When Banks Use Facebook Friends To Determine Your Credit Score - <AUTHOR> http://www.betabeat.com/2011/12/13/as-banks-start-nosing-around-facebook-and-twitter-the-wrong-friends-might-just-sink-your-credit/ <comment><USER3> Some days I hate being right.

<http://news.ycombinator.com/item?id=954276>

[Edit: The article says the ultimate nightmare is the banks using this to access data that they can't ask you for on forms. That is unlikely. What they'll do instead is do exactly what credit scoring does: develop an algorithm which a) improves assessment of risk and b) is totally, verifiably blind to all protected classes which c) happens, as a side effect, to correlate very strongly with membership in certain protected classes.]

<comment><USER4> The problem with trolling my FB account for understanding my behavior is that people fall into roughly 3 categories:

\- Old work associates

\- School friends

\- Family and close friends

If I have a deadbeat cousin who also happens to be the black sheep of the family, they may penalize me unfairly for his behavior. Or if I used to be in school with someone who is now doing poorly financially, I get whacked. Now consider that this person might have been my close friend in 6th grade, but we grew in different directions. Where is the relevance here? Where's the logic in that?

Pulling this info from social graphs as augmentation is a whole lot different than simply creating a full profile from your graph in the absence of real financial data.

Lagging or not, how I paid my credit cards over the past 5 years is going to tell you a lot about how I treat money. Not so much about what I'm tweeting tomorrow.

<comment><USER5> > they may penalize me unfairly for his behavior.

What you are describing is just a fundamental quality of these types of risk assessment algorithms. For example, males pay more for car insurance than females, because there is a demonstratable correlation between being a male and the insurance company paying out more money to you.

This is true even for an individual that has been in absolutely no accidents. Statistically it is true that a male that has had no accidents still has a higher expected value for insurance payouts in the future than a female that has been in no accidents.

You as an individual is an unknown quantity that they cannot absolutely determine. There may have been completely legitimacy reasons why you failed to pay credit cards that cannot possibly occur again in your life, you should equally complain about that not being taken into account.

No one can perfectly predict the future (if they could, insurance would be pointless). They can only use information that they have to imperfectly model the future; both who you tweet and previous credit card payments are imperfect signals for what will happen in your future. It is true that how you paid your credit cards in the past is a much stronger singal; it is absolutely impossible that any credit evaluation is taking who your cousin is and your personal history as equals. Their models take into account that who you tweet is a much lesser indicator.

<comment><USER6> >You as an individual is an unknown quantity that they cannot absolutely determine.

well, we can imagine that given more info and better algorithms they would narrow the "unknown quantity" into the range much more narrow and thus less populated than "male, 22 years old, 00000 zip code". From a hundreds thousands peers to just a hundred of peers in the same risk level pool - it would be very different "unknown quantity" then.

The better they differentiate the higher profits they will get by offering lower quotes to no-risk ones while more intensely screwing ones with the risk. This is wet dream of the retail, insurance, etc... business - custom targetted offerings. Lower prices when it is really neccessary to make the sale and screw the customer by jacking up the price when it is possible. To do this they need to _know_ the customer. Thanks Facebook.

</comment></comment></comment></comment><comment><USER7> It's very hard to argue against this. Either your social network is a good signal, or it's not. If it's not a good signal, the people who use this information are going to lose money--they will quite literally pay for being wrong.

But if it _does_ work, then overall mortgage rates will marginally decline. Better information will lead to better choices, so mortgages will become less risky overall. Some people will suffer, but keep in mind that when those people oppose this, they are saying "I want to hide material information from the people with whom I do business; if they knew the truth about me, I would get a worse deal." That's fraud.

Yes, there will be false positives. And it's easier to visualize being the victim of one of those than it is to visualize the tiny collective improvement in human welfare that tends to result from better decisions.

I would be interested in an argument that applies _in this specific case_ , but doesn't apply to the general class of rough but useful heuristics, like "Kids with bad grades who drive recklessly are probably less responsible than 40-year-old moms who drive minivans, even though there is some C-student with a red car who is safer than some particular 40-year-old minivan-driving mom."

<comment><USER8> _But if it does work, then overall mortgage rates will marginally decline._

Or the banks will just raise the profit margins.

 _Some people will suffer, but keep in mind that when those people oppose this, they are saying "I want to hide material information from the people with whom I do business; if they knew the truth about me, I would get a worse deal." That's fraud._

What about "my bank has no business spying on who my friends are or what I do on my free time"?

This raises the cost (possibly prohibitively, if the number of people who refuse to give out an account is so small that banks can outright refuse credit to them) to anyone who isn't willing to sell out their privacy, and more importantly, their friends'.

And of course, people like me who just don't have an account are outright fucked.

<comment><USER9> _Or the banks will just raise the profit margins._

A bank doesn't operate alone in a vacuum. As the number of people who have prime credit shrinks the competition to lend to those people will go up. They can't simply raise profit margins because there is always another lender out there who will be happy to take on a prime credit borrower.

<comment><USER10> Unless of course the banks agree--off-the-record if need be--to not undercut each other because they realize they will all lose by doing so.

<comment><USER11> I don't think that's practical. In an industry with very few players, it could work, but there are tons of small banks, credit unions, and online banks. Do you really think the big banks could convince every single one of them to just accept their share of the pie and stop trying to compete?

<comment><USER10> There's many small banks like you say, but the impression I get (I have not done the research to back this up) is that the few really major banks (i.e. Bank of America) have a huge market share. Again, I have not researched this, but just from day-to-day experience, it sure seems that way.

Edit: <http://www.cardhub.com/edu/bank-market-share-by-deposits/> According to this site, the market share of the top 10 banks is about 45%. Those statistics are not highly precise but it illustrates the point I am trying to make.

</comment></comment></comment></comment></comment></comment><comment><USER12> My first reaction: "Why would I volunteer that information?"

Followed quickly by: "I don't have to; my less-savvy friends would. And I'm in their graph."

At which point, it's in my interest to disclose my own social graph, so that the bank sees that I'm actually connected to responsible people, too. Which means betraying those individuals' presence in my graph. Gah!

<comment><USER13> or just get rid of Facebook.

<comment><USER14> And cut yourself off from the people you interact with there. Social networks have very high value. You can't expect people to throw them out -- they _love_ them. This is why people talk seriously about regulating privacy handling, to prevent this sort of abuse.

<comment><USER15> >And cut yourself off from the people you interact with there.

So what? You only have that much time on earth to spend it socializing with people you don't really care about online.

For people you do care about, you can always meet offline, or call.

Oh, and if they won't talk to you outside FB, take it as a hint you don't mean much to them anyway.

<comment><USER16> >For people you do care about, you can always meet offline, or call.

This is an incredibly myopic worldview especially nowadays. I don't know about you, but online is where I do 99% of my socialization outside of the office. Why? Because phone calls are distracting and rude (when IM is right there and won't interrupt everyone), and meeting up in real life is something that requires a sometimes herculean effort of schedule juggling.

<comment><USER17> >> Because phone calls are distracting and rude (when IM is right there and won't interrupt everyone)

Why? If the other person is busy, they don't have to pick it up. Or you send them a text to make sure they are free (it's what I do). For close friends, I already have a pretty good idea when they'll be busy or free.

<comment><USER15> Actually if they are too busy for the occasional phone call from you, then gee, maybe they are NOT your friends.

Despite what they are called on your online "social graph".

We're not talking about stalking/trying to be together every minute, but, by definition friends are people that LIKE to see you and TALK to you.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> My social graph doesn't tell you anything useful about _me_.

What it tells you about is _people who like the books I write_.

Someone sends me a friend request? I auto-friend them unless they're an obvious spambot. It doesn't mean they're my "friend" or someone I know IRL; probably 80% of my FB "friends" live in parts of foreign countries I haven't visited. I don't use FB for social purposes, I use it for marketing communications.

(EDIT: Paradoxically, it turns out that many of my _real_ friends aren't hooked up to me via FB. And none of my relatives -- except one nephew -- even _have_ FB accounts.)

This wouldn't be a problem except for Zuckerberg's sociopathic insistence that we all have just _one_ unitary identity. Groan.

<comment><USER7> If I were writing a social network layer to a creditworthiness algorithm, the first thing I'd do is create some kind of taxonomy of friend networks. Got 500+ friends? See if the Google results for your name indicate fame (i.e. you show up in title tags on Amazon, IMDB, or the NYT). And bam, reduce the social networks' weighting.

Although I would be willing to bet that a) your fans will have above-average credit scores adjusted for age, and that b) authors whose fans have crappy credit are themselves more likely to have crappy credit.

In the extreme case, if you're a law professor and your FB friends are all attorneys who loved your book, you're probably a good credit. If you wrote a guide to how to fool your parole officer and your FB friends were all fans of your book, your odds of default might be pretty good.

<comment><USER19> What if you are Adam Sandler or another intelligent, responsible comedian with a base fan base?

<comment><USER7> No heuristic is perfect, but the question is whether this situation is common enough to swamp the general informational effects. So, three possibilities:

1\. Adam Sandler will pay a fractionally higher interest rate. 2\. The heuristic will route around this situation. 3\. Banks that blindly apply this heuristic will lose money on Sandler because they make a comparatively unattractive offer; the bank that lends to him will get higher market share by being less cautious or more careful in this instance.

