that its news feed is a content recommendation engine with only positive reinforcement but no negative reinforcement. So you end up with a ton of false positives even when actively interacting with the content, and their system doesn't even know how wrong it is.

And should you really not like some content, the solution is unfriending the poster, rather than simply matching against that type of content (political, religious, etc).

The fact there isn't a private dislike button (that no one sees you clicked other than Facebook), is remarkable at this point. It's either woefully obtuse, or intentional so that a feed of false positives better hides moderately targeted ads.

<comment><USER27> That's like YouTube lord help you if you click on a video you don't like by mistake you'll never see the end of it in the recommended section.

It's to the point now where I just log out so I can see what's available rather than a continuous feedback of what I already watched.

<comment><USER28> You can go to the "History" page on youtube and delete the video from your watch history. It seems to stop youtube from using it for recommendations.

</comment></comment></comment><comment><USER29> Honestly, if FB was just me and my mom I'd probably get more value out of the site. Smaller radius is better IMO.

<comment><USER30> Pruning my friends improved my experience, but they grow back over time as people rediscover you or you make new acquaintances. I wonder if you could make a game or website that forced you to prune your facebook friends down, perhaps by looking at your social graph and telling you that you haven't messaged with a person in x years or something, or that you've never even "liked" something they posted. Some heuristics to determine who you really wouldn't miss. The problem with unfriending is that Facebook's UI makes it almost impossible to do in batches, and it feels kind of rude to "unfriend" someone, even though I personally wouldn't care if someone I don't talk to unfriended me.

<comment><USER20> Here's a trick to constantly pruning down your friends list. Don't worry about pruning down your whole list, just check the people who have birthdays every day you log in. I just checked; there was a single friend who had a birthday today, and I haven't had any contact with her in years. That makes for a nice easy prune.

Of course the downsides are that you risk disappointing someone who obsessively checks their friend count on their birthday, and that it only really works if you log in every day.

<comment><USER31> If you don't care enough to talk them in a year, then I doubt you care about "disappointing someone who obsessively checks their friend count on their birthday"

<comment><USER20> Agreed, and it's never stopped me, but a couple times I've told people that and their response was along the lines of "on their birthday? harsh."

<comment><USER31> You can't please everyone.

</comment></comment></comment></comment></comment></comment><comment><USER18> There is a very simple solution for this issue. Create a Facebook Page for yourself as a brand, post links to your articles on that page, then share it from your personal Facebook page.

<comment><USER32> It would be interesting if Facebook allowed personal users to access the brand tools that pages get (impressions, distribution, etc).

This won't happen because facebook wants you to think everyone is seeing your posts. People would be livid if they knew just how low of a % of friends were actually viewing their stuff due to algorithmic meddling.

<comment><USER33> I think that's why there's been more and more images posted as video, to track viewership (FB shows the number of views on videos but not pictures).

<comment><USER32> I agree, people want validation and it steers them to post a higher ratio of videos. A subtle way of altering user behavior.

</comment></comment></comment></comment><comment><USER34> Some proof or data to back up the article's claim would be great. I'm not really buying it.

If moms auto-like every post, then how is that a relevant signal? Everyone has a mom. That would mean every post is getting penalized in the same way (which effectively means no posts are getting penalized).

And if circumventing this was as simple as excluding his mom, wouldn't the effect be even greater if he excluded all non-technical friends and family?

Which pretty much just means you're posting this for the greater public, which presumably a lot of users of Facebook's API already do. Since his intention is for his content to be seen by the greater public, then... go ahead and tell the API that?

It's a great angle for an article, and it's very shareable, but he provides no data (even though he seems like someone who would have all of the data).

<comment><USER35> Have you ever had a post that ended up being liked by an odd subset of your Facebook friends? I certainly have had posts, that for some reason, only my high school friends end up liking.

I know this is only another anecdote and real data would be preferable. But I'm convinced that the described behavior absolutely happens.

