Firefox 39.0 released - <AUTHOR> https://www.mozilla.org/en-US/firefox/39.0/releasenotes/

<comment><USER2> I love that the Fetch API is happening (has happened!): [https://developer.mozilla.org/en- US/docs/Web/API/Fetch_API](https://developer.mozilla.org/en- US/docs/Web/API/Fetch_API)

        fetch(url).then(data => ...)

Not earth-shattering, but much more fun than XHR!

<comment><USER3> Guess nobody told them,

[https://bachelorburnbook.files.wordpress.com/2013/07/image.p...](https://bachelorburnbook.files.wordpress.com/2013/07/image.png)

<comment><USER4> We've been making that joke internally at Mozilla for at least a year.

</comment></comment></comment><comment><USER5> > Disable use of RC4 except for temporarily whitelisted hosts

This is the one which has the greatest chance of giving people a headache. For instance, one of the biggest banks here still uses only RC4 for its online banking site. Its top-level hostname and a few of its auxiliary hostnames are on the whitelist, but there's no guarantee that all the RC4-only auxiliary hostnames it might use for some of its functionality are on the whitelist.

<comment><USER6> Good. Breaking their websites is the only way some people will fix their broken security.

<comment><USER7> YES. Force them to upgrade their weak sites!

<comment><USER8> Which unfortunately costs time and money. Whilst yes, they should be up to date and secure, banks are pretty big businesses and require more time.

One day they'll catch up.

<comment><USER9> After the CVE score for BEAST and RC4 got adjusted and the RFC 7465 was introduced I've seen some payment systems update their system quite quickly (in a matter of days), and if they didn't they'd probably fail their next PCI audit: [https://news.ycombinator.com/item?id=9198889](https://news.ycombinator.com/item?id=9198889)

Perhaps it helps if you write your payment site operator/bank _private_ emails asking them to allow other ciphers beside RC4, mine looked like this (actual site name removed):

      According to Qualys SSL Labs the site **** [2] only supports the RC4 cipher,
      and thus is not RFC 7465 compliant [3], and Google Chrome qualifies the site as
      "Your connection to **** is encrypted with obsolete cryptography."

      The site **** is even worse [4], it uses only 768-bit DH key exchange in some
      situations (instead of 2048).

      There is an online tool [5] that you can use to generate/compare
      configuration for popular web-servers, using the intermediate level is
      recommended [6].

      For your information I sent a similar email last year to **** and they have
      fixed their problems, and get a nice 'A' grade from SSLLabs now.

      Apparently this use of RC4 all comes down due to a mistake in NIST's
      classification of the severity of the BEAST vulnerability [7], but both Google
      Chrome[7] and Mozilla Firefox[8] are trying to avoid the use of RC4 completely,
      and mitigating the BEAST vulnerability is no excuse for not providing good
      ciphers (in addition to RC4 if you must) when my browser supports TLS 1.2 with
      AES-GCM which is NOT vulnerable to the BEAST attack.

      I suggest you to include the Qualys SSL Labs test when testing sites for
      PCI-DSS compliance, they are usually quite good at reporting the latest TLS
      vulnerabilities for a server.

      [1] http://www.visaeurope.com/media/images/pci%20dss%20validated%20web%20listing%20march%202015-73-18412.pdf
      [2] https://www.ssllabs.com/ssltest/analyze.html?d=****
     This server accepts the RC4 cipher, which is weak. Grade capped to B.
     Certificate uses a weak signature. When renewing, ensure you upgrade to SHA2.
      [3] https://tools.ietf.org/html/rfc7465
      [4] https://www.ssllabs.com/ssltest/analyze.html?d=****
     This server supports insecure Diffie-Hellman (DH) key exchange parameters. Grade set to F.
     Certificate uses a weak signature. When renewing, ensure you upgrade to SHA2.
     The server supports only older protocols, but not the current best TLS 1.2. Grade capped to B.
     This server accepts the RC4 cipher, which is weak. Grade capped to B.
      [5] https://mozilla.github.io/server-side-tls/ssl-config-generator/
      [6] https://wiki.mozilla.org/Security/Server_Side_TLS
      [7] https://code.google.com/p/chromium/issues/detail?id=375342#c30
      [8] https://bugzilla.mozilla.org/show_bug.cgi?id=1088915
      [9] https://www.ssllabs.com/ssltest/analyze.html?d=****

<comment><USER10> Sadly the 768-bit DHE is hardcoded into older versions of Java, which is why I suggested to them that they raise the limit to that instead of 1024-bit for now.

</comment></comment></comment></comment></comment></comment><comment><USER11> Surprised by the inclusion of "CSS Scroll Snap Points": [https://developer.mozilla.org/en-US/docs/Web/CSS/scroll- snap...](https://developer.mozilla.org/en-US/docs/Web/CSS/scroll-snap- points-y)

It basically allows to do _scroll hijacking_ [1] without any JavaScript, just like this: [http://blog.gospodarets.com/demos/scroll-snap-full- screen/](http://blog.gospodarets.com/demos/scroll-snap-full-screen/)

[1]: [http://trentwalton.com/2013/10/23/scroll- hijacking/](http://trentwalton.com/2013/10/23/scroll-hijacking/)

<comment><USER12> I'm torn.. I dislike scroll hijacking and in a sense don't want support for this practice, _but_ at the same time I assume this will never go away and then this seems less hacky and easier to make it work without ruining use on various input devices and settings.

For example, I tried the demo and saw how the pages jumped to the nearest page if I middle click and pulled down to go half way. Corner cases or anything more complicated than simple wheel flips often don't seem to work if you hack your own solution. Now the browser seems to have a much better idea of what's going on. So.. That's nice. We'll get hijacks but at least they seem to be much more robust? But at the same time I hope this won't make more designers hijack scrolling or go overboard with this. :\

</comment></comment><comment><USER9> If all your passwords are gone/not working in the password manager after the upgrade see this bug: [https://bugzilla.mozilla.org/show_bug.cgi?id=1146731](https://bugzilla.mozilla.org/show_bug.cgi?id=1146731)

</comment><comment><USER13> How much does Project Silk improves scrolling performance? Can you "feel" it?

Scrolling/motion performance is the only thing that is keeping me away from FF at the moment - Even dev tools are getting amazingly good.

<comment><USER14> For what it's worth, I've just updated on OS X and scrolling feels just as janky as ever.

<comment><USER15> Same here. But I'll keep using Firefox because I cant stand what Chrome is doing with my cpu/memory/privacy and I want to keep Safari (the less 'usable' browser) for work related stuff and Firefox for personal ones, on another desktop space.

<comment><USER16> Two firefox profiles? One for work and one for personal?

Type "man firefox" into your terminal and you will see the relevant options and can set up aliases and shortcuts appropriate for your separated browsing needs.

<comment><USER17> There are some Firefox add-ons that let you run multiple profiles in separate windows.

<comment><USER16> Firefox does this out of the box without any addons.

</comment></comment></comment></comment></comment></comment><comment><USER18> To those using FF, is there a way to get an "omnibar" similar to Safari?

For example, Safari usually suggests Wikipedia articles or other useful autocompletions. FF only autocompletes from domain names, bookmarks and history, it seems. It does have a separate search input in the toolbar, but even that one doesn't do what Safari does; all the suggested autocompletes are from Google, and additional search engines like Wikipedia or Amazon require that you click on their icon to search.

There's an extension called Omnibar, but it doesn't seem to provide suggestions from other than Google, bookmarks and history.

<comment><USER19> Firefox's URL bar is literally my favorite Firefox feature. It's quick, it searches my local history much better than Chrome, and it doesn't leak anything to the world.

If I want to search the Internet, I type in the search box.

</comment></comment><comment><USER20> The preconnect relationship is intriguing; I hadn't been following the adoption of resource hints.

Sidenote: I find it really interesting that the current spec suggests preconnect and its siblings accept a probability attribute estimating how likely connecting to different resources is.[1] Something funny to me about making the directed-graph/state-machine nature of the internet finally show through the markup.

[1] [http://www.w3.org/TR/resource-hints/#hint- probability](http://www.w3.org/TR/resource-hints/#hint-probability)

</comment><comment><USER21> "Drag and drop enabled for nodes in Inspector markup view "

This is going to make me never use Chrome dev tools again. Nice

<comment><USER22> I can't think of a situation that would make me want to move nodes around from place to place. Where would that be useful?

<comment><USER23> "Lets see how this document looks when I move this content over there"

</comment></comment></comment><comment><USER24> Yey for progress, but one of the most annoying things for me with FF is that if I cmd-t for a new tab, I can't start typing right away for a new search and have that get preserved. There's always some lag and only then do my keys get transcribed. Safari and chrome don't have this problem, and it drives me insane.

<comment><USER25> That would annoy me too, but I've never noticed it. My main laptop is a Core 2 Duo, so not a speed demon. Have you tried with extensions disabled and/or with a new profile?