Keep in mind that we're talking about an edge case among edge cases. Authors are a tiny minority of social networking users. And authors whose fandom is a _contrarian_ indicator of their creditworthiness are even rarer. Actually, it would more likely work in the other direction: I bet poets published in the _New Yorker_ have very creditworthy friends and still have trouble paying the rent.

</comment></comment></comment></comment><comment><USER20> So in a scenario where social credit becomes a part of your economic health as an individual, what happens to friends and family that declare bankruptcy? They become some sort of pariah, avoided on Facebook and Twitter?

<comment><USER21> Or helping someone becomes a dangerous proposition, because they'll likely add you to their social graph, dragging you down. It'll be just like those social clubs that determine what you're allowed to do in your private life and who you're allowed to hang around if you wish to remain a member.

Stratification would occur automatically out of fear, as each clings desperately to their social position and tries to keep their social graph pure now that it has real-world consequences.

<comment><USER22> This right here is my single greatest fear of banks knowing/using this information. If I befriend an undesirable (because I see past society's assumptions/the rough times this person has had in their life/whatever), or I care for an undesirable, I am punished. Of course, I would have to weigh if it's worth it (it probably is), but the fact that things like this may have to be considered is just depressing and wrong.

Heaven help the preacher that friends his congregation. Not everyone comes from a rosey past.

</comment></comment></comment><comment><USER23> Back in the days of Old Man Potter, the bank solved this problem by being local and the banker actually _was_ your friend, so he already knew your social graph.

<comment><USER3> Yes, but _that_ banker used heuristics like "Tom is a good white Christian who goes to church every Sunday, of course he is good for the money" and _this_ algorithm can be proven not to, even if it comes to very similar credit decisions as Bill the Biased Banker.

This is part of the reason why credit scores took over the world in the first place: they're _demonstrably_ blind to protected classifications. (They're also more accurate than Bill the Biased Banker _and_ orders of magnitude cheaper to run _and_ execute virtually instantly at 3 AM in the morning, but if their only feature was "As effective as traditional underwriting but immune to anti-redlining legislation" they'd still have taken over the world.)

<comment><USER19> <https://en.wikipedia.org/wiki/Disparate_Impact>

<comment><USER7> Disparate Impact is not a real explanation, because it's equivalently useful at any stage of the argument. For example, "Disparate Impact" might explain why banks don't lend so much to group X. So if we find some good underlying variable that explains why banks would be disproportionately unlikely to lend to group X, "Disparate Impact" now explains _that_ factor. And when that factor gets explained, it explains the _next_ factor.

Disparate Impact is just "God of the Gaps" for discrimination.

</comment></comment></comment></comment><comment><USER24> "The first thing Lenddo asks for is a Facebook account; then it wants access to Gmail, Twitter, Yahoo, and Windows Live."

Umm, pardon my French, but fuck that.

<comment><USER25> How much is access to your Facebook account, Gmail, Twitter, etc, worth?

What happens if the bank offers to lower your rate if you give access?

What happens if you cannot find a bank that gives you a loan without insisting that you give them access to your accounts?

<comment><USER26> > _What happens if you cannot find a bank that gives you a loan without > insisting that you give them access to your accounts?_

This is what I find so frightening about the Facebook-login-only web services.

It's the first step towards the widespread requirement of a massively asynchronous information+value exchange between customers and businesses.

<comment><USER27> If you actually mean "asynchronous", could you please explain how that is relevant? Or perhaps you meant "asymmetrical".

<comment><USER26> Thanks for the correction; I meant asymmetrical.

</comment></comment></comment></comment></comment><comment><USER28> The implicit assumption here is that judging your credit score using your social graph will give the wrong answer: as in either claim you are a deadbeat when you're not, or claim you are trustworthy when you're not.

But, judging from other stories here and elsewhere, your social graph does seem to yield mostly accurate information about you. So, most likely, you are likely to be tagged as a deadbeat or not correctly.

More meaningful, I suppose, is for those of us that are very careful about social media. I have a Facebook account, but use it very little. However, it has come in very useful in that long lost friends have been able to get in touch with me through it. I must admit, I have never really initiated that myself (ie. go search for someone). So, am I likely to be judged incorrectly solely on the basis of being a social media avoider; that is, are the banks going to say hey ignore social media stuff for this guy, or are they going to say, loners avoid social media and loners are likely to be bad credit risks?

I am definitely a member of the group that almost instinctively react negatively to the use of social media for data mining like this. I am also aware that I'm old enough that I might just be an old fuddy-duddy. I wonder how many articles were written about the loss of privacy when telephones started becoming popular and when the white pages were introduced.

<comment><USER29> People will also be incentivized to "prune" their social graphs of undesirables.

</comment></comment><comment><USER30> I'm probably going to go to downvote hell for this, but I need to say it; I'm massively disappointed startups are still using their energy and talents to service the loan industry. It's 2011 - have we learnt nothing from the past 3 years? Build value, don't destroy it.

<comment><USER31> Selecting qualified people for loans is a valid industry that promotes growth. The goal is to loan the right amount and that the person will pay it back. If you can do that accurately and loan to people who would fail normal tests then you've created significant value.

<comment><USER30> What if the person in receipt of the loan was selected with perfect accuracy but then his/her circumstances changed due to no fault of their own?

No loan is a "good" loan. Loans facilitate the reallocation of money. No net value is created and for the majority "value" decreases in fact.

I'd challenge the "leads to growth" assumption too but I'm on iPhone and I don't wish to hijack the thread. Essentially, it does not lead to sustainable growth for the majority (or the economy for that matter)

<comment><USER31> There are lots of loans that shouldn't be issued due to no fault on the person being invested in.

For instance, I've been working on opening an icecream shop for weeks and need a loan to finish the preparations and a bigger better icecream shop opens next door. Through no fault of my own, I am no longer a good investment.

<comment><USER32> It _is_ your fault if the bigger better icecream shop opens next door and _you still persevere with your original plan._ That suggests that you personally are a bad investment (not just your original business plan.)

I would be more likely to give you the money if you needed five times as much, because you had decided to sell pies or pizzas instead.

</comment></comment></comment></comment></comment><comment><USER33> The social graph is much easier to fake than paying your bills on time: Unfriend, apply for mortgage, refriend.

However this does sound an awful lot like collective punishment -- and may even open the banks up to discrimination lawsuits.

<comment><USER34> But now the data available to the credit bureau consists of you being friends with others, then unfriending them just prior to applying for credit. Which sounds like an intent to deceive, which is worth -200 points on your credit score. You didn't think unfriending people erased your historical association with them, did you? "Deleting" data is so 1995. Facebook has never deleted _anything_ , and they're not going to start. Google may be partially anonymizing some old data, but my guess is it isn't really anonymous - probably Google can reconstruct everything you have ever searched for, ever.

</comment></comment><comment><USER35> Why are we all assuming people would naturally have a large social media presence in the first place?

If I have a 790 credit score and no Facebook account, do I get a higher rate? Now you're looking at discriminatory practices based on the fact I don't engage in social media.

This is a VERY slippery slope these industries are going down.

<comment><USER36> The purpose of a credit score is to serve as a discriminatory practice.

</comment></comment><comment><USER37> Articles critical of the loss of privacy that comes along with social media often come up with this type of scaremongering. 'If you know someone that has bad credit, then you won't be able to get credit either'. Well, if your relationships do actually effect your ability to repay your debts, then banks would be right to be at least a little more wary of giving you credit - <USER2> you should not be trying to overextend your credit.

I would have said that the undesirable practices that are mentioned - such as redlining - are the result of using crude, discriminatory heuristics rather than the result of having too much data about customers. This isn't necessarily a bad development - it could enable banks to lend to more marginal borrowers if they could see they had a strong support network. Clearly, if you have a good conventional credit record, then your social credit will hardly matter. Banks that use this new source of data stupidly won't do well.

</comment><comment><USER38> I think half of my facebook friends are people whom I don't know in real life. On twitter it's probably 80%. Many of my replies and retweets are for people whom I've never met. So they won't find out a lot unless they get clever, which could be time consuming.

</comment><comment><USER39> I'd like to see actual evidence that a few bad friends are a good indication of your own credit rating. Frequency of posts, number of new friends/contacts in the last month, grammar/spelling -- all might be better correlations to your paying debts.

</comment><comment><USER40> The article is alarmist for sure. I highly doubt these startups centered around this activity will outlast the inevitable death of the platforms they're attached to.

</comment><comment><USER41> How is this not an edge case of discrimination?

Isn't this saying you are guilty by association? I see this as an infringement on my civil liberties.

This fails to take into account the element of CHANGE. Change that is as much a function of time as it is of a person's choice and circumstance.

The idea may succeed; hell, it WILL succeed given the nature of financial institutions and the online social infrastructure that exists today but it will be an aberration in the name of progress.

<comment><USER42> How are your civil liberties infringed by receiving a different rate from someone else? Why are you not busy protesting car insurance?

Also, it's not "guilty by association", it's "risk by association".

<comment><USER41> Car insurance applies to the skill of driving. And the part mandatory by law is third party insurance. So essentially, car insurance is not for your protection, its for the person you hit. The concept of owner's insurance is so you can also pay for your own car after running into a pole - this is optional.

