Apple Responds to Dash Controversy - <AUTHOR> http://www.loopinsight.com/2016/10/10/apple-responds-to-dash-controversy-with-proof <comment><USER2> This is a very weird definition of "proof".

A much more accurate headline might be "Apple responds to Dash controversy by insisting they were right all along and refusing to provide proof."

Edit: The tone of the entire article rubs me the wrong way; it reads like a press release that nobody could be bothered to re-write.

> The integrity of the App Store is as important to Apple as it is to > consumers.

Citation needed? Plus it immediately follows an unsubstantiated claim that Apple has been ignoring evidence of review manipulation for two years, so even if we take the article at face value...that doesn't _sound_ like they think it's important?

> This is part of the reason we trust Apple and the App Store.

That's the most circular argument. "We trust Apple because they claim they're trustworthy!"

<comment><USER3> Unfortunately The Loop isn't much of a news site, more of a controlled Apple leak blog. Dalrymple has gotten to the point of being a complete Apple shill.

Edit: Compare the tone of the Loop article to Daring Fireballs:

[http://daringfireball.net/2016/10/apple_dash_controversy](http://daringfireball.net/2016/10/apple_dash_controversy)

Gruber takes a much more unbiased approach, supported well. The Loop article reads like a statement from the Principal read by your teacher.

<comment><USER4> And here's Kapeli's explanation of what happened:

[https://blog.kapeli.com/dash-and-apple-my-side-of-the- story](https://blog.kapeli.com/dash-and-apple-my-side-of-the-story)

!!! it includes a recording of a phone call with Apple !!!

Edit: After listening to the first 2 minutes of the call, i can say with absolute confidence that Apple is straight-up blackmailing him. I would love to hear opinions on whether this is something that could be taken to court.

Here's the HN submission of the link: [https://news.ycombinator.com/item?id=12680597](https://news.ycombinator.com/item?id=12680597)

<comment><USER5> After listening to the entire thing, I can say that Kapeli sounds like a complete ignoramus.

He has registered an account using _his_ credentials, the account was involved in fraudulent activity, that makes _him_ responsible, as an individual. Why is Apple supposed to even care that he doesn't control the other account anymore? He's _supposed_ to control the account, according to the terms of service _he_ agreed to. If he doesn't control it and he doesn't want to be responsible, he has to close it.

Apple is giving him the _opportunity_ to get back to having a business relationship, but he doesn't _understand_ the problem. Apparently, neither do many of the other users on here. Apple has every right to terminate their business relationship,so how is it blackmail? It's more like a plea bargain...

<comment><USER4> Please read and listen again. He did not register the account, nor use his credentials (if he had, apple's contact attempts would've reached him). He only _paid_ for it, and donated hardware.

<comment><USER5> The bank account used _is_ credentials and Apple considers both accounts to belong to (quote) "the same legal entity" based on that fact. This is the way Apple conducts business.

<comment><USER4> It is indeed the way they do, but you are saying he should've known that, when he had in fact no way of knowing.

<comment><USER5> It is certainly knowable that the identity on the credit card is part of the verification process and that it must match his own. If the name he entered wasn't his own, the verification would likely have been denied: [https://discussions.apple.com/thread/6238222?tstart=0](https://discussions.apple.com/thread/6238222?tstart=0)

That's why I'm suspicious as to which name he actually entered.

<comment><USER4> Suspicion is fine with me. You could ask him via his twitter account. :)

<comment><USER5> I don't use twitter, but here is a tweet that suggests it isn't just about the credit card: [https://twitter.com/JamesNnnn/status/785645305396027392](https://twitter.com/JamesNnnn/status/785645305396027392)

<comment><USER6> That's interesting and kinda important evidence that it's more about credit card and some devices.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> The Dash developer posted his side of the story including a recorded call with Apple: [https://blog.kapeli.com/dash-and-apple-my-side-of-the- story](https://blog.kapeli.com/dash-and-apple-my-side-of-the-story)

<comment><USER8> For the conspiracy minded, HN quickly moved that story off the front page while this Apple press release remains. [https://news.ycombinator.com/item?id=12680597](https://news.ycombinator.com/item?id=12680597)

<comment><USER9> I believe "one front page slot per story" is a matter of general policy.

</comment></comment></comment><comment><USER10> Having dealt with nefarious characters in a pretty active community that was quick to defend their own members (even when they were being very naughty) I'll give my guess as to what's happened, basically assuming good faith in Apple, mainly to counter a lot of the questions here around "what if a competitor bought these..."

In cases where Apple is this certain (or seemingly certain) they usually have a smoking gun. That is, they have some kind of heuristic or action/event that is unquestionably tied to the developer. Perhaps a bunch of the positive reviews came from installs that used a developer freebie code, something only the developer could give out.

Also, smoking guns, when you're dealing with fraud and systems that people can manipulate, are the kind of thing you don't share with others.

I expect that Apple has seen _a lot_ of competitors trying to screw over other apps, and they would have exhausted that possibility before banning a popular app.

<comment><USER11> I think the difficult part is correctly attributing the behavior to the correct party.

My knee jerk reaction to this article, is that if I were nefarious and I wanted to get a competitor off the appstore, than I would game the review system on their behalf. I didn't look at it too closely, but I think part of it they said was also creating negative reviews for competitors.

Like you said, it depends on the smoking gun or the strength of evidence, but without knowing what criteria Apple uses I think it's difficult to say how prudent they might be.

I of course have no indication that another party is involved in this case, I just imagine that it could, along with any number of other scenarios. Without knowing what evidence or criteria apple uses to make this determination, it's impossible to say as an external observer.

<comment><USER10> Yep. I look at it this way: Apple has a team, or teams, dedicated to detecting and stopping fraudulent behavior. People on these teams are very smart and are likely using very sophisticated methods for detecting fraudulent behavior and attributing it, and they are very sensitive to false positives.

It's likely better to take no action than to take action, so when you take action, it is only when there is a very strong positive signal.

Again, I'm making assumptions because this is how the work I did went. There are a lot of things that can be done before dropping an app from the store entirely, and Apple is incentivized to keep the apps in the store – they get paid when people buy them, so removing them is a last straw.

<comment><USER12> I know of one very large company that paid for downloads and 5 star reviews for years; I doubt Apple would ever do more than ask pretty please. Given how far their rating has fallen recently they might have been asked to stop. But that's a long way from punishment.

</comment></comment></comment></comment><comment><USER13> From 3:52 on the recording with the Apple rep -

"Because we see them as the same entity. If we have accounts that are enrolled in our programme using the same credit card, they are the SAME legal entity. They ARE the same..."

Yikes, because I often put contractor developer subscriptions and other incidental expenses on my company credit card to facilitate turnaround. Now it looks like I can get black banned if one of my contractors on the other side of the world goes rogue?!?

<comment><USER14> Yes. I'm not sure what the alternative would be. They let spammy app creators keep opening accounts indefinitely with no attempt to block them from repeat behavior?

I would refrain from using your credit card for others' accounts without serious consideration. I definitely wouldn't do this frivolously or for people you don't have a real trust relationship with.

</comment></comment><comment><USER15> So if you want to get your competitor banned from the App store, just post lots of spammy positive reviews for their product? How would you defend your app against such an attack?

<comment><USER16> While I don't know how their rating system or detection works, I imagine it would be harder than just posting spammy positive reviews. They would have to have solid evidence that you're doing it to your own app, or paying someone to do it on your behalf.

<comment><USER17> Genuinely curious: what are some heuristics that could be used to distinguish between fraudulent reviews paid for by the developer and those paid for by a malicious third party?

Maybe I'm missing something, but it seems practically impossible to distinguish between the two unless there was a royal screw up somewhere along the line.

<comment><USER18> Using freebie promo codes given by the developer

</comment></comment></comment></comment><comment><USER19> Well that's definitely strange. Why would the developer do such a thing when Dash is basically the best app of its kind out there?

Edit: To other commenters, why would Apple accuse the dev of faking reviews if it wasn't true? I don't see Apple getting anything out of it.

<comment><USER2> As one of the other commenters, I wasn't suggesting that Apple is purposefully accusing innocent developers as part of a nefarious plot; I was suggesting that they might be mistaken, and obliquely hinting that it would be nice if they'd respond to the controversy _with actual proof_ , as the article title (apparently falsely?) claimed they had.

> I don't see Apple getting anything out of it.

Refusing to admit innocent error is a very understandable course of action. If, of course, that's what they're doing. From where I stand the entire situation is completely muddy, and I don't think the linked article clarifies anything.

<comment><USER20> _I was suggesting that they might be mistaken, and obliquely hinting that it would be nice if they 'd respond to the controversy with actual proof_

They'll never provide proof for the same reason that Google won't publicize the exact parameters behind search; it would provide bad actors with information on how to game their system.

</comment></comment></comment><comment><USER21> The guy has already admitted that the fraudulent account is from his "relative" who uses the same credit card and same test devices. It seems like Apple gave him a lot of leeway due him actually making a good app and being public.

While I'd like to give him the benefit of the doubt, the overwhelming most likely case is he was doing exactly what Apple thought he was doing. At the very least, he should take some responsibility for the fact he's paying for someones account who is actively trying to harm his competitors.

Apple probably could've avoided a lot of this mess by not overtly banning his account, but doing the except opposite of what his manipulations intended and make the app almost impossible to find.

</comment><comment><USER22> This whole story just comes off as a bunch of bruised egos too proud to get out of their own way.

They both agree in principle that DASH should be reinstated, and clearly it being reinstated is in both sides best interests.

Why Does Apple NEED an acknowledgment that they didn't do anything wrong? What difference would it make?

Why can't Kapeli just acknowledge that he was associated with a bad actor in Apple's system.

I get the idea of integrity, but I get the idea of self-preservation a little more...Especially when reality is subjective and your perspective might not be the only sincerely held belief.

I will never understand the people too principled to just SAY SORRY even if you believe you are in the right. Are you so principled that you can't even acknowledge the existence of a potential conflicting view point, at least enough to admit you might be wrong, when its clearly in your best interest to just own up, and move on...even if you aren't sincere in your apology!

