Why does GitHub let me commit as other people? - <AUTHOR> http://gluxon.com/blog/2014/05/23/Why-does-GitHub-let-me-commit-as-other-people <comment><USER2> The author of a commit in git is just metadata. You can set it to whatever you want. This is a necessary feature for distributed workflows, or any kind of workflow where one person may be committing on another person's behalf.

The only way to avoid 'spoofing' commits would be to require them to be signed. Anything else would require a single source of authority on the identity of a given committer, which would defeat the purpose of a distributed VCS.

The OP mentions "security": what's the security issue here? Being able to label a commit as being from defunkt doesn't give you access to anything defunkt has access to.

<comment><USER3> > The only way to avoid 'spoofing' commits would be to require them to be > signed.

You could just ignore Git metadata and bind it to the account which was used to authenticate (pubkey, pass, etc)

<comment><USER2> But in that case, if I pushed commits from another person (that they sent me over email, for instance) I would end up falsely claiming credit for their work.

This would also be a huge issue for rebase workflows, because rebasing changes the commit SHA. Every commit I rebased would end up belonging to me, not the original author.

<comment><USER4> Perhaps in situations where the uploading user and the committing user differ, it could read something like "X on behalf of Y". This seems like it would satisfy OP's concerns as well as yours.

<comment><USER2> "Y via X" would be preferable.

It's worth keeping in mind that what GitHub does now is what _every_ other git client does, and it's in GitHub's best interest not to confuse users (or to make it look like they're privileging a GitHub-based workflow over a standard git workflow).

</comment></comment></comment></comment></comment><comment><USER5> This isn't a github problem, git lets you set your user.name and user.email as anything you like. In addition, you can rebase and rewrite the history to change former commits to be from whomever you like.

It's a feature, not a bug - this is how git is able to seamlessly interoperate with other VCS, like SVN. The SVN user id and email is displayed as the git commit author. Having to verify this information would be very complicated and essentially break interoperability between VCS's. In addition, mutable history means you could go back and fix up the history, remove misspellings from names, update your git repo to show a new email address, etc. Git follows the standard user philosophy of letting unix users do what they want, and simply warning them if they push rewritten history to a repository.

<comment><USER6> It's a useful feature in git, but a bug in github.

In my company's git repo, yes, I want full control.

In a public forum where lots of my public image is tied up, I don't want people to be able to impersonate me.

It's a tricky one to solve, though. Not sure how it would be achieved without demanding that every commit is GPG signed.

<comment><USER2> It seems like it'd be possible to at least restrict your GitHub account from appearing linked to a commit unless it's a repo you've contributed to directly (by pushing or with a pull request).

That would need to be configurable, though -- it would kind of suck to lose credit for commits just because they weren't merged using GitHub's tools.

</comment></comment></comment><comment><USER7> This isn't a "security problem", nor is it something on GitHub's end. The email used to author a commit is set by the person making the commit, and shouldn't be taken as a secure value or proof that the person who owns that email made that commit. Think of it like the return address on an envelope, not the barcode on a driver's license.

If you're looking to securely prove who made a commit, look into signing commits.

GitHub _does_ require that you have a valid SSH key for a GitHub user, and that the given GitHub user has access to write to the repo you're pushing to, but that's totally separate from commit messages and authorship.

</comment><comment><USER8> This has been reported many times.

[http://www.jayhuang.org/blog/tag/impersonating/](http://www.jayhuang.org/blog/tag/impersonating/)

If you want real verification, sign your commit with GPG/PGP.

Some people don't use real email address for privacy reason (not sure if email address is really required to commit). Another reason why Github may not want to implement verification is all the people you have written code with... like when you want to push an existing repo to Github. Why? Because Git as a tool is pretty good at rewriting history (unlike Mercurial).

</comment><comment><USER9> Discussed earlier here: [https://news.ycombinator.com/item?id=6918343](https://news.ycombinator.com/item?id=6918343)

Original post: [http://www.jayhuang.org/blog/pushing-code-to-github-as- linus...](http://www.jayhuang.org/blog/pushing-code-to-github-as-linus- torvalds/)

</comment><comment><USER10> It's because Git is decentralized, and when you push a repo to GitHub it could contain genuine commits from other people that you've pulled into your repo from some other, non-GitHub source. There's no way for GitHub to authenticate such commits.

There is definitely a potential for abuse, but can you solve it without breaking useful functionality?

<comment><USER11> GPG sign your commits in git if its an issue.

<comment><USER10> Agreed, but GitHub doesn't show any indication that a commit has a valid GPG signature, so a casual visitor to GitHub wouldn't know if a commit is genuine or not.

<comment><USER12> Even git itself does not show signature information by default in `git log` and friends.

</comment></comment></comment></comment><comment><USER13> It's because Git includes the author name and email in the commit (remember setting the config?)... if they added any info post-commit on the server it would change the digest which would break tracking for the pushing author. They could easily reject commits that come from emails that don't match the email associated with the account since a key can only be used by one account, but that would break the decentralized Git model of accepting commits and pushing them upstream and mirrors since not Git development happens through GitHub. There might be some kind of solution related to confirming emails are associated with a key, but for the most part it's a function of the Git model and any solution will break some legitimate use cases.

</comment><comment><USER14> Also, I hear you can send e-mail claiming to be from anyone!

</comment><comment><USER15> One small problem is that github uses email addresses both for associating commits and for password resets. This means that if someone used their company email account for commits to an open source project, and left the company, once they removed the email address from their account, their commits would no longer be associated. Or, they could leave their email address in their account, but if someone hacked it they could use it to initiate a password reset.

It would be nice if in the list of email addresses there was something showing whether it can be used to recover their account, and the ability to change it (requiring them to have at least one email address that can be used with account recovery).

Two factor auth helps with this, I think.

<comment><USER7> EDIT: After testing, my statement below is wrong. I've hit up GitHub to see if they'll fix either the wording or behavior.

I haven't tested it, but based on the description, it seems that only the "Primary GitHub Email" would be used for password resets:

[https://github.com/settings/emails](https://github.com/settings/emails)

Other added emails would thus be used for associating commits but not for regaining account access.

<comment><USER15> The reason it seems that way to you is because you haven't tested it.

The email address has to be verified, but any of the verified email addresses can be used to reset passwords. There is no way to un-verify an email address besides deleting it and re-adding it.

<comment><USER7> If that's the case, I'll be reaching out to GitHub to clarify the wording once my test shows otherwise. I specifically pointed out that I was basing my understanding on the message they provide.

EDIT: I've confirmed the wording doesn't match the execution, and I've send a message to GitHub

<comment><USER15> Thanks! I sent them an email a year or two ago and they haven't addressed it. It is a bit of an edge case, and there's a workaround. So I'm not annoyed that they haven't fixed it, but I will be glad when they do.

</comment></comment></comment></comment></comment><comment><USER16> As several others have pointed out, this isn't a security issue or a bug, it's just how Git works.

However, it does make me wonder something. Do these spoofed commits count towards the "Contributions" visualization on GitHub user profile pages? I wonder if you could do this but on other people's profile pages: [http://joshbranchaud.com/blog/2013/06/06/Fun-with-GitHubs- Co...](http://joshbranchaud.com/blog/2013/06/06/Fun-with-GitHubs-Contribution- Graphs.html)

<comment><USER17> I doubt it. If you follow the links to individual usernames, you'll see that they don't even get credit for the commit that might have been made on their behalf. (Although the person who actually committed got credit for their commits.)