<comment><USER24> Believe so. But either way if its extensions well that sucks because I only have like 2-3 and I want. Extensions shouldn't be written in a way that does that -- chrome and safari don't have this problem and I have about 12 chrome extensions.

</comment></comment></comment><comment><USER26> If you're wondering what "unicode 8 skin-tone emoji" is about, here you go: [http://unicode.org/reports/tr51/#Diversity](http://unicode.org/reports/tr51/#Diversity)

Hmmmm, I'm on ff 40.0a2 and they don't render for me: [http://emojipedia.org/man-with-dark-brown-skin- tone/](http://emojipedia.org/man-with-dark-brown-skin-tone/)

<comment><USER27> This is bullshit.

<comment><USER28> How so? If you're white, perhaps you see no problem with making everyone's skin white.

But the billions of people who _aren 't_ white might have a problem with it.

<comment><USER29> > How so? If you're white, perhaps you see no problem with making everyone's > skin white.

> But the billions of people who aren't white might have a problem with it.

I'm not white, and I have a problem with "skin tone" emoji.

Previously, skin tones for emoji were left up to the font creator. In practice, this meant that they were usually lime green, neon blue, or Simpsons yellow, all of which are cartoonish enough not to be evocative of any particular real-life skintone.

I can't really imagine a situation in which drawing attention to the race of an emoji character is desirable or even acceptable. I'm sure some exist, but they're nowhere near important enough to be included in the actual standard itself.

Beyond that, the skin tones used are incredibly reductive. Human skin tones are not as simple as 6 different shades of brown. (I, for one, cannot match my skin tone to any of the examples on the Unicode website). And if we want to get philosophical, there are a number of ways in which race and culture are encoded (literally) into emoji that are far more subtle, yet more significant, than the color used to render the skin of the faces. In a way, it reminds me of the picture-interpretation tests that they used to administer at Ellis Island to "prove" that certain immigrants were not "fit" for life in the US, though that's perhaps a topic for another day.

<comment><USER28> > Beyond that, the skin tones used are incredibly reductive. Human skin tones > are not as simple as 6 different shades of brown.

Yes, they are a bit more complicated. But 6 choices that correspond to a widely-used system (Fitzpatrick) is far better than none.

<comment><USER29> > correspond to a widely-used system (Fitzpatrick)

The fact that a system is widely used when classifying the impact of UV light on melanoma does not imply that it has relevance in another.

> 6 choices is far better than none.

Actually, no, sometimes the "solution" is worse than the problem. It's quite regressive to bake an outdated conception of the color theory of race into a standard that aims to "educate and engage academic and scientific communities, and the general public" (the stated mission of the Unicode Consortium).

As one of the "billions of people who _aren 't_ white" that you refer to in your original comment, I find this approach more problematic than the existing status quo (leaving it up to the font creators).

<comment><USER28> > The fact that a system is widely used when classifying the impact of UV > light on melanoma does not imply that it has relevance in another.

You may have a point there. But it is a classification of skin colour as well.

> It's quite regressive to bake an outdated conception of the color theory of > race into a standard

Color theory of race? This isn't the Von Luschan chromatic scale, that was used to enforce racial segregation. It's a simple colour selector based on level of melanin.

It's not perfect, sure, but I think it's surely better to allow a choice of skin shades than to make everyone white (the de facto result otherwise). You might object that implementers could make everyone black, say, and that's also true. But either way, you're enforcing a "default" skin colour, and there is no such thing. Different human populations have different skin colours.

</comment></comment></comment></comment></comment></comment></comment><comment><USER30> And yet there are still issues on my Sandy Bridge system with display corruption even with the latest Intel drivers.

Also has anyone else noticed that Firefox is no longer keeping the page state when navigating back? For example on Reddit go to the comments section, minimize a few comments then navigate to a link then go back and none of the minimized comments remain minimized, in Firefox prior to 38 things worked correctly.

<comment><USER31> Yes I have noticed the exact same thing on Reddit lately. My guess it's because they started sending "Cache-Control: no-cache" which prevents Firefox to cache the page for the back button.

<comment><USER32> [https://bugzilla.mozilla.org/show_bug.cgi?id=567365](https://bugzilla.mozilla.org/show_bug.cgi?id=567365)

</comment></comment></comment><comment><USER33> Probably unfair of me, but when browsers have a new .0 release, my brain automatically thinks "Oh good, new security bugs."

<comment><USER34> firefox is on a 6-week release schedule, and has been for a while. They increment a by whole number each time, but the for both chrome and FF they shouldn't really be thought of as .0 releases. It's a fairly minor, incremental change.

</comment></comment><comment><USER35> So, they finally fixed Logjam, 1 month and a half after publication.

Chrome _still_ hasn't fixed it. Color me unimpressed.

<comment><USER36> Since Chromium is open source, you can contribute to the project. I'm sure if you send a quality patch to the Chromium dev team to fix Logjam, they'd be willing to review it.

Did you try to contribute to Chromium and Firefox to speed up fixing the Logjam issue ?

<comment><USER35> >Did you try to contribute to Chromium and Firefox to speed up fixing the Logjam issue?

No. The issue isn't that it's (so) hard to fix; the fix in 39 has been out for a while, they just didn't want to release it for the stable release, which means few people got it. (In fact, some distros apparently fixed their versions earlier [1]).

On Firefox, you could manually fix it in 2 minutes [2]

I'm not familiar with the codebases, so it would take me longer to make a patch, but it really should not take 2 months to release to stable a fix that affected 8.4% [3] of popular websites, especially for a company like Google.

The tinfoil hat in me says certain things about this, considering that logjam was likely known by the NSA, but then again I can't prove anything.

I'm a bit surprised there hasn't been more talk about this, actually. A major security hole going unfixed for months after public disclosure should have had more chatter.

[1] [https://news.ycombinator.com/item?id=9702061](https://news.ycombinator.com/item?id=9702061) [2] [http://techdows.com/2015/05/how-to-make-firefox-browser- safe...](http://techdows.com/2015/05/how-to-make-firefox-browser-safe-against- logjam-attack.html) [3] [https://weakdh.org/](https://weakdh.org/)</comment></comment></comment>


Facebook is blocking a critical article from being posted - <AUTHOR>

There's an article on FastCompany about a change to Facebook's Android mobile app permissions:
http://www.fastcompany.com/3025589/fast-feed/why-is-facebooks-app-asking-to-read-your-text-messages
The app is now asking to see your SMS messages, and the article discusses some of Facebooks recent privacy issues and how this change might be viewed skeptically. However, if you try to post a link to this article on Facebook it is flagged by their malware detection system. Other articles from FastCompany post without issue, so it looks like Facebook is explicitly blocking this article. <comment><USER2> Apologies, this was a false positive from our automation and has already been unblocked. Thanks for reporting!

</comment><comment><USER3> Definitely being blocked (though possibly heuristically / accidentally; nothing to suggest malice afoot yet):

[http://s17.postimg.org/vy3dl85mn/Screenshot_from_2014_07_30_...](http://s17.postimg.org/vy3dl85mn/Screenshot_from_2014_07_30_12_27_06.png)

I've filed a report, & will let people know if I hear from them, & if they unblock it.

</comment><comment><USER4> It could be that so many people are positing it on FB (since the article is about FB) that it's gotten flagged. But you could be right too.</comment>


David Allen's killer GTD app system brought into practice - <AUTHOR> https://bertkruisdijk.wordpress.com/2019/07/24/david-allens-killer-gtd-app-system-brought-into-practice/ <comment><AUTHOR> If this submission would somehow end up on front page I would also like to ask you to share what experiences do you have with GTD, how you implemented it yourself, what works best for you in regards to managing personal time and goals. I'm looking for some inspiration.</comment>


Django Code Search - Find that function you just can't seem to remember. - <AUTHOR> http://www.djangocodesearch.com A side project of mine that I've put together to help search through django source code. I always find myself looking up function definitions. This is a side project that I've made to help look up things much faster. <comment><AUTHOR> This originally started out as my own tool, but I thought you guys might be able to benefit from it. I'm always forgetting how certain functions such as "direct_to_template" are called , so I end up digging through source code to find out.

This lets you find code quickly. No need to dig through documentation to reference simple functions or class definitions.</comment>


Interesting Podcasts - <AUTHOR> http://grant.systems/2015/07/20/podcasts/

<comment><USER2> Add [http://decentralize.fm](http://decentralize.fm) and Floss Weekly up there for me.

<comment><AUTHOR> those podcasts look super cool thanks for the suggestion</comment></comment>


P.F. Chang's Breach Likely Began in Sept. 2013  - <AUTHOR> http://krebsonsecurity.com/2014/06/p-f-changs-breach-likely-began-in-sept-2013/ <comment><USER2> I want to know an explanation of why credit card data was stored. Is this standard? Shouldn't they only need it long enough to process the transaction - there's no reason to store it, correct?