Edit: I can maybe understand a prisoner refusing to admit to a crime they didn't commit to a parole board despite contrition being a key to getting released...but at some point of serving a life sentence, you have to kick into self preservation mode and just admit to wrongdoing, and spend your free years atoning for your lie.

<comment><USER21> > Why Does Apple NEED an acknowledgment that they didn't do anything wrong? > What difference would it make?

I get what you're saying, but if Apples gets hammered with bad publicity every time their anti-fraud team does the right thing, they're going to stop doing the right thing.

Especially as this case is going to be cited for years to come, it's important apple has something to point to and say: "We didn't just arbitrarily ban the account, it was involved in manipulating our reviews"

<comment><USER22> >"We didn't just arbitrarily ban the account, it was involved in manipulating our reviews"

>anti-fraud team does the right thing

That's not what happened though. What happened is that Apple has their internal tools to link fraudulent accounts, to keep out bad actors, and this "good" account got caught in that web. You can just as easily argue that he didn't actually do anything wrong. After all, if he did Apple wouldn't even consider reinstating him. The fact that Apple linked the accounts internally doesn't actually point to any guilt or wrongdoing...It could even be pointed to Apple's policies arbitrarily hurting the little guy.

I can see both sides very clearly and I can see a middle ground very clearly. The only thing stopping this from being resolved is "bruised egos" on both sides.

Edit: Added in second quote

<comment><USER23> But what if the developer did do something wrong and the account is not so "good" as the developer is trying to make it out to be. There's too much that stinks about it:

1\. Opened up a developer account for a relative 4 years ago. Relative. Yeah, ok. And 4 years ago... don't credit cards usually expire before then?

2\. The same devices were being used on both accounts. While the info isn't available, I'm sure Apple can know if these same devices were still in active use by both accounts.

3\. Dash isn't the problem. Too many people seem fixated on the notion of why the developer needed to do review manipulation on Dash when that's not at all the problem. It's the other apps on the other account that were the subject of App Store review manipulation. These apps contained descriptions that contained the developer's own email address in it: [http://appshopper.com/search/?searchdev=603546869&sort=name&...](http://appshopper.com/search/?searchdev=603546869&sort=name&dir=asc)

<comment><USER22> I do agree that he could totally be lying...but that doesn't seem to be Apples belief or they wouldn't reinstate him.

Also, if he really was guilty, why would he poke the bear after apple agreed to reinstate him...why not apologize and get off scott free.

It appears to me like both sides agreed to a set of facts and now its just a matter of setting the record straight. No one seems to want to admit fault and they are being childish about that since its in both of their interests to do so.

</comment></comment></comment></comment></comment><comment><USER24> In telling the other side of the story, the Dash developer published his (apparently secret) recording of a 7-minute long telephone call he had with a person at Apple who purports to be speaking on behalf of Phil Schiller.[1]

Leaving aside whatever inferences might be drawn from the fact that the developer saw fit to record and publish the recording in the first place, here's a brief summary of what was said:

\- There was at least one other developer account "linked" to the Dash developer account. In this context, "linked" means that the accounts "shared the same details": they were enrolled in the Apple Developer Program "with the same credit card number", and "used the same test devices".

\- Apple says that at least one of those other developer accounts "definitely had fraudulent activity": "It was not your direct account but it was a linked account." Warnings about fraudulent activity were sent to the linked account. No warnings were sent to the Dash account.

\- The Dash developer asked: "Why didn't you notify me beforehand though, and let me know that an account that's linked to mine is doing fraudulent activity, so I can do something about it?" The answer is "because they were linked"; "we see them as the same entity". "If we have accounts that have enrolled in our program using the same credit card, they are the same legal entity; they are the same." So Apple believed they had notified the Dash developer because Apple believed the same person was behind the linked accounts. (Prudence would dictate notifying all accounts at risk of termination; we'll see what happens in future.)

\- Apple's position is that no mistakes were made. The Dash developer account was linked to an account with fraudulent activity based on the facts known to Apple.

\- The Dash developer says (in his blog post) that he "helped a relative get started by paying for her Apple's Developer Program Membership using my credit card" and "handed her test hardware that I no longer needed".

\- Apple says they are "working with" the Dash developer to "unlink the accounts", which (I speculate) may involve some attempt to verify the Dash developer's claim that the linked account was used only by a relative and not by him. If the accounts are unlinked, there would be no reason for the Dash account to remain closed.

[1] [https://blog.kapeli.com/dash-and-apple-my-side-of-the- story](https://blog.kapeli.com/dash-and-apple-my-side-of-the-story)

<comment><USER6> In one part of the conversation, they mentioned that the accounts used the same bank account(Not only credit card). I assume it means the bank account that the developers is get paid with. That's even more convincing that accounts were linked. Note that you can use "arbitrary" bank accounts to get paid with(Source: I'm an apple developer.)

Also The apple guy said it uses same test devices. As usual the devil is in details, it's important if they still uses the same devices and in what extent.

<comment><USER25> If both developer accounts were using the same bank account to receive Apple's payments, and that bank account was owned by the Dash developer, then I think it's entirely reasonable on Apple's part to conclude that the same developer was effectively in control of both accounts. And it would also imply that the Dash developer was effectively profiting from the fradulent activity occurring in the other account.

</comment></comment></comment><comment><USER26> So if I want to remove a competing app from the app store, all I have to do is buy them a bunch of fake reviews and Apple will ban them?

<comment><USER27> No. There is no evidence for this.

You're assuming that Apple has no process to distinguish between intentional fraudulent reviews coming from the developer in question, and random fraudulent reviews from others. But that assumption is not supported by any facts.

<comment><USER28> There is no evidence it isn't this either. Detecting fake reviews is easy, detecting the source (probably a click farm) is probably pretty easy too but getting to the bottom of who hired the click farm would be extremely difficult. You'd probably need assistance from law enforcement or a court, probably in a developing country, to get that information from the click farm operators.

I would think its pretty easy to hire a click farm to blatantly post fake reviews to the app store. The worse the click farm is at covering their tracks the better if you're trying to get a competitor banned by Apple.

Dash was a popular app among developers who use Apple products I doubt the fake reviews would be needed. I wouldn't be surprised at all if this was caused by a third party.

</comment></comment></comment><comment><USER29> Sigh. Apple comes off very poorly when you listen to that audio recording. The rep on the phone seems clueless that he is possibly causing more damage with this posture than would've happened had they just explained their side of the story and re-enabled the account.

Apple should have just told us that the account was linked to a fraudulent account so they were correct to pull the plug quickly to prevent add'l harm, and that on further review it was clear that the relationship between the accounts was not as close as the facts initially suggested. That would seem entirely reasonable to me.

That said, by not notifying both accounts it seems that problems like this are totally foreseeable. It also suggests that if a malicious actor was able to get a developer's credit card he would have a fair shot at getting an app delisted.

</comment><comment><USER30> Didn't the dash author say that it was inexplicably removed with no warning. Now this press release says otherwise...

For people saying this was already in top of app store, well, there was rating manipulation. That's why it was on the top (?)

<comment><USER31> According to his blog post [1], it sounds like the other account that was engaged in fraudulent activity was notified, but "his" account was not.

[1]: [https://blog.kapeli.com/dash-and-apple-my-side-of-the- story](https://blog.kapeli.com/dash-and-apple-my-side-of-the-story)

<comment><USER30> Can someone explain how 1 account can act "nefariously" ?

</comment></comment></comment><comment><USER32> The root problem in this controversy, in my opinion, is that iOS offers no other way to install third party applications outside the appstore for the general public. If a blackmailing attacker hits your app with fraudulent reviews on purpose you have nowhere to go with your app. If you could at least host the .ipa for installation on your own web page, such tactics wouldn't necessarily turn into a death sentence, just a loss of access to an effective sales channel (the app store)

<comment><USER33> Platforms that dont support side loading need to be held to a higher standard than those that dont.

</comment></comment><comment><USER34> I'm willing to give Apple the benefit of the doubt here, because they are unlikely to release information as specific as this to the press unless it's been checked and vetted, even if they don't release the proof to the public. And without the proof, it's really their word against the developer's. Does Apple have a bad reputation when it comes to this kind of thing? If not, why are people so strongly on the developer's side?

</comment><comment><USER35> So, now we have a "He Said; She Said" situation. Who do we trust? Apple? They've made mistakes before, and need to protect their integrity. The Dash developer? It's in his best interests to paint himself in the best light.

What's worse, by coming out, the Dash developer has forced Apple into a defensive position, ensuring that Dash will never appear on iOS again. Dash has now lost revenue and exposure opportunities, and Apple's consumers are reminded once again that they don't have the right to control their devices.

Both sides want to come out of this looking good, and right now neither side does.

<comment><USER35> And hence comes the recordings.

Dash developer caught up in an errant fraud check? Eh, it happens. At least this is Apple; were it Google, the developer would be right proper fucked (then again, his post made it to HN, so he might have gotten some special attention).

However, making that resolution conditional on the developer making Apple look good in a blog post? That feels pretty scummy here again to me.

The error seems innocent enough to me (though the party line of "we can't tell you why you were shut down" is the worst way to interact with your developers), but the conditional resolution is not making Apple look good.

</comment></comment><comment><USER36> I get the feeling the bigger problem for Apple is the number of developers who really don't believe them.

</comment><comment><USER37> There's proof, but we're not going to link it because ... reasons. Why would they not include any proof that might exist?

<comment><USER38> Because they're in an arms race with review spammers, and telling the spammers how they were detected causes them to evolve new, undetected behaviors.

It might not be fair, but it's logical.

<comment><USER39> While Apple understandably may be very reluctant to disclose review validation / fraud detection methods, they could certainly show some trusted media figure -- Marco, some other popular ios developer, maybe even Gruber -- some detailed bit of proof and put this controversy to rest. If, indeed, they have any proof.

<comment><USER40> That would be pointless because these people would be accused of being shills who would always sing praises of Apple. There's no easy way to handle giving away the proof and having an expectation that it would indeed help Apple. Depending on the material, there could be nuances that could be interpreted out of context…the context being the entire chain of events and internal and external communications that took place.