</comment></comment><comment><USER36> I'm pretty sure this description is wrong. My impression is facebook shows your content to a subset of friends and then classifies it based on likes received. If your mom 'like's 9/10 posts and your other friends like 3/10 posts, then 60% of your posts /are/ family content. Even if they're about mathematical theories.

<comment><USER37> It seems like what he is claiming is that his mom instantly clicks like on everything and so the post gets gated before his other friends ever have the opportunity to indicate whether they like it.

<comment><USER36> A lot of this seems like it comes down to how that initial pool of users is treated. If they show it to 5 users and his mom is the only one (ever) that likes it, then it makes sense to show that content to people common to him and his mom. If the other users like it, they should distribute it more widely and maybe include users from other non-overlapping networks. That all seems good. If mom likes 90% of the posts, then show that 90% to the family and maybe they care and maybe they don't. If it gets engagement from other people, share it more widely. That seems like a good approach.

The wrong way to do it would be to show it to 5 people and as soon as his mom likes the content, decide the content won't be interesting to the other 4 people they showed it to. I haven't seen any evidence of that happening, and I don't think the article points to any (anecdotal or otherwise).

<comment><USER37> Well, like I said to the other guy, I don't know how you account for the fact that he gets engagement from other people if he hides the posts from his mom then.

</comment></comment></comment></comment><comment> compiler-guy For every social media site XX:

Question: "Why does XX do things this way?"

Answer: "Because it increases engagement."

Why does the Facebook algorithm do this? Because it increases clicks. Why does Youtube use autoplay? Because it increases watch time.

For every single social media site.

<comment><USER38> This article is about how while Facebook's _intention_ is to increase engagement, it backfires in this specific case because the algorithm takes his mother's Like and interprets that as "this post will get the most engagement from family" when actually it was more targeted to outsiders.

<comment><USER39> For all we know the author's experience is a fringe case and Facebook's policy in this instance is successful.

<comment><USER38> For sure. I just thought it sounded like compiler-guy hadn't quite understood what the article was claiming.

<comment> compiler-guy I understood it very well. The issue is that his case is an edge case and facebook likely doesn't care--the algorithm creates more engagement than it destroys.

</comment></comment></comment></comment></comment><comment><USER40> I generally hold facebook in contempt for the forced filtering that they subject me to. Making the 'sort posts chronologically' flag come unstuck is a dirty hack that they should be ashamed of.

</comment><comment><USER41> Any proof of this happening? And does it utilize the user-provided relationship data or just group people?

</comment><comment><USER42> I'm not a machine learning expert, but isn't this an easily solved problem?

Similar to TF/IDF, where you mitigate common words by dividing by their overall frequency, you should be able to divide the weight of any particular "like" by the frequency of likes between the two people. That way a genuine expression of interest by an acquaintance is weighted far higher than a relative or close friend that reflexively likes everything you post.

</comment><comment><USER43> > I'd love to hear from others who've seen a similar effect and love their > mothers (or other close loved ones) enough to not cut them out of their > Facebook lives.

I think the bigger issue is family members, friends and relatives who do cut out their non-fb using closed ones by ignoring all other methods of telecommunication. "Oh, you didn't knew we planned a wedding, too bad you're not on fb!"

</comment><comment><USER44> Even aside from complicated questions like the Newsfeed algorithm, when a friend started hitting Like on nearly every post of mine I appreciated their caring but mentally discounted the meaning of their Like in terms of being a reaction to the content of my post. It's like "Like Inflation". So the algo should probably do the same about indiscriminate likes...

</comment><comment><USER45> Dump facebook, it's sucks for basically everything. Ring your mom, tell her she's awesome and you love her. Wish I could ring mine...

Post a blog post to a real blog under your control. If you want a colleague to see it, email the link and ask for feedback.

There solved. It's a good algo too.