Withholding financial goods from a person based on their social interaction is different from suspending their driver's licence because money is a _need_ and is directly related to the very survival of a person. Money, in our society, is a very fundamental requirement; driving licence is not. So this idea imposes a very real threat on my very existence. And thats why its an infringement on my civil liberty.

Judging a person's financial aptitude based on their social actions is dangerous. Not to mention the fact that social interaction isn't currently scientifically quantifiable and so all the conclusions you draw from the data are essentially opinions of the experimenter, nothing more.

</comment></comment></comment><comment><USER43> I love how we're all being reduced automatons thanks to statistics and I especially love how programmers seem to have a data mining fetish that will only help governments, corporations and banks, the same groups that repeatedly screw things up.

Also, won't some of this count as discrimination based on age, race, gender, religion, political beliefs? At least in some tangential sense?

</comment><comment> brown9-2 So, is it actually accepted that a person's creditworthiness is correlated to the creditworthiness of the people they socialize with?

<comment><USER44> The assumption that I socialize with the people on my Twitter or Facebook lists is incorrect, also.

<comment><USER45> The implied assumption (not you, the credit industry) that I value a relationship with a bank more than my friends is incredibly wrong.

I would gladly take a bullet for some of my friends. I would watch a banker drown with no guilt whatsoever on any day.

</comment></comment></comment><comment><USER46> This goes both ways. If it becomes commonplace, there will be a business in SEO'ing your social media profile. I wouldn't be surprised if a large portion of facebook will consist of networks with good credit scores all friending eachother and blogging about savings tips.

</comment><comment><USER47> How about the TV shows you watch, the books you read, and whether you call things "Grape Juice" or "Grape Drink". The problem with bad Fico is that it in itself can create self-fulfilling prophesies. Just look at Italy.

</comment><comment><USER48> If this were to get big, the industry to game it will be even bigger. Pay $500 to friend some high-credit-rated people on Facebook to get a few points off your loan. Then un-friend them after the loan is established.

<comment><USER49> Its an amazing opportunity for brokers and ilk geared for risk to join cracker circles privy to lenddo et.al algo exploits, creating a credit-metric marketplace. Game on.

</comment></comment><comment><USER50> The good news is that you don't actually need credit. Rent from someone you meet on Craigslist, spend only what you earn, ride your bike or use public transportation (to avoid mandatory insurance).

<comment><USER51> I had a harsh experience while on vacation recently.

In Miami, I was _utterly and completely refused a rental car_ because I didn't have credit history. Never mind that I could buy one of their cars, cash. They didn't want to hear it.

<comment><USER50> I have this same problem. I don't have a driver's license, so I'm not allowed to rent cars. Outrageous!

Taxis and public transportation work fine, though.

<comment><USER51> I don't normally rise to your mocking/trolling/whatever, jrockway. I am glad you are content with your life and transport choices.

In the past, I have never had problems renting cars. I rented one in Mexico the month previous, no problem. But now there is another requirement for car rental in the US, which is hard to acquire.

It was massively inconvenient to find this out in the middle of a trip to Miami, which has virtually no public transportation _or_ taxis, and spread out over nearly 80km.

</comment></comment></comment></comment><comment><USER52> They may find this useful at first, but if they weigh social media heavily wouldn't it be too easy to game to be useful in the long run? It isn't that hard to have 2 Facebook or twitter accounts.

</comment><comment><USER53> This is either really clever or frightening if its used beyond marketing. smart marketing but somewhat unethical. Interesting nonetheless.

</comment><comment><USER54> What if the only online profile I have is a GitHub account?

But seriously, 2016? I expect a totally new social networking platform to emerge by then.

</comment><comment><USER45> This is an opportunity. The same tech that the military uses for propaganda can be used against banks that scan your profiles.

</comment><comment><USER55> Some things simply need to be outlawed. Unless you truly like the idea of ending up with a caste system.

It's a slippery slope.

</comment><comment><USER56> response from a friend of mine:

"I would like to be able to run an antivirus style application on FB that identifies relationships that are a threat to my credit profile, career prospects, and caste. I want to know who to ditch."

</comment><comment><USER57> If you want a picture of the future, imagine a boot stamping on a human face — forever

</comment><comment><USER58> Who wants to buy an invite to my high-roller social network? We promise to weed out those "untouchables" who are losing their jobs and homes!

Honestly, it would only be a matter of time before we saw entirely fabricated social groups. Unless social networks start requiring photo ID/SSN to join.

Not to mention the potential this would have to further skew wealth distribution in favor of the rich while strengthening the barriers that already prevent upward economic mobility.

<comment><USER59> Reminds me of long-forgotten blog post I read where someone claimed they were able to raise their credit score by subscribing to affluent lifestyle magazines, luxury catalogs, charging small purchases from Neiman Marcus and Sacs Fifth ... just creating a trail of data that would give the appearance of being in a higher income bracket produced a lot of interesting side effects.

<comment><USER60> The thing most people don't realize is that your credit score is mostly an indication of how much the bank can make off of you, and your income. High income basically always gets you a high credit score, and making minimum payments also gets you a high credit score. Lets say two people who both have the same income, the person who pays their debts off fastest will have the lower credit score.

It's pretty easy to get a high credit score by maintaining a balance on a high interest credit card.

</comment></comment></comment><comment><USER61> People that use facebook don't care. They would rather use facebook than have privacy, thats the bottom line. To them the benefits on facebook outway the problems.

For most people if you told them they would die in 10 years if they continued to use facebook, they would still use facebook. For a lot of websites today and apps, you can't even login or do anything without a facebook profile.

Find me one person that is outraged and dropping their facebook account in light of this information.

On top of all that banks aren't lending money nowadays anyways.

<comment><USER62> _People that use facebook don't care._

That's pretty obviously not true because "what they care about" can change a lot.

"Facebook is using face recognition!" = OK, no huge deal. "Banks are using your info for credit scores!" = a big deal.

If someone has those responses they aren't being inconsistent. "Privacy" has a variable definition, so "Facebook users don't care about privacy" makes no sense.</comment></comment>


Google I/O Keynote, a summary - <AUTHOR> http://rajatkhanduja.com/techblog/2014/06/26/tech-news-google-io-keynote/

<comment><USER2> There was a lot of neat stuff shown off at I/O, but I was sort of bummed that they didn't announce a programming language update for Android. I'd been hoping that they were going to unveil a move to Java 8. I suppose the legal issues around that might prevent it from ever being feasible.</comment>


Refill cartridges cost more than a new (fully loaded) printer - <AUTHOR> https://plus.google.com/101416274833608453021/posts/T9iENrg8roa

<comment><USER2> I looked up the model number, and two interesting facts are not pointed out (as Sebastian probably did not expect this to appear all over the internet).

The first fact is that HP offers the printer and cartridges at similar prices on their web site. This means the discrepancy is not due to a crazy sale on Amazon. Even according to the HP web site, the price of four replacement cartridges is $822, while the price of the printer (which includes the cartridges) is $699. Though Amazon reports that at some point, the printer may have been sold for up to $885 since it was launched in October, that's still almost identical to the cost of the cartridges.)

Second, also by design, the printer comes with the full cartridges, not starter ones...

[http://h10010.www1.hp.com/wwpc/us/en/sm/WF28a/18972-18972-33...](http://h10010.www1.hp.com/wwpc/us/en/sm/WF28a/18972-18972-3328060-15077-236268-4184772-4184773-4184776.html?dnr=1)

<comment><USER2> I can only imagine that:

1) HP makes a profit when people buy this $699 printer (though not as large as when they sell four ink tanks without a printer for $822);

2) Every printer re-purchase helps maintain their 40% marketshare in the printer business, if it's measured by printers sold rather than cartridges sold;

3) Every printer re-purchase keeps a sale away from Brother or another competitor;

4) HP's printing division has now been merged into the declining PC division, so nobody would notice the declining printer margins amongst lower-margin PC's anyway.

"HP's new CEO Meg Whitman, who calls the printing division "the lifeblood of HP," responded to the decline by folding it into the PC division, which saw a 15% drop in revenue last quarter. _That will solve one problem: concealing the extent of the decline in HP's printer margins by blending it with lower-margin PCs._ More practically, it could give HP greater leverage in negotiating prices with component suppliers."

From: <http://tech.fortune.cnn.com/2012/03/29/hps-printer-problem/>

</comment></comment><comment><USER3> The printer usually comes with less ink per cartridge than the refills. So buying a new printer every time you run out of ink is not cheaper than buying the refills.

Nor practical.

<comment><USER4> When my $50 laserjet runs out of ink (going on 3 years now; I don't print much), I may just leave it at the end of the driveway and get another $50 printer, even if the > $50 cartridge would last longer than the starter cartridge.

<comment><USER5> You should check check the prices first. I know I looked into Brother lasers, and the preinstalled cartridge is only rated for 600 pages. A high-yield black toner cartridge is only $47 and prints 2600 pages. And $50 doesn't get you much of a laser printer.

<comment><USER6> And the rating of 600 pages is low, it is determined in software on the starter toner. On my brother, there is a small hole on the cartridge that light is passed through to detect the toner level.

My printer is at 3200 pages on the starter toner because I put a piece of tape over the sensor which makes it believe it is always full of toner.

New printers from Brother which I bought the same model for my in-laws, have solved this hack. But you can buy a replacement gear online for a few bucks, it pops on, and then you have access to the same method I used to trick the printer.