</comment></comment></comment></comment><comment><USER41> Here's the developer's side of the story (includes a recording of a phone call between him and Apple)

[https://blog.kapeli.com/dash-and-apple-my-side-of-the- story](https://blog.kapeli.com/dash-and-apple-my-side-of-the-story)

</comment><comment><USER42> What I dont understand is that if Apple are so vigilant in removing false reviews, and if they're so sensitive to fraudulent reviews (as I wish they would be), why is it that seemingly everywhere I look it is full of them.

Take this app for example: [https://itunes.apple.com/us/app/disk-drill-media- recovery/id...](https://itunes.apple.com/us/app/disk-drill-media- recovery/id431224317?mt=12)

(click on "All versions"). You'll see there's HUNDREDS of fake reviews, all giving it 5 stars, and in all cases it is the only review that account has ever made.

</comment><comment><USER43> What if the fake reviews were paid for by a competitor, so they would get banned?

<comment><USER27> What if Apple just happened to be smart enough to think of the most obvious, very first question that would need to be asked in this situation?

<comment><USER44> That would be wonderful. Do you have any evidence that this is the case?

I mean, we are talking about the same company that just a few years back subjected all iPhone developers to such a strict NDA that they were technically not allowed to discuss a WWDC panel they were watching with the person sitting next to them.

</comment></comment></comment><comment><USER45> So there's an incentive to write fraudulent, positive reviews for your competitors apps. Noted.

<comment><USER46> No, you have to have an account that your competitor opened with their own credit card and gave to you, and then you publish an app for that account and buy fraudulent reviews for it.

The account that the fraud happened on, and all the other accounts that appear 'linked' will be closed.

The issue was with the account he gave to his relative, which Apple probably assumed was his account because it used the same credit card and test devices registered to both accounts.

<comment><USER47> "No, you have to have an account that your competitor opened with their own credit card and gave to you, and then you publish an app for that account and buy fraudulent reviews for it."

implying that this is the only way Apple would consider fraudulent positive reviews to be developer's fault? Unlikely.

</comment></comment></comment><comment><USER48> California is two-party consent, so I hope that phone call starts with the consent of Apple's employee to be recorded.

If it's not, it'd be quite a blow to the dev's credibility. (and a felony).

<comment><USER31> He's based in Romania, where (as best I can tell) one-party consent is legal [1].

[1]: [https://en.wikipedia.org/wiki/Telephone_recording_laws#Roman...](https://en.wikipedia.org/wiki/Telephone_recording_laws#Romania)

<comment><USER48> California doesn't care: [https://en.wikipedia.org/wiki/Telephone_recording_laws#One-p...](https://en.wikipedia.org/wiki/Telephone_recording_laws#One- party_consent_states)) "he California Supreme Court ruled in 2006 that if a caller in a one-party state records a conversation with someone in California, that one-party state caller is subject to the stricter of the laws and must have consent from all callers (cf. Kearney v. Salomon Smith Barney Inc., 39 Cal. 4th 95[38]). "

But it does make it less relevant at least practically.

On another note, I tried to find out where he lives, but it's nowhere to be found on the website. I really prefer business websites that give me at least a full name and a city. I don't even know why – I'm not planning to write/stop by/sue – it just feels shady.

(whois data is similarly anonymous – I'm starting to see Apple's point of view)

<comment><USER49> _> California doesn't care_

Romania doesn't care either, considering how it is not subject to US law.

</comment></comment></comment></comment><comment><USER50> So, in order to punish the developer of an app Apple takes an action that significantly hurts the users of that app.

<comment><USER51> I know this doesn't treat the totality of what you're saying but in the past (and I assume it to be the case here) if you paid for the app on the app store it'll be available for download even if it's delisted. This was the case with the game Edge when they got targeted by a trademark troll for their name.

<comment><USER31> I believe the app stays available in the Purchases section like you said if the developer "unpublishes" the app, but not if the account or app is "terminated" by Apple.

In addition to Dash (which I'm not able to locate in my Purchases tab), I've noticed this to be the case with apps that violate Apple's rules, like those hidden proxies or emulators that have sprung up over the years and were later removed by Apple.

</comment></comment></comment><comment><USER52> Why won't they admit their system was flawed? They may be right in considering accounts funded with the same payment source as linked accounts, but they never notified both accounts about the impending closure.

</comment><comment><USER36> This is the part I'm unclear on:

 _What Apple has done: on Friday they told me they'd reactivate my account if I'd make a blog post admitting some wrongdoing. I told them I can't do that, because I did nothing wrong. On Saturday they told me that they are fine with me writing the truth about what happened, and that if I did that, my account would be restored. Saturday night I sent a blog post draft to Apple and have since waited for their approval.

Tonight Apple decided to accuse me of manipulating the App Store in public via a spokesperson._

That makes me wonder about what the heck happened?

</comment><comment><USER51> Can anyone who bought Dash confirm or deny that you can still access it from the "purchased" tab in the app store? This used to be the behavior for paid apps that were delisted† and I assume it still is.

† I remember it happening for the game Edge when it was taken down due to trademark trolling. It was later reinstated.

<comment><USER48> No, it's gone.

</comment></comment><comment><USER53> Where does Apple respond? Or is this blog maintained by Apple?

</comment><comment><USER54> > Almost 1,000 fraudulent reviews were detected across two accounts and 25 > apps for this developer so we removed their apps and accounts from the App > Store

Sounds damning. Was this a paid app? How many downloads did it have?

</comment><comment><USER22> The amount of power Companies like Apple, Google, Facebook and others have to completely destroy and make businesses, makes me wonder if there should be some internet arbitration court to at least let people present their case to a third party. I get the companies would never want to give up this power and I get that every country has their own court system and laws...

This is more a middle ground, for people caught in the cross hairs to present their case. Maybe like WIPO arbitration for trademark domains.

</comment><comment><USER33> this is a new attack vector that will definitely start getting used against competitors.

</comment><comment> a-b Rotten fruit. I don't give a shit about reviews, I'm using this app on daily basis and I've paid for this app so I want future updates!

</comment><comment><USER55> Meta: at times like this Apple is hurt by its policy of doing zero Developer Relations.

If there was somebody - anybody - in Apple who spoke with a voice developers trusted, right now they could be explaining what in hell's going on. Having Apple Marketing leak something to somebody who leaks it to Gruber, who then reports it as hearsay, is a damned shoddy substitute.

</comment><comment><USER56> I'm not familiar with this site, so this might be ignorant, but it seems strange. Bad copy on a wordpress site. At first is looks pretty official, but none of the "according to Apple" or "Apparently" quotes are cited or linked. Did Apple release a statement or press release about this? At the end it just says "it seems to me...". Who is this guy? Do we have a better source for this news?

<comment><USER57> This is Jim Dalrymple's site (I might have the spelling wrong). He is well- known among Apple bloggers to be well connected to Apple people. I've seen sites like MacRumors use a "Yep." confirmation from Dalrymple as evidence of a rumor, so I guess folks have some reason to believe he's connected.

</comment></comment><comment><USER58> so was he migrating his account from type to another in an attempt to disrupt the investigation? Perhaps as a means to break connections between accounts , apps, and such?

</comment><comment><USER59> This may sound stupid, and I am not by any means saying this is what happened here, but would it be possible for someone to maliciously buy fake reviews for a competitor app? What would happen in this scenario?</comment>


Ask HN: The right way to store settings in a webapp - <AUTHOR>

A couple of collegues and I have been wondering for a while now what the right way is to store settings in a webapplication (like a wamp or lamp stack).
The MySQL database isn't supposed to do this, tables are to store a variable number of rows with a fixed number of columns. Storing settings you would either set the variablename in the columnname and the value in a row, or create 2 columns (variable and value) and store variables in rows. Either way, the number of rows is constant. Not immediately a bad thing, but not ideal either.
There is also the lack of hierarchy this way, currently we have a filesystem-like path in use. The variable in the database will be something like "/modules/twitter/username". This is a custom system though, and it works but doesn't really feel right either. Unlike a table, files can be placed in the directory along with the right module (part of the application, they can be added or removed as needed).
Lastly a problem with a database is that you can use one table for all settings, or a new settings table for different modules. Using a single table, you would have to clean it up every time you add or delete a module. Using multiple tables, you get a long list of tables in the database, often to store only a few variables per application.
Settings files (ini, json, or another format) feel a lot more like how it should be done, but to open and parse a settings file every pageload seems not too great for performance either. Or even if it performed well enough, settings are something that can be loaded into the RAM and only written to the disk when changed. MySQL can keep file handles opened, doesn't use an interpreted language to read or write the data, and even caches stuff so there is often no disk interaction at all on reading.
So... what else could or should we use? NoSQL perhaps (I'm rather unfamiliar with that)? Or is there simply no optimal solution and should we continue to (ab)use the database for this? <comment><USER2> Most web-app frameworks use an INI file or JSON, etc. In Django, the settings is just a python file with a series of arrays and constants, meaning you can change them programmatically (e.g. in response to the server environment, whether you're on production / dev, etc).

Remember, an extra call to a database each request isn't very performance- friendly. Your best bet would be to use a JSON/INI/etc (or go down Django's route) and then cache it in memcached or APC or similar.

<comment><AUTHOR> Okay, so basically another service to get the best of both the file option (hierarchy; no clutter) and the database option (cache). Seems the best solution indeed, as far as I can see.