Was the data stolen in transit (should be entirely encrypted) or stolen while at rest?

<comment><USER3> Is there any evidence the transaction was stored, except insofar as storage was necessary to carry out the heist? The credit card data could have been intercepted while being input (e.g. by a keylogger).

</comment></comment><comment><USER4> One of the things that bothers me most about all these breaches is that I can't think of a single reason for many of these companies to store the data, yet they do it, presumably to make some sort of additional profit. Then, when they lose/have that data stolen, its just an "oops! we're doing our best to fix it". Maybe some of these companies can just stop collecting/storing this data if they can't do it securely?

</comment><comment><USER5> Has anyone yet described exactly how the breach was accomplished? Or as usual no details come out?

</comment><comment><USER6> Dang nabbit! I love eating here.

<comment><USER7> You enjoy eating at PF Changs China Bistro? Really?

Do you also enjoy The Olive Garden?

<comment><USER8> Don't act so surprised. Plenty of people do. They stay in business from the money they get from people who want to eat there.</comment></comment></comment>


The First Website of a Beginner Coder - <AUTHOR> http://www.findthepixel.com/ I'm an aspiring entrepreneur currently teaching myself how to code in order to build a MVP for a product I've fully mocked up in Illustrator and see a huge need for.  This idea came to me when learning about the :hover pseudo class in CSS.  I basically just created a bunch of divs for each "pixel" element with height/width of 25px and transparent background, absolute positioning in %, then set the :hover class of each div id with a url of the background image and the specified height and width.
I figure this will be a cool "sandbox" for me to play around with as I continue learning.  I haven't yet reached Javascript (done w/HTML _for now_ and nearing completion of CSS), but when I do I imagine there will be some more cool effects I can add.
Anyway, feel free to comment or offer suggestions for resources that may help me along the way as I learn to code.  I know the site is bush league (the title is intentional btw) but even a journey of a thousand miles begins with a single step. And hopefully it will put a smile on the faces of a few Star Wars fans :) <comment><AUTHOR> I'm an aspiring entrepreneur about 3 weeks into teaching myself how to code in order to build a MVP of a product I've fully mocked up in Illustrator and see a huge need for. This idea came to me when learning about the :hover psuedo class in CSS. I basically just created a bunch of divs for each "pixel" element with a height/width of 25px, transparent background, and absolute positioning %, then added a :hover class for each div with the background image url, height, and width defined.

I figure this will make for a cool "sandbox" as I continue to learn new aspects of programming. I haven't yet reached actual _programming_ (just HTML and CSS), but will be diving into Javascript soon and look forward to messing around with it some more.

Anyway, I welcome your comments and suggestions for resources that may help me as I learn to code. I know the site is bush league (the title is intentional btw) but even a journey of a thousand miles begins with a single step. Plus, hopefully it will put a smile the on the faces of a few Star Wars fans :)

<comment><USER2> If you decide to learn JS and want to do anything server side, try installing node[1] and stopping into the #node.js[2] irc channel!

[1] <https://github.com/joyent/node/wiki/Installation>

[2] [http://webchat.freenode.net/?channels=node.js&uio=d4](http://webchat.freenode.net/?channels=node.js&uio=d4)

<comment><AUTHOR> Thanks! I will definitely check it out as I move into JS.

</comment></comment></comment><comment><USER3> I love it! Try looking into these things:

1\. CSS Sprites: merge all of your images into one large image so when your page loads, it makes one request for the css sprite. When the right pixels are found by the user, your images will appear straight away without being pixelated as the CSS sprite would have loaded at the start so the web page will not need to load a new request

2\. jQuery (javascript framework): This is a great JS framework that is easy to implement that will allow you to start displaying your images using "Star Wars" type effects! e.g. <http://jqueryui.com/demos/show/#default>

3\. source control: if you want to get into programming, you should look into using source control to manage your code... even if you're starting off using html and css, it's good practice. Later on when you start doing some complex stuff, you'll find that it'll save your bacon more than a few times. I would recommend using git because all the cool kids are __ _. Just sign-up for a free account at<http://github.com> and you should be right with their great documentation

All the best, Star Wars fan at heart!

_ __i dont want to get into a git vs svn debate here so I won't even begin to list reasons for my preference

<comment><USER4> It never ceases to amaze me how serendipitous I find the comments on HN to be. Like the dcpdx, I've also been working on my first website and have been looking for a feature exactly like the effects you've linked.

I've also been debating with myself on github vs svn (or in my case, bitbucket). Care to explain your choice?

<comment><USER3> For me, I love it because I can work with it offline and it's branching and merging rocks compared to other version control systems. Checkout this page for a good detailed explanation: <http://learn.github.com/p/intro.html>. One last reason why I love it... because github rocks! It's all setup for you with a large range of third party add-ons that I find useful.

</comment></comment></comment><comment><USER5> Might want to check out <http://jsdo.it> for more Inspiring CSS (ab)use

</comment><comment><USER6> Firebug found the pixel!</comment>


App turns power button into panic button for activists at risk - <AUTHOR> http://www.wired.co.uk/news/archive/2014-06/23/amnesty-panic-button <comment><USER2> Since this would never pass Apple's approval, why not take another approach: create an app that checks in automatically on a pre-set interval. If the phone ever gets turned off and a check-in is missed, the dead man's switch will flip. When you're in danger, just turn the phone off. This also has the added benefit of triggering the alert if the captor/aggressor turns off or destroys the phone. Just enable it when you know you're going to be entering a dicey situation.

<comment><USER3> Sorry to hijack the thread but: does anyone know the "dead man switch" online service? Can be as simple as sending email if some action is not completed at predefined time. It's pretty triaval to do, but if there is an existing one…

<comment><USER4> [https://deadmanssnitch.com/](https://deadmanssnitch.com/) is what we use.

</comment></comment></comment><comment><USER5> Nice. Panic App meet signal jammer.

Perhaps a combination with some form of dead-man's-switch could be useful? A basic design might be: record gps coordinates at an interval, encrypt to chosen gpg/pgp keys and store on a server. Additionally have a heart-beat, and pre-recorded message. When the heart-beat signal is interrupted for a configurable length of time, send email(s) with encrypted message and gps trail?

The reason for encrypting the data, would be an effort to minimize the risk associated with a compromise of the server account(s) (could really just be smart remailers - allowing the server interface to be via smtp).

Perhaps combined with a panic-button for signalling immediate distress along with destroying the signing gpg sub-key (so that, when authorities get help from the vendor to unlock the phone, they can't send a signed "I'm ok, never mind"-message).

Would require the usual mess of administrating keys, of course.

</comment><comment><USER6> Soon:

I came as quickly as I could, are you OK?

Yes, I was just trying to turn up the volume of my music, but wasn't paying attention.

<comment><USER7> I have no idea why you were downvoted. This is definitely going to happen.

<comment><USER8> Volume button != power button. Nobody ever hammers on the power button repeatedly.

<comment><USER9> You haven't seen some tech illiterate people try to work a phone have you?

That's something my mom would do. She once asked me how you can tell if the phone was on or off... no joke.

<comment><USER8> Tech illiterate people probably aren't the ones to install a panic button application for use by demonstrators.

</comment></comment></comment></comment></comment><comment><USER10> Nice .. I wrote a similar app, a "Fall Detector", which allows you to send an SMS (or Twitter alert) if the app detects you have fallen over:

[https://play.google.com/store/apps/details?id=at.spantec.sec...](https://play.google.com/store/apps/details?id=at.spantec.securemotion.falldetector)

Seems like it would also be useful to have some mechanism like this in such an "emergency app", so that operator interaction is not required - more of a dead man switch than a big fat button ..

</comment><comment><USER11> Built this 5 years ago. You will get an expired SSL error as the acquirer has since abandoned it.

[https://plerts.com](https://plerts.com)

It was free to use with friends and family, or you could have paid a small fee for 24x7 S&R and medi-vac backed by Lloyds of London.

One of the biggest issues is "top of mind". During times of severe distress – most people forget they have these services available. They are so distraught and in fear of their life, they are not thinking clearly. 911 is an exception because it's been engrained in us (Americans) since we were born.

<comment><AUTHOR> Can I ask why you gave it up?

<comment><USER11> Without going into detail, a lesson in M&As.

<comment><AUTHOR> I would be interested in a chat at some point. Interesting business model. I reached out to you on twitter.

</comment></comment></comment></comment><comment><USER12> Combine it with a Pressy button[1] and you won't even need to override the power button.

[1]: [http://get.pressybutton.com/](http://get.pressybutton.com/)

</comment><comment><USER13> This is a really cool idea, I particularly like the fact that it can be disguised as another app on the phone. Rather than it being "I'm the panic button app Mister oppressive government operative, please delete me" it can just be disguised as a calculator.