</comment></comment><comment><USER18> I sure hope the "public computer" in your workspace has a private key that matches a public key submitted to Github ... I know Gitolite won't allow this to happen but I'll have to check on GitLab and GitBucket.

<comment><USER7> I sure hope a public computer doesn't have a private key that has credentials to push as him to GitHub :)

<comment><AUTHOR> It doesn't. :)

It was actually a personal private computer until I left that area and opened up the password. I overlooked changing 'git config user.email !@#$'.

</comment></comment></comment><comment><USER19> That's a well known property of git/hg/distributed version control. If you want to be sure about who made which commit you need to use commit signing. It's the only way to be sure about such things anyway.

</comment><comment><USER20> It'd be pretty good if the publicity surrounding this article led to an increase in usage of PGP. I've always thought it was a shame how underused asymmetric encryption is in comparison to its potential.

</comment><comment><USER21> I think this is a use case of signed commits. They would allow for verification of the commit's author's identity.</comment>


What to do with greedy investors? - <AUTHOR>

I've been working on my new start-up for 3 months now. Basically, it'll be the first payments-enabled marketplace for end users in my country with great potential to actually take over the domestic market.
Two investors have already heard of it and made an (IMHO, greedy) offer: an "angel" investment of ~30K (plus office space) for 60% of the company - they'd practically own me. This "investment" would be charged to the company these "investors" work for, but the deal is that both of them get 20% each and their company getting 20% (yeah).
The thing is; both me and my co-founder are pretty much broke since we've been working on this only, so we won't be able to proceed without some kind of investment. I don't know many people who invest in start-ups here and I don't know where to look for them at all. I know about funds like 500startups and YC but I don't think it's worth even applying or pitching their mentors about a product that's targeted for our market only.
Please, enlighten me; what should I do and where should I look for a better deal? <comment><USER2> It's a good thing that you asked here, but you need to do more homework. YCombinator typically offers $15K to $20K (USD) for about 2% to 10% of the company on their seed level funding.

<http://www.ycombinator.com/about.html>

I recall reading the average was about 3-4% of the company, but I can't recall where I read it.

You seem to already know that the offer you received is absurd but the YC numbers should put it in better perspective.

If you want to know what _real_ angel investors are like, you should read this:

<http://www.paulgraham.com/angelinvesting.html>

And then read over the docs/terms typically used for angel investments.

<http://ycombinator.com/seriesaa.html>

Everything under 50-100K is typically considered "seed funding" but the differentiations between "seed," "angel," "super-angel," and "VC" are somewhat blurred and undefined. If you have a viable market/product, _real_ investors at the various funding levels will be interested. If you get into one of the seed funding organizations like YC or one of the incubator programs, the most important things you get are outside validation, mentoring/help, and access to networks of investors through "Demo Day" gatherings and other channels. It's smart to apply.

As for the ways to look for a "better deal" the above is the best idea, but you can also start contacting angel investors on your own through things like Angel List and similar. Be careful on which investors you work with and choose them carefully. As PG states in his essay, the best angel investors are nice people, but if you also read enough of the horror stories from founders, not all angels investors are nice.

A lot of the angel investors run their own blogs and twitter feeds (Fred Wilson at avc.com comes to mind), so that's another way to find them. As for learning the reputation and skills of specific angel investors, you'll need to do a ton of searching and reading.

Hopefully, this will get you headed in a better direction.

Good Luck!

</comment><comment><USER3> I think you are confusing "greedy" with "opportunistic" and "risk averse".

You said, "I've been working on my new start-up for 3 months now... both me and my co-founder are pretty much broke since we've been working on this only, so we won't be able to proceed without some kind of investment" - that's telling me that you are desperate. If you are seriously that desperate, then you are a huge risk. The potential investor likely feels the need to see a bigger ROI potential before getting into bed with you.

In this post, at least, you haven't set yourself up as someone worth investing in - the two of you started a business yet failed to do so with enough money to even last four months, you are currently broke, and neither of you know any other potential investors. From that pithy description, it sounds like your business is on the brink of disaster. I know this is an abridged form of what you are going through but you just sound risky. I'm surprised that anyone is interested given that baggage.

I'm not trying to be disparaging but let's call a spade a spade: this isn't a "greedy investor" story; it's a story of two entrepreneurs who started a business without enough money and planning.

I'd suggest you move to working part-time on the project to get an MVP and then look to grow it over a few years. Taking on a 60% investor is mind crushing - that leaves 20% for you and 20% for your partner. Ouch.

</comment><comment><USER4> 1\. They're douchebags (which is proven by the terms of the "investment"). NEVER sign your company away to douchebags. You should prefer to shut down.

2\. Which country are you in?

3\. You have a (terrible) offer in hand. Now shop around. Decide how much you need for 12 months runway, minimally, and sell 20% of the company for that. Tell us your country, and ask for people here to connect you. Try to connect to expat technology people who are from your country but live in the US tech world. They are more likely to invest a few 10K at reasonable terms.

<comment><AUTHOR> 2\. I'm in Bosnia and Herzegovina and the start-up is targeted for the ex- Yugoslavia area (Bosnia, Croatia, Serbia, Montenegro)

3\. I'd love to connect with as many people as possible, my email and twitter are visible on my profile

</comment></comment><comment><USER5> Look for a better deal, definitely. Have you tried posting your company, product and fundraising on <http://angel.co>? There are lots of investors there and 30K would be a tiny deal for many of them.

Edit: clarified sentence.

<comment><AUTHOR> I have an unpublished 'template' on angel.co, waiting for the product to be ready for launching to publish it

<comment><USER6> Just as a warning, angel.co is completely useless if you don't _already_ have a number of preexisting connections to the angel investing community. If you start with 0 followers, you will have 0 followers forever, and nobody will ever see your profile.

<comment><USER5> This may not be entirely true. I started on angel.co as a beginning _investor_ with no deal flow. I have invested once via angel.co so far and have come close several times. I have also made several connections which have now allowed my deal flow to expand well beyond angel.co. A 30K deal would be ideal for a beginning angel or syndicate.

</comment></comment></comment></comment><comment><USER7> Politely tell them that you are not interested and move on. I don't know where you are or what your credit is like, but you could raise that much with credit cards in the US.</comment>


CapitalOne has the most secure password system - <AUTHOR> https://www.capitaloneonline.co.uk/CapitalOne_Consumer/Login.do

<comment><USER2> Ouch! This means that they are storing your original password in plaintext somewhere, and that is definitely _NOT_ best practices!

<comment><USER3> They may be storing the three characters as a hash separately, not that that is much better.

<comment><USER4> So I just need a pre-hashed table of all 80 possible single chars for a lookup table?

That is worse than a hash of SSNs.

<comment><USER3> You check 3 characters, not 1, but like I said, 80^3 still isn't good.

</comment></comment></comment></comment><comment><USER5> I think it's important to call attention to these issues, but can we change the sarcastic title?

<comment><AUTHOR> I see no reason to? This is a UK bank, not observing security, UK levels of sarcasm are entirely in order.

</comment></comment><comment><USER6> I remember awhile back I created a CapitalOne account and I put in a long password which it excepted, when I tried to login it wouldn't work, so I reset my password very carefully typing it. The password reset was successful, I tried to login and nope, didn't work. Third time reset I realised they have a max password length and were truncating my password as my original password was past their max length but would except, truncate without telling me and store it. This was the CapitalOne in the US.

<comment><USER7> I use 1password and run into this problem so frequently it makes me rage.

<comment><USER8> I usually use the DOM inspector to check for a maxlength, but really wish I didn't have to do that. >.<

</comment></comment></comment><comment><USER9> That is going to make lastpass hard to use for the site.