Thanks :)</comment></comment>


Ask HN: How to deal with an uncooperative registrar? - <AUTHOR>

How does one deal with an uncooperative losing registrar? In this case, Network Solutions, which refuses to give up a domain name?
I have the AuthInfo code. I can receive email at all of the WHOIS contacts. The gaining registrar has sent me the authorization requests and I have accepted them, but Network Solutions persists in insisting, alternately depending on what CS rep I talk to:
1) "We never got the request from the gaining registrar."
2) "We don't allow transfers within 120 days of domain expiry."
3) "We don't have a procedure in place for transferring domains." [Yes, really, they told me this.]
What do I do? <comment><USER2> Try @netsolcares on Twitter. Maybe there's a real human there.</comment>


The Hajj Stampede Is a Fluid Dynamics Problem - <AUTHOR> http://www.wired.com/2015/09/hajj-stampede-fluid-dynamics-problem/ <comment><USER2> The fluid dynamics models are useful for crowd simulations in graphics

[https://m.youtube.com/watch?v=pqBSNAOsMDc](https://m.youtube.com/watch?v=pqBSNAOsMDc)</comment>


Efficient C Code for ARM Devices - <AUTHOR> http://www.eetimes.com/design/embedded/4210470/Efficient-C-Code-for-ARM-Devices

<comment><USER2> Never mind C, it's nice to see the Go ARM compiler coming along nicely ([http://code.google.com/p/go/source/detail?r=3e8c5af7bb1a810f...](http://code.google.com/p/go/source/detail?r=3e8c5af7bb1a810f148f938110778ae3a0204442)). Pretty cool to see that Ken Thompson is still checking in code.

</comment><comment><USER3> Interesting that they completely ignore dynamic branching, but I guess the target audience are mostly classical "embedded" developers rather than mobile app devs. If you're writing iOS apps in Objective-C, you're paying a penalty for every method call, as it goes through the objc_msgSend() dispatch mechanism every time. I'm extremely surprised Apple haven't added more "clever" optimisations to the compiler, such as a JVM-like call site cache for de-facto monomorphic calls. (hacking clang/llvm to do that is an item on my endless list of things to do on a rainy day) This would essentially allow branch prediction and instruction prefetching on messages for a vast majority of cases. C++ virtual calls are typically cheaper than Objective-C messages but can also benefit from this sort of treatment (just not as much).

</comment><comment><USER4> I presented a course on this subject to engineers at my former employer. It's a set of tips about how to improve C code for ARM targets: [http://www.davespace.co.uk/arm/efficient-c-for- arm/index.htm...](http://www.davespace.co.uk/arm/efficient-c-for- arm/index.html)</comment>


Why Data Storage Is the Next Frontier in AI Expansion - <AUTHOR> https://edgylabs.com/2017/05/05/data-storage-ai-nvidia/ <comment><USER2> Doesn't the claim that "algorithms need to look at better (high quality, informative) examples" suggest they will need to use less storage, not more?</comment>


Ask HN: Is anybody working on tech to improve objectivity in news reporting? - <AUTHOR> While I'm also curious about people working on incremental improvements (fact checking systems, integrations with existing media distribution platforms etc.), I'm especially curious whether anyone is working on something like a totally separate alternative to traditional news sources (or news discovery systems).
This feels like exactly the kind of thing we should really be applying lots of smart people to, building prototypes, seeing what works and what doesn't, iterating—essentially, intensely searching for some platform/mechanism/approach that could become a widespread source of necessarily objective information (of course that's always a matter of degree, but within more favorable bounds, let's say). Is this something YC cares about?
I think this is the most important thing I could potentially apply my engineering skills to. If you're doing something related, maybe I can help (see my profile for more info). <comment><USER2> I have often thought it would be brilliant to have more of an objective source and to have this in the sparsest text format with images optional, all downloadable to your phone each morning in a small archive for browsing during the day. No ads, no ridiculous bandwidth consuming formatting, just the simplest usable hypertext format possible. I also think the media seems to have lost the plot over the last couple of years over Brexit and the US election for example, and there seems to be relentless and unquestioned promotion of certain ideologies over others. Whichever side you are on, I'd hope you would agree that it cannot be healthy to have the media controlled by a group that is overwhelmingly pro one side or the other.

I think there is a desperate need for a news source that communicates the facts, comprehensively in breadth and detail, and in an unbiased way, but I think the chances of us getting this are slim to none. How is a new entrant to discover what is being suppressed by the MSM? If discovered, how will it be gathered if no other organisation is prepared to cover it? How can seeded stories be identified?

I think there are serious problems with the idea. In consolation, I like to think that the general population are far savvier and less susceptible to manipulation than those that would try to manipulate us think. Going back to Brexit and Trump for example, the overwhelming majority of the media seemed to be anti-Brexit and anti-Trump - certainly in the UK the media spoke virtually with one voice warning us about the armageddon that would inescapeably follow a Brexit vote, and yet look what happened. I think the media have burned through people's trust with their bullshit.

<comment><AUTHOR> > How is a new entrant to discover what is being suppressed by the MSM?

The MSM isn't the only way of acquiring information about current events, so it isn't necessary to discover what they withhold. Not that that wouldn't also be valuable—I'm just trying to get at the potential range of approaches here. I'm only advocating that resources get put into a serious search for solutions. I think it's highly unlikely any of us would just be able to produce the solution in a few minutes of thinking about it.

<comment><USER2> Actually, a tool that compares texts from different sources on the same topic and ranks them on different criteria could be interesting, i.e. assertion, logical fallacy, emotive language, inclusion/exclusion of key details; very off the top of my head.

Additionally - over time you could build up a nice corpus for one source versus another source.

I guess you do see studies examining bias every now and then, but the whole thing could be automated and ongoing.

<comment><AUTHOR> Yep, that's more like it. So what I'm imagining is a group of smart people just experimenting with and prototyping ideas like that until something very promising is arrived at.

</comment></comment></comment></comment><comment> wu-ikkyu I've yet to see anything successful or promising.

Unfortunately, this seems to be far more of a human social problem than a technical problem.

<comment><AUTHOR> Consider how Facebook for instance has influenced the social problem. It's possible for tech to influence it in different directions—but much imagination will be required.

<comment><USER3> I agree. That's a good example, as is twitter in terms of speed of propagation.

The problem with objective news, I imagine is the objective part since sources, even if designed to be validation capable (which might reduce fake news) would be hard to validate for objectivity.

<comment><AUTHOR> There is so much room for different approaches here, I don't think anyone has a solution at the moment. What I'm proposing is just a directed _search_ for a solution. I don't think we know enough to rule one out either.

For instance, maybe it involves employing a large number of people (maybe Amazon Turk style), piecing together commentary on shared subjects from varied sources (e.g. different newspapers)

—not that I think _that_ is a particularly good solution, I just mean to point out the potential range of solution-types possible here.

<comment><USER4> The problem though is the central control of info, WHO says something is a valid and trusting source, WHO determines what people should be lead to, there are several different sides to the same story, some are "right" and others are "right" as well. WHO is right. It would also need to be a decentralized system, otherwise it can be manipulated just like everything else, but then how do you properly agree on things to be trusting.

</comment></comment></comment></comment></comment><comment><USER4> Tech will not be able to stop people from saying what they want, even when they insist on lying to spread false narratives.

<comment><AUTHOR> The solution should not stop people from saying what they want. It has to co- exist with that, and yet (maybe—just an idea) be better at funneling people to more objective sources of info, for example.

<comment><USER4> So you would like to control the information people receive and push them into different directions based on whether the "facts" are correct or not according to some set of rules? I think we need less reliance on tech and more common sense and independence of our own free thought. We should do our own research and investigative work before we believe the clickbait headline of the article we did not read.

<comment><AUTHOR> While I agree, we have to also acknowledge the fact that people with entirely selfish intentions are already using tech for purposes opposite of what I suggest. So a big part of my motivation is just to combat tech being used to amplify capitalist motivations in news distribution.

<comment><USER4> Then you have to figure out how to take down the social bots, and the people paid to spread disinfo, and all the people who are wrapped up in the disinfo :/

<comment><AUTHOR> Getting rid of the disinfo isn't the only approach; you can also increase people's probability of ending up at non-disinfo in various ways. See my other comments here: not saying I have a solution, I'm proposing a search for one.</comment></comment></comment></comment></comment></comment>


Computer Programmers the 7th most sleep deprived profession - <AUTHOR> http://finance.yahoo.com/news/americas-10-most-sleep-deprived-222203794.html

<comment><USER2> Wow! I can get 11 more minutes of sleep a day, simply by calling myself an Engineer instead of a Computer Programmer.

<comment><AUTHOR> And you'll save 3 more by having less letters to type in your title.</comment></comment>


Can I Set Up An LLC To Avoid Personal Liability In A Lawsuit? - <AUTHOR> http://www.litigationandtrial.com/2009/05/articles/the-law/for-people/can-i-set-up-an-llc-to-avoid-personal-liability-in-a-lawsuit/ <comment><USER2> I'm the author; thanks for reading and let me address it "go[ing] a bit far."

In the context of Hacker News readers (presumably startups looking for funding and with employees) there are many good reasons for setting up an LLC, including limiting liability if one of those employees gets sued, and limited contractual liability. However, the point I was getting at is that the LLC doesn't totally shield you from liability, a misconception that has brought a lot of trouble to people who played fast and loose with their conduct and ended up staring down the barrel of potential personal liability.

The core point is: don't try to "dodge" liability. Instead, take steps to reduce the likelihood of causing harm and get a good insurance policy.

<comment><USER3> That article was very useful. I wish we had more attorneys writing such entries for the rest of us. There are a striking number of legal misperceptions out there among businesspeople.

<comment><USER4> Do you have any specific topics in mind?

<comment><USER5> How about asset protection strategies?

<comment><USER4> Are you looking to protect business versus personal assets, or protecting assets via risk management, or other?

<comment><USER5> Mostly looking to protect personal assets.

</comment></comment></comment></comment></comment></comment><comment><USER6> Hopefully, liability never becomes an issue in your startup, but hope is not an acceptable plan :-)

So it's good to debunk the myth of the fake LLC. I just think the article goes a bit far (but the author is a lawyer and I'm not).

Either way, it matches my experience: in the US, you can get sued pretty much no matter what steps you have taken _not_ to get sued...

<comment><USER7> Well, from what I understand, anyone can sue anyone for any reason. It's whether or not they will win, and more importantly _what_ they will win that people go to great lengths to protect against.

<comment><USER8> If their goal is to bankrupt you, then doesn't starting a lawsuit fulfill that goal, regardless of whether they win?

<comment><USER9> There are "anti-SLAPP" laws to deal with people filing frivolous lawsuits whose sole purpose is to bankrupt or silence you (or your business)

</comment></comment></comment></comment><comment><USER10> Any thoughts on getting sued regarding IP Infringement as a LLC, how does the liability trickle down to the people behind the LLC.