I wonder if there is a choice of which app to mimic for the disguise, and whilst this isn't going to be a silver bullet it definitely adds another layer of defence to people who really need it.

<comment><USER14> I had a friend who worked for a well-known movie director who built a "black book" contact list disguised as a tip calculator. A quick search does not return any association between his name and an app, but I can see there are a number out there.

</comment></comment><comment><USER15> There's a similar app called SafeTrek:

[https://itunes.apple.com/us/app/safetrek/id716262008?mt=8](https://itunes.apple.com/us/app/safetrek/id716262008?mt=8)

<comment><USER16> Of course, SafeTrek is intended to contact the police. The "Panic Button" app seems to be intended for those for whom the police may be the people they need to be rescued _from._

</comment></comment><comment><USER17> This might be a good thing to install on my kids' phones?

<comment><USER9> I can't tell if you are serious or not...

Are your children human rights activists at risk from attack, kidnap or torture? Do you anticipate them being in a situation that requires them to dial for help in a stealthy manner?

Do your children know how to dial you or 911?

<comment><USER17> Mostly I'm pondering if this would be useful for them in the (very unlikely) case that they get into a situation where they can't dial 911 (need to be quiet or otherwise don't want to draw attention to themselves). But, as others point out, actually remembering the app exists when you need it may be problemmatic. And even so they would then have to find it on screen 27, past all the 2048, angry bird, and flappy bird games and things.

</comment></comment></comment><comment><USER18> This could pretty easily be setup on a jailbroken device also.

</comment><comment><USER19> Nice, we're evolving the same mechanisms for quick herd notification that animals have.

This is why humans and animals scream when we're in danger (not because screaming is a very effective danger mitigator), and this is why some animals jump in place when they detect danger ([http://en.wikipedia.org/wiki/Stotting](http://en.wikipedia.org/wiki/Stotting)).

We've had these two signals exploiting our vision medium, and our sound medium. And now increasingly, we're adding signals exploiting our digital network medium.

As those become more and more commonplace they have a very tangible effect on our society. Think Twitter riots and what not.

BTW, people in Japan get an instant smartphone warning when there's an earthquake.

<comment><USER20> > BTW, people in Japan get an instant smartphone warning when there's an > earthquake.

To be specific, BEFORE there's an earthquake. Otherwise it wouldn't be very useful :) And it's not just smartphones, this system is in place on dumbphones well (using the GSM Cell Broadcast feature).

Americans get an instant smartphone warning when a child has been kidnapped [http://www.imore.com/amber-alerts-your-iphone-what-they- are-...](http://www.imore.com/amber-alerts-your-iphone-what-they-are-and-how- manage-them)

<comment><USER21> > To be specific, BEFORE there's an earthquake.

Yes, it takes a little while for seismic waves to travel from the epicentre to locations a fair distance away. The high speed trains are programmed to start braking as soon as an alert is heard - it's usually enough to shed 100mph or so off the speed before getting in trouble.

</comment></comment></comment><comment><USER22> www.panicguard.com firstname.lastname@example.com

Was built in 2011 and serves giant security companies.

Old news.</comment>


Ask HN: running startup as a sole proprietorship until you receive funding. - <AUTHOR>

So I am entering an agreement with someone who is starting up a company. He asked me to work for the company in exchange for a percentage share, and the agreement states that until the venture receives funding it will be run as a sole proprietorship to save on legal fees. Is this a good idea? Are there any risks, for me or for the startup? I'm not familiar with the legal aspects of business, so I'd really appreciate the guidance. <comment><USER3> I'm not a lawyer so don't take this as legal advice, but here's my understanding:

I don't think that you are able to give a percentage share of the company with a sole proprietorship. By definition it is owned by him alone and if you transfer the IP to the company, then you are transferring it to him and you have no stake. I am not sure what effect a contract would have, but I think he would be in a position to do what he wanted with the company and you'd have no official stake. For example, what if he sells the sole proprietorship before he gets funding?

As an LLC, I know that you can specify shareholders. I have seen people do this for family-and-friend investors. Although a full-fledged startup typically runs as a corporation.

If I were you, I would insist on creating a corporation (or at least an LLC). From what I've seen it only costs $1,500-$2,500 for an affordable lawyer which isn't really -that- much if you're serious about building a business here. You can even do LegalZoom though it's not typically recommended, but you can just re-do your corporation when you get funded. But the point is that at least your interests will be protected until then.

Personally I'm running as an LLC because I'm not expecting to get funding. If I was actively looking for funding I would have just started a corporation.

<comment><AUTHOR> Can you explain why it makes a difference to run as an LLC if you are not expecting funding? My company is expecting funding. So should I insist on creating a corporation instead?

<comment><USER4> VCs will insist, as a requirement of the raise, that you change your corporate structure to a C-Corp. This is because LLCs pass-through income to the shareholders. The VCs' limited partners may have severe problems with this - for instance, a foreign entity might suddenly have US income, forcing them to file a US tax return.

In other words, if you know you're raising money, you might as well structure the company correctly in the first place, since you'll just have to pay lawyers to redo it when you raise.

The big risk in going from a sole proprietorship that you don't own to a corporation is to you personally, not to the startup. I would only consider such an arrangement if my co-founder was compelled to follow through on the deal - for instance, if you retained full ownership over the IP you created until the company was properly structured. But why set up a Mexican standoff when you can just do it right the first time? It's not the hardship your co- founder is making it out to be.

</comment></comment></comment><comment><USER5> This is a bad idea at best and a red flag at worst. It costs very little to set the paperwork up properly. A sole proprietorship is just that - he owns everything and owes you nothing without some strange contract promising you equity in a business that doesn't exist yet. And if you're going to go through with the hassle and expense of setting up a contract with his sole proprietorship, you may as well just set up a proper entity.

This is such a bad idea that it's not worth talking to a lawyer about. If he won't do it right, don't do it at all.

(The right answer is probably an LLC. They're cheap to set up, flexible, and pretty easy to convert to a C corp should you go the institutional investor route.)

</comment><comment><USER6> I don't quite understand this and maybe I'm reading it wrong. But if it is a sole proprietorship he owns it outright and you're an employee and you have nothing but a verbal promise of a foot massage and an ice cream later.

If he's saying you have a percentage now, then it isn't a sole proprietorship. It is a general partnership. The default result when two people go into business together is that they've made a general partnership. There are an elaborate set of laws that fill in the gaps if you don't have an explicit agreement on profit allocations or any ther aspect of your deal.

All that aside this shows sloppy thinking on the part of your friend. Be careful.

IAAL.

</comment><comment><USER7> > He asked me to work for the company in exchange for a percentage share, and > the agreement states that until the venture receives funding it will be run > as a sole proprietorship to save on legal fees. Is this a good idea?

Let's find out what he really thinks about this arrangement.

Ask him to switch roles. In other words, the company is your sole proprietorship and he gets whatever he expected you to take.

If he won't go for that, why should you?

If he will and you decide to go through with this arrangement, make the decision as to roles using a coin flip or some other random process. If he won't agree to that, he was bluffing.

</comment><comment><USER8> It comes down to trust, because legally, I don't think your bases would be covered. I'm in a similar situation, working as a consultant. But I've known the CEO for several years and trust him. We are in the final phases of adjusting the LLC and giving me shares. I've been willing to defer this for a while since there is a decent amount of costs involved setting this up correctly so I don't get taxed on the shares.

Come to think of that, this could be a serious issue for you. Lets say that everything goes smoothly and you do get funding. At this point you get shares, you will have a taxable event based on the value of those shares. This is true even if you are never able to sale the shares. You still owe taxes on them. If you get your shares now, the valuation of the company will be much less than later and therefore the tax you owe will be much less.

If you don't trust this guy a lot, I'd push to get it set up correctly. Or at the minimum have a lawyer draft up an agreement and talk with an accountant to figure out the tax implications of this.

</comment><comment><USER9> Ask a lawyer.

But before you do, read up on the sole proprietor model:

[http://www.sba.gov/smallbusinessplanner/start/chooseastructu...](http://www.sba.gov/smallbusinessplanner/start/chooseastructure/START_FORMS_OWNERSHIP.html)

It would appear to be the same as what we in the UK call sole traders - <USER2> most important point is that there is no real legal distinction between the owner and the business itself. Not in terms of assets/debts, anyway. This is the kind of business that loses the owner's house if it all goes to hell.

I don't know how this affects relationships with employees - even if there is such a thing under this model - and I really don't know how it affects the notion of equity. In particular, 'a percentage share' of what?

You want to talk to a lawyer about whether what your partner is proposing even makes legal sense, as well as whether it is advisable.