</comment><comment><USER10> Also, they don't support any kind of two-factor authentication, and have no plans to add that: [https://twitter.com/AskCapitalOne/status/504679257239719938](https://twitter.com/AskCapitalOne/status/504679257239719938)

<comment><USER11> Maybe they think 'tick the box' and 'enter character N from your password' are additional factors. :p

</comment></comment><comment><USER12> It also appends some garbage to the username, validates it and then proceeds with the random char grab....weird

      var results = document.cookie.match ( '(^|;) ?' +    "Username" + '=([^;]*)(;|$)' );

<comment><USER13> Some sort of bs client-side salt?

</comment></comment><comment><USER14> Fidelity's phone system lets you authenticate by typing your password on the phone keypad. On the plus side, this is probably the only time I've understood the technical reason behind a limited password alphabet.

</comment><comment><USER15> In my experience, most UK banks do the same thing. Their excuse is that it prevents keylogger attacks. I do not know enough to say whether it's an acceptable trade-off or not.

<comment><USER16> Seeing as I've been the victim of a half dozen or so password leaks, one credit card clone, and not a single keylogger attack, I'd probably err on the side of secure password storage, but that's just me.

</comment></comment><comment><USER17> HSBC has this: single-letters from your "secret word", in addition to an actual full passphrase.

</comment><comment><USER18> Is there another step after this one? Or does this get you in?

</comment><comment><USER19> Why would anyone think this was a good idea?

<comment><USER11> This is the definition of 'security theater': take off your shoes, spin around, hop on one foot. Many consumers mistake having to jump through hoops over a flaming pile of poo for 'more secure'. So it goes. :(

Edit: I'm a U.S. CapitalOne customer, and I just know that if they do that to my login, I will close my account faster than you can say, "Warning: do not tick". Good security doesn't need to be a hassle. And I'm happy to find another company that actually understands that.

<comment><USER19> Honestly don't all of the US banking and credit card companies do this sort of 'security theater'? While this seems pretty absurd, I'm not aware of any that don't have mediocore to poor password practices.

<comment><USER11> Simple.com is pretty awesome. I'm sure there are others as well, but yes -- they are in the minority. :/</comment></comment></comment></comment>


Hearthstone's new formats and the rise of digital scarcity - <AUTHOR> http://arstechnica.com/gaming/2016/02/hearthstones-new-formats-and-the-rise-of-digital-scarcity/ <comment><USER2> > In Hearthstone, on the other hand, there's no practical reason that Blizzard > couldn't keep selling its entire line of cards directly for as long as the > game exists.

There's no _technical_ reason why they can't continue to sell all of the types of cards however they aren't introducing scarcity for the sake of it, or as (just) a money grab.

When they design a new card they have to ensure that it fits with the other cards in the game, tweaking the effects it has so that it isn't too powerful when combined with existing cards. This becomes increasingly difficult as the number of cards increases. The "Standard" mode changes announced today make their job a lot easier as they only have to consider the last 2 years worth of cards (+ classic + basic cards) when designing new cards.

IMHO this will be a net positive for the game.

</comment><comment><USER3> The article gets quite short on my expectations. It just notes that Hearthstone is doing the same things that "Magic: The Gathering" does. And they notice - I disagree - that is completely different because Magic has to deal with physical cards while Blizzard has digital ones.

> it's a systemized way of creating enforced scarcity of a theoretically > limitless digital product through a deliberate, timed process.

This is the theme that will have make a memorable article. Our economic systems have been dealing with scarcity for a long time. The increase in production and reduction of scarcity was one way of measuring an economic system success. I really would have liked a talk about how for the last decades we have designed scarcity as an expanding business model and what it will mean for the future of economy.</comment>


Samsung: Solid state will match hard drive price - <AUTHOR> http://news.cnet.com/8301-13924_3-10196422-64.html?part=rss&subj=news&tag=2547-1_3-0-20 <comment><USER2> Anyone who still believes that CD, DVD or Blue-Ray still have a future is deluding themselves. There is no market for spinning media, it's just that there is currently no better alternative. Flash Memory will replace all spinning media as soon as it becomes viable from a cost perspective.

<comment><USER3> FYI: Blue ray is up to 400GB/disk (As in you can make 400GB disks that a PS3 will read) and it costs a tiny fraction of what that what flash memory costs. In ~20 years they might cost the same per GB, but that's still a long way from now and plenty of time for the next optical disk format to show up.

PS: I am assuming blue ray disks will cost around 10c per disk in 20 years. So flash needs to drop to 1/10,000th of it's current price to be competitive in that time scale.

<comment><USER4> The point is not how much you can store and how fast you can access consecutive sectors. The problem is that spinning platters have been stuck at 100 random seeks / second for the past 20 years, and most database struggles have been based on that. The new Intel SSDs can do 100,000 "disk seeks" per second, which means that you suddenly have the speed of a thousand-disk raid on one SSD. That's why SSDs are interesting. Not the storage per disk, the random-access IO. People still use tape (not just .tar formats) because it's really cheap for dumping big backups.

<comment><USER5> But I don't care about random-access speed when I'm just using it for media (music, photos, video).

I think within a few years most people will end up with a small (a few hundred GB) SSD for their OS and programs, and a very large traditional HD (a few TB) for archiving data that doesn't need random access.

That's the system I'm using now. Two 73GB 15K drives in Raid-1 for my OS, with 3 1TB drives in Raid-z for media.

<comment><USER4> Yeah, the same separation between small assets available quickly and big assets available slowly is how Amazon recommends you separate data between SimpleDB and S3.

I'm quite fascinated by all the ways we'll be able to persist data.

<comment><USER5> Yep, it isn't a new idea. The premise of Von Neumann machines is that you work around the cpu/data bottleneck with increasingly faster (and larger) caches. You have a tiny bit of ludicrously fast on chip memory (registers), a few megs of successively larger and slower L1/L2/L3 cache, a few gigs of kind of slow memory, and hundreds of gigs of unbelievably slow hard disk. This would just split the unbelievably slow disk into two separate layers - kind of slow SSD and really slow disk.

</comment></comment></comment></comment></comment></comment><comment><USER6> For what it's worth, chipmakers been saying that flash drives will catch up with hard drives in price for about 17 years now. I first read an article about solid state drives catching up with rotating drives in 1992.

Right now a terabyte hard drive costs $81, and a terabyte of SSD costs $2684, I'm not going to hold my breath.

<comment><USER7> They're not really saying that SSD will match HDD price per GB, but that it will reach parity for a specific demanded GB capacity (64-256GB) in a few years.

But by then, as you imply, the demanded capacity also will have increased...

So it seems to be a question of the rate differential. So far, SSD's are getting cheaper at a much faster rate than demanded capacities are increasing, and (assuming nothing changes the rates, like Blu-ray-sized 400GB movie downloads), it will catch up soon. Firstly just nipping at the heels of the low end, then biting a chunk out of the mainstream, and eventually consuming all but niche applications.

It has already caught up for lower capacities e.g., a 1 GB flash drive is cheaper than a 1 GB HDD (fixed costs: $2 vs $40-50), and disrupted hard drives from iPods and netbooks.

Meanwhile, desktops PCs themselves are being disrupted by laptops, which are being disrupted by netbooks.

<comment><USER8> _SSD's are getting cheaper at a much faster rate than demanded capacities are increasing ... Firstly just nipping at the heels of the low end, then biting a chunk out of the mainstream, and eventually consuming all but niche applications_

This is a classic Innovator's Dilemma/Innovator's Solution situation. People were buying for capacity, soon they'll be buying for convenience (speed, power consumption, etc). Tape drives are cheaper than HDD but no one is buying those.

