The mystery of Mingering Mike: the soul legend who never existed - <AUTHOR> http://www.theguardian.com/artanddesign/2015/feb/11/-sp-mystery-of-mingering-mike-the-soul-legend-who-never-existed-jon-ronson

<comment><USER2> Check out his actual recordings, they're great!

[http://www.mingeringmike.com/mingerplayer/index.html](http://www.mingeringmike.com/mingerplayer/index.html)

I can definitely hear winehouse et al singing them. Bring in the string section hafway through. It writes itself! Shame byrne had to be so militant about the terms.

</comment><comment><USER3> I'm friends with Dori Hadar, the DJ & record collector who found Mike's albums at the flea market. It's an amazing story and it's been great to see Mike get the attention his art deserves, all the way to inclusion in the permanent collection of the Smithsonian.

<comment><USER3> Hmmm re-reading that it sounds kind of prosaic and press-releasey. here's what I really want to say: Dori is a great guy, the perfect person to find these records. Mike's artwork has reached such a wide audience only because Dori and Mike were able to trust each other, which was not a guaranteed outcome given the circumstances of their meeting.

plus Dori DJ'd my wedding and killed it.

</comment></comment><comment><USER4> In the Northern Soul Scene for ultra rare records it was common for DJ's to disguise the real artist to stop any rival DJ's from finding a copy.

</comment><comment><USER5> Now that was worth reading... and by worth reading I mean I had work to do and why am I reading HN while I have work to do.

Damnit HN.

</comment><comment><USER6> I remember the day this broke on the record collector forum [http://www.soulstrut.com/](http://www.soulstrut.com/)

I wonder if that thread is still online someplace?

</comment><comment><USER7> They're cardboard albums... What does one call this, outsider art (which would fit since one of the albums is called 'The Outsiders are Back')?

</comment><comment><USER8> Similar one if you like that kind of thing

[http://www.theguardian.com/sport/blog/2009/jan/15/masal- bugd...](http://www.theguardian.com/sport/blog/2009/jan/15/masal-bugduv- moldova-hoax-player)</comment>


A Netbook that makes you go wow - <AUTHOR> http://blog.zumodrive.com/a-netbook-that-makes-you-go-wow/

<comment><USER2> _We think there's a third alternative which is much more enticing for the consumer and the manufacturer – make a netbook that is a pleasure to use and can serve as a gateway to lucrative subscription services._

How about making a netbook that is a pleasure to use and can serve as a gateway to data I serve from my home computer?

</comment><comment><USER3> Not news. Thinly disguised marketing ploy.

<comment><USER4> I have nothing against people discussing their start-ups, and even posting that up to the top of HN, but the attempt to obfuscate is, in this case, what is irritating.

Half of us are entrepreneurs. We know you want to pitch your start-up. So pitch it already and be done with it. Don't try to make it into an "interesting article" unless you're able to write a genuinely interesting article (which this is not).

</comment></comment><comment><USER5> Netbooks with great usability and gizmos that make for interesting apps(gps, touch etc) combined with a billing system that allows for subscription pricing for services would be as explosive as an iphone and the app store. It would be great way for companies to drive up the revenue beyond what they get from laptops today.

<comment><USER6> The App Store has nothing to do with subscription pricing. Are there explosively successful consumer software subscription services? All the ones I can think of which get close to piercing the general consumer consciousness are also-rans (Napster, Rhapsody), or are hardware locked (Xbox Live Arcade, which is more paying for arbitrary online access to Microsoft than anything -- the actual game content is still priced outside of the subscription, and on competing services on the Wii and PS3 online connectivity itself is free). I can't think of any subscription based marketplace (either subscribe to browse the contents of this marketplace risk free, or a marketplace for various subscription services) that has ever really caught in digital space. I'd love to be told what I'm missing here though! I don't really pay attention to this stuff from anything other than an end-user standpoint so I'd be interested in some great service or network I didn't know about.