My hunch would be that it is not a fantastic idea. Go see a lawyer (or even a business adviser - your city may have some that don't cost anything).</comment>


GDPR vs. Blockchain: Technology vs. The Law - <AUTHOR> https://blog.trendmicro.com/gdpr-vs-blockchain-technology-vs-the-law/ <comment><USER2> My issue with Blockchain and "information laws" (not just GDPR, but any law which prohibits or controls information) is that you ("you" being the creator/maintainer of the blockchain) can never mess up.

If someone puts "illegal information" directly in your blockchain, you either need a way to roll-back the change (which removes most/all of the benefits of an append-only structure like a blockchain), or you need to be okay with breaking the law.

That someone could be a blackhat that wanted to publish a bunch of personal info, a disgruntled employee, or just regular users if you allow arbitrary input.

I don't know of any kind of real solution, and at some point someone is going to push the limits and make it obvious that "illegal information" is on a blockchain, and we (as society) will have to come up with a way to deal with it.

<comment><USER3> > you either need a way to roll-back the change (which removes most/all of the > benefits of an append-only structure like a blockchain)

Blockchains are not inherently immutable or even append-only. What they guarantee (assuming the consensus scheme is working) is that you'll be _aware_ of all the data in the chain _or_ the fact that some of it is missing; the idea that blockchains are inherently immutable is a big misconception that treats blockchains like they're magic.

In a database, if you are forced to delete data, you'll go ahead and delete that data. You's probably also record the fact that you deleted that data in some kind of auditing log to be able to audit compliance with those deletion requests, as well as detect illegitimate deletions.

In a blockchain, you can do the exact same thing, but with better controls: add a block to the blockchain that contains machine-readable instructions telling all nodes processing the blocks to delete the data if they have a copy.

Once every node has done that, even though the blockchain still _commits_ to that data, the data itself is unavailable, thus complying with the requirement to delete it. Essentially we now have a dangling pointer: there will be a digest in the chain, but the data that was hashed to produce the digest is no longer available. The blockchain is of course no longer able to be validated in the same way as before, but what you can validate is the fact that the deletion process was followed properly. E.g. you might have rules that state 2-of-3 senior admins have to use their signing keys to sign off on a deletion request.

A similar example of this principle exists in Git: you can do a shallow checkout that doesn't contain all prior history. Recentish versions of Git handle this quite well: every operation will succeed _if_ it doesn't happen to process the missing history. Similarly, if every git repo is in fact a shallow repo, with some history deleted, that data will gone.

At the low level, this works because practically all blockchains make use of merkle trees. Rather than the hash of a block b_n being calculated as Hash(b_n), you instead have a header that commits to a merkle tree of data items. Thus you can still validate that the headers are connected without actually having all the data (extra credit problem: is this always a good thing?).

1) By "commit", we mean that the blockchain headers contains a hash digest of some other data; the headers are _committed_ to the data they hashed, because if that data was changed the hash digest would change, rendering the headers invalid.

<comment><USER2> I'd argue at that point it's not a "blockchain", since you are removing one of the major points for using the data structure (the ability to verify the chain without trust).

If you are just going to rely on a central authority to say which blocks should be "ignored" (in other words, which hashes should just be trusted), then why use a blockchain at all? It's just a very slow, complicated, expensive append-only log file.

The only benefit a blockchain provides (for the sake of this discussion) is it's ability for someone to verify it without trust from the genesis block all the way to the most current. You take that away, it's not a blockchain anymore.

<comment><USER3> > If you are just going to rely on a central authority to say which blocks > should be "ignored" (in other words, which hashes should just be trusted), > then why use a blockchain at all?

Even if I ultimately have to kotow to the central authority, I still want to be able to audit what they're doing. Similarly, there is no such thing in the real world as a trusted central authority: the central authorities themselves are groups of people who don't fully trust each other, and thus want to be able to do effective internal auditing.

You're line of argument could also be used to argue that we don't need to audit banks at all.

> It's just a very slow, complicated, expensive append-only log file.

The reason why Bitcoin is slow and expensive is because of the proof-of-work and decentralization, not because of the blockchain itself.

Distributed databases already make use of complicated log files to achieve consensus between nodes and for auditing; adding hashes to the entries in those log files is relatively easy, and as cryptographic hashing is quite fast, doing that doesn't incur much of a performance hit. Most importantly, in a centralized environment, you can fairly easily use standard sharding techniques to make all of this scale well - which is the same way very large databases scale anyway.

<comment><USER2> That's not my argument, my argument is that using a blockchain as your underlying data structure is entirely pointless if you have a way to selectively remove blocks. I'm saying nothing about how we should audit other things, just that a blockchain's "audit method" is the ability to follow the chain from the genesis block to current without any trusted 3rd party or outside information. You remove that ability, you've removed the point of using a blockchain in general. I don't care how other central authorities audit themselves, that's completely off topic, I care that a blockchain is by definition a chain of blocks.

A simple list of "data", it's hash, and a counter would be better for what you want in just about every way. You'd still be able to see that data was modified or removed, and it would be faster, simpler, and easier to work with.

>The reason why Bitcoin is slow and expensive is because of the proof-of-work and decentralization, not because of the blockchain itself.

I never said anything about Bitcoin. I'm saying that using a blockchain while throwing out the "chain" part is more complicated, slower, and more expensive than using a simple append-only log file.

<comment><USER3> > I don't care how other central authorities audit themselves, that's > completely off topic

We're talking about GDPR here, which is most important in the context of centralized systems whose operators have to worry about compliance with European law; really, it's easier to argue that the fully trustless systems you're imagining - what Bitcoin attempts to be - are what are off topic here.

> A simple list of "data", it's hash, and a counter would be better for what > you want in just about every way. You'd still be able to see that data was > modified or removed, and it would be faster, simpler, and easier to work > with.

If you implement this in a real system, you'll need to rehash all the data any time any of the data is changed. The obvious optimization there is to only hash new data plus a commitment (hash digest) of the old data, at which point you have a blockchain.

> I never said anything about Bitcoin. I'm saying that using a blockchain > while throwing out the "chain" part is more complicated, slower, and more > expensive than using a simple append-only log file.

How do you know the append-only log file was actually append-only? You'll want redundancy, which means multiple systems must have their own copies of that log file.

Next you'll want auditors to be able to challenge those systems, which is often easiest if you have those systems sign cryptographic statements about what should be in that log file. Real-world systems have log files whose state changes over time, thus you'll want to the chain of blocks optimization so you don't have to re-download and re-hash everything every time the state changes to verify the latest set of signatures for the log file.

And at that point, you have a blockchain whose consensus is defined by a centralized quorum of trusted but auditable entities.

</comment></comment></comment></comment></comment></comment><comment><USER4> Pretty reasonable actually:

> GDPR does not prohibit blockchain, but it does put some procedural > requirements around blockchain's use in commercial enterprises. For > individuals who opt into a blockchain, there is no authority to amend or > correct a block once it is incorporated into the chain. For them, caveat > emptor. For organizations, make sure you have a mechanism that will allow > you to disassociate an individual with their blockchain contributions

<comment><USER5> Wow the blockchain can actually become a grat loophole! Concerned about privacy of your users? Just upload their data to blockchain and then use this information anyway you want directly from the blockchain. I mean GDPR wont rollback blockchian, can they now?

<comment><USER6> IANAL, but pointers to PII are still PII. If you can go from "description or address" to "human" then it's PII.

<comment><USER7> Yes.

> Personal data that has been de-identified, encrypted or pseudonymised but > can be used to re-identify a person remains personal data and falls within > the scope of the law.

Solution:

> Personal data that has been rendered anonymous in such a way that the > individual is not or no longer identifiable is no longer considered personal > data. For data to be truly anonymised, the anonymisation must be > irreversible.

Source: [https://ec.europa.eu/info/law/law-topic/data- protection/refo...](https://ec.europa.eu/info/law/law-topic/data- protection/reform/what-personal-data_en)

<comment><USER6> So you're agreeing? If someone else has the handle->PII mapping then the handle is PII too, and if you can't scrub the handle, then you are in violation of GDPR.

<comment><USER4> According to the article, you only have to scrub the actual PII, not the pointer to it. A pointer that points to nothing is fine, even if it used to point to PII.

And even that is only the case if it's an enterprise holding the PII; if it's out there in the world in a P2P context then the law recognizes that nothing can be done about it.

<comment><USER6> I'm not so sure. An IP address is PII, not because it's about you but because when combined with other databases identifies you.

I'd argue that you're still _identifiable_ if this pointer can be converted to your PII. Even if you point to someone _elses_ database, as long as it's not been scrubbed.

Again, IP address is PII even though I don't have address-to-human mappings. My understanding is that this is because their ISP does.

Maybe somewhere the word "identifiable" is defined in the legal context?

In any case we agree that whatever it means, it will not allow me to outsource PII-storage to China, and have mere random "handles" in their database, right? Because then the law is completely void through a loophole.