<comment><USER9> The SSD taking over the HDD is based on the preposition that everything stays the same, but the game is going to change and we all know that. Digital distribution is beginning to hit big, I mean look at NetFlix on Xbox 360 and iTunes.

I haven't bought a CD in over a year and when I did it was because it was one of my favorite bands. How long is it before I'm saying the same thing with DVD?

SSD might pick up some niche uses, but there's a reason people have wanted mass storage, which is that programs are progressively getting bigger and so are all the files we store. I remember thinking a 400x300 pixel image was big, now I think a photo smaller than like 2000x1500 as small. In 5-10 years I'm going to think anything smaller than like 10,000x7,500 as pathetically small. Equally, I'm going to think any video that's not at least 720p isn't worth having, because by 2015 companies want UHDV to be released displaying at 4320p. When my video is taking up 32MB _per frame_ I don't want, I'll _need_ maximum capacity still.

<comment><USER8> _10,000x7,500 as pathetically small_

Ok, that's 75 megapixels. Ken Rockwell estimates that 35mm film is about 175 mp (<http://www.kenrockwell.com/tech/film-resolution.htm>), so that is a technically realistic number. But you need an outstanding camera and photographer to make all those megapixels matter, and most people won't pay for and _won't even notice_ the extra detail. Resolution bigger than the biggest computer doesn't matter much for mainstream users, and even a 6.1mp image from my DSLR looks good printed out at 8x10".

Now a hard drive full of HD movies would take up tons of space, but do you want to carry that around with you? Not to mention that movie studios will do whatever than can to prevent persistent files from being the digital format of choice. They would much rather stream on demand and charge per viewing or per rental.

We've always wanted more space, but computers are getting to the point where they're fast enough and big enough to satisfy common users. The fact that you're here on HN means that you're by definition not a common user.

</comment></comment></comment></comment></comment><comment><USER10> Samsung has a funny and impressive "viral" ad video showing 24 SSD drives in a RAID array. Sign me up for one of these: <http://www.youtube.com/watch?v=96dWOEa4Djs>

</comment><comment><USER11> What I find most attractive in SSD is the IO performance. The fusion-io PCI express SSD storage is the most attractive. The IO speed difference and reduced latency would make a significant difference for my application.

I'm not so sure about long term storage reliability. I would currently prefer to combine both type of storage.

</comment><comment><USER12> Fusion io is about $30/GB - which makes it more competitive with gobs of server ram and SAN than HDD arrays (RAID).

</comment><comment><USER13> I couldn't resist the hype and bought the cheapest no-name (A-Data, anyone?) 32GB second-hand SSD. I haven't seen a noticable performance improvement since but FWIW the silence - getting rid of the disk thrashing - is worth alone the price of this thing.

<comment><USER14> I think A-Data is more than "no" name: <http://en.wikipedia.org/wiki/A-data>

I too bought a 32GB SSD from SanDisk a year ago to replace hard drive in my IBM ThinkPad X60s to get silence and shock resistance (I guess I'm paranoid on those issues, but it made me happy) Sequential write perfomance is noticeably less than even in 5400 rpm drives, but I didn't care much; it's okay for me.

Yet I would call people who use SSD in their computers early adopters; the outlook for SSDs is optimistic but I guess it will be a few years at best till SSDs will be able to become mainstream.

</comment></comment><comment><USER15> What would be really informative is a graph of the historical price per memory size for both spinning and solid-state harddrives... anyone come across anything like that?</comment>


You May Not Need Moment.js - <AUTHOR> https://github.com/you-dont-need/You-Dont-Need-Momentjs <comment><USER2> It's almost always better to use a standard than grow something at home. When your project gets bigger (which most projects of interest will), the inertia of the homegrown solution will become a detriment and liability. Only simple or novel use cases should be kept as internal libraries, and dates are not simple.</comment>


Using the Blockchain to Fight Crime and Save Lives - <AUTHOR> http://techcrunch.com/2015/09/27/using-the-blockchain-to-the-fight-crime-and-save-lives/ <comment><USER2> There's no explanation about how this is meant to work, either in the article on on Blockverify's website.

e.g. authenticating paintings: 1) Why should I trust the data in some blockchain to tell me whether or not the painting in my hands is genuine? and 2) How do I know in the first place that the data relates to this actual painting?

I can't see the magical step that can give reliable answers here.

<comment><USER3> I don't know if you can tie anything to a physical painting, but you can keep track of ownership through the ledger. I don't really know what this company has planned, but if you start at the source use the shared ledger to pass on ownership, then someone can prove that they own something.

Basically like a title being passed around on the blockchain.

<comment><USER4> What happens if someone steals the key but not the painting?

What happens if someone steals the painting but not the key?

What if there's two claims for the same thing?

How do you prove that thing == key?

How do you prove thing doesn't have two keys?

What if you lose the key?

It makes absolutely no sense.

<comment><USER2> The only clue on their website seems to be 'Each product is labelled with Block Verify tag', but this in itself is useless:

* How can I tell that the label is genuine? With expensive items, an attacker can spend a lot of money creating an exact replica of a label. There's no hologram/anti-tamper system that's undefeatable.

* _If_ we assume that Block Verify's tags are trustworthy and tamper-proof, and there's no way they could be duplicated or placed on to a fraudulent item, then at this point we don't actually need a blockchain to prove anything, as the label is proof enough.

<comment><USER4> It's just completely absurd. See how often and in such large amounts Bitcoin is stolen, and tell me that wouldn't happen with these keys as well. I get the impression there's just a lot of people getting VC money for complete and utter bullshit like this, and somehow employing a team of people for a concept that doesn't even make sense on a flashy website let alone in the real world.</comment></comment></comment></comment></comment>


Ask HN: How do I honestly display my education on my resume? - <AUTHOR>

Some background: I recently withdrew from university to move to the Bay Area and work full time. I'm in the process of applying for jobs and wondering how to most honestly approach the subject with potential employers. My resume currently reads:
Foobar University, College of Computer Science
2010-2014
GPA, etc.
I'd rather not add "Did not complete degree" to the education section, but as it stands it seems to imply that I did finish school. I don't want to find a job and have problems arise later when it comes up that I didn't graduate, but I also don't want to have to tell every company I apply to that I dropped out. Thoughts, HN? <comment><USER2> I dropped out due to financial reasons, and personally I just don't list a degree next to the education. I have never had a problem, and if an employer asks I just explain. I think most HR folks interpret no degree listed as meaning that you attended the school, but did not get a degree.

</comment><comment><USER3> As jeffmould said, simply not mentioning any degree is sufficiently honest, but will likely trigger the question from HR. If you want to be a bit more up- front, I have seen resumes with the words "coursework towards B.S."</comment>


TikTok Agreed to Buy More Than $800M in Cloud Services from Google - <AUTHOR> https://www.theinformation.com/articles/tiktok-agreed-to-buy-more-than-800-million-in-cloud-services-from-google <comment><USER2> TikTok seemed to run off of Alibaba Cloud (from what I read which may be wrong) so it's an interesting move to buy Cloud Services from Google. I probably read this as a way of strengthening the case that they're an "American" software company since they run on the same infrastructure as any SV startup.

<comment><USER3> According to Chinese law, the government can quietly demand any information they want on anyone. A warrant in China? Hah.

All they have to do is say "Give us the data stored on GCP host" and TikTok is legally obligated to comply.