</comment></comment><comment><USER7> The problem with netbooks is that they occupy a market position sandwiched between smartphones and full-featured laptops. A netbook that is only sold with 3G service sounds very much like Apple's business model with the iPhone.

</comment><comment><USER8> My G1 is practically a netbook, I can browse, I can use maps, I can download applications, read ebooks, alarm clock, develop for it. Anything I can do for a netbook I can do on the g1. Short of flash and java.

Its getting better every release :)</comment>


Adblocking: How about Nah? - <AUTHOR> https://www.eff.org/deeplinks/2019/07/adblocking-how-about-nah <comment><USER2> I don't actually want to block ads. If you want to put a small text or image blurb anywhere on the page... Good for you. I'll gladly accept those on a webpage so that the content creator can make a bit of cash.

But these companies are intentionally blurring the lines between advertisement and digital surveillance. You don't need to collect everything about my operating system, browser, monitors, GPU, every click I make on every website I visit, etc.

That's crossing a line of what "advertisement" means. So the more these "advertisers" work to blur those lines the more their "ads" will be blocked under the umbrella of those who don't want this level of pervasive tracking and surveillance.

<comment><USER3> Agree. I'd go as far as forbidding embedded JS altogether which removes the attack vector for malware within advertising networks. The networks have proved time and time again they are not able to prevent distribution of malware, and this is the primary reason I use an adblocker.

Maybe a new <ad /> tag which points to a resource which can only serve an image, video or text. Absolutely no scripting. Pass along only the advertiser ID and the bare minimum.

The problem is it's not in Google or Microsoft's interest to implement this. This has to come from legislation at US gov level. So it'll never happen.

I'll continue ad blocking.

<comment><USER4> _> Maybe a new <ad /> tag which points to a resource which can only serve an image, video or text. Absolutely no scripting. Pass along only the advertiser ID and the bare minimum._

How would fraud detection work in this model? How do advertisers know the requests are coming from real users and not bots? Without assurance there, advertisers would pay much less, and publishers would earn much less.

(Disclosure: I work on ads at Google, speaking only for myself.)

<comment><USER5> I don't really care if ads stop being profitable. If ads stopped being a good source of revenue, the tech industry would adapt, and my guess is that the end result would be much more favorable to society. I'm working on an early-stage startup right now, and I'm certainly not going to use ads as part of my revenue model.

Google might not be too happy about an outcome like that, but I'm not overly concerned about Google's wellbeing. :)

I'd be interested to hear your thoughts on this since you work on ads: are ads _actually_ essential in the software industry, or could we do just fine without them?

<comment><USER6> In recent years we, conscious consumers, shot down several viable business models that could have replaced ads such as data collection for trend analysis and crypto mining in the browser. They were met with outright hostility.

Perhaps justifiably so, but we have to keep in mind that any producable "value" will have to "hurt" in some way. We have to give _something_ in exchange for "free" services. Yet the focus is only on the price paid instead of the fairness of the transaction (or lack thereof).

Either we give up the "free" model alltogether and shift back to paid services only, or we choose the lesser evil and live with it.

<comment><USER7> > data collection for trend analysis

Of course that's going to be met with the same hostility. It's 99.9% the same thing.

> crypto mining in the browser

Of course that's going to be met with similar hostility. Climate change is even more present in the public consciousness.

</comment></comment></comment></comment></comment></comment><comment><USER8> For many many years I resisted installing an ad-blocker. As someone who worked at a website that made the bulk of it's revenue from ads, it felt hypocritical, and also, I wanted to make sure that the experience of our website was bearable without ad blocking, by forcing myself to experience it every day.

I gave up about two years ago. The web just go so bad I _had_ to install ad- block. My computer would spin like a jet plane at least once an hour due to insane advertising on a website consuming all the CPU.

I literally installed ad-block to save my computer hardware.

The ads don't even bother me that much. I used to always say, "my brain is my ad-block". It was the slow loading, CPU heavy ads that got me to turn.