<comment><USER4> I think the scenario is, you have the PII in your database and the blockchain has "RecordNumber: 123", and then you delete all the PII in record 123 so the it's just a meaningless number.

If there's another copy of the PII somewhere, then you haven't deleted it. If the PII was actually public on a P2P network, instead of held by a company, then they're saying the law doesn't apply.

<comment><USER6> Ok. But why would that be the law? Say my reference number is public on the internet, and the reference number is in a transaction log.

That means that the transaction log has information about me, that is not anonymized. Thanks to this reference log you can see my purchase patterns.

And isn't "a database of people's purchase patterns" the exact thing GDPR is meant to control?

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> This applies to all uses Merkle trees---blockchains is one example, but someone[1] pointed out that git is another. Each git repo typically contains the names and email addresses of people who committed, and you can't rewrite history without disrupting anyone else who is working with the repo.

Does this now mean that github is in violation of the GDPR, since they cannot retroactively delete people's personal information?

[1] [https://social.heldscal.la/notice/7460829](https://social.heldscal.la/notice/7460829)

<comment><USER6> > Each git repo typically contains the names and email addresses of people who > committed, and you can't rewrite history without disrupting anyone else who > is working with the repo.

But you _can_ do it. You can disrupt people, but _shrug_. You do the same thing in git to remove copyrighted content from your repo. You can't tell The Law (copyright law and/or GDPR) that "sorry, can't do it because that'd be inconvenient to people".

The problem is that if you do it to bitcoin it breaks.

> Does this now mean that github is in violation of the GDPR, since they > cannot retroactively delete people's personal information?

Sure they can.

First of all github may not be the legal "owner" (I forget the term), the user is. Second, if github were told by a court to remove the content, of course they can.

This is even scalable, to github:

"Hello N. N. Due to GDPR request XYZ your repo A is in shallow-clone mode until you remove Y piece of PII. Click here to automatically git-filter- branch."

To say they can't remove it is like saying you cannot remove PII because your business's domain name is TheresaMayIsABigFatTurd.com. That's not going to fly.

</comment></comment><comment><USER9> _> Under GDPR, an organization that constructs a blockchain may have to remove a block or modify some data to comply with a request to forget someone.[...] GDPR does not prohibit blockchain, but it does put some procedural requirements around blockchain's use in commercial enterprises._

If "organizations" and "commercial enterprises" means entities like Goldman Sach's proposed blockchain, or Kodak's cryptocurrency, than the GDPR rules aren't really that radical nor create contradictions of compliance. As the blog says, just use a record id (a db "foreign key" id) instead of storing the raw data directly in the blockchain. The record pointer can either point to real data in a lookup table or point to null. The "erase" only works because the organization controls the "lookup table" that the record ids point to.

Instead of that commercial scenario, what people wonder about are the public blockchains such as Bitcoin and Ethereum. Has there been definitive writing on that subject that concludes GDPR doesn't apply to those? Since there's no central authority in charge of those blockchains, any private data can't be erased as easily.

<comment><USER6> IANAL:

Bitcoin isn't cash[1] (or money?), so presumably doesn't have financial retention requirements.

But it is data about my behaviour, purchase transactions, donations, interests, etc.

Which is PII.

Which means (to me) like I should be able to demand all transactions related to wallet xyz be purged, not just the "additional data" associated with the transactions.

As we've learned anonymizing data is hard. Even with IP addresses removed people have been identified[2]

[1] [https://www.youtube.com/watch?v=p9HH_dFcoLc](https://www.youtube.com/watch?v=p9HH_dFcoLc) and other references and actual court decisions saying it's not money.

[2] I think it's this one I'm thinking of: [https://arstechnica.com/tech- policy/2009/09/your-secrets-liv...](https://arstechnica.com/tech- policy/2009/09/your-secrets-live-online-in-databases-of-ruin/)

<comment><USER9> _> I should be able to demand_

If GDPR applies to Bitcoin, __who__ would you demand the purge action from?

There are an estimated ~10000 pseudoanonymous Bitcoin full nodes[1] all updating a ~170 GB append-only database[2].

Where does the GDPR compliance demand get sent? To the bitcoin user forum where some (not all) the developers hang out? Or to the maintainer of the github repo for C++ bitcoin client? What would be the procedure? Make those 10,000 nodes update and download new client software that "forks" the blockchain for each GDPR erasure request? Why would Chinese miners care about compliance with EU laws like GDPR?

[1] [https://bitnodes.earn.com/](https://bitnodes.earn.com/)

[2] [https://blockchain.info/charts/blocks- size](https://blockchain.info/charts/blocks-size)

<comment><USER10> > If GDPR applies to Bitcoin, _who_ would you demand the purge action from?

It's not doable for sure. However, one can argue you can find all the node IPs, subpoena their ISPs, sue every companies and individuals to compliance, jail the ones who don't obey, and blacklist IPs from non cooperative jurisdictions. Fun times.

<comment><USER6> It's doable for a very useful definition of "do".

A good comparison is "the pirate bay" and copyright infringement.

You can't shut down all copyright infringement, but starting a company in 2018 to spread and share other people's copyright is not "a good idea", or at least you know what you'll be getting into.

GDPR, likewise, is meant to stop dealing in other people's PII without consent (and consent can be withdrawn).

When you see "PII", think copyrighted content. You can't say "because algorithms I'm not responsible!".

</comment></comment></comment></comment></comment><comment><USER11> Would the GDPR have any effect if an anonymous 3rd party installed personal info into the blockchain against the wishes of people who now want it to be forgotten?

<comment><USER6> IANAL, but why would it matter _how_ the PII got into some company's computers? GDPR demands that the person in question can have it removed.

Otherwise companies could just go "yeah we have everyone's personal data, but that was done by a previous employee and we fired her, so we don't have to delete it".

<comment><USER11> But in the case of the (bitcoin or other public) blockchain - there is no person or organization you can go to to have it removed. It is a distributed p2p ledger/database with individuals and orgs all over the world in every jurisdiction storing and sharing the data.

<comment><USER6> Yes there is.

\- "Are _you_ storing my data?" \- "Uhm, technically… I mean it's on our hard drive" \- "Delete all my data now. Please and thank you"

<comment><USER12> "I'm in China, request denied."

<comment><USER6> Sigh.

1) Sounds great! Hand over all bitcoin control to the Chinese jurisdiction. Problem solved, eh?

2) Hey CoinBase, Merchant X, etc… you are acting as a front to dealing in EU citizens PII, cease and desist with all that.

<comment><USER12> Yep. I don't know that the EU intended to create a perverse incentive to move cryptocoin experimentation out of the European jurisdiction, but here we are.

Given how anti-authoritarian the userbase for most cryptocurrencies is, I wouldn't be surprised if this result is---while not intentional---certainly not something EU regulators would worry too much about.

<comment><USER6> To me this sounds like "why make murder illegal in the EU? What perverse incentive are they creating to move murder offshore to China?"

You can't defend doing bad in the world by saying it's not yet banned everywhere. It's kinda defeatist. We can't allow women to drive because then Saudis will have less incentives to come here to spend their money.

<comment><USER12> The thing is whether we assume the behavior in question is bad.

I expect people in the EU still want to make murder illegal even if it "moves it to China"; they don't want it in their backyard.

Did the people of the EU really not want cryptocurrency in their backyard? Maybe they didn't, and this is all working as intended. I'm not sure they intended this side-effect. "Right to be forgotten" may not be something one actually wants to apply to questions like "Where did the mafia get all this money?", even if we want to apply it to other spaces (which is why "follow the money" is so often a useful technique for piercing obfuscatory smokescreens in other data sets).

(Personal bias disclosure: I'm also kind of expecting they're going to find the costs of the GDPR outweigh the benefits in general in the next five to ten years, but I might discover I'm mistaken).

<comment><USER6> I'd say the people of the EU don't want their PII all over the place (even if it's in China. Actually especially if it's in China). If you can make cryptocurrencies not have that then that'd be great. Bitcoin very much does not address this.

As for questions like "Where did the mafia get all this money from" this is an argument against all cryptocurrencies, and for the financial regulation that is in place.

Financial regulation exists because people want it, for the most part, and either cryptocurrencies should have to abide by them (which includes trackability and reversibility) or it does not (which means GDPR).

I'd argue that no, there is pretty much nobody who wants cryptocurrencies, when they think about how yeah almost all the time financial regulation do benefit the individual.

I'm not saying GDPR is perfect, or even necessarily a step in the right direction. But cryptocurrencies are definitely a step in the wrong direction, going what people want.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> > A medical record would refer to "Corp-ID Client 192734." If that person > wished to be forgotten, the organization would re-assign that pseudo-ID to a > null ID, eradicating the link from the person to the data.

Putting medical records into a global public database seems like it would require a more anonymisation work than just redacting the name for it to be acceptable.