Once the stater runs out, I will get a toner replacement and also tape the sensor. Even if it prints a little light, all it takes it taking the cartridge out and shaking it a little. This will buy you another month.

If you are on Mac OS X or Linux and access the printer through CUPS, ( not sure about Windows and how to access these settings ) and you can set the DPI to a lower rate and put it in toner saver mode. I can't tell a difference unless I have a side by side to compare. Plus, this is just black and white so invoices, driving directions, stuff like that. I don't care about the quality of a halftone image.

<comment><USER5> Should note that doing this can damage the printer. The toner particles that don't stick keep getting recycled back into the cartridge until eventually clumps of that crud are most of what's in it, and you're still trying to use more and more voltage to pull it out onto the paper... possibly getting it stuck somewhere else in the printer, damaging the drum, clogging a fan, or any number of risks.

If you're 5 times past the rated capacity of the cartridge and it's printing light, instead of shaking the crud around and putting it back in, just buy another cartridge... unless you WANT to destroy your in-laws' printer and burn their house down.

<comment><USER7> Citation needed. I have never heard of a house being burned down by this means.

</comment></comment></comment></comment></comment></comment><comment><USER8> Ug:

> _"Sounds like a market begging for disruption."_ (in comments)

There have been 'disrupters' at work for many years now. I wish people wouldn't assume that (a) this sort of market distortion hasn't been noticed for years, (b) leveraged for almost as many, and (c) that there are actually reasons why the market delivers these prices.

<comment><USER9> It is interesting to note that Brother and Kodak didn't even seem to put a dent in the market leaders with their "rational" business model.

</comment></comment><comment><USER10> That's why I installed and use BULK INK refillable instead of the original cartridges in all my printers. Costas are 97% less than original ink. This is my printer with the external bulk ink: <http://bit.do/bulkink>

<comment><USER11> Did you do it yourself or can this be bought ?

</comment></comment><comment><USER12> One solution is to not print, except when absolutely necessary for legal/financial events. Go to UPS or Staples to do the few printings per year that you absolutely must do.

My printer hasn't printed for at least a year. The scanner still works, and UPS/Staples is just down the street. Not for everyone, works for me. HP can die in a fire.

</comment><comment><USER13> A lot of folks point toward much-less expensive third party toner cartridges and refill kits. I tried that route with my two Konica Minolta color laser printers and had _horrible_ experience with cartridges/kits from several vendors: toner leaking in the printer, streaks, squeaking, colors that were off, etc.

YMMV but for know I'm sticking with OEM toner. And yes, the toner 4-pack is more expensive than a new printer. So much so that when I used up the toner on my printer I bought a new one since I wasn't all that satisfied with the printer I had.

<comment><USER14> Same here, with a recent HP color laser printer. It's not worth the hassle for me to use the third-party cartridges.

<comment><USER15> I picked up a HP LaserJet 4000 for $10 at a thrift store a few years ago. $40 for some RAM, a NIC, new toner cart, and a duplexer and I've enjoyed one hell of a great printer.

The 3rd party black toner carts have never given me issues. Is there something different about color toner? Has the fact that my printer is 15 years old allowed 3rd party toner/cart makers time to "get it right"? Or are new printers just crap in comparison to older models?

</comment></comment></comment><comment><USER16> That's how it's been for years (always). Also, that's the reason why they put authentication chips in those cartridges to try to stop you from refilling them or putting in cheap alternatives. However, this doesn't stop the counterfeiters and you can get the cartridges for tenth of the price. [http://www.alibaba.com/product- gs/569376994/CE400_1_2_3A_Las...](http://www.alibaba.com/product- gs/569376994/CE400_1_2_3A_Laserjet_Color.html)

</comment><comment> B-Scan That's a "bait and hook" business model, just like Nespresso's: <http://www.businessmodelinspiration.com/?p=55> and Gillette's: [http://www.boardofinnovation.com/business-revenue-model- exam...](http://www.boardofinnovation.com/business-revenue-model- examples/bait-and-hook)

</comment><comment><USER17> This. And try downloading a driver to run a HP printer and you will be forced to download a 750 MB "HP Digital Solution" crapware.

Thats why I avoid HP printers.

<comment><USER18> My favourite feature of Mac OS X is one ruthlessly stolen from Windows 98: most contemporary printers will just "work" when you connect them up. No need to install any drivers. And you don't just get a basic driver, you get a full- featured driver that can operate all the printer's features, tell you the ink levels, and not fill your computer up with garbage.

</comment></comment><comment><USER19> Hasn't it been long established that printers are a loss leader? I have a HP printer that cost me peanuts and at every opportunity the printer pushes me to purchase HP printer cartridges. Yes you can game the system but most people don't understand that and it never crosses their mind because of how absurd it is.

<comment><USER5> This isn't the case for consumer printers anymore, though. Ink isn't as expensive as it once was (HP/Lexmark/Epson/Canon all have $10-15 black inkjet cartridges), and printers don't ship with so much ink that it's cheaper to buy the printer. It's the same with low-end laser printers too; a $99 Brother comes with a 600 page cartridge, where a $50 replacement prints 2600 pages.

I guess the situation is different for business-grade stuff where the toner costs $800 a pop.

</comment></comment><comment><USER20> <http://theoatmeal.com/comics/printers>

</comment><comment><USER21> I remember getting a new printer _and_ extra ink for less than a refill:

[http://ask.slashdot.org/story/09/12/03/211250/what-do-you- do...](http://ask.slashdot.org/story/09/12/03/211250/what-do-you-do-when- printers-cost-less-than-ink)

</comment><comment><USER22> The original printer claims it comes with 6000 page yield color cartridges but a 5500 page yield starter cartridge for the black.

There are also 2000 page low yield color and 11000 page high yield black cartridges available.

The replacement cartridges he is looking at are 6000 page yield for color and 11000 for black. So the black is twice the capacity of the original.

You can also find aftermarket compatible toner, the high yield version 10,000 black and 6,000 for each color, for $330 for a complete set of cartridges for this machine - <http://www.lenscomputers.com/hp-m551-vp.html>.

</comment><comment><USER23> Some websites allow you to sort printers by price. They then list the cartridges that you can use with those printers.

But some people would want to sort the carts by price, and then see the printers that accept those carts. These people can't (for whatever reason) use toner refills or third-party carts. (There is a complication with number of sheets printer per cart, but that's easy enough to fix.)

And if you're a toner refill company some people will buy printers based on how much they'll have to spend to get new toner, so listing your cheapest print-per-page refill kit would be useful.

</comment><comment><USER24> Epson went even further: <http://pryf.livejournal.com/1829152.html>

It's in Russian, but look at the pics: it's the same cartridges made in 2010, 2011 and 2012.

<comment><USER25> Epson is never mentioned in the linked blog post, it says those are HP ink cartridges.

Also according to original story those are only from 2010 and 2012 + another model added for comparison: HP 350/2010 _(left)_ , HP 350/2012 _(center)_ , HP 301/2012 _(right)_.

Original non-blogspam article in English: [http://www.hpinkcartridges.co.uk/technology- blog/2012/05/hp-...](http://www.hpinkcartridges.co.uk/technology- blog/2012/05/hp-introduces-nano-sponge)

</comment></comment><comment><USER26> You can get really cheap refill cartridges on Amazon. I paid maybe 8 bucks for C Y M and x3 B. They're not 'official' but they work just fine, in my case better even than the normal ones.

</comment><comment><USER27> Is there a good reason why someone hasn't done a Dollar Shave Club business model for printers + inks? I would think it would decimate the ink racket.

Granted, it may have been tried numerous times and failed due to the hardware dominance the major printer players enjoy (and throwing out an existing printer isn't the same as throwing out a razor from Gillette, so you have to capture transitional customers). And of course hair grows fairly consistently, whereas ink usage is less consistent - but offices can always stock back a couple cartridges if they're not using enough and downgrade their account with the click of a button until they burn through them.

<comment><USER28> Easier to stock 3 blade types and 3 handles than 500 diff ink types. That only obstacle I see. Also people don't buy ink so regularly I have no idea what intervals I buy ink at

</comment></comment><comment><USER29> I don't own a printer for home use and most likely never will.</comment>


CSR Violates GPL. Bluetooth IDE Comes with GCC. No Sources Provided - <AUTHOR> https://forum.csr.com/forum/main-category/main-forum/software/54778-gpl-sources-please

<comment><USER2> I think they're unlikely to take a demanding forum post like this very seriously. Also, it's unclear which sources you're asking for; is it just binutils and gcc, or are you asserting that the entire IDE is virally GPL'd?

<comment><AUTHOR> The forum was the last attempt, after emailing their support back-and-forth about other issues, and them suddenly shutting up and not replying about binutils and gcc sources</comment></comment>


Alibaba Lawsuit Throws the Spotlight on Fake Reviews - <AUTHOR> https://www.bloomberg.com/news/articles/2016-12-19/alibaba-lawsuit-throws-spotlight-on-brushers-gaming-rankings <comment><USER2> This is somewhat funny to me, because while the article is about Taobao, Alibaba's other sites are rampant with not just fraudulent reviews, but fraudulent sellers in general.

I buy quite a bit of stuff from their AliExpress.com site. These are inexpensive things, so I know what I'm getting into, however...