To be fair, it's not much different than in the United States unless the data belongs to a US citizen, which is why many companies are attempting to domicile cloud data in their own country.

<comment><USER4> Tiktok' parent is bytedance is incorporated in Cayman islands. It has a US and a Chinese subsidiary. Chinese subsidiary runs douyin is subjected to the intelligence law. The US subsidiary runs tiktok and is managed by US employees and is not subject to the same law. The intelligence law would be problematic if bytedance is incorporated in China but it's not. The data and the code for tiktok is stored in the US and Chinese subsidiary cannot view that data.

<comment><USER5> >The US subsidiary runs tiktok and is managed by US employees and is not subject to the same law.

Which leaves us with the question as to whether or not the government cares what the law says or whether they would back down if employees in China said they can't easily hand over foreign data.

<comment><USER6> Eventually tiktok will run anything that is remotely sensitive inside us soil. That has already began.

</comment></comment></comment></comment></comment><comment><USER7> For comparison, another reference GCP customer is SnapChat who signed a 5 Year $2 Billion dollar contract with Google Cloud, as they disclosed in their IPO Prospectus. At that time (2017) they were by far the largest single customer on the Google Cloud Platform by spend. They spend the majority of that on App Engine, Cloud Storage, BigQuery, and bandwidth.

Even after this disclosure of the TikTok $800M Agreement - SnapChat is still a much larger customer in spend per year.

[https://www.vox.com/2017/3/1/14661126/snap-snapchat-ipo- spen...](https://www.vox.com/2017/3/1/14661126/snap-snapchat-ipo- spending-2-billion-google-cloud)

</comment><comment><USER8> I believe it. 1B daily users globally. Processed events per day probably somewhere in the trillions. In case you missed it, they recently shared some details on their algorithmic curation system ;)

[https://newsroom.tiktok.com/en-us/how-tiktok-recommends- vide...](https://newsroom.tiktok.com/en-us/how-tiktok-recommends-videos-for- you/)

<comment><USER9> No chance they have 1B DAU. That doesn't pass the sniff test.

That's like 1.5B MAU, which is even more ridiculous. But let's look.. 7 billion people, 4.5B have internet access. So more than over 15% of humans with internet access are using tiktok every day.

3.5B humans have a smart phone, so 1 in 3 are on tiktok every day? Nah.

And honestly, I'm fairly even on china but I don't really believe numbers the put out for most things.

[https://www.statista.com/statistics/617136/digital- populatio...](https://www.statista.com/statistics/617136/digital-population- worldwide/)

[https://www.bankmycell.com/blog/how-many-phones-are-in- the-w...](https://www.bankmycell.com/blog/how-many-phones-are-in-the-world)

<comment><USER10> 1.5B MAU is not unreasonable. A majority of Chinese users are using it. It is superfluous when you ride the subway or eat in a restaurant. Everyone. That alone could be .75-1+B.

Then you only need a relatively small percentage of the rest of the world to reach that number.

Just because you can't see it, doesn't mean it is not real.

<comment><USER11> > superfluous

I do not think that word means what you think it means.

<comment><USER12> I'm guessing they meant "ubiquitous"

<comment><USER13> Mellifluous?

</comment></comment></comment></comment></comment></comment><comment><USER14> Makes sense. It ensures google faces repercussions from removing tiktok from the Android play store.

<comment><USER15> This deal is from May 2019, well before anybody was talking about banning TikTok.

<comment><USER16> It's not hard to imagine them planning ahead. In fact you can argue that the parent company ByteDance has planned for such existential risk by setting up TikTok as a separate entity from Douyin.

<comment><USER6> That of course was the case. Mega corporations are as powerful as small sovereign nations, they have to behave like one...

</comment></comment></comment></comment><comment><USER17> Just for reference, GCP earns $10 Billion a year and this deal is $800 Million over three years. Whether this is a big deal is an exercise for the reader.

[https://www.zdnet.com/article/google-cloud- hits-a-10b-annual...](https://www.zdnet.com/article/google-cloud- hits-a-10b-annual-revenue-run-rate/)

<comment><USER18> That comes to 2% of this year's revenue. I'd say that's a pretty big deal. I can't imagine Google has many individual customers representing more than 2% of revenue. Math says that at the least, they are one of the top 50 customers.

<comment><USER17> There are two types of customers that every B2B company wants - customers that bring in a lot of money and "referenceable" customers that are willing to stand up on stage and have their companies listed in marketing documents.

TikTok being referenceable means a lot more so sales people can go out and tell CxOs "look we are a safe choice because $x company trusts us".

Disclaimer: Just in case I get called out. I work for AWS consulting but I am so far removed from the sales process it's not even relevant. All opinions are my own. I've been in the room more when "enterprise deals" were being made in smaller B2B companies.

<comment><USER19> nice!!! let's get this referenceable asap!

<comment><USER17> Yeah. I've heard that a previous companies. I am afraid that I'm going to become "that guy"....

</comment></comment></comment></comment></comment><comment><USER20> Am I missing something? The article says this was a May 2019 deal. Why is this news now?

<comment><USER21> Ditto^

<comment><USER22> Interesting, I suppose a little reminder to Google not to remove Tiktok?

</comment></comment></comment><comment><USER23> I wonder if there is a salesperson getting an insane commission from this transaction.

More generally/seriously how exactly does this conversation go? I've seen deals at my company which have been in the 7 figure range (involving many, many people) but never anything so large. Is this the kind of thing discussed only at C* level?

<comment><USER24> I was tangentially involved as a consultant when a major bank bought a few billion USD in GCP services.

Others have mentioned whole 50 person deal teams from both sides, multi year processes, all of Google's most senior execs pressing the flesh etc.

But to your question this type of deal usually goes beyond even the C Suite, to a companies board and shareholders. The bank I was involved with held an 'Extraordinary General Meeting' for reps of major shareholders, to present its case and get sign-off. This part of the process was actually the longest, it took ~6 months.

That was because the shareholders of the bank had interests to be accommodated, for instance one of them was also a major holder of Amazon stock so they had a vested interest in having the bank choose AWS. They needed to be worked around or convinced choosing GCP would create more value for them than portfolio synergies.

<comment><USER25> that sounds like a conflict of interest if a board member's shareholding has to be accommodated.

<comment><USER24> Wasn't a board member, it was a pension fund who held stock in the bank.

</comment></comment></comment></comment><comment><USER26> I think snapchat have a similar massive deal with Google.

It really does solidify a kind of class structure within these tech giants. Google, Apple, Microsoft, Amazon at the top and everyone else, even massive players like snap and tick tock are completely reliant upon them.

<comment><USER27> That's an odd way to look at things. Google, Microsoft, and Amazon are in turn reliant on Intel for the CPUs that power their cloud services. Does that put Intel in a class above them? No -- it's just companies buying stuff from other companies so they can focus on what they're good at.

* _and going one step further, all of these rely on a handful of janitorial companies to operate. so maybe the ABMs of the world are in the top class?_

<comment><USER28> Amazon has AWS instances running their own custom ARM silicon. It's not hard to imagine Microsoft and Google doing the same, which will eventually become dominant for cost reasons alone.

We'll have three platforms that control most non-Chinese computing. It's hard for smaller players to compete with that kind of inertia.

<comment><USER29> Last year's Gartner report concluded that less than 10% of cloud computing workloads were running in public clouds. With respect to technology, most of the companies of the world are consistently living 20+ years in the past.

It's certainly hard to compete at running a public cloud, but it's hard to compete in any industry that requires $X00B capex to get the ball rolling.