<comment><USER46> Um, the author does post to their blog as well:

>For quite a while now, I've been publishing most of my content to my personal website first and syndicating copies of it to social media silos like Twitter, Instagram, Google+, and Facebook. Within the Indieweb community this process is known as POSSE an acronym for Post on your Own Site, Syndicate Elsewhere.

YMMV on if Facebook sucks for you, your experience is probably the exception. Personally, I find it very valuable despite it's many flaws. It has made making new friends a _lot_ easier (and I absolutely needed local friends after I relocated). I've used it to reconnect with a couple childhood friends which has been absolutely amazing and I'm super grateful for that.

Also, my mother is very toxic and abusive so I'd really rather not call her, however, I can acknowledge that my experience calling my mother is probably the exception. Additional values comes with being "Facebook friends" with my mom, it reduces her need to pick up the phone and harass me.

</comment></comment><comment><USER47> > Facebook, despite the fact that they know she's my mom, doesn't take this > fact into account in their algorithm.

Wouldn't it also be possible to analyze the content of the post to determine if it's family-related? It seems like with a math or technical post, that should be easy for FB to do.

<comment><USER48> What if mom is a mathematician?

<comment><USER49> Why would that imply that the rest of the family would want to c it? The suggestion here isn't hiding it from mom, it's avoiding interpreting a click from mom as "this is something primarily family cares about."

</comment></comment></comment><comment><USER50> No joke. My mom is the first person to LIKE anything that I post -- and then make an inappropriate comment on it.

I have added all of my family to a family group. I'll see if I can post to friends/publically and exclude an entire group of contacts.

</comment><comment><USER51> Offtopic: It always baffles me when people "suggest" better ways to customize their "internet feed" because they don't realize how much information the "system" need to know about you (or those persons close to you) in order to make it useful and when confronted/informed about it, they explicitly denied such permission because it undermines their privacy.

</comment><comment><USER52> Unrelated but worse problem: top of feed livelock. If you're below the fold, cause, I dunno, you got shit to do, you are only going to get viewed by heavy scrollers, which overly favors (IMHO, as somebody with shit to do) folks who get on the thread first. Even a one-dimensional "rank by number of uplikes" filter still doesn't calculate your likes/views ratio, which is what you'd actually care about.

<comment><USER52> This is probably not a facebook problem, as facebook serves you content based on.... god only knows what. But HN? Reddit? Tweeter? Rampant. Real bad for engagement, as anybody looking at a post with more than a few comments knows not to even bother. Gots to get that engagement, you know?

</comment></comment><comment><USER53> I feel it's not limited to family. Empirically I've noticed liking of a post factors in how much someone likes the poster then just the contents of a post.

</comment><comment><USER54> Beyond a 'mom' problem, this seems like a highly plausible cause for the incredibly silo-ed content on Facebook.

</comment><comment><USER55> I haven't found Facebook to be very good at recommending things. They often don't seem to be able to tell what people are interested in, and they don't really let users control who they're posting to. For example, they should make it easier to just post to people who live in the same city...

</comment><comment><USER56> I'm pretty sure they're using a machine learning algorithm, and it's determining the way to handle your post. Can someone who understands the ML algorithms better than I explain how this would interact with the feature weights? I'd be curious as to how we think that would play out.

</comment><comment><USER57> I also have a problem with social media in general, especially with following people instead of institutions/groups. Usually what 99.9% of people like is totally not what I like. So if you base the content I should consume on the assumptions that I like what my connections liked you are nearly going the opposite direction of what I want.

PS: Maybe some of you have the experience of having an active following. I notice that many social networks like Twitter, FB, Youtube, allow comments. But almost never does the content creator/sharer actually react to comments. Some may use comments in future content, but some don't react at all. Are these people not even reading the comments? Why are people commenting when it's so obvious that it's just going down a black hole? For instance, on Twitter a share with additional text is nearly the same amount of work than a comment. And it's obvious that you reach more people by share-commenting rather than simply writing your comment underneath the content. So why do people do that? And why does Twitter has the option to comment even?