For example company X sues a LLC stating that they have violated a patent for example?

<comment><USER2> If by "people behind the LLC," you mean the investors, then, yes, their liability is _typically_ limited.

I write "typically" because investors can be liable if either (1) they participated in the infringement or (2) a court decides to "pierce the corporate veil," which is rare, but can happen if an investor abuses an LLC (undercapitalizing it, disregarding corporate forms, etc) for the purpose of avoiding liability.

</comment></comment><comment><USER11> My umbrella insurance policy includes coverage for defamation-related suits, and it seems to be standard for the insurance company's customers (i.e., I did not have to request it). It's not like I am going out of my way to provoke such suits, but it's nice to have.

</comment><comment><USER12> Setting up and keeping up an LLC is a bit of a pain in the neck. Also working out how to pay yourself, keeping accounts separate, and so on takes extra time.

One benefit of an LLC might be a somewhat more professional image (for some customers anyway). Also, my guess is that corporate customers may not want to do business with you unless you're an LLC (though I wouldn't know for sure as I have no corporate customers).

Anyone here go from having your own LLC to dissolving it and going sole proprietership?

<comment><USER13> "A pain in the neck"

You've got to be kidding.

1\. Trivial law work is required. 2\. Annual total business license fees range from ($20-$1,000) depending on location 3\. Trivial bank account setup

All of this can be accomplished literally in the span of a few hours. I would argue the biggest maintenance costs are related to tax filings and accounting, but they're more than offset by all the available expense write-offs.

It's really a no-brainer decision with today's streamlined systems and litigious society. Additionally, having an LLC operating agreement (even a generic one) in place, usually makes converting to a C-corp (to be available for VC financing) much easier.

<comment><USER14> Not so in New York. You have your UBT (over $3,000 per year), your publication requirements (over $1,500 per registration), and more. Considering that generally your clients cannot sue you for more than the contract was worth in the first place (excepting rare cases of willful negligence etc.) it is _far_ from a no-brainer.

<comment><USER13> Willful negligence indeed. That's why it's a good idea to carry E&O insurance in most states--despite the costs.

Nah, the tax write-offs alone make those costs more than manageable.</comment></comment></comment></comment>


Ask HN: How to learn advanced maths - <AUTHOR> I studied physics as my undergraduate degree and, as such, only really studied up to differential equations in a pure maths context. However, since graduating, I've been working mostly as a maths teacher, and it's made me much more interested in learning more about advanced math, outside the basic geometry, algebra and calculus we teach. It's also made me much more interested in learning about rigorous mathematical proofs, especially in a research framework.
Does anyone have any good textbooks or resources to help self-educate myself on more advanced maths? I still have my linear algebra and diff. eqs books that I'll go through again, but I'd love other recommendations. I've found the post series on Quantstart [1], which looks like it was never completed, and I know HN has discussed them some before ([2] being one example) but was wondering about anything else you all might know about besides going back to school (which I seriously might do, to be honest; teaching it has made me really fall in love with maths again, and made me regret studying physics as opposed to maths!).
I do know this is vague, and mathematics is a huge field with lots of subbranches, so just any resource you'd like to recommend to any of those subbranches, or, perhaps, something of how an undergraduate curriculum would work leaning up to graduate level work? Thanks in advance!
[1]https://www.quantstart.com/articles/How-to-Learn-Advanced-Mathematics-Without-Heading-to-University-Part-1
[2]https://news.ycombinator.com/item?id=11267456
ETA: I would much prefer materials that have solutions readily available. Since I am self-teaching, I want to be able to confirm my answers to problems without resorting to MathOverflow or other resources every time. Of course, I am not against materials without solutions, especially if they are the best materials available. <comment><USER2> One thing you want is some equivalent of the "Foundations" course described at [https://www.quantstart.com/articles/How-to-Learn-Advanced- Ma...](https://www.quantstart.com/articles/How-to-Learn-Advanced-Mathematics- Without-Heading-to-University-Part-1#year1-foundations)

You want to make your way to the point where you can write a proof and check it without needing feedback telling you where it falls down.

In addition to that, you've got the basic undergrad math major curriculum.

Maybe look at [http://web.evanchen.cc/napkin.html](http://web.evanchen.cc/napkin.html) as some sort of goal, to understand everything you find interesting there, and a small set of medium to hard problems that you could use to track your progression. (It goes quick so I'm suggesting it as an example plot of a subset of a curriculum, not necessarily a great learning resource. It's clearly aimed toward a particular sort of reader, and it is a bit tilted towards parlor trick mathematics. It's kind of a neat document if you finished a math major a decade ago. Edit: this link is weak on analysis.)

Oh, this is definitely an answer you should read critically.

</comment><comment><USER3> I would second going back to school if you can afford it. You can always start going part-time and then transition to full time if you really see it as another career path.

I'd also recommend the Art of Problem Solving's Calculus text, it has a solution book, as well as their Volume 2 book. Try working through those on your own, since you have great background in math you should find it quite enjoyable, and perhaps somewhat challenging.

</comment><comment><USER4> I would recommend "Discrete mathematics demystified" by Steven G. Krantz. It is an introduction to topics that you may have never encountered before

</comment><comment><USER5> I can't suggest brilliant.org highly enough.

</comment><comment><USER6> Not a mathematicians, but I always got the impression that at the beginning it's all about doing it yourself...and later it's all about reading what the top minds are doing

</comment><comment><USER7> I repeat my comment from [https://news.ycombinator.com/item?id=11274264](https://news.ycombinator.com/item?id=11274264)

"A single book is enough to learn mathematics: Riley, Hobson, Bence: Mathematical Methods for Physics and Engineering: A Comprehensive Guide It has a whopping 1300 pages, but it has everything you need. And if that is not enough for you get Cahill: Physical Mathematics This will give you advanced topics like differential forms, path integrals, renormalization group, chaos and string theory."

</comment><comment><USER8> 3 blue 1 brown @YouTube</comment>


Farm Confessional: What Butchering Your Animals Really Feels Like - <AUTHOR> http://modernfarmer.com/2014/10/butchering-animals/

<comment><USER2> This article reminded me of the deer hunts I've participated in the past. Looking through the rifle scope, moments before pressing the trigger and feeling that inevitable moment of unconsciousness as the controlled explosion blasts out of the barrel and shocks your senses...I've always aimed for the upper neck. I've seen others shoot deer in the rump and also the shoulder area (which shoulder shots are often recommended to prevent them from running away after being shot)...but then run for miles in pain and exhaustion before expiring. To me, targeting anywhere but the neck is lazy and inhumane.

My neck shot is a way I come to terms with hunting a live animal. I miss more than I have hit - it's a way to keep myself sharp. One shot through the neck with an adequate caliber rifle stops the animal in their tracks and are almost always expired before I can run the 50-100 yards to where they fell. Of the few that were still alive when we reach them...one of us in the hunting party always carries a 9mm pistol to end things quickly.

</comment><comment><USER3> It's still disingenuous to call this "being part of nature". This is asserting complete dominion over the predator prey relationship. There's no better depiction of how we are "above nature" than in the way that we can keep these animals in complete obliviousness of their ultimate fate for their entire lives.

<comment><USER4> Untrue, that's just the same human-exceptionalism with fresh set of paint from "we are uniquely awesome" to "we are uniquely terrible".

We're not _that_ unique: Nonhuman species have wars, rape, pillage, lie, etc... and yes, that includes "raising" other creatures for food.

Certain ant species, in particular, manage aphid livestock. At various times, the aphids are raised, mutilated, drugged, and eaten.

<comment><USER3> You are coming awfully close to completely destroying any distinction between artificial and natural. Raising animals for food is not a natural human instinct and there have been plenty of human societies that hunt rather than raise livestock. Call it for what it is: a (very old) technology.

<comment><USER4> You're telling me ant-behavior is artificial and they have technology?

<comment><USER3> I'm saying ant behavior is artificial when humans emulate it. Just like humans flying isn't natural just because birds do it too.

<comment><USER4> You can't seriously be telling me that animal-husbandry is artificial... because early humans learned it from squinting at ants!?

Or are you telling me the _ants_ are the artificial ones, and they learned it from us?

You claim there's a bright-line distinction between "natural" and "artificial", but so far your personal definitions appear to be illogical and mutable.</comment></comment></comment></comment></comment></comment>


Eusociality - <AUTHOR> https://en.wikipedia.org/wiki/Eusociality

<comment><AUTHOR> I find it interesting how the social structures of animals are independent of their intelligence, to an extent. I always associate the societal structure humanity has achieved with our intelligence, so seeing examples like ants and termites breaks me out of that habit.

Really quite interesting to think about how our world might be different, if we were equally intelligent but had an alternative social structure.</comment>


What problems you are facing in managing business calls remotely? - <AUTHOR> <comment><AUTHOR> Hello, friends!

I am Vishnu. I work at a company called MyOperator ([https://myoperator.co](https://myoperator.co)).

Since Coronavirua outbreak, we are helping businesses to remotely manage business and customer calls.

To help people better, I would like to hear from you what problems and challenges you are facing in managing business calls while your offices are closed and you are working from home or other remote location.

Also, if you have possible suggestions to fix those challenges, let's discuss those.</comment>


What software you use to be creative? - <AUTHOR> https://github.com/s-a/creative-software

<comment><AUTHOR> A list of graphic, video, audio and 3d programs. Would be nice to see some pull requests</comment>


Ask HN: Text-based web-browsers. Are it affected by Meltdown and Spectre? - <AUTHOR> Most popular web-browsers (Mozilla FireFox, Gooogle Chrome, Pale Moon, etc.) already work on solving issues related to Spectre and Meltdown attacks and this month rolled out it's security updates.
Text-based[1] web-browsers (such as Lynx, Links2, etc.) are much simpler than 'normal' browsers, so  could they be affected by Meltdown and Spectre? Are there any news on security issues for text-based browsers related to such attacks?
[1] https://en.wikipedia.org/wiki/Text-based_web_browser
P.S.: I use Links browser in graphics mode as default browser on my PC, and this post also submitted throw it ;-)

  $ links2 -g http://news.ycombinator.com
 <comment><USER2> Those browser's vulnerability to those attacks are entirely based on the fact that they execute JavaScript. Thus, if your browser doesn't execute JS, it's immune.