If advertisers want to advertise to me, that's fine. I understand they need to make money. But how about not melting my computer in the process?

<comment><USER9> > If advertisers want to advertise to me, that's fine. I understand they need > to make money.

I feel sad just reading that. Advertisers are paid to deliver targeted psychological manipulation to you, and yet you feel ashamed for making their work less profitable. It's like observing some kind of digital stockholm syndrome.

<comment><USER10> > targeted psychological manipulation to you

This seems exceedingly hyperbolic. With advertising, we can enjoy many services free of charge.

Using google as an example, google maps, search, android, etc all provide tremendous value to their users while being ostensibly free. Without revenue, they simply wouldn't be able to exist.

<comment><USER11> > _Without revenue, they simply wouldn 't be able to exist._

Nonsense. OSM exists, HN exists, Linux exists. And just because some services need revenue to pay bills, it doesn't mean advertising or users paying is the only way to get it. Google Maps gets revenue from businesses using it on their websites, for example.

<comment><USER12> I do not see your argument. That some projects are subsidized, because they carry a value, that pays off manyfold somewhere else, no one denies.

</comment></comment></comment></comment></comment><comment><USER13> I used to not use ad blockers as I'm not bothered by ads. But it's getting increasingly difficult not to because the ads are making thousands of requests downloading hundreds of mbs of who knows what quite often simply crashing the tabs. It has got to the point that ads and analytics are being added so mindlessly (I saw it first hand as random CPU hogging battery killing trackers were pushed onto my single-page web app by product managers) that browsing without an ad blocker isn't viable anymore performance-wise.

<comment><USER14> > the ads are making thousands of requests downloading hundreds of mbs of who > knows what quite often simply crashing the tabs

Where are you going for that to happen? Not only does a tab crashing is extremely rare for me, even on my low 8 GB of RAM which I got 8 years ago. It seems a bit crazy that it happens quite often for you.

</comment></comment><comment><USER15> Did anyone ever investigate what benefits ads have to a population? It seems like a net loss to me, because ads are used to make people consume more than they need; ads make people buy the product with the biggest advertising budget instead of the best product; and while ads may make the internet "free", we are still paying for those ads indirectly.

Why then, doesn't the government bring advertising to a halt? At least they could start with _targeted_ advertising as seen on the internet.

(Of course, if you measure the success of an economy by the GDP, then it might seem that ads have a positive influence, but that seems a bit like a broken- window fallacy to me).

<comment><USER16> IMO the first place to start implementing ad bans is in public spaces, which I hear is common in Europe. I don't have to watch TV so I don't see TV ads. I don't listen to the radio much so I don't listen to radio ads. I can use an ad blocker on the web, yet for some reason the public spaces I inhabit (and help pay for) are full of ads.

<comment><USER17> Not saying you are wrong, but which European states is this common in? I've never noticed this, and many public spaces in Europe have a great deal of poster/bill board style advertisements.

I remember reading Paris tried this, but that's a long way from "common in Europe".

<comment><USER18> There aren't any billboards along freeways in Switzerland, e.g.

<comment><USER17> There's usually no shortage of public ads for Swiss watches at Zurich airport. There is for sure no ban on advertisements in public places.

<comment><USER19> Airports are not public places, you literally have to pay for a ticket to get past security.

<comment><USER17> Sigh. Aside from the fact this comment adds no value to the discussion, anyone can walk into Zurich airport and buy a ticket.

By this logic, many public transport centres such as train stations wouldn't be public spaces either (not unheard of for a train station to have a ticket barrier too). There are adverts in places other than the airport too!

<comment><USER19> This is not true, you can't buy a ticket without identification and you can't get past security unless you go through several other checks. Going into a public area like out on the street is not even similar at all. Airports are not public locations, they are much more similar to the interior walls of a private business than a public location, which doesn't require you to pay to enter and produce varying amounts of identification.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> Remember that the formal name for a web browser is a _User Agent_.