At least one of out every 10 orders ends up having a serious problem. Items that never ship, items that don't work (and clearly weren't designed to work, ever), and so on. Their process to deal with these sort of things is heavily weighted in favor of the sellers. For example, the sellers get cheap shipping due to the UPU[1]. So, they will demand you return an item to get a refund. Well, as a buyer, I have no such access to cheap shipping...so the return shipping costs more than I paid for the item itself.

I also see little to no effort on Alibaba's part to curb things like

\- Deliberately inaccurate item titles and descriptions

\- "Stuffing"...one vendor creates hundreds of nearly identical listings to game the search functions.

\- Shipping delays...not in-transit, but sellers sitting on orders for weeks before shipping out

\- Fake, defective, or otherwise substandard merchandise

Basically, it's silly to me that they are chasing other companies when they could just start by cleaning up their own house.

[1][http://fortune.com/2015/03/11/united-nations-subsidy- chinese...](http://fortune.com/2015/03/11/united-nations-subsidy-chinese- shipping/)

<comment><USER3> Hm, I've ordered loads of inexpensive stuff on AliExpress as well, probably around 30 orders. The only problem I've ever had was that I received the wrong item once (DHT11 instead of DHT22), and the seller promptly refunded it. I mostly buy electronics components. It does require a bit of careful reading to know what exactly you're buying, though.

<comment><USER2> It does depend on the item. More consumer oriented things tend to have more fraud, because they know there's a more gullible, and larger audience.

Things like guitar effect pedals. I ordered one where the plastic molded casing design was such that it would never click the switch underneath, and never could have :)

Most of the orders I do are basically trying to find new sources for things we sell, so I have a larger sample size...more than a thousand orders over the years.

<comment><USER3> Ah yes, that does make sense. I guess it wouldn't be very lucrative to sell non-working electronics components. But consumer things that are just way worse quality than expected (or just not caring about manufacturing defects) could probably turn a nice profit :(

<comment><USER2> There is bait-and-switch in the electronics arena. Ordered an FTDI usb-to- serial adapter, got a counterfeit Prolific adapter. Wrong chipset, and not even a genuine wrong chipset.

</comment></comment></comment></comment></comment><comment><USER4> Going off a tangent on this, (paid) fake reviews on the Chinese AppStore is so bad that the official ranking is saturated with random cash grab apps and games, and even publishers with a legitmate following has to pay for brushing if they want any exposure at all. Not a very healthy state of things to say at least.

<comment><USER5> Apple's one?

<comment><USER6> Yes:

[http://www.cultofmac.com/311171/crazy-iphone-rig-shows- chine...](http://www.cultofmac.com/311171/crazy-iphone-rig-shows-chinese- workers-manipulate-app-store-rankings/)

The problem with China is that if pressure is big enough someone will create an alternative app store for jailbroken devices and then iphone in China will go downhill the same path Chinese Android did...

</comment></comment></comment><comment><USER7> Brushing is an interesting hack, tt seems that no matter what you do online, someone will figure out how to game it, and profit by not actually doing anything.

</comment><comment><USER8> anyone actually buy anything from alibaba as north american? I'm curious about the experience.

I'm half heartedly buying shitty items on Amazon I don't even need. So far, items shipped and made in China have not failed in furthering their reputations of poor quality goods. It made me think twice about ordering from Amazon on a whim. There's a good chance it won't come in time if it's shipped from China.

<comment><USER9> I've bought a couple of electronic items on alibaba and had a good experience- Clearly, you have to pray that the product works correctly, since returns/refunds are pretty impractical.</comment></comment>


Apple's Mac OS X update breaks Perl - <AUTHOR> http://www.theregister.co.uk/2009/02/16/apple_update_perl_breakage/

<comment><USER2> It says this problem occurs only if "you've updated the distro via CPAN".

Conventional wisdom says that you don't mess with most of /usr, you only add to /usr/local; and on Mac OS X, you don't mess with most of /System/Library, you add to /Library.

So people shouldn't be trying to patch the system Perl, they should be installing their CPAN modules in a separate place (e.g. /usr/local/lib/perl5).

As long as /usr/local isn't blown away, the OS vendor can do whatever the heck they want to the rest of /usr, including reverting it to a known and supported state.

</comment><comment><USER3> Perl is dying. On OSX, with updates killing perl.

</comment><comment><USER4> Wow. People still use Perl?

<comment><USER5> A few small sites like Amazon and Slashdot still do.

<http://jobs.perl.org/>

<comment><USER6> I've heard of amazon, but what is slashdot?

<comment><USER7> <http://lmgtfy.com/?q=slashdot></comment></comment></comment></comment>


Show HN: Twitter bot uses deep learning to "read" comics - <AUTHOR> https://twitter.com/BotReadsComics <comment><USER2> This is wonderful - some of the captions I'd love to see illustrated in their own right.</comment>


Killer Acquisitions - <AUTHOR> https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3241707 <comment><AUTHOR> Quoting an author: In our "Killer Acquisitions" paper we document the same effect in pharmaceuticals where dominant incumbents acquire small entrepreneurial startups and then kill the innovation because it would otherwise cannibalize the profits of their own existing drugs.

There are also other papers that show that increasing concentration is terrible for innovation in pharma ([https://econpapers.repec.org/article/eeeindorg/v_3a63_3ay_3a...](https://econpapers.repec.org/article/eeeindorg/v_3a63_3ay_3a2019_3ai_3ac_3ap_3a283-325.htm)): horizontal mergers not only decrease the innovation intensity of the merging parties, but even the incentive to innovate of other competitors.</comment>


HTTPS crypto's days are numbered. Here's how Google wants to save it - <AUTHOR> http://arstechnica.com/security/2016/07/https-crypto-is-on-the-brink-of-collapse-google-has-a-plan-to-fix-it/ <comment><USER2> First and third paragraphs make strong claims, mentioning forecasts for crypto doomsday scenarios but offering no links.

For those of us living under a rock, how realistic are these applications of quantum computing?

<comment><USER3> Realistic in the sense that we will one day have scalable quantum computing? Very. There have been a few (non-crackpot) people in QI and adjacent fields who have argued that it will be impossible indefinitely (one I know of is Gil Kalai), but the consensus that this is physically possible is pretty overwhelming.

As to timeframe? Estimates are all over the place but some groups have made promising and somewhat unexpected strides in the last few years (Martini's group at UCSB/Google have done some particularly impressive things). If people in quantum information get extraordinarily lucky, even the more optimistic estimates (usually ~20 years) could be shortened dramatically. Considering how long it takes to roll out totally new crypto, we really should've gotten started yesterday.

The biggest complication is that all our quantum-resistant encryption systems are young and untested by crypto standards. We don't want them to be our first line of defense until we have more confidence there won't be some unfortunate way to beat them with a Python script on a laptop in 15 seconds. This seems like a good compromise, especially if they can do it without increasing the number of roundtrips in the handshake (I don't in principle see why they couldn't do both in parallel, but I'm not sure how feasible that is with TLS).

<comment><USER4> > but the consensus that this is physically possible is pretty overwhelming

Most of what I read is "it might happen". No one knows for sure. Most of the claims come from people in need of funding for Quantum research, so this is to take with a grain of salt.

<comment><USER5> As I understand it, the consensus is:

1\. Quantum computers do exist in reality, as in we can build qubits, shove them through quantum gates, and read the results.

2\. Quantum computers that are large enough to do anything useful don't exist.

3\. It's not clear if we can practically build systems that hold 000's of qubits without letting them decohere.

4\. D-Wave's quantum computer isn't a quantum computer for the purposes of what most people talk about with quantum computing. It also doesn't look better than classical computers.

</comment></comment></comment></comment><comment><USER6> Another description of the mod. they made: [https://medium.com/@sergey_nog/google-learning-errors- rings-...](https://medium.com/@sergey_nog/google-learning-errors- rings-a944281967f3#.51skfk6up)

</comment><comment><USER7> Given the history of past innovations in cryptography (public key), it's reasonable to assume that there are quantum machines in the works or already operating (to some extent) behind closed doors inside institutions that benefit from having everyone believe such a capability doesn't exist yet. We don't know if someone has it, but I don't agree with Google's remark that there's no imminent threat. It's wise to assume it does and speed up R&D of production PQC. Even if it doesn't exist, there's enough data that can be recorded now and is still valuable to decrypt later, so it makes a lot of sense to implement and deploy PQC.

Edit: To rephrase: even if we don't know of any capable system, it's wise to take precautions now. I'd compare it to a storm shelter. You don't unpack a blowup storm shelter once the weather report comes in. You prepare, assuming the worst. I'm not arguing that someone has such a system, but that we don't know and have been proven wrong before only after Whitman and Diffie combined the pieces and had to fight for publishing their results. NSA and BT came forward after their paper was published and wouldn't have otherwise.

<comment><USER3> > it's reasonable to assume that there are quantum machines in the works or > already operating (to some extent) behind closed doors inside institutions > that benefit from having everyone believe such a capability doesn't exist > yet.

I would be very surprised. Somehow, the more clandestine parts of governments would have had to siphon off a whole _ton_ of people working in quantum information (physicists, engineers, mathematicians), which is a relatively new and close-knit field, without anybody noticing. Or, people who work in collaboration with parts of the government (NIST and UMD's JQI) are all making up work that looks like they haven't cracked it yet, when they really did last year.