<comment><AUTHOR> > Thus, if your browser doesn't execute JS, it's immune.

I hope on that, but it would be cool get more details why text-based browsers are much more secure than modern browsers in 2018.

P.S.: Screenshot[0] from my web-browser with this thread.

[0] [http://hnng.moe/f/ZZJ](http://hnng.moe/f/ZZJ)

<comment><USER3> That is the complete explanation… JavaScript. Executing arbitrary code from strangers on the Internet is what makes browsers less secure.

</comment></comment></comment><comment><USER4> Possibly.

Because Meltdown and Spectre are vulnerabilities caused by CPU design, any running code is potentially vulnerable. Text based browsers are not safe merely because they do not run javascript, they are only safe in that case from javascript being able to exploit the vulnerabilities. The application itself may still be vulnerable.

You should contact the maintainers of these projects directly and find out from them.</comment>


Linus on /dev/random: "We actually know what we are doing. You don't." - <AUTHOR> http://nakedsecurity.sophos.com/2013/09/11/rudest-man-in-linuxdom-rants-about-randomness-we-actually-know-what-we-are-doing-you-dont/ <comment><USER2> We allow the wild web to have access to our closed source GPU driver blobs but we elaborate tinfoil hat theories about rdrand. This is insane.

Regarding "(I'm not sure I agree with Linus that mixing in a known-tainted RDRAND stream would nevertheless invariably improve randomness, but on the surface, it shouldn't reduce it.)": I think it's fair to say it would, in practice.

Even if the NSA knows how to predict the output of rdrand (because it's really some stream cipher with a known key or something), most people don't. Therefore, it wouldn't improve the randomness of the final stream from the NSA point of view, but it would from the point of view of any other attacker not in the secret. So I think it's fair to say it can't do harm and it can actually do some good.

See also the previous discussion:

[https://news.ycombinator.com/item?id=6359892](https://news.ycombinator.com/item?id=6359892)

The consensus seems to be that if the NSA can backdoor rdrand so deeply that it can keep track of the CPU state and the contents of the RAM then you might as well throw away the whole CPU, why would you choose to trust all instructions _but_ rdrand? They could have compromised the interrupt vector, the syscall vector or anything else.

This feels like "rumor based cryptography" or more precisely "FUD based cryptography". We're just running in circles.

<comment><USER3> This is true. I think it is unlikely that rdrand is this deeply backdoored. However, I do think for something this critical the comments should match the code better and working on fixing the problems identified in the article is probably prudent.

It is worth noting that police used to be able to exploit firewire DMA to bypass disk encryption and copy encryption keys out of memory from any system with a firewire port. This has been fixed and a CPU-level exploit for crypto seems unlikely to me because making something that not only worked consistently but didn't slow down general purpose programming when it worked, would be an engineering marvel.

This being said, having clear, unimpeachable code in these areas is a good start because it helps ensure that other problems are not lurking under the surface.

<comment><USER2> I agree that the comment of get_random_bytes should be fixed, it's misleading. However I don't think modifying code that has no known bug or weakness because of a rumor and some handwaving is good policy. It's more likely than not to introduce a regression and create real trouble.

If it's ain't broke...

Or in this case:

If you can't prove it's broke...

EDIT: I would also remind everybody that if they really don't trust rdrand for any reason they can just add the "nordrand" boot kernel param and disable this code. It's a non-issue.

</comment></comment></comment><comment><USER4> This whole discussion about rdrand reminds me of people arguing about what strength the secondary lock on their upstairs back window should be when the downstairs floor has single pane glass windows all around.

Even if rdrand _is_ backdoored it would have to be a significant supplier of entropy in the resulting random number for this to be a meaningful attack vector, as soon as you mix it with other (good enough, large enough) sources of entropy you get a situation where some other attack is more likely to be far more feasible than to use the knowledge about some of the bits that rdrand contributes to the entropy pool.

Such as:

      - good old b&e and placing a keylogger or hardware bug
        (very easy to hide in a keyboard)

      - a compromised bit of the OS

      - compromising the application that you use to encrypt your messages or finding a significant weakness in the application.

      - doing any of the above with the recipient

<comment><USER5> Did you actually look at how the Linux kernel is mixing RDRAND output with other randomness, or read the comments by the author of the original change.org petition? Because of the way Linux mixes RDRAND output with other entropy using XOR, a malicious RDRAND implementation can easily make the output of /dev/random totally determinisitc whilst being completely indistinguishable from a correctly-functioning implementation except to the attacker.

All it has to do is detect the code sequence in question and XOR the output of RDRAND with the randomness from the other entropy sources before returning it. The two XORs cancel out, and this is completely undetectable because there's no way to distinguish between a true random bitstream, a good PRNG, and a good PRNG XORed with data you provided based on the bits themselves.

<comment><USER6> _All it has to do is detect the code sequence in question and XOR the output of RDRAND with the randomness from the other entropy sources before returning it._

How is that going to work? i.e. how is RDRAND going to 'detect the code sequence'?

<comment><USER5> Only Intel engineers know exactly how to do this and I doubt they're allowed to reveal hardware internals, but at the point RDRAND actually executes the next fewt instructions should have already been decoded and the data flow between them analyzed. In theory it's not terribly hard to use that information to change the behaviour of RDRAND.

<comment><USER2> Honestly, and for lack of a more suitable expression, put up or shut up. If you think rdrand actually reads back the output of the RNG from RAM in order to nullify it, then show it.

It's actually possible, you can verify that the timing of the instruction conforms to what it's supposed to be doing, you can check for RAM access. RAM accesses are slow and easy to detect (I'm sure there even are hardware counters for that kind of thing on modern CPUs).

So unless you can get any kind of hard evidence that would even shed the base of the idea of a doubt about what rdrand is doing: this is pure FUD.

Finding out how rdrand is truly implemented is hard, but if it's truly the evil instruction of doom that sends images from your webcam to the NSA then it should be trivial to prove it's not behaving as it should.

<comment><USER7> Instead of saying put up or shut up, let's think if this is within the capabilities of Intel or an impossible feat.

First off, the RNG doesn't have to reside in RAM as it could already be in cache. So you're already not going to be detected by looking at RAM access. Also, it's not 1992. Modern architectures and modern operating systems are going to throw out instruction timings from Intel manuals. A cache miss and you're toast.

Now if you have a dedicated pipeline to executing a RNG within a code cache, all you would have to do is work out it's inverse. Very plausible.

Unless the above sounds magical, it does seem like this is a possibility. And as it's been shown that the NSA is using it's enormous budget to pay US companies to help do it's bidding, this does seem like it's within reach.

</comment></comment></comment></comment></comment></comment><comment><USER8> Instead of discussing on LKML or other forums, he decides to create _a petition on change.org_. Got what it deserved.

Somebody should be apologizing here, and it isn't Linus.

</comment><comment><USER9> Please do not submit professional troll articles.

<comment><USER10> Agreed. This article is very one-sided, and after posting a calmly worded comment regarding Linus's standpoint[1] on his attitude, it was deleted. The article is simply link bait and is not professional journalism.

That being said, I have more confidence in Linus's knowledge regarding /dev/random. Mostly because XOR in this context _is_ secure:

1\. XOR is an incredibly powerful encryption algorithm (not primitive); one of the best we have. The problem with XOR is that you MUST use a UNIQUE one time pad (that is the length of the data) for every message AND you need to be able to securely transmit that one time pad. AES CTR is effectively using AES to create a one time pad for XOR encryption, as an example.

2\. The prior steps are effectively creating a irrecoverable OTP meaning that any malicious intent in RRAND is effectively encrypted away.

[1]: [http://marc.info/?l=linux- kernel&m=137391223711946&w=2](http://marc.info/?l=linux- kernel&m=137391223711946&w=2)

<comment><USER11> The argument is that RDRAND may have access to the previously generated OTP. If that is true, a malicious RDRAND can cancel out any randomness from that OTP. In that case the "incredibly powerful encryption algorithm" XOR can be tricked to generate a stream of zeros, shakespeares complete works, or whatever you like.

<comment><USER12> Who the christ is feeding the output of /dev/random for its use as a cryptographic function without checking that what they read is in fact NOT just a stream of zeroes? Because that's an outcome which can happen from any truly random number generator just by chance - its unlikely, but not unreasonable.

Hence debiasing and the like.

<comment><USER13> If they can make it look like a stream of zeros, they can make it look like a random stream which is actually a pseudo-random stream as well.

Also, they might leave _some_ randomness in, but it can be a small enough amount of entropy that it would still render crypto keys vulnerable.

<comment><USER12> Doi. This is an obvious danger and I feel stupid for not putting two and two together.

</comment></comment></comment></comment></comment></comment><comment><USER14> If you think RDRAND is examining the L1 and registers in order to derandomise it, why wouldn't the evil chip just skip bothering with RDRAND and instead just attack that random buffer it knows how to find...?

<comment><USER5> Mucking with RDRAND can easily be done in such a way that it's provably impossible to detect any differences in behaviour. It's much harder to guarantee that if you start mucking with buffers in memory, since there are so many clever ways a developer could check their work and catch you out.

<comment><USER14> How's the provably impossible to detect bit work again? Surely it'd fail a Chi Square test on reruns with the same input? The attack can't use external input e.g. clock because the NSA can't correlate generating the random number with seeing it in flight.

<comment><USER15> Why should the CPU not have an internal counter that is backed up in flash memory between reboots? 128bit would be enough, with the highest bits set to the processor serial number. Using this counter in AES-CTR mode – i.e. encrypt the counter with the secret key to generate the pseudo random data – the NSA could reconstruct the internal CPU state from a single block (16 bytes) of random data. As many random data is published verbatim, for example as nonces, getting such a block should not be a problem.

<comment><USER14> You are completely right.