This metaphor makes it clear that when there is a conflict of interest between you the user and whatever the server on the other side wants, your Agent should act in your interest.

<comment><USER21> Not when the User Agent is built by the world's largest online advertiser.

<comment><USER20> That's a [https://en.wikipedia.org/wiki/Double_agent](https://en.wikipedia.org/wiki/Double_agent)

</comment></comment></comment><comment><USER22> Regrettably, nobody bothers to mention that JavaScript is really what's to blame for all of this. If unnecessary use of JavaScript earned the same sort of derision that "best viewed in IE 6" banners did, we wouldn't be where we are today.

That genie is too far gone to put back in the bottle, but that's the real problem with the online advertising 'ecosystem'. JavaScript enabled pop-up ads, it enables tracking, it enables coinminers and other malware.

<comment><USER23> JavaScript enables functionality in the same way that cars enable transportation. They aren't the only solution. And there would be far less injury, death, and pollution if we all just didn't use automobiles. The world would be a safer, cleaner place. And a small fraction of people would be happy with it.

JavaScript is the same. We'd have a cleaner, safer web without it. And only a small fraction of people would be happy with that.

<comment><USER24> If only using JavaScript required a license to operate and came with a set of rules enforced by fines and jail time :)

If every browser had done the sane thing from day 1 (no third-party scripts and no cross-domain communication) we wouldn't be in the mess we're in. Sites could still use all the power that comes with scripting, ad networks just wouldn't be feasible.

<comment><USER25> Sites would collect the data with first-party scripts and tunnel through their own servers to ad peddlers.

<comment><USER24> That's fine. Now the first-party and ad peddlers have to work with and trust each other instead of using my machine, my ignorance and my disinterest in their dealings as an intermediary.

</comment></comment></comment></comment></comment><comment><USER26> I've been blocking ads ever since I learned that I could stop seeing DoubleClick ads by blocking their domain in /etc/hosts.

I won't ever apologize for doing so. As far as I'm concerned, any advertisement that depends on JavaScript is malware, and I think that my right to protect myself online outweighs the need of publishers to turn a profit.

IMO, profits are like respect. They must be earned, and if the only way you can turn a profit is by spying on people then maybe you shouldn't be in business in the first place. If the only way you can get me to use your product is by giving it away and selling my data, then maybe your product shouldn't exist?

As far as I'm concerned, the data I generate by using a search engine should be treated with the same care as my medical records. It should not be mined or traded. It should not be kept longer than 30 days.

And if that breaks the internet, so be it. You brought this on yourselves.

<comment><USER27> Best way to block ads in 2019?

<comment><USER26> Are you asking about blocking ads on a smartphone? Or on a desktop/laptop? The answer depends on your platform, you see.

<comment><USER27> Both?

<comment><USER28> Blokada on Android + PiHole on wifi. In the really occasional instances where I'm away from wifi and Blokada is down, it's night and day.

</comment></comment></comment></comment></comment><comment><USER29> The great thing about getting older for me is realising that nothing is indispensable. Everything eventually ends, we move on with our lives and do something else.

So sure: maybe someday un-adblockable content will be a thing. Do I care about that content? Turns out maybe I'll just walk away entirely. The internet has a lot of utterly ad-ridden services with far too high an opinion of how important they really are.

<comment><USER30> There is _so much_ content. Great content, too. The miracle of over 100 years of mass media recording tech. And, you know, 4000ish years of written word records and storytelling. Ad-supported web trash is mostly just a distraction from better things that can be had used for just a little money, or checked out from a library. My life'd probably _improve_ if it all went away (Web would have a better wheat/chaff ratio, I'd be less distracted by junk).

So sure, make your sites, services, and content so annoying that I stop using them, and close copying loopholes, somehow. Or ban spyvertising and let it all go down in the flames of the prophesied ad-pocalypse. I really don't care a bit either way.

</comment></comment><comment><USER31> Firefox offers blocking you from "third-party tracking cookies" by default, so if you are concerned - make the switch.