</comment></comment></comment></comment><comment><USER30> Aren't US going to ban TikTok?(i heard something like this previous week)

If US banned TikTok, willn't that decision affect TikTok? (like it affected Huawei)

<comment><USER31> >>If US banned TikTok

Any attempt to ban it to the wider public would be immediately be met with a legal battle that the US government would lose as there is no legal way for them to implement such a ban, our constitution would forbid it

At most they could bar employees of the federal government (and its contractors) from using it, which given the federal government is one of the largest would have a large impact. Even that limited action however would be met with a large legal challenge and would have a good chance of failure for anything that is not a Government Computer / Phone / Network

<comment><USER32> All they need to do is poke the Play Store / App Store the right way and, poof, it's gone. They don't need to legally ban it, just send a strongly worded letter.

<comment><USER31> Well given that Google is anti-trump I am sure they would not simply do what Trump says.

Now if Biden was elected I am sure it would be different

</comment></comment></comment></comment><comment><USER33> Must be all on the backend because everything they serve that I can see flying past is coming from either AWS or Akamai.

</comment><comment><USER34> TikTok/Bytedance seems to be growing like crazy, I had three different recruiters from that company reach out to me in the past month. I declined for many various reasons, but mainly what would happen if they were banned in the US which seems like it could happen( I would prb be without a job in short order!). Would all US operations cease and a contract like this be voided and refunded?

<comment><USER35> ByteDance pays INSANE compensation. Significantly more than any of the FAANG. You should consider it.

</comment></comment><comment><USER36> If tiktok had was under the influence with Chinese government why wouldn't think do this to keep things on the up and up. Look at us guys - we put data in US. All good nothing to see here. (as china still can request whatever it wants). I dont see the point in this.

<comment><USER37> I really think this is just a company that went to get the best deal because the homegrown offering wasn't as competitive. I still think having TikTok isn't in the best interest of the democratic west, but you're right. There is not sinister play here.

<comment><USER36> Man my iphone really butchers my messaging with weird auto correct now and days. Anyways I think you got the gist. Makes sense about best deal, thought didnt cross my mind.

</comment></comment></comment><comment><USER38> TikTok could have had hosting for cheaper from Alibaba, but now Google has an $800M incentive to keep TikTok alive in the U.S. Smart.

<comment><USER29> Alibaba has a whole 2 regions in the US, and they're much smaller than AWS/GCP regions. They are not a significant infrastructure player outside of China, and an app like TikTok is high bandwidth and latency sensitive. It's not feasible to host something like that entirely out of datacenters in China.

</comment></comment><comment><USER39> Wasn't one of the promises of cloud - "it will save us money ?" It's hard to visualise the end result of "savings exercise" for ppl to put funny video's on the internet is 800M /s :)

Yea I know they big and there is a lot I don't graps/knows about their system

</comment><comment><USER40> Google Cloud sales are very aggressive with discounts and offers. They offered my company great prices vs AWS and they even offered to pay for local contractors to do some of the migration work from AWS for us.

We took the deal and it's worked out well in both price and performance.

</comment><comment><USER41> Interesting, I wonder what discount rate they are getting, or if 'buy' actually just means 'use'. GCP was throwing discounts and credits at companies not too long ago, if you were willing to publicly announce your move from a competitor to GCP.

</comment><comment><USER42> ByteDance runs two video services. One is TikTok, which runs on non-China servers. The other is Douyin, a regular Chinese app. Of course TikTok is still subject to Chinese law governing Internet services provided to foreigners, which is cause for concern.

</comment><comment><USER43> I might have missed the train somehow. First time I heard about TikTok was about half an year ago and now it's already buying services for 800M. How did it get so big so fast or was it already huge deal in China before it reached us?

</comment><comment><USER44> This might be a bit off-topic, but why is the US worried about Tiktok? They only show short funny/interesting videos that have almost no political content. If anything, apps like these bring people around the world together.

<comment><USER45> It's believed that TikTok scoops up more data from your device than you think and is a major data collection source for the CCP.

<comment><USER46> Not just believed but actually proved with reverse engineering. They even have the app download remote files and executing them which no app should ever do. (Only on Android since iOS does not allow that!)

<comment><USER47> I mean, downloading remote files and executing them is literally what every web browser does.

</comment></comment></comment></comment><comment><USER48> It would be nice to have articles that don't force you to pay for a subscription.

</comment><comment><USER49> Money can buy you everything. The country is so poor that what is left is money. Done. No; when is infrastructure is just a hardware where you run your software. When is the software hack that push a button send info back to China or analysing in American soil using American expert but helping communist to slightly bias and ... Is an American firm can be trusted even. And a Chinese controlled one?

</comment><comment><USER50> Makes sense, now the US Government also gets their data.

</comment><comment><USER51> Bribery always works at suppressing outrage and information dissemination

</comment><comment><USER52> This page presents me with an (email) paywall.

</comment><comment><USER53> OT: Can we stop sharing The Information links on HN? They seem to have the strictest paywall of anyone. I doubt many commenters here actually subscribe which means we're just discussing the headline.

<comment><USER54> I believe The Information gives out free access links to HN, or at least used to. Maybe we just need to wait a bit for them to notice.

<comment><USER55> I'm not sure if it's a specific policy for HN, but often for popular articles they aren't too upset if a subscriber shares the full article. (Which we can do.)

I think it's worth noting that The Information is an _incredible_ journalism outfit that does incredible work. I subscribe not for access to the content (which other sites reblog within hours), but to support legit journalists doing real, original research.

</comment></comment></comment><comment><USER56> Explains why they ignore the obvious violations and still publish the app in their store. Seems like a major conflict of interest.

</comment><comment><USER57> Good move. Google will think twice if it is a good move to remove clients from their platform. I think TikTok has to show they cannot go around banning apps left and right without financial repercussions.</comment>


My Favorite Settlers of Catan Trick - <AUTHOR> This is my all time favorite Settlers trick.  I had come into possession of a Monopoly card.  This was late in a six person game when all the players had a ton of cards in their hands.  When it was my turn, I noted that almost all the ore was handed out (by looking at the bank's stack).  I had a lot of it myself.  So I traded heavily by giving away ore and getting other cards in return, with some haggling to not raise suspicions.  Once I had traded all my ore away, I played my Monoploy card to get all of it back.  I got a crazy number of cards and I can never forget the look of shock on my friend's faces. <comment><USER2> This is just how Monopoly is supposed to be used, not a new idea.</comment>


How Artsy Did a Company Re-Org - <AUTHOR> https://artsy.net/article/robert-lenne-the-secret-s-to-company-re-orgs <comment><USER2> I am a huge curmudgeon when I read these types of articles. I tend to think back to Moral Mazes and I have no faith or hope that executives will do healthy things in these situations.

But I actually liked a couple of the major points in this. And it's really rare for me to not just basically be Lumpy Space Princess about these things.

The points I most liked:

\-- Keep it internal -- They didn't mention this in the article, but it's not uncommon for firms to blow unreasonable amounts of money on external consulting firms, who typically come in with no consideration whatsoever for the existing employees or the way things work.

Often these firms are value-destructive, and the fact that a company would choose them usually means there's some type of internal power struggle that can only be resolved through the use of meaningless external credential, status symbols, and prestige. When someone is using BCG or McKinsey, you can bet it's not because they need quality, evidence-based outcomes, but because the BCG/McKinsey/FancyBrand stamp of approval cannot be overridden by their internal rival. It's a good sign for this firm that they did it by talking with their existing employees rather than hiring external advisers (at least it seems that way in the article).