[https://plus.google.com/117091380454742934025/posts/SDcoemc9...](https://plus.google.com/117091380454742934025/posts/SDcoemc9V3J) and [https://lkml.org/lkml/2013/9/6/205](https://lkml.org/lkml/2013/9/6/205) are interesting explanations too.

</comment></comment></comment></comment></comment><comment><USER16> When I first learned about RDRAND I was thrilled because I naively assumed this would be just a hardware RNG with direct link to the CPU register vector capable of delivering randomness with a speed of cache hits or better. This would be an end to all struggles with non-crypto PRNGs (which have zyllions of uses in science, mostly in Monte Carlo methods and machine learning, but also some in "consumer computing" like raytracing).

But no, Intel made a sluggish hardware PRNG that occasionally eats some thermal bits just to make crypto guys happy -- and bang, now everybody thinks it is an NSA backdoor.

<comment><USER15> You think 500MB/s [1] is slow? Or are you concerned with the latency of each call?

Also I don't understand why you rant against PRNGs. Do you know that this stretching of actual random data makes RDRAND considerable faster than using actual randomness?

[1]Source: [http://stackoverflow.com/questions/10484164/what-is-the- late...](http://stackoverflow.com/questions/10484164/what-is-the-latency-and- throughput-of-the-rdrand-instruction-on-ivy-bridge)

<comment><USER16> This 500MB/s a merged stream when using all cores, I got like 140MB/s on one (from my answer in the SO thread you linked).

And I'm not ranting, I'm just crying over a lost opportunity. Nowadays you must spend time to think which PRNG to use and how to implement it to satisfy some quality/speed trade-off; an RNG (infinite cycle by design) directly connected to CPU (no transfer bottlenecks) that passes Die Hard (read random enough for science) would be a golden bullet.

Yes, PRNG makes RDRAND faster than its entropy source _in its current design_ ; but it is not hitting any wall. Intel engineers could made it way faster if they had focused on maximal throughput possible not just big enough for crypto.

<comment><USER15> > And I'm not ranting

Sorry if I offended you.

I'm still surprised that poses a challenge for your applications. I thought fast non-cryptographic RNGs were a solved problem. How much random data do you generate? If you use a significant amount of CPU just for that I doubt it would be feasible for Intel to build a cryptographically secure RNG with the same throughput without significant extra costs (think one extra core). (I'm no expert on that subject though.)

</comment></comment></comment></comment><comment><USER17> I'd want to hear Linus responding to both the OP and Taylor. But quick thought: do people like Bruce Schneier ever read this file? I think in the next year or two we will see a huge number of research going into finding "backdoor", suggesting implementation weaknesses. I am not going to speculate too much about who is NSA mole or why certain code got into the codebase. I'm more interested in researchers to find more weaknesses, like how Barton Miller did by fuzzing unix programs back in the 90s! I wish I had enough knowledge to help out.

<comment><USER18> Bruce Schneier

I have all the respect for the guy, really, but then I read his guardian article "how to keep your data safe and secure" and mentions keeping "air gap" between computers with sensitive data but then he himself admits after all his methods and safeguards for the leaks he is working with, he uses Windows and usb-sticks to transfer (encrypted) files between them.

He uses Windows.

He uses Windows.

And he was claiming in the article that free and open source are better for security. Oh really, so your encrypted files on your usb-sticks for sure cant spread malware through your airgap through a file-system exploit? For sure it has never been done before that a file system could be used to take over an OSs internals, oh never.

<comment><USER19> It's still good advice. In fact, unless you audit the source of your OS, it's compiler, hardware and any software you need to use you can't really make any guarantees either.

<comment><USER18> I can make you the guarantee that Microsoft is actively cooperating with the NSA and has backdoors in Windows.

I can guarantee you that few people have access to the Windows source to check it.

I can also guarantee you that many more people have access and have audited the source code of a GNU/Linux system.

I cant guarantee you that GNU/Linux doesnt have backdoors. But for all intents and purposes it is just plain Wrong to use windows for any security related activities.

Would you be more comfortable leaking documents using a GNU/Linux livecd or Windows?

<comment><USER17> Sorry. I think you are too paranoid. You are. Close source can have backdoor and open source can have backdoor too. I like to use Linux and my Mac to do programming work, but it doesn't mean I don't care about Windows.

If you think Linux has less chance getting backdoor, well, look at all the speculation we got these days. If NSIT cryptographic standard has reduced security as many people believe, then your communicate is dead.

If you believe that all ISP are cooperating with the US government here in the US, why the hell are you still using the Internet as we know it? You are guaranteeing that only an open source system will not have a backdoor while a closed source must have. Microsoft has collaboration with NSA in one way or another. Is that a secret? Most of their "collaboration" probably come from business things like military-kind projects. They might have backdoor. But guarantee is a big assumption. If you don't have solid proof then you are making false accusation.

It's like saying because your friend shakes hands and hang out with a cold- blood murder he must be a cold-blooded person too. Plain wrong, ignorant and simply stupid.

Security has a trust involved. If you don't trust your USB, your own product, then you will not get any security. There is nothing wrong with transferring things between usb and windows computer. It's fine. You can still run SCP, SSH over your Windows socket. Is that now weaker because damn MS is working with NSA as you say?

Someone give this man a cookie because we are obviously living in an fantasy.

If you think your ipod, your laptop don't have backdoor according to how MS and Intel are working with NSA, you are contradicting. Stop using the Internet and stop using anything. Then you are safe.

</comment></comment></comment></comment></comment><comment><USER20> Is rdrand really the very last stage? As in the output is "stream XOR rdrand"? If that is really the case it puts full, 100% trust in Intel not to insert a backdoor. It wouldn't even be hard. All the CPU need do is check for the xor operation used with rdrand as an operand, and instead of performing the xor, substitute the backdoored pseudo-random stream instead. No runtime monitoring of internal state would be necessary, the whole thing could be done at the assembly to microcode translation layer.

</comment><comment><USER21> Where do I go to elect this guy "King"? All of his suggestions were reasonable and measured.

</comment><comment><USER22> If I remember right, the original reasoning why this could be a problem was something along the lines:

You are using sources s1, s2, s3. Then final result is combination c(s1,s2,s3). Now somebody screws up something and the sources s1 and s2 start returning just constant values. If you were just using s1 and s2 you would immediately notice this. However since you are combining all three, you are getting something that looks good but what might not be really secure if the source s3 is compromised.

(I think this came up in some HN discussion some weeks ago)

I'm not familiar with the Linux implementation so I don't know if this has any meaning there.

<comment><USER23> The problem with this argument is that it would also apply to any low quality random source, and linux (and other OSes) all use sources of dubious quality. The reason to use them is that when we mix, they only improve matters.

</comment></comment><comment><USER24> I never followed this at all prior to reading this article so forgive me if this was covered outside the scope of this write-up, but...

If the CPU did give you a RDRAND value that was pre-baked to weaken the number it thinks you're going to XOR it against it, it would be easy to detect this by feeding RDRAND the same input state repeatedly and seeing if there is a pattern to what is spit out or if it is indeed statistically random... So why hasn't someone (who thinks RDRAND is a trap) done that instead of just claiming it could maybe be doing something fishy?

<comment><USER25> How would you distinguish actual randomness from the output of a CSPRNG with a known or weak seed? Patterns won't be apparent in either output.

<comment><USER24> The gist of the argument as I understand it is that some people think Intel's chip (at the chip level) is taking a look at data that the RDRAND result will be used as an XOR against and using that to mess with the result RDRAND returns in some way to weaken the overall random number.

If this were true and you set up a repeatable test situation in which you force the other parts of the RNG to generate the same numbers prior to RDRAND and then did the RDRAND and captured the results then I don't see how one could argue RDRAND is compromised in this way if the results coming out of it over time even appear to be statistically random.

...unless people think the chip is also detecting situations where you are actively trying to fool it by setting up repeated simulations of the same initial value to be XORed, which strains credibility way beyond what I'm willing to believe.

<comment><USER15> Actually that is quite simple. For simplicity let us assume RDRAND will only attack the Linux RNG. Now RDRAND first generates its own weak random stream w_k. When it predicts that Linux will generate l_k it outputs l_k xor w_k thus the final output of the Linux RNG will be w_k. As w_k looks random for everyone who does not have the private key you cannot check that there is anything wrong with w_k or w_k xor l_k.

<comment><USER24> "For simplicity let us assume RDRAND will only attack the Linux RNG."

Assuming the chip is detecting that the Linux RNG is in play is already way out of the realm of simplicity and frankly way beyond what a company like Intel is likely to be able to keep secret given the number of engineers that would have to be aware of this complex functionality.

This whole conspiracy theory hinges on some wild claims that I haven't seen substantiated in the least.

<comment><USER15> As far as I have followed the discussion there are no hard facts or claims at all, just the general suspicion against a completely closed system of an US company.

I, too, don't believe that Intel adaptively generates its RNG to spoil the Linux RNG. But be reminded that what would have been wild conspiracy theories just half a year ago is now common believe (NSA deliberately introducing vulnerabilities in software and even in cryptographic standards, routinely by- passing TLS).

Given all we know (and don't know) I think it would be prudent to mix Intel's RNG with the other randomness sources using a cryptographically strong primitive and not just XOR. Personally I'm enthusiastic about Keccak as a reseedable RNG, but these modes will probably be standardized no earlier than fall 2014.

> Assuming the chip is detecting that the Linux RNG is in play is already way > out of the realm of simplicity

I meant simplicity of my argument. As an answer to this paragraph I argued that it is indeed possible to generate malicious output that appears completely random:

> If this were true and you set up a repeatable test situation in which you > force the other parts of the RNG to generate the same numbers prior to > RDRAND and then did the RDRAND and captured the results then I don't see how > one could argue RDRAND is compromised in this way if the results coming out > of it over time even appear to be statistically random.

</comment></comment></comment></comment></comment></comment><comment><USER26> It could be summed up as is: either you have a test that shows that rdrand has got problematic behavior or you shut up.

Backdooring rdrand is of little to no interest given how PRNGs are built.