If all the NSA needed were mathematicians and electrical engineers that specialized in classical computing, then I could believe they had something going on. As it stands, most people in QI seem to land in industry, academia, or perhaps some national laboratories, not report to Fort Meade or fall of the face of the Earth.

This would be like doing the Manhattan project, but with the extra complication finding convincing body doubles for Feynman, Oppenheimer, etc.

<comment><USER8> There's a good point in GP's post though. The thing is, one day quantum computers WILL BE available to the NSA or whatever. And they also have the means to record all encrypted transmissions (and they probably do). So one day, the NSA will be able to crack those transmissions that are using pre- quantum algorithms.

Using post-quantum algorithms ASAP would at least make sure that from this point on, we're "safe" from quantum computers making a sudden appearance tomorrow.

<comment><USER3> I don't contest that at all, I'm very much in the "let's have post-quantum redundancies here yesterday" camp. I just found it hard to believe (though I was quite entertained by the conjecture) that the people I know in QI are either NSA impostors or stupid enough to fall for NSA impostors of their colleagues.

</comment></comment></comment></comment><comment><USER4> This was the title of the article yesterday: [https://twitter.com/lyon01_david/status/751530478335823875](https://twitter.com/lyon01_david/status/751530478335823875)

> HTTPS crypto on the brink of collapse. Google has a plan to fix it.

Apparently it was changed for a less click-baity title. But in my opinion it still shows a bias on the hypothetical outcome of Quantum Computers. No, HTTPS crypto's days are not numbered for sure.

</comment><comment><USER9> HTTPS is no longer end-to-end encryption as everybody from corporate networks to load balancers to governments transparently MiTM.

The three big things that need to be solved are:

\- How to do fault tolerate distributed end-to-end encryption

\- How to develop a stronger trust model than exists in PKI

\- How to move from an privatized ownership model of trust (CAs) to a public individualized model of ownership (web of trust doesn't seem to work)

<comment><USER10> So you're assuming there are compromised CA keys in the hands of governments & corrupt corporations?

Even if this is true, isn't it mitigated by certificate pinning?

<comment><USER9> It's well known that governments are trusted CAs themselves in addition to their having 'shadow certificates' (issued by CA's to impersonate other identities) as well as compromised CA certificates. There's no assumptions there.

With regard to corporations, most large ones configure employee browsers to trust corporate proxies which can see their traffic in plaintext. That's not unusual at all.

Certificate pinning very partially mitigates these issues. It should be done, but pinning certificates (as fragile as that process is to begin with) isn't enough when you can't trust what you're pinning to begin with.

In short it's a good idea to use certificate pinning but in no way should be thought of as a fix for fundamental problems that exist in PKI.

I might add Moxie's concept of "trust-mobility" to the list of things in the list up the comment stack.

</comment></comment></comment><comment><USER7> Can someone explain how the stacking on top of existing crypto works? Is it redundant (aka double)?

<comment><USER11> This is pretty simple: The results from the two key exchanges are concatenated and hashed. The result is used as a TLS session key. The idea is then that in order to attack this an am attacker would need to break both key exchanges. Thus even if one of them is insecure the combination still stays secure.

This is a well known method, but it's rarely used. Usually we are confident enough in our algorithms and most people don't see a need to combine them.

<comment><USER12> How do we know the inner cryptography isn't weakening the outer cryptography? Couldn't they conflict somehow, making the message easier to decrypt?

<comment> Ar-Curunir It because the hash function is just looking at a concatenation of two (computationally) pseudorandom strings, and output the hash of that.

If either method is broken (but not both) there is still enough entropy to create a safe key.

</comment></comment></comment></comment><comment><USER13> As a crypto layman, can someone explain to me how PFS plays into currently used TLS schemes?

Am I correct in assuming that each session would still need to be decrypted individually, even were one in possession of a trivially-decrypting quantum computer?

<comment><USER14> Each session would need to be decrypted individually, but if it only took you a few ms per session, you could essentially decrypt as many as you want.

<comment><USER3> Moreover what we know from the physics of our current general purpose quantum gates (different rules apply for quantum annealers like the D-Wave but these cannot perform Shor's algorithm) it is unlikely it will take more than that to perform a computation. Quantum states in circuits decohere quite rapidly; this is the main obstacle we face in developing them. Chances are we won't have a choice but to do things relatively quickly with quantum computers (there are some possibilities where we need to take time to prepare resources for the computation, but these have the advantage of being trivially parallelizable).

On the plus side, all quantum algorithms will be unable to perform a Logjam- style attack[1] where you do part of the computation once because the same parameters are reused by many servers. You can't copy quantum memory in any useful sense.

[1]: [https://weakdh.org/](https://weakdh.org/)

</comment></comment></comment><comment><USER15> Recent discussion about post-quantum cryptography at Google: [https://news.ycombinator.com/item?id=12050220](https://news.ycombinator.com/item?id=12050220)</comment>


Tech Money Sends Funds on the Hunt for Unicorns - <AUTHOR> http://www.nytimes.com/2015/03/23/business/dealbook/tech-money-sends-funds-on-the-hunt-for-unicorns.html

<comment><USER2> This article adds depth to concerns raised in this thread: [https://news.ycombinator.com/item?id=9192154](https://news.ycombinator.com/item?id=9192154)

It's important to recognize that private capital isn't simply "rich people playing with their own money". The lack of transparency and accountability in this sector is going to have negative consequences.</comment>


Using an oscilloscope as a Gameboy display - <AUTHOR> http://flashingleds.wordpress.com/2011/02/13/nintendoscope/

<comment><USER2> As the creator of a similar oscilloscope hack (the Terminalscope: [http://hackaday.com/2010/02/24/oscilloscope-doubles-as-a- ser...](http://hackaday.com/2010/02/24/oscilloscope-doubles-as-a-serial- terminal/)) I find this very cool. If Craig is reading this, thanks for the shout-out :)

I'm not intimately familiar with the Game Boy's video signals, but I wonder: why the fancy microcontroller and digital-to-analog converters? The Terminalscope just uses a couple of op-amps to generate the horizontal and vertical sweeps. The microcontroller doesn't have to worry about moving the beam, so the refresh rate is very high and there's no flicker.

Maybe I should try this with my old Game Boy: the LCD is starting to die anyway...

<comment><USER3> You're welcome =)

As noted in the comments of that post, I'm doing a raster display with vector display techniques. Opamp sweeps are indeed a more sensible way of rastering, but the internal DACs on this microcontroller are fast enough to keep up anyway.

What's killing the refresh rate is the settling time for the (crappy) external dac doing the 4-shade colour. Your terminal application only deals with beam on/beam blanked so you can run it a lot faster.

By all means give it a go, it's a pretty satisfying project. I have no doubt you can improve on my version.

<comment><USER4> If you used an opamp sweep for one of the rastering dimensions (probably the horizontal), wouldn't that free up one of the DACs so you could use it for the shading?

<comment><USER3> It most certainly would, and you'd probably want to do the vertical sweep as that's the slowest.

</comment></comment></comment></comment><comment><USER5> The model of a good HN post. Not only does it do something interesting to geeks, but, unlike "Star Wars On A Floppy Drive", actually takes the time to explain how it worked. Less cat - photos - in - geek-post - clothing. More like this.

Also, coolest thing I've seen done yet with a Salae probe. Those things are cheap, tiny, cool looking, and make great gifts; we've given them to job candidates before when things didn't work out.

</comment><comment><USER6> This is probably one of the coolest hacks I have ever seen.

Practical? Hell no. Awesome? Hell yes.

</comment><comment><USER7> Achievement Unlocked: God of Nerds

</comment><comment><USER8> Masterfuck!</comment>


New York Experiments with a 'Holy Grail' to End Gridlock - <AUTHOR> https://www.politico.com/magazine/story/2019/05/23/new-york-city-without-cars-transportation-226927 <comment><AUTHOR> I think the actual holy grail would be billing everyone a small amount per road-minute spent in the zone, not a large amount for entering. If you enter and immediately park in a garage, you're not causing congestion. If you circle the block endlessly, you are.

(Separately, we should bill for street-parking-minute spent, but that's a separate issue.)

Does the technology exist for this?</comment>


Ask HN: What blogging service/software do you use? - <AUTHOR>

I have been blogging on and off for the past 6 years or so. During this time I have used blogspot, wordpress.com (hosted) and recently hosted my own wordpress on a VPS.
Just last week my web site was down and I got an email from my VPS provider (a cheap $25/month service provide who shall not be named) telling me that I lost all my data. Yes, I am at fault for not taking back ups of my blog posts but between the code that I need to protect and my personal documents I have not treated my blog post content as top class material (lesson is learned).
At this point, I am in search of a new blogging solution that will let me post content easily, give me some sort of a backup, is not going to require updating the software every month. I am willing to go either the service or installed software route although my preference is a no hassle hosting.
Preferably this solution should cost me less than $20/month. What are your suggestions? What do you use?
Thanks in advance. <comment><USER2> I once had a VPS provider lose everything. And shame on me for not having current backups.

And that was when I switched to blogger. While I have yet to do it for myself, I've setup some sorta automated backup of the text from blogger for my wife. I should look at doing that for myself b

</comment><comment><USER3> I wrote my own, and opened it for other people to use.