<comment><USER12> Also, the process described will require nothing to ever denormalize the record from the "handle" identifier to the "pointer" identifier.

Caching is hard, so good luck guaranteeing that.

</comment></comment><comment><USER14> If the information does not need to be public. A simple solution is to encrypt the data you put on the blockchain. And then just throw away the key if somebody request that you delete their information. Of course it cannot be applied in all situations. But sometimes it will do the trick.

<comment><USER6> But an IP address is PII. So presumably a wallet address in PII. If so, then all transactions are PII and subject to GDPR removals.

This seems harder to solve.

</comment></comment><comment><USER15> With GDPR the scope of what is actual personal information is broadend. This means that an account number is considered personal information. How is any variant of an ID in a block chain different from an account id?

<comment><USER7> Account ID is only personal info if it can be tracked back to a person.

Source: [https://ec.europa.eu/info/law/law-topic/data- protection/refo...](https://ec.europa.eu/info/law/law-topic/data- protection/reform/what-personal-data_en)

<comment><USER15> As an example; If I have an account on a block chain I still will know what it is and anyone that have been interacting with that account could still identify the account. And GDPR says explicitly that it shouldn't be possible at _all_ to identify an individual given considering any amount of time and any resources. So I still think an "account" pseudo key in a block chain is still under GDPR. But we'll probably see those cases in court under various conditions.

Source: paragraph 26 [http://eur-lex.europa.eu/legal- content/EN/TXT/PDF/?uri=CELEX...](http://eur-lex.europa.eu/legal- content/EN/TXT/PDF/?uri=CELEX:32016R0679&rid=1)

</comment></comment></comment><comment><USER16> How is this specific to blockchains compared to any other kind of append-only book-keeping?

<comment><USER2> Because blockchains have what most other append-only systems don't, a mathematical requirement that the data NEVER change in order for the system to continue running.

In an append-only system the enforcement comes from the software running around the data, if you need to you can modify the data in the past, and tell the software to just pretend it wasn't changed. You can't do that with a blockchain without throwing the whole thing away, so it brings into question what happens when legally you MUST remove information.

<comment><USER3> A good way to explain it is with a blockchain the math guarantees that you'll be able to _detect_ modifications to the data, or if some data is missing, the _potential_ of modifications.

But even with a blockchain, the solution is the same: build an "escape hatch" into the validation software that allows certain kinds of data modifications and/or deletions to be ignored. The only difference is with a blockchain you'll have stronger guarantees that auditors will be able to detect if that has in fact happened.

It is true that certain types of blockchain cryptographic structures can greatly limit the granularity of those options. But no-one actually uses those types of blockchains (namely chains without per-block merkle trees), so that point is moot.</comment></comment></comment>


Thousands of Razer customers order and shipping details exposed on the web - <AUTHOR> https://www.linkedin.com/pulse/thousands-razer-customers-order-shipping-details-web-diachenko/ <comment><USER2> For goodness sake. What is it with these people who operate these databases only to leave it exposed, password-less and open to attack on the internet.

They would not wish to do that in Europe or they would be hit with gigantic fine and will be sued to the ground.

Such people should just stay away from computer systems altogether if they can't be trained to secure them adequately.

<comment><USER3> IMO the better question to be asking is why Razer _requires_ a user account for hardware peripherals in the first place. Logitech, Corsair, HyperX, Asus, et. al. do not have the same requirement of registering an account before giving you control over your device.

As shitty as it is for those whose information was leaked, it was just a matter of time, IMO. There was no reason they needed any of this information in the first place, they're a hardware device manufacturer and whatever data they were collecting can't possibly be useful for future products. With any luck Razer will be re-evaluating their mandatory account policy and maybe they can finally be a contender for my next peripherals.</comment></comment>


[Startup] Beyond Invoicing -- an online invoicing and payments solution - <AUTHOR> http://beyondinvoicing.com

<comment><USER2> Looks very nice - probably covers the ground for a lot of use cases.

Big question for me would be - how do we go through "due diligence"? How do you communicate your bona fides to me the seller and to my customers? I suspect this needs addressing in some substantial manner.</comment>


There's no room for The Idea Guy (2010) - <AUTHOR> https://signalvnoise.com/posts/2188-theres-no-room-for-the-idea-guy <comment><USER2> 1000 times this. One of the other problems with having 'the idea guy' as a partner is that they don't have as much to lose because they haven't actually put and blood and sweat into your startup.

This might result in loss of interest before you actually finish or even derailing the current idea because success isn't happening fast enough.

I've tried to partner with different friends over the years and its unbelievable to me the amount of people that think running a company is essentially coming up with the ideas and having other people execute them for you.

We all shouldn't forget the richest ideas guy: Sean parker.

<comment><USER3> Yea. Another thing I've found is that ideas people tend to see technical ability and ideation ability as mutually exclusive skill. If you're technical and can build a product, you can't possibly come up with good ideas because you're too busy worrying about code.

</comment></comment><comment><USER4> Some people sometimes have really good ideas and an understanding of some niche market that I, the programmer, had no idea even existed. But those are domain specialists and not "idea guys" (and gals). But the question is, if you are not a domain specialist, how do you distinguish between the two? And how do you evaluate whether the domain specialist will be a good business partner and not just drop work on you? It's quite simple really. The way I do is that I am available to have a coffee with anyone who says has an idea and talk about it. There's not much to loose there, it's networking. After being presented the idea, I instruct the person to do the legwork that follows, be it market research, interface design using paper or the marvel app or similar, testing the idea with potential users, analysing the competition, juridic analysis, and whatever else business related work that is necessary but I have no interest in doing. What happens everytime without fail is that if you are dealing with an "idea guy/gal", they will bail on the first task and never get back to you. There you have it, a simple screening process that will spare you the trouble and filter out the useless business partners.

</comment><comment><USER5> Ideas are just multipliers, [https://sivers.org/multiply](https://sivers.org/multiply)

<comment><USER6> I think this is missing the marketing/sales factor. You can have a great idea, well executed, if nobody knows about it, it's still worth nothing.

I like the general idea though.</comment></comment>


How Anyone Can Fake an ATM and Steal Your Money - <AUTHOR> http://gizmodo.com/5687689/how-anyone-can-fake-an-atm-and-steal-your-money?utm_source=twitterfeed&utm_medium=twitter&utm_campaign=Feed%3A+gizmodo%2Ffull+%28Gizmodo%29&utm_term=%23gadgets

<comment><USER2> Now I know how they stole money from my dad's back account. Stupid Indian Bank, not able to stop what's happening at mass scale: [http://www.indianexpress.com/news/Cloned-ATM-card-leaves- wom...](http://www.indianexpress.com/news/Cloned-ATM-card-leaves-woman-poorer- by-Rs-20-400/714195/)

</comment><comment><USER3> "you can see why the 'everybody panic' headlines associated with this topic are a bit overblown."

Doesn't that apply to this headline as well?</comment>


3M Files Trademark and Anti-Cybersquatting Lawsuit Over Domain Names - <AUTHOR> http://www.billhartzer.com/pages/3m-files-trademark-and-anti-cybersquatting-lawsuit-over-domain-names/ 3M Corporation has filed a trademark infringement and anti-cybersquatting lawsuit over domain names that appear to be similar or confusingly similar to their trademark. But in this case, it appears as if they're suing everyone, not just the domain name owners. <comment><AUTHOR> Take a look at the huge list of people they're suing, including Domains by Proxy, Godaddy, and even web hosts.</comment>


What is Math washing? - <AUTHOR> http://www.mathwashing.com/ <comment><USER2> The article is correct that machine learning doesn't remove bias. If the training data is biased, the output will be biased in the same way. But machine learning doesn't add bias, either. If the training data are unbiased, the output will be unbiased. In this sense, algorithms are fairer than humans.

So if someone wants to argue that a machine learning model is or is not biased, they should base that argument on how the model is trained. For example: suppose a bank wants to use a machine learning model to predict who to make loans to. Historically, human bank managers made those decisions, and they tended to have a bias against people from the wrong side of the tracks. There are several possibilities:

* If the bank trains the model on the bank managers' decisions, and it uses ZIP code as a feature, then it will discriminate against people from the wrong side of the tracks just like the human bank managers did.

* If the bank trains the model on the bank managers' decisions, but the only features it uses are monthly income and existing debts, then it will probably be unbiased (although it's still conceivably possible for there to be a bias).

* If the bank runs a controlled experiment by approving loans for 100 people at random, and trains the model on which loans were paid back, then the results of the model will be fair; it will accurately predict how likely people are to pay back loans, regardless of which side of the tracks they live on.

* If the bank trains the model on loans made by human bank managers, but it trains the model to predict loan repayment instead of loan approval, then the algorithm will actually _invert_ the bank managers' biases. If the bank managers never approved loans for people from the wrong side of the tracks unless they were an extraordinarily safe bet, then the algorithm will conclude "people from the wrong side of the tracks always pay back their loans!"