\-- Anticlimax -- this is a great way to put it. By the time the dust settles, anyone who didn't want to leave the company should be completely and utterly unsurprised, bored even, by how it has turned out. This doesn't mean everyone has to like it, but no one should come to work after the re-org and have significant feelings of "why is it working like _this_?" or "this isn't what we talked about..." The aforemocked consulting type dummies often take a rip- the-bandaid approach that I will never understand. It leaves almost everyone surprised, like one of George Sr.'s mass layoff days.

<comment><USER3> I personally liked the "people who know how this needs to happen are the people you're reorging" thought, to paraphrase. I've been in orgs where "the reorg" is some sword of Damocles that will shatter all order and attempt to rebuild it in some unknowable new form. Poetic license aside, that does no good for morale, and typically doesn't end up too well with respect to operational efficiency given the inevitable communication gaps between the powers that be and the boots on the ground when the reorg is seen as orders from on high rather than a collaborative restructuring.

That last bit was a little too close to the buzzword line for me, twenty lashes or something.

</comment></comment><comment><USER4> Maybe shows my inexperience but I don't see how people have time to write things like this if a company is successful, busy and making money. To me it indicates people have time on their hands. Ok do the re-org but spend 4 hours writing about it ?!

<comment><USER5> (disclaimer: I work at Artsy)

Writing a blog post like this is a form of retrospective. Would you agree that those improve outcomes and surface issues and are valuable? The only difference with those other successful companies making money is that we try to do more of it in public and that non-Engineers are doing it too (like Robert did here). It shouldn't take more time.</comment></comment>


Ask HN: Why you left your job for starting a startup? - <AUTHOR> What attracted you to jump into the startup world, that you didn't have at a regular job? <comment><USER2> In my own company, I get to decide what work I'm doing, what the production schedule is, what the processes are, my working conditions, and so forth.

But mostly it's the "what work I'm doing" part.

The advantage to working for someone else is that there are a ton of things you don't have to pay any attention to. So, when I'm between entrepreneurial projects or am just in a "low energy" period, I work for someone else. Eventually, though, the "itch" returns and I'll start a new company.

<comment><AUTHOR> I guess you consider "I get to decide what work I'm doing" as freedom (advantage) in case of your own company?

Do you think it is even more bosses that you have as the entrepreneur (in the form of your customers) who indirectly dictate you what you need to do?

<comment><USER2> No, I don't think that way, although I do understand that others can reasonably frame it in those terms.

If I'm working on a product that I am interested in on its own terms, 99% of the time what I want to do lines up very well with what my customers want, so they aren't really "dictating" anything.

<comment><AUTHOR> I agree.

If it lines up with potential customers, that might be a signal for founder/market fit.</comment></comment></comment></comment>


How the Winning Tron Bot Works - <AUTHOR> http://a1k0n.net/2010/03/04/google-ai-postmortem.html

<comment><USER3> You can also play against a dumbed-down Javascript version of the bot. It only spends a few milliseconds searching for a move rather than a whole second, and its move evaluator isn't as smart -- but at least a human has a chance of beating it and the code is very simple: <http://a1k0n.net/code/tron.html>

</comment><comment><USER4> Here's the post mortem by the winner of the subsequent AI contest: <http://quotenil.com/Planet-Wars-Post-Mortem.html>

</comment><comment><USER5> There is supposed to be a new version of this contest coming up soon, although it seems to be temporarily stalled as the main developers are busy with other things.

You can find the beta here: <http://aichallengebeta.hypertriangle.com/>

<comment><USER4> ............says the guy currently kicking everyone else's tail.

(nice work by the way)

</comment></comment><comment><USER6> Looks like the old AI Contest site ( <http://csclub.uwaterloo.ca/contest/rankings.php> ) has been hacked. The "Google AI Challenge" header links to a random online game site)

<comment><USER7> I've notified those in charge of the site. Thanks for pointing that out!

<comment><USER6> Thanks, looks fixed now.

</comment></comment></comment><comment><USER8> This is really interesting, thanks for the submission.

It also highlights just what you need to compete in these contests - <USER2> programming skill, plenty of algorithmic knowledge, the ability to come up with clever heuristics and the desire to try absolutely anything to improve the quality of those heuristics. Seeing the process behind that was very enlightening.</comment>


Twitch Sues Troll Streamers over Violent Videos, Pornography - <AUTHOR> https://www.bloomberg.com/news/articles/2019-06-15/twitch-sues-troll-streamers-over-violent-videos-pornography <comment><USER2> Guessing it's related to people streaming on the Artifact section on Twitch. Basically, there was a popular streamer who would joke about how nobody was streaming the game, so people start streaming porn, Avengers: Endgame, etc, so they'd be at the top of the list of Artifact streams when the popular streamer looked at the streams. It lasted for a few days, with Twitch doing nothing about it. The lawsuit seems like they're trying to save face because they failed to do anything about it for way too long.

[https://apptrigger.com/2019/05/28/artifact-twitch- channels-p...](https://apptrigger.com/2019/05/28/artifact-twitch-channels- porn-anime/)

<comment><USER3> >showing downright despicable content such as Adolph Hitler propaganda, videos of beheadings, varying interests of pornography and even streams of anime programming

That sentence makes it sound like anime is worse than beheadings and Nazi propaganda.

<comment><USER4> That's because it (the anime programming and pornography) is worse. At least from a corporate perspective.

For the same reasons tumblr banned pornography, yet still hasn't done anything to fight child pornography, child abuse, or grooming on their platform.

For the same reasons youtube demonetizes videos about legal education or discussing alphabet/google/youtube policies, yet still allows child grooming and radicalization to be monetized and recommended to children.

As always: money.

<comment><USER5> >For the same reasons youtube demonetizes videos about legal education or discussing alphabet/google/youtube policies, yet still allows child grooming and radicalization to be monetized and recommended to children.

What nonsense.

<comment><USER4> This is well documented [0] and has been going on for years. Rather than take a straightforward approach of hiring more community managers (which is expensive) to solve the problem they instead rely on algorithms that punish probable child abuse with _demonetization_ (harking back to my earlier point that it's all about money) rather than say _banning and reporting to authorities_.

[0] [https://www.techdirt.com/articles/20190223/00430041656/youtu...](https://www.techdirt.com/articles/20190223/00430041656/youtube- demonetization-hammer-nail-content-moderation.shtml)

</comment></comment></comment></comment></comment><comment><USER6> Honest question, doesn't the Twitch TOS have an arbitration agreement?

In my (nonlawyer) reading of their terms, it's not clear to me why this wouldn't fall under that policy. It doesn't seem to fit into any of the exceptions they list. How can Twitch file this suite before a normal judge?

 _Edit: Hah, another commenter found the filing, and it alleges a trademark violation. I wonder if that 's in there purely so they can get this before a normal judge?_

<comment><USER7> I wonder how could a trademark be violated in this case.

</comment></comment><comment><USER8> I'd like to know the law company Twitch is contracting out of because holy shit is Twitch getting ripped off here. Sueing people you don't even know the identities of has to be the easiest way of racking up legal fees I have ever seen

<comment><USER9> Could it be a pre-emptive political move to avoid scrutiny from governments where the content that was streamed (Christchurch shooting, some illegal pornography) is illegal? Also, I'm pretty sure they know some of the perpetrators but are probably still building a case. A few years ago they pinpointed the heads of a viewbotting operation and successfully took legal action. I could see them finding a few people to make an example out of, honestly.

<comment><USER8> I could see Twitch's thinking be to only catch a few people to make an example of, but in similar style cases with media companies and pirating the paperwork already has the targets name on it; the use of just placeholders imply to me that the lawyers are going to intentionally drag the case out while telling Twitch they are trying to find the "perfect target" to make an example of.