<https://jekyllhub.com>

Can you email me? I'd like to chat about blogging. firstname.lastname@example.com

Cheers,</comment>


Hacker's extradition put on hold - <AUTHOR> http://news.bbc.co.uk/2/hi/uk_news/8327179.stm <comment><USER2> I got through 5 or 6 of the articles RiderOfGiraffes pointed to, and it appears that the case for not extraditing this guy is:

* He has Aspergers

* He's been threatened with a 60 year sentence if he doesn't cooperate

* He's "terrified" of going to a US prison

* He could end up in Gitmo

* New Jersey officials want to "fry" him in the electric chair

* So they should just try him in the UK under UK misuse laws.

And I mean, whatever. I'd be terrified too. But then I'd also be terrified if I robbed a liquor store and got caught, Aspergers or not. The reality is, this guy would probably do 1-2 years, like Abene and Mitnick (even Mitnick did minimal time after his trial concluded). The "terr'ist!" and "gitmo!" stuff is just jingoism. He'll clearly get a better deal in the UK, and his family has to pull for that by any reasonable means necessary.

<comment><USER3> _New Jersey officials want to "fry" him in the electric chair_

 _The "terr'ist!" and "gitmo!" stuff is just jingoism._

But... that's what we do in the US. Execute computer hackers. In a state that has banned capital punishment, no less.

My favorite pastime is calling up the sheriffs posse and having a good ol' lynchin' for petty thievery, cavort'n and port scann'n.

<comment><USER4> I would prefer the electric chair to 60 years in a US federal prison.

</comment></comment></comment><comment><USER5> For some background on this:

<http://searchyc.com/extradition></comment>


Linus Torvalds: 'I Do No Coding Any More' - <AUTHOR> https://linux.slashdot.org/story/20/07/03/2133201/linus-torvalds-i-do-no-coding-any-more <comment><USER3> > _commit messages to me are almost as important as the code change itself_

This is high on my list of code craftsmanship points. It's very difficult to explain to young programmers who have never worked on an old code base how valuable this is when done well. In fact, often you hear complaints about how a code base "is crap", but more often than not I'd wager this is just a result of the context at the time not being known or appreciated. Frankly, all code we write is heavily governed by context we take for granted at the time, but is in precious short supply 1, 5, 10 years later. If you come back with a different use case later, the original code may very well be unsuited for that purpose. We can argue all day about good judgement and YAGNI, but at the end of the day no one can see all ends, therefore the best we can do is document clearly why we did what we did.

Taking the time to rebase, cleanup, and explain your changes in detail will pay huge dividends for any long-lived project. I've literally had successors write me a thank you note for a commit message from over a decade ago because I take this so seriously.

<comment><USER4> I write detailed commit messages for every single commit I make(even though commits would be squashed on merges), I write detailed PR descriptions that included before/after screenshots in multiple resolutions whenever relevant. Never once did I have any indication that someone took their time to read descriptions or commit messages.

In my previous job, I received some feedback from my manager that some people complained about code quality of my work, I was dumbfounded, I have no problem with being criticised, but I at least wanted to be able to learn from it and adapt. I went back through every single PR I did at the company and found little to no comments and it made me feel personally attacked with very little evidence. I then went on my peers PRs and see what I could learn from them, most PRs included highly non-descriptive commit messages and descriptions often only included a link to a JIRA ticket which most of the time was only visible to their direct team members and not me. From that I took the position of being more demanding on not just code quality during reviews but also descriptions, I didn't manage to influence a single developer to improve documenting efforts. That was a major reason why I eventually left the company.

I continue to be a believer in taking your time to write good commit messages, I have yet to collect dividends from it however.

<comment><USER5> Yep, no one ever reads them and the cost to benefit ratio is extremely low.

Writing good comments is far more important. Don't explain what the code does - that's what the code is for, explain the _why_ and the background information in the code. Additional, explain what the code does at the function level or at the module level - at a much higher abstraction level basically than the line of the code.

No one ever looks at the commit messages when trying to figure out what the code does as it convolves history and state of the repository, having to contextually wrap your head around when and how this commit was added.

Inline documentation? Perfect.

<comment><USER6> I look at commit messages quite often working on a 10+ year old code base.

Bisect leads to the commit, the commit message explains why the change was made. I take the explanation from 10+ years ago and determine if the reason still applies today.

Or, I bisect and there's a low quality commit from 10 years ago from a person long since departed that simply says "fixup" and I'm dead in the water.

<comment><USER5> Commit messages are supposed to be short. "Fixed stuff" is totally wrong. I usually write "Added ability to do foo with bar when baz is true."

Commit messages aren't mutually exclusive to the inline documentation.

I am making the case that inline documentation is _far_ more important than commit messages.

<comment><USER7> "Supposed" to?

Git was made with the intention that commit messages look like whole emails, describing not only why the change was made but also the thought process behind it, why this particular solution was chosen instead of some other etc.

What you describe is a decent header, although most people would probably prefer "Add ability to" (not "Added ability to", this is a custom that goes way back before git).

Inline documentation, or comments, is something else entirely. That is a moving target that can describe intended usage, remote APIs, and hard to understand passages. Commit messages describes a particular changeset, at a fixed point in time.

Google it, and see that most people's ideas of a good commit message goes way beyond the header ("shortlog") line.

<comment><USER8> GitHub discourages making commit messages longer than a certain number of characters; it's interesting for me to see other opinions on that.

<comment><USER9> You're talking about the title of the commit message. Yes, the title is supposed to be under 50 characters. Now add a blank line after it and you can write all you want (line wrap at 72 chars).

If you use markdown Syntax in your commit body, github and other tools will gladly render it correctly. You can grep for commit messages with "git log --grep <pattern>" and it will also search commit bodies as well. It's beautiful!

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> This is sad, not so much because of the lack of code coming from this world class programmer, but because coding is such fun, and Torvalds isn't having fun programming, else he'd be doing it.

I'm closing in on forty years of coding and still get a kick out of it. I'd still be doing it if I weren't getting paid for it. But my skills are at best, uh, modest compared to Linus. I'd think that doing a thing so much better would only be that much more fun. But this is a data point against that correlation.

<comment><USER11> Coding is fun but for me collaborative development has stopped being fun. People can be rude, biased, and it seems there is always someone with 50 questions or a concern who sucks the life right out of it.

<comment><USER12> This is what I don't like about open source, it seems to encourage these sort of behaviours.

<comment><USER13> That's interesting, because every office I've been in is like this while working only with and building proprietary software

Tool flame wars, constant bike shedding, "that's too abstract" premature optimization wars (apparently a list comprehension is too abstract for some eng, if-else all the way down!). Every Medium post by a tech somebody becomes a religious soapbox.

I quit it all but kept my job. People complain I skip meetings and take Friday mostly off.

But my stories are done by Weds, so really I take Thur off and just do work log updates Fri to make it look like I was still working.

And the reason they're done by Weds is cause I do the programming and skip everything else.

Job life feels like being in high school anymore. It's about social appeasement, debating well trodden concepts at length, and exploring little new ground.

Import toolkits and go home. Like most creative endeavors, writing code to express my own mind is fun. Writing code to satisfy the pretense of our job worshipping culture is mind numbing.

Edit: Oh almost forgot my "favorite": environments where open source is leveraged heavily. Millions of lines of imported code, at best 5% was written internally. But somehow the business environment is that they're engineering thought leaders for building a "tech biz" around a traditional business model. Smh

<comment><USER14> > Edit: Oh almost forgot my "favorite": environments where open source is > leveraged heavily. Millions of lines of imported code, at best 5% was > written internally. But somehow the business environment is that they're > engineering thought leaders for building a "tech biz" around a traditional > business model. Smh

This is definitely a serious issue. Imo, unless the project is tiny, your own codebase should be at least the majority of whatever binary is shipped, otherwise you're adding very little value.

<comment><USER15> At the same time, reimplementing, say the complex video codec pipelines of FFMPEG just because of NIH syndrome would be a massive waste of resources. I think making use of existing solutions (open source or otherwise) when it makes sense rather than trying to implement everything from scratch is a hallmark of a good developer.

</comment></comment></comment></comment></comment></comment><comment><USER16> Am I the only one who's intensely jealous of Linus? I'm 34, I've been coding prolifically since I was 9, and by 20 I was running on fumes. That was probably the last time it was any fun.

By now it's very hard to sustain anything remotely resembling motivation, especially having been around long enough to have been around the block with a few technology waves. This article, circulated on HN a while back, resonated with me more strongly than anything I've seen here in years:

[https://frankchimero.com/blog/2018/everything- easy/](https://frankchimero.com/blog/2018/everything-easy/)

I'm completely burned out on it all, and I don't even do more than a few hours of coding a week many weeks. Even that takes some serious psychological effort to get into, and some weeks I don't manage it. Honestly, I'd much rather sit in meetings, answer e-mail, and advise others on architecture. I like talking and teaching, and people issues interest me fairly indefatigably. It very well might pay better, too, depending. Alas, I picked a business model that economically rewards me for coding--that other stuff is just non-revenue overhead.

I really hope a day comes soon when I can say, "I don't really get involved in code much anymore," before RSI and disinterest foreclose upon the possibility of a life worth living.

<comment><USER17> Yep, same. I am supposed to be coding and writing Infrastructure as Code for cloud programs, but I find myself wishing I could be in Architecture or Design. I am an excellent facilitator of conversations and problem solving - <USER2> would love to "be in the room where it happens" and make sure we as a program have a coherent vision.