</comment><comment><USER58> Had an aha moment reading this post. It makes sense now. This sentence mirrors my own recent experience: "These kinds of things are ones which I would relay to them via phone or in person and not post about publicly."

</comment><comment><USER59> I find this interesting: So much talk about the technical solutions both in the post and in the comments here. Yet, it doesn't seem like he asked his mom not to like his tech posts. If that's the goal - why not start there?

</comment><comment><USER60> It's a more general problem than that. Maybe Facebook should penalise posts written by popular authors, celebrities or recognizable brands to offset the popularity (rich-get-richer) factor and select only for quality.

</comment><comment><USER61> Interesting post. I clicked thinking someone had coined a clever new "NASCAR Dad" moniker about parents who read and parrot their Facebook echo chamber at Thanksgiving, but was pleasantly surprised.

</comment><comment><USER62> I like the idea of "embargo from group for n days".

</comment><comment><USER63> Kind of fascinating.

</comment><comment><USER64> our interests are different based on our daily interactions outside of facebook. How would an algorithm define that?

</comment><comment><USER65> I've said it before and I'll say it again, FB users are a kind of digital peasant or serf.

To me it feels like we're seeing the genesis of the divide between Morlocks and Eloi.

<comment><USER66> "Digital Sharecropping" is Nicholas Carr's term.

[https://www.theatlantic.com/business/archive/2017/07/connect...](https://www.theatlantic.com/business/archive/2017/07/connecticut- tax-inequality-cities/532623/)

[http://www.roughtype.com/?p=634](http://www.roughtype.com/?p=634)

<comment><USER65> Cogent, cheers.

Personally I find the power differential more disturbing than the economic aspect (which is still pretty disturbing.)

FB (and Google and Amazon and ...) have enormous power with only the crudest of checks, an their users cannot fully understand _how_ that power works and affects them.

</comment></comment></comment><comment><USER67> Simple solution: hide post from family :)

<comment><USER68> this. facebook has targeting tools, the OP must not have used them?

<comment><USER69> He describes his solution using said targeting tools in the post and you think he "must not have used them"?

</comment></comment></comment><comment><USER70> Facebook is disgusting.

* Delete your account * Convince your mother to delete her account

<comment><USER71> Would you please not post unsubstantive comments here?

If you have a substantive point to make, make it thoughtfully; otherwise please don't comment until you do.

<comment><USER70> Im sorry dang. its become a bit of a dirty habit to throw shade on FB whenever it comes up. I hate it with a passion.

My goal is to get as many people to question their usage of FB and if it really enhances their lives.

Ill try to be more constructive with my comments.

<comment><USER72> Judged by this thread, I enjoy Facebook posts far more than your comments.

Ergo, in my opinion, Facebook is the signal and your posts are the noise.

I know it's not fair to compare a couple of 'activist' comments to an entire social network, but I felt it was worth pointing out that this style of "content" is more destructive to many audiences than Facebook is.

</comment></comment></comment></comment><comment><USER73> This is not a problem, and I certainly hope Facebook does not fix it. Why? Because it forced the OP to narrow down his audience and show the post only to those who would enjoy it.

That's a much better experience than everyone trying to push everything they publish to you.

<comment><USER74> The problem he is referring to is not that facebook narrows down the audience based off of likes. His problem is that his mom, and consequently other family members, always immediately likes his posts regardless of the content which narrows the audience down to his family members instead of the intended audience. He wants Facebook to take into account that the person liking his post is his mom before narrowing down the audience to family members.

<comment><USER73> But the content is not intended for his mom, so he shouldn't have targeted it to everybody.

<comment><USER75> The post is intended for an audience including his mom (she interacts with his posts by liking them). The author's argument is that Facebook's algorithm is (incorrectly) assuming that her interaction is based on interest in the actual content, rather than her association with the author.