Arguments about machine learning bias should be based on these sorts of specific details, rather than assuming "algorithms aren't biased" or "algorithms are biased".

<comment><USER3> I don't think you really understand the kinds of details that AI picks up on. If that data pool shows that people who apply for loans on a Tuesday and have a salary whose third digit is 7 almost always default on loans, then neural networks will pick up on that, regardless of the connection to reality.

An algorithm, especially a trained algorithm, should be assumed biased until proven otherwise. It's not humanly possible to cleanse and normalize a dataset to a level that will prevent all possible overfitting ever, and even if you have godlike precision in squashing irrelevant data, it still depends on your personal definition of unbiased.

As someone who has been boots on the ground for political surveys, I'd frequently asked surveys that respondents from both parties would comment were biased against their own side. I don't trust human judgement, and I don't trust the judgement of human tools.

</comment></comment><comment><USER4> I like the idea of algorithm transparency. There were a few cases were people have tried to subpoena the source code from red light cameras, or DUI breathalyzers.

[http://digital.law.washington.edu/dspace- law/bitstream/handl...](http://digital.law.washington.edu/dspace- law/bitstream/handle/1773.1/1069/7WJLTA123.pdf?sequence=4)

It's not clear cut as it seems is that states can side-step forcing discovery of the source code by arguing that the state prosecutor does not control / own the source code.

This is of course moot in regards to a private entity like FB, Google or Twitter. They can ban anyone for any reason. Do they even need the "algorithms" excuse? Maybe if they ban someone for whom they get a lot of negative PR, then they can issue an apology "Sorry you feel this way, but algorithms did it, we swear".

</comment><comment><USER5> It's amazing how big companies like Google can be so oblivious to how biased their algorithms are. See: YouTube "hate speech" detection, Facebook and fake news.

Algorithms more often then not inherit the same biases their programmers have. Having those biases determined mathematically makes no difference.</comment>


Waking up in the same place every morning is boring - <AUTHOR> http://www.rationalcraft.com/Winscape.html

<comment><USER2> I was hoping for someone who actually tries to sleep somewhere different every night. Reminds me of a friend who tries to never order the same thing twice at any restaurant. Doesn't take too long before that becomes difficult, but any time he goes to a restaurant that has something he hasn't tried, he orders that. I was always impressed with that approach to life.

<comment><USER3> I'm curious. Does your friend balance his meal exploration adventureness with boring-ness in other parts of his life? Or is he a free spirit?

</comment></comment><comment><USER4> All product demo videos should include a confused baby.

</comment><comment><USER5> Waking up alone every morning isn't fun either, but that's what you'll need to do for perspective tracking to work properly.

<comment><USER6> And wear a large necklace box.

</comment></comment><comment><USER7> I wonder if you can achieve similar effect by projecting a video shot with fisheye lens onto a concave screen.

</comment><comment><AUTHOR> Hidden down below he also has a video of how he made it:

<http://www.rationalcraft.com/Winscape_MakingOf.html>

</comment><comment><USER8> Sweet Minerva, this is super cool! I hope this technology matures.

This is one of the promises of sci-fi, right? It seems a heck of a lot easier to do right than flying cars.

</comment><comment><USER9> _Slow glass_ at last!

Bob Shaw's _The light of other days_ [http://en.wikipedia.org/wiki/Slow_light#Slow_light_in_fictio...](http://en.wikipedia.org/wiki/Slow_light#Slow_light_in_fiction)

</comment><comment><USER10> This reminded me of an old movie:

<http://www.youtube.com/watch?v=vF6DI0btvVY>

Makes more sense to Italian speaking people.

</comment><comment><USER11> The short train scene shown in the video is from <http://nrkbeta.no/2009/12/18/bergensbanen-eng/>

</comment><comment><USER12> now all we need is for someone to get the right head tracking cameras set up for a more production ready solution. how cool would that be!

</comment><comment><USER13> I like the way it combines the Wii and the iPhone. The name -- Winscape -- is unfortunate though. It makes it sound like a Windows program.

<comment><USER14> Well it is a program, sort of, for windows, sort of, but not for Windows, I think.

</comment></comment><comment><USER15> A great gift for your friends with only one eye.

<comment><USER16> I believe stereo vision provides little 3D info at long distances.

<comment><USER15> But it provides info at short distances, which is where the monitors are.

</comment></comment></comment><comment><USER17> It's cool, but not as cool as waking up in other people's beds.</comment>


Why is GitHub not opensource? - <AUTHOR> https://twitter.com/SauravTom/status/450279008022700032 <comment><USER2> Umm, I would argue that a good percentage of it likely is [1]. What is a twitter post doing this high up?

[1] [https://github.com/showcases/projects-that-power- github](https://github.com/showcases/projects-that-power-github)

</comment><comment><USER3> [http://tom.preston-werner.com/2011/11/22/open-source- everyth...](http://tom.preston-werner.com/2011/11/22/open-source- everything.html)

</comment><comment><USER4> This is a no-brainer. Use Cgit or Gitlab.</comment>


Gluing Galaxy Note 7 Batteries Down Made It Worse for Samsung - <AUTHOR> https://www.wired.com/2016/10/samsung-exploding-note-7/ <comment><USER2> I think the real problem is the battery was itself sealed with an airtight plastic wrapping. If consumers could just pull out the lithium plates, patch new electrolytic material over wherever they were shorting, then zip the battery back up, then they'd be fine.

And another thing! Back in my day, if you had a transistor go bad in a discrete logic unit, you could just pop out the card and solder on a new one. But kids these days with their fancy integrated circuits...

<comment><USER3> But I've seen many old and even ancient computers where only –you guessed it– the (CMOS memory/clock) batteries went bad. Basically all of them go dead after a few decades, exchange them for new ones, and the puppy will boot up again.

For more modern devices: I'm now on my third battery of my private notebook (6 year old HP Probook), third battery on a Galaxy SII (!) which still is OK for random tests and to leave around as a music player even running Android 6.0(!). If I had to send them to a shop to have the (internal, glued down) battery exchanged, I would have stopped using both devices already a few years ago.

But just buying the battery for a few (few 10) bucks is cheap enough to risk the investment in an otherwise paid off machine.

I don't think the same holds true for more involved repairs where a mobile phone made of (a few hundred million…) discrete and easily repairable transistors would be handy ;-).

<comment><USER4> >I don't think the same holds true for more involved repairs where a mobile phone made of (a few hundred million…) discrete and easily repairable transistors would be handy ;-)

Yes, but the phone you are describing would be much easier to repair than an modern phone, with several orders of magnitude more transistors.

Processor (Samsung Note 7 - Exynos 8890) Transistors - ~1 Billion (I couldn't find a good number for this, so I used a conservative estimate [1]).

DRAM - 4GB = 8bits/byte * 4 billion bytes * 1 transistor per bit = ~32 billion

Flash 64 GB = 8 bits/byte * 64 billion bytes * 0.5 transistors per bit (i.e. two bits per transistor with floating gate NAND Flash) = 256 billion transistors

Ballpark total = ~289 billion transistors

;-)

[1] [https://en.wikipedia.org/wiki/Apple_A10#Design](https://en.wikipedia.org/wiki/Apple_A10#Design)</comment></comment></comment>


Google to Start Selling Own Phone Next Year - <AUTHOR> http://online.wsj.com/article/SB10001424052748703757404574592530591075444.html

<comment><USER2> The opening line is provocative, but I didn't read the article because I'm not a subscriber.

Do they have evidence to support the claim that google will sell these to the public, or is it just a guess based on the rumours?

<comment><USER3> It has apparently been confirmed conclusively. Here's the TechCrunch article: [http://www.techcrunch.com/2009/12/12/google-phone- unlocked-c...](http://www.techcrunch.com/2009/12/12/google-phone-unlocked- confirmed/)

</comment></comment><comment><USER4> subscribe free link anyone?

<comment><AUTHOR> Apologies for the paywall. A search on Google News for the article title should allow full access.

<comment><USER5> This is really ridiculous.

[http://www.google.com.au/search?hl=en&safe=off&q=htt...](http://www.google.com.au/search?hl=en&safe=off&q=http://online.wsj.com/article/SB10001424052748703757404574592530591075444.html&btnG=Search&meta=&aq=f&oq=)

<comment><USER6> For almost every news websites that requires a free subscription, making a copy paste of the title in Google an clicking the first result will give you access to the full article. The reason this works is that they give full access when Google is the referrer. They do that to comply with Google's "anti-cloaking" policy while letting the Google spider crawl the whole article.

[http://www.google.com/support/webmasters/bin/answer.py?hl=en...](http://www.google.com/support/webmasters/bin/answer.py?hl=en&answer=66355))</comment></comment></comment></comment>