<comment><USER18> In all seriousness -- why can't you move into architecture and design? I know it sounds a little trite, but I've seen many times where people don't do what they want or dream just because they haven't bothered to figure out how to get to their goal or simply because they don't let themselves. I know the world isn't always that simple, but I truly believe it is sometimes (plus some work and planning).

<comment><USER17> I have only been in my current role for a handful of months, and frankly, I need to put out more work to get the kind of creds I need to command legitimacy in a design role. Before, I spent years as a SME on a different set of technologies - in a non-pandemic world, I may drop back to that world and do consulting. Right now, though, I have a great team, a great manager, and decent pay, so given all the volatility in the world I am taking what I can get until I feel a bit safer moving around.

<comment><USER18> That makes sense -- I guessed it more something like this. Thanks for the response.

</comment></comment></comment></comment></comment><comment><USER19> When you are on your second rewrite, wondering why the new codebase already has as much tech debt as the previous, it's because you don't have a Linus. Better engineers might help, but what really matters is a better filter, one that has final say on the commits and the release date.

<comment><USER20> "Good programmers write good code; great programmers "borrow" good code; best programmers remove good code." – Mike Gancarz, "The UNIX Philosophy", mutatis mutandis.

</comment></comment><comment><USER21> I'm an academic (post-doc) and while I am about to transition, I've never really worked hard to get an actual tenure track position because honestly I don't want to become a grant writer who does so little actual scientific work, in all honesty. I might have to for my future's stability sake but I've been loathe to. I want to do science, not academia.

<comment><USER22> > I want to do science, not academia.

Don't get me wrong, I come from the same background you do and have similar wishes, but isn't this just "I want to do the things I like and not the things I don't" (which is true for anyone anywhere in any job)? Any job is going to have unliked things (that's why it's w.o.r.k and not f.u.n).

</comment></comment><comment><USER23> There are two (old school) people that inspire me, him and John Carmack. I guess that's the natural course of things. Eventually you get busy to the point you don't have time to write code anymore. So many thinks to tend...

I tried to write a little bit every day, cause it is something that gives me joy, but I never have a project taking off like those guys, so I don't know how much free time they have to start new projects or to program just for fun.

</comment><comment><USER24> To think that [them] having made so much progress in the kernel by carrying a "Lean and Mean" profile for all of those decades is astounding!

My guess is Linus is still L&M (if people didn't enjoy his lean, they wouldn't appreciate his mean), but perhaps he's not in his element right now (and just taking a breather).

Either way, I'm a fan (not a professional) of a lean (looking) codebase with perhaps a new "overlay" commenting system being developed to accommodate a wide range of proficiency (one size fits all is either too terse or too bloated).

I am not sure of the difficulty of linking comments by line number between revisions, but outside of having an official repository of comments, being able to toggle through multiple perspectives from the same line/set of code would offer valuable insight and chronicle mindset/POV in a way that a global scratchpad could never deliver.

Writing terse or bloated comments should not be top of mind, but rather a frictionless byproduct (expect terse, but be pleasantly surprised on occasion by the detail and multiple perspectives).

<comment><USER25> You know that 'git blame' exists?

<comment><USER24> I guess the above was more about keeping the comments terse (at best) by default, rather than instituting an ambiguous or arbitrary formality.

The overlay thought was similar to the map concept, where you can load and toggle data layers (comments of various verbosity or from a dynamic source) easily.

</comment></comment></comment><comment><USER26> > " _in the end, my job is to say no. Somebody has to be able to say no to > people._ "

This is funny to me, because I feel like Linux got ahead over BSD specifically because it had a more accepting policy in the beginning.

I think this says something important about project maturity and lifecycle. BSD was already a "well established" system by the time the Linux kernel appeared, and as such had more gatekeeping to meet their standards.

<comment><USER27> There was also the licensing/copyright controversy. It wasn't clear that BSD was really free until Linux was already taking off. From 1992-1994 there was a legal cloud over BSD and probably even after that people had lingering doubts that something like that could happen again.

[https://en.m.wikipedia.org/wiki/UNIX_System_Laboratories,_In...](https://en.m.wikipedia.org/wiki/UNIX_System_Laboratories,_Inc._v._Berkeley_Software_Design,_Inc).

<comment><USER28> Ten years later, ironically enough, Linux encountered a similar fate: [https://en.m.wikipedia.org/wiki/SCO_Group,_Inc._v._Internati...](https://en.m.wikipedia.org/wiki/SCO_Group,_Inc._v._International_Business_Machines_Corp). ... and technically it's not fully settled yet.

</comment></comment></comment><comment><USER29> Well said as usual.

And Wow, Slashdots back button disabling is the strongest I've ever seen, felt like I was in the Deathstar's tractor beam trying to get back to HN.

</comment><comment><USER30> > So commit messages to me are almost as important as the code change itself.

Why commit messages rather than code comments?

<comment><USER31> I've seen that useful commit message make it incredibly easy to see where the code came from and is going. It also never gets 'out of sync' like code comments tend to, as it's a comment on a static place in the code, not a dynamic one.

<comment><USER32> > It also never gets 'out of sync' like code comments tend to, as it's a > comment on a static place in the code, not a dynamic one.

That's simply not true, not in a git world where rebasing to rewrite history is standard practice.

<comment><USER33> The branches you rebase most of the time are your own topic branches, where you know what's going on. And they should be relatively short-lived.

</comment></comment></comment></comment><comment><USER34> After having been paid for a few months to do upstreaming, I know very well that nobody close to the linux kernels is doing any 'coding' anymore.

it's seems to be more of an excercise into pleasing the priesthood to their, current, very important way/shape/form "canon" of what IS right at the moment than actually get any 'coding' done. And given the time it takes, i wonder if ANY of the top level maintainers actually program anymore, and are just "patch gateways".

And yes, there is a massive caste of priesthood of the patch series, discussing and making decisions on stuff they often borderline understand, and on criteria that are in fact quite far from the "it make sense" line of thinking.

I know, I've spend months re-writing drivers which were perfectly fine, neat, written with the upmost care of "upstreaming" as our team could figure out, to have to rewrite them completely and entirelly in the whim of someone halfway across the world, who didn't couldn't possibly have known what we were working on (as we were the designers, mostly) but who decided that version of the "canon" was not matching ours.

It's a stupid waste of time, money, brain cells, and the result is actually _lesser_ than the original code.

 _For no good reason_ as the canon will change next year anyway.

For many years, I thought that the Linux kernel ecosystem was pretty much self-sufficient, but it's grown way too big, to the level of MASSIVE bloatware level nowadays. Massive corps have dozens of guys working on it, and many of them are also 'maintainers' \-- full time; threading patches, some of them with conflicts of interest, or lack of understanding, or both, or just having been left behind a while back while still being innundated with patches.

I think it's doomed, in that form anyway.

</comment><comment><USER35> Please next time link to the source and not to another discussion forum:

[https://www.youtube.com/watch?v=H8Gd9t7FQqI](https://www.youtube.com/watch?v=H8Gd9t7FQqI)

<comment><USER36> Many of us don't have time (or inclination) to watch a 25 minute video just for a few key sentences. Yes, I'm sure there are other interesting things in the video too, but that bit is what the submitter found interesting enough to submit, and what the upvoters found interesting enough to upvote, and the link to the source is on the first line.

<comment><USER35> There is a very well-known function in YouTube that allows you to link to the exact time of interest. For example, simply suffix the query-string "?t=10m32s" to the URL to skip to 10:32.

Odd that there doesn't seem to be enough time to read beyond 140 characters, yet there's plenty of time to type up lengthy opinions...

</comment></comment></comment><comment><USER37> Website will not let me edit with the back button on safari, had to close the tab to escape. Why do so many sites do that?

<comment><USER38> I can confirm: if you try to back out, you are presented with a blue bar at the top saying something like "before you leave..."

[https://imgur.com/a/93wjGED](https://imgur.com/a/93wjGED)

<comment><USER39> And when I click on that link I immediately get a popover ad for the Imgur app. The mobile web is such a mess.

<comment><USER40> Firefox + UB origin

</comment></comment></comment></comment><comment><USER41> " 'No, this is fine, but...' And I send out pseudocode, or — I'm so used to sending out patches that I sometimes edit patches and send out the patch without having ever compiled it, ever tested it, because I literally wrote it in the mail reader, "

Yes he does so write code....

</comment><comment><USER42> I don't know about Linux Kernel, but in 99% of projects, 99% of commit messages are write-only.

<comment> iso8859-1 It's self-reinforcing. People won't start reading them unless they know that they may contain usable information. Given that the process of making a clean history can make you understand the project better even if you are alone, saying they are write-only is misleading.

</comment></comment><comment><USER43> Just like Stallman except 12 years later.

</comment><comment><USER44> So it was git then the mic drop.

</comment><comment><USER45> Wasn't expecting slashdot to hijack my browser back button...

<comment><USER46> " _Please don 't complain about website formatting, back-button breakage, and similar annoyances. They're too common to be interesting. Exception: when the author is present. Then friendly feedback might be helpful._"

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

(added recently: [https://news.ycombinator.com/item?id=23648867](https://news.ycombinator.com/item?id=23648867))

</comment></comment><comment><USER47> Tech deed I</comment>