</comment></comment></comment></comment><comment><USER76> >.. shame on Facebook for torturing them for the exposure when I was originally targeting maybe 10 other colleagues to begin with.

Seems like the facebook algorithm is actually working for the users by in effect blocking insipid idiots from posting their crap trying to game the system.

You don't 'target' colleagues.. colleagues are people you work with and respect.. not try to spam.

<comment><AUTHOR> Geez.

Target in this case: stuff that will most probably interest that specific group of people.

How about reading the authors' publications before making assumptions next time?

<comment><USER76> He's clearly on a mission to be 'known'... he spends an awful lot of time and effort worrying about how his posts rank and perform... to me, that's disingenuous.

>Could you fix this algorithm problem please? I'm sure I'm not the only son or daughter to suffer from it.

He's asking facebook to fix his mom? The algorithm isn't broken.

</comment></comment></comment><comment><USER77> You are obviously giving Facebook to much information to act upon. Some suggestions:

1\. Don't use Facebook :)

2\. If you use it don't tag your family members as such. Or your close friends as FB "close friends"

3\. Never tag anyone in photos

4\. Never set "relationship status"

5\. Never add info about where do you live, work, etc.

6\. Having separate public profile for your company/work related stuff is probably a good idea.

7\. Never post anything you wouldn't want to see in CNN news :)

<comment><USER78> See also: [https://stallman.org/facebook- presence.html](https://stallman.org/facebook-presence.html)

</comment></comment><comment><USER79> It's simple really, just stop participating in that evil experiment. From the outside, you look like morons; talking to opposite sides of an algorithm while interpreting what comes out as reality. It's been proven over and over again that consuming that crap makes everyone feel bad and hate each other. There are plenty of alternatives, but this one is mine: [https://github.com/andreas- gone-wild/snackis](https://github.com/andreas-gone-wild/snackis)

<comment><USER49> > It's been proven over and over again that consuming crap like this makes > everyone feel bad and hate each other.

Consuming posts about theoretical math? Because that's them only content that the article talks about. I'd love to see the research that claims this.

<comment><USER79> I was rather thinking about consuming bullshit lies about other peoples fabulous lives, algorithmically arranged for maximum impact. But yes, bragging about the size of your intellect falls in the same basket. Google it if you desperately need authority to back up common sense. Most of the stuff people post on Facebook just wouldn't be posted in a less twisted medium, and we would all be better off. I know I'm growing tired of watching adults, companies and even authorities do anything for a few like-clicks. It's sick and corrupting, and it needs to stop.

<comment><USER49> If you think that posting things that interest you is bragging about your intellect, I think that says a lot more about deep-seated problems you may have than it does about Facebook.

The thing is, I agree with you that many people's Facebook usage probably isn't particularly good for their psyche, but that doesn't mean that it's impossible to use it healthily (at its core, it's just a communications medium) and the assumption that articles about theoretical math is "bragging about the size of your intellect" is honestly just pathetic.</comment></comment></comment></comment>


Dotcom failures – a look at those who tried and failed [PDF – 2002] - <AUTHOR> http://pages.stern.nyu.edu/~iag/presentations/dotcomfailures.pdf

<comment><AUTHOR> Amusingly this includes Amazon.

<comment><USER2> And priceline. Or is this a different one?</comment></comment>


Rapture: all jokes until someone gets hurt - KTLA news - <AUTHOR> http://www.youtube.com/watch?v=3Vj8-_jhFAA&feature=share

<comment><AUTHOR> Suburban mom caught up in believing the Family Radio May 21 prophesies tries to kill kids, self, before 'Tribulation' comes. In spite of his right to free speech, I can't help but feel the guy behind these theories (Harold Camping) is somehow responsible for promoting this. I realize he has done this before but some people continue to buy into his theories. When it comes to mass media (radio, tv, internet) should we have responsibility rules similar to those applying to yelling fire in a theater?</comment>