<comment><USER15> I would agree with you if the Linux RNG was build according to common cryptographic wisdom. But as far as I can tell by reading the article the random sources are compressed in a common randomness pool using CRC. If RDRAND was added to this pool it might reduce the randomness of this pool. If these sources were added by a cryptographically secure mixing primitive this would not be possible. A faster alternative would be to maintain one pool for every randomness source that is added to via CRC and then only mix all pools together with a cryptographically secure primitive when randomness is requested.

</comment></comment><comment><USER27> Good article if only for "bucket of digital slurry."

</comment><comment><USER28> The way things are, people are going to post on HN if Linus farts and others would upvote.

</comment><comment><USER29> Why is this _AGAIN_ here? This has been posted like 50 times already during a couple of days. And what Linus says isn't actually even anything bad that should create this kind of stupid fuzz.

</comment><comment><USER30> If you consider the title of the article, "Rudest man in Linuxdom", you understand very quickly that the article author is imposing their own moral on Linus, but that's OK because the author is a proven programming genius of greater skill than the person who invented Linux, git, etc.

...

Oh wait, he isn't. The author of the article is just another "tech blogger" that is interested in page views. So what's more interesting an article to write: one about RDRAND, or one about how mean, naughty and rude that ignorant "Linus Torvalds" person is? The second option will generate more page views so the choice is obvious.

Since the author of the article is quick to criticize Linus and his way of expressing himself, even going so far as to, in a bullet list, sentence Linus to community service for the crime of not being as kind, understanding and tolerant a person as the author, I'm going to do the same.

Hey, article author! If _I_ were king, here's what I would want you to do:

* Write an operating system that is used by millions of people and powers a large part of the Internet (together with BSD and friends).

* Write a distributed CVS that is also used by millions of people.

* Stop writing bullet lists about people.

* Stop trying to attract hits to your tech blog and create something of use to the human species. How about rewriting the graphics support in the kernel or something?

* Criticize what people say, not how they say it.

I'm tempted to go on, but I know that the author has no interest in neither learning nor creating anything, only criticizing other people, so anything I write is for the enjoyment of HN (in addition to mine).

<comment><USER31> I assume your post was intended to be ironic?

 _> "Write an operating system that is used by millions of people and powers a large part of the Internet (together with BSD and friends)."_

Linux wrote a kernel, not the full OS user land. What's more, most of the code in Linux (the kernel) isn't actually written by him - these days he's job is more that of a maintainer. Not that I'm trying to undermine his achievements - just pointing out that you're making the same exaggerated arguments as the blogger you're condemning.

 _> " Stop writing bullet lists about people."_

You mean like the bullet list you've just written?

 _> "Stop trying to attract hits to your tech blog and create something of use to the human species."_

Again, like you've just done. Let me explain with a little code:

        ($potkettleblack = $_) =~ s/tech blog/forums/;

_> "Criticize what people say, not how they say it."_

Which would be fine if the whole premise of your argument is complaining about not what the blog said by how the blogger said it.

Don't get me wrong, I have a lot of respect for Torvalds, but your comments were -at best- hypocritical. Though I'd say they were much worse than that as at least the blog in question added some content to compliment their clickbait headline. You've not even touched on the real subject matter of this topic.</comment></comment>


The Mindfulness Conspiracy - <AUTHOR> https://www.theguardian.com/lifeandstyle/2019/jun/14/the-mindfulness-conspiracy-capitalist-spirituality <comment><USER2> There are some fudgy leaps of logic here, trying to make sweeping insights but it is just undermining the whole thing for me. Like: "The ideological message is that if you cannot alter the circumstances causing distress, you can change your reactions to your circumstances. In some ways, this can be helpful, since many things are not in our control. But to abandon all efforts to fix them seems excessive."

Who is saying "abandon all efforts" to fix things? That is a total strawman argument. Mindfulness is fine and helpful for fixing exactly the issues we face in the world - I don't see how being stressed or overwhelmed helps anyone improve things. Mindfulness is meant to give you space to make useful actions rather than spin in place. Yes, the wheels of capitalism have inflated and twisted the concept for profit, but it is quite a stretch to say it is some sort of opiate for the masses to keep us docile.

If the Titanic is sinking, telling people to keep freaking out probably isn't the best way to save lives. "Stay calm" doesn't solve things either, but I feel like it gives you a better chance to find a raft, yes?</comment>


Tiler: Build Images with Images - <AUTHOR> https://github.com/nuno-faria/tiler <comment><USER2> Shameless plug: Here's my take on building images with images. It uses a genetic algorithm. [https://github.com/iver56/emoji-art- generator](https://github.com/iver56/emoji-art-generator)

<comment><USER3> This is great! Does it have an option to not overlap?

<comment><USER4> I have a similar non-overlapping project for steam emoji's:

[https://github.com/EhsanKia/Steam- Mosaticon](https://github.com/EhsanKia/Steam-Mosaticon)

[https://steam.tools/mosaticon/](https://steam.tools/mosaticon/)

</comment></comment></comment><comment><USER5> Took a while to realize it was about graphics and not docker, maybe that's my bad.

<comment><USER6> I actually thought the same thing. I thought this was a tool to compose Docker images transparently in some way.

</comment></comment><comment><USER7> This looks so cool! The results are great.

The '@'-symbol derived Github logo and the paperclip pie are fantastic. This could easily be used to create high quality logos or t-shirt designs.

Kudos to the author(s).

</comment><comment><USER8> How neat! Lovely project. I applied it to a gif, an excerpt from the new Joker trailer, and it created what I think is a neat effect.

[https://imgur.com/a/6U7SvR5](https://imgur.com/a/6U7SvR5)

</comment><comment><USER9> Tile images, set randomness, build videos with tile images, and do face alignment montages with embedding network:

[https://github.com/worldveil/photomosaic](https://github.com/worldveil/photomosaic)

</comment><comment><USER10> am I Missing something? Didn't work on few images I tried. Output folder is empty.

python tiler.py /work/one.png /work/Test/Tiles/

Loading tiles

0it [00:00, ?it/s]

Gettting and processing boxes

0it [00:00, ?it/s]

Creating tiled image

0it [00:00, ?it/s]

</comment><comment><USER11> Doesn't someone have a patent on this? I vaguely remember this at one point.

<comment><USER12> I remember the same, IIRC it was US6137498A that was referred to. That one seems to describe a pretty specific process for the generation so I don't know how generally it applies.

Wikipedia appears to also list a few other patents: [https://en.wikipedia.org/wiki/Photographic_mosaic#Trademark_...](https://en.wikipedia.org/wiki/Photographic_mosaic#Trademark_and_intellectual_property_of_the_concept)

</comment></comment><comment><USER13> From the 'About,' I thought that it would use various images of different colors.

<comment><USER14> It does?

<comment><USER13> As far as I can see, it uses the same image, painting it different colors. I think it would be cooler to mix various images but with the scaling. There are plenty of 'mosaic' tools like that, however they mostly use images of the same size, essentially as uniform pixels.

<comment><USER14> Look at the minecraft tiles example. The readme also describes an extra tool to make differently-colored versions of a single image to feed into the program.

</comment></comment></comment></comment><comment><USER15> Looks cool. Can someone give an overview of how it works.

<comment><USER16> OP might be the same person. But, the original creator posted a short explanation here [https://www.reddit.com/r/GraphicsProgramming/comments/d10kcl...](https://www.reddit.com/r/GraphicsProgramming/comments/d10kcl/tiler_a_tool_to_build_images_out_of_smaller/)

<comment><AUTHOR> I am not the author. Found it via reddit. The same link you posted.

</comment></comment></comment><comment><USER17> Seeing Minecraft pixel art always makes me nostalgic

</comment><comment><USER18> I just thought about building something like this. Will give me some good input. Thank You!

</comment><comment><USER19> Funny I thought this about containers and kept on reading README, realized only when I actually saw example "images".

</comment><comment><USER20> Does anyone know of an app to mKe one of those animated gifs pf a face stabilized selfie montage?

I cant seem to figure out how to find one.

<comment><USER9> yep. [https://github.com/worldveil/photomosaic](https://github.com/worldveil/photomosaic)

<comment><USER20> Oh i recall that one, buts not a binary install on windows Nd the reqs are to high (from a skill level) for the people i want to give this to....

But thank you!</comment></comment></comment>


BBC Radio 4: Mathematics Program Collection - <AUTHOR> http://www.bbc.co.uk/radio4/collections/mathematics/

<comment><USER2> Radio 4 is perhaps Britain's greatest pop-cultural output of the 20th century.

Allow me to direct you to the rest of the In Our Time archive, with programmes on Science, Religion, Culture, History and Philosophy:

<http://www.bbc.co.uk/radio4/features/in-our-time/archive/>

In particular the recent celebratory 500th edition, on free will, was very interesting: <http://www.bbc.co.uk/programmes/b00z5y9z>

</comment><comment><USER3> The first series listed - Marcus du Sautoy's A Brief history of Mathematics - if just fantastic. I highly recommend everyone to get all the episodes from the podcast on iTunes. Already knowing some of the history of the mathematicians was not a downer at all; du Sautoy's great way of narrating with the BBC-quality production really makes this a fabulous and interesting series to listen to. As JonnieCache said, Radio 4 is an just such an amazing treasure to be able to experience.</comment>


Can't Prioritize? Tips to Prioritize Your Day - <AUTHOR> https://medium.com/@billdinh/feel-out-of-control-3-tips-to-priotize-your-day-735be650053c <comment><AUTHOR> The #2 biggest problem our users have is they don't know how to prioritize their day. Here are 3 tips to do so.

Hope it helps other Founders.</comment>


Startup Quote: Mark Suster, general partner, GRP Partners - <AUTHOR> http://startupquote.com/post/5266239770

<comment><AUTHOR> Good entrepreneurs have a chip on their shoulders. They are out to prove something.

\- Mark Suster (@msuster)

<http://startupquote.com/post/5266239770></comment>


Amazon offered job to Pentagon official involved in $10b contract it sought - <AUTHOR> https://theintercept.com/2019/06/03/amazon-defense-department-jedi-contract/ <comment><USER2> \s They grow up so fast ...

</comment><comment><USER3> This is surprisingly (or not) common at defense contractors large and small.</comment>