<comment><USER10> It may be less of finding an example defendant as just providing an example that they are doing something if they're accused of not doing enough later. I expect the case will quickly settle.

</comment></comment></comment></comment><comment><USER11> A certain twitch category I frequent has had streams advertising phishing websites (phishing game credentials) on it 24/7 for a few years and twitch has never done anything about it. I guess if it doesn't cause public outrage then it's fine.

<comment><USER12> Sounds like so called "trading" portals for skins in CS:GO ...

</comment></comment><comment><USER13> ""The company said that if it learns the identities of the anonymous streamers who have abused its terms of service -- named in the lawsuit as "John and Jane Does 1-100" -- it will ask the court to prohibit them from using the platform and order them to pay restitution and damages.""

Restitution and damages for what?

<comment><USER14> if nothing else: legal fees. If a streamer violates the ToS, and hides their identity then serving them a restraining order can cost quite a lot.

I'm sure there are other things - eg punitive damages exist for the purpose of ensuring that the cost of violation is more than just the direct harn

<comment><USER15> Also the videos were presumably damaging to the Twitch brand for anyone who saw them, which translates into lost revenue for Twitch.

<comment><USER14> I just figured that that was a pointless argument (people on HN seem to dismiss the concept of brand image and how that might have value), but you are of course correct - legal costs however are very directly enumerable

</comment></comment></comment></comment><comment> joatmon-snoo Can't access the filing, but I did find a preview of it.

The complaint lists four causes: (1) federal trademark infringement, (2) breach of contract, (3) trespass to chattels, and (4) fraud.

[https://www.pacermonitor.com/public/case/28635117/Twitch_Int...](https://www.pacermonitor.com/public/case/28635117/Twitch_Interactive,_Inc_v_John_and_Jane_Does_1_through_100)

</comment><comment><USER16> Seems like it's admitting that they both don't know how to stop people technically and don't know who any of the 100 people are.

<comment><USER17> How would they know who they were? Filing a lawsuit is a tool to find out.

<comment><USER2> What could they do though? I thought courts in the USA ruled that an IP address can't be used to identify a person. It seems like the most they could do is ban the account, which they can do for any reason they want.

<comment><USER17> They just said an IP can't solely be used to identify someone. You can use the IP address to get the name and then acquire additional information to prosecute the case. But you need to start with the IP address to get the ball rolling.

<comment><USER18> Interesting. So for instance if the offence is sharing a Hollywood movie on Bittorrent, the ip address would not be enough to get fined? What then? Use ip to get search warrant?

(I'm from Europe, asking out of curiosity.)

<comment><USER19> IANAL but it would go something like this: Twitch has IP addresses of the trolls, but no way to tell their real identity. So they file the lawsuit and then use it to subpoena the ISPs assigned those IP addresses to get their client information.

<comment><USER20> But there's no way they can prove that it was actually the owner that did this. An argument could be that someone got access to the WiFi, either maliciously or otherwise.

It's not enough to be used as evidence in court.

Most likely did the majority of the bots use proxies and VPNs, which may or may not provide additional information about their customers, but even then it has to be proven that is was the same user that did the acts which is very difficult.

<comment><USER17> It is enough to be used as evidence, it isn't enough, by itself, to definitively prove identity. It might be enough to get a subpoena to image the computers at the IP address. From there you might find the offending material that was broadcast, VPN accounts, chat logs talking about planning it, etc...

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> I basically gave up on twitch after it stopped working on the Xbox 360. The app just shows thumbnails but never streams. It doesn't work right in the browser for me either, probably due to running an old version of Chrome, but it used to work, and the browser hasn't changed, so I blame site "upgrades" (read: changes that break what was previously working.)

<comment><USER22> X360 is literally a 15 year old console... Of course twitch doesn't work on it anymore.

Have you considered running something more modern?

</comment></comment><comment><USER23> Can they really sue someone for streaming porn / legal content? Is violating the twitch TOS really such a crime that they can prosecute you?

</comment><comment><USER14> Finally - make being an asshole cost money.

<comment><USER24> Agreed. Maybe also introduce some sort of system which rewards good behavior? A sort of, hmm, social score?

<comment><USER14> Dude there's a difference between saying "we won't host violent videos so some trolls can get off" and "we're going to police every action".

People like you who will inevitably bring up the "slippery slope" argument seem to ignore a) twitch etc are private companies and you can't force speech on them, and b) there's is no difference between threatening or broadcasting violence against people and having an unpopular opinion.

Unpopular opinion: America should be communist.

Opinion that might get you banned: "go out & beat up or murder people who disagree with me"

<comment><USER25> Sure but Twitch is here suing people in a real court. It's not about whether Twitch is forced to host your speech or whatever. Here the government is getting involved.

<comment><USER5> >It's not about whether Twitch is forced to host your speech or whatever.

That's exactly what it's about.

>Here the government is getting involved.

Which is not the same thing as the government abrogating anyone's freedom of speech, fairly obviously.

</comment></comment></comment></comment></comment><comment><USER26> Paywall: [https://outline.com/KRAU7W](https://outline.com/KRAU7W)

<comment><USER27> I was going to upvote this but it turns out outline.com hides it's content behind a computational paywall. You have to execute their code in order for text to display.

Here's a version that is just accessible text: [http://superkuh.com/twitchsues.txt](http://superkuh.com/twitchsues.txt)

<comment><USER28> I can't use that site because I am under 90 years of age.

</comment></comment></comment><comment><USER29> I suspect this is in part retaliation of someone or people getting banned for stupid reasons

</comment><comment><USER30> I think it is interesting how people use porn streaming sites for general non- porn related streaming now since these other platforms keep shooting themselves in the foot, playing a war of attrition to keep their own investors and advertisers placated.

But now the porn platforms also have their own pornographic advertisers, and lower overhead costs on moderation.

<comment><USER31> I'm not sure what you're trying to say... Who is using porn streaming sites for non-porn related streaming?

<comment><USER30> I was talking about the growth of porn sites for general user submitted content that isnt of the pornographic variety

Users use them for that, you want usernames per site? How am I supposed to answer that. I assumed A lot of people are already familiar with this use case and also find it discussion worthy

<comment><USER31> Yes this is genuinely news to me and sounds intriguing. I was hoping for some examples or an article about that phenomenon.

</comment></comment></comment></comment><comment><USER32> I am curious as whether this will be relatively forgotten or it will become a manifestation of the streisand effect ( [https://en.wikipedia.org/wiki/Streisand_effect](https://en.wikipedia.org/wiki/Streisand_effect) ). With hordes of troll users streaming crap, just for fun and to fight against what they perceive to be a corporate overlord (twitch being owned by amazon).

<comment><USER14> The Streisand effect is not wanting people to know something, and in trying to prevent that drawing attention to it.

That's not what is happening here: everyone knows there's a bunch of basement trolls who stream violence (which is of course against tos), and from twitch's POV publicity is a win:

* they get public appearance that they're trying to do something about.

* the specter of being sued may discourage some people from abusing their platform

<comment><USER33> > That's not what is happening here: everyone knows...

I didn't know. The Streisand Effect absolutely applies, at least in my case.

<comment><USER34> The Streisand Effect implies that the subject did not want the publicity but got it by trying to hide or cover up something. Here Twitch wants people to see that they are taking action. Now if the publicity leads to additional trolling of their platform thus exacerbating the problem, then you could make an argument that this scenario fits the Streisand Effect.</comment></comment></comment></comment>