[https://blog.mozilla.org/blog/2019/06/04/firefox-now- availab...](https://blog.mozilla.org/blog/2019/06/04/firefox-now-available- with-enhanced-tracking-protection-by-default/?utm_campaign=firstrun)

<comment><USER32> It's simply better to go to the options of your browser and disable third- party cookies altogether. And at that point why not keep using Chrome, which is faster, heh

<comment><USER33> Chrome isn't faster anymore in my experience. FF has made great advances in performance.

</comment></comment></comment><comment><USER34> How is that still a debate?

I often use firefox reader mode just because websites use custom fonts, and to remove all the clutter, even when there is no ads.

Also, it won't be long until reddit is sued and must remove comments where people copy-paste the entire article because of pay walls and ad blockers. Same for outline. I guess website will start findings ways to prevent copy pasting, and maybe someone will create some app that just let their users browse a PNG rendering of websites.

It's almost as if normal newspapers might be considered a good alternative.

<comment><USER35> I think Reddit is largely protected from being sued (in the US) for copyright infringement in comments/submissions as long as they comply with valid DMCA notices. But yeah, that involves removing the content.

</comment></comment><comment><USER36> I'm amazed that all the interested parties haven't got together to flesh out a microtransaction standard. The whole ad-blocking debate would be moot if we could pay a few cents to read an article free of distracting ads. If you choose not to pay, you get the ads and don't get to complain about ad-blocker- blockers because you were offered an alternative.

I know it has been attempted in the past with little success, but all those attempts were just companies going it alone and hoping for the best. If the W3C, browser makers, banks and publishers all got together a standard could be developed. Something that would be core to web standards. It wouldn't be easy, but it would solve a lot of problems.

<comment><USER37> It's been tried countless times. We tried as well: [https://news.ycombinator.com/item?id=19038540](https://news.ycombinator.com/item?id=19038540)

The issue isn't the payment tech, it's human behavior. People don't want to or can't pay for all the content they consume.

<comment><USER38> I don't think this is down to human behavior. Some content has zero or negative value.

<comment><USER37> Who gets to judge the value of content? And how can it have "negative value"?

Regardless, the action of consuming the content itself means that it has inherent value. I believe whether it's worth it is a decision for the user instead of dictated by someone else.

<comment><USER39> > Who gets to judge the value of content?

The user. That's the context – the user deciding who gets their money.

> And how can it have "negative value"?

Zero value, plus the time it took to find out that it had zero value.

> Regardless, the action of consuming the content itself means that it has > inherent value.

Not really.

<comment><USER37> I believe that's what I said, but to be clear: yes it should be up the individual, however if you look at most people's actions then their demand and willing consumption of content does not align with what they can or will pay for.

For example, blocking ads (even though most know that is the trade-off for the content) instead of refusing to visit the site. If the content has no value, why visit the site at all? Surely not ever pageview has zero value?

</comment></comment></comment></comment></comment></comment><comment><USER40> A huge part of advertising is getting users to feel that they can _trust_ in a product or service enough to spend their money on it. Spend a bit of time watching TV commercials and see how many methods of establishing trust you can spot.

This is why the way web ads are served is utterly farcical. How can you build a person's trust by invading their privacy in a hundred different ways just so you can be sure the ads they're seeing are a little bit more targeted than what's on TV?

People often say that they would be happy to have reasonable ads that don't interfere with website function and which respect their privacy, but it's been so bad for so long that it would likely be very difficult for an ethical, privacy respecting ad service to get off the ground. Many people have been burned too many times to believe and unblock such an ad service. EME shows that there is no interest in even trying this approach. They're just going to continue escalating the arms war.

They're going to lose.

Companies advertising on the internet need to wake up to the fact you can't support a war against the privacy of your potential customer base and expect them to trust you. Yes, you've dug quite the hole for yourselves over the last couple of decades. Why keep digging?

</comment><comment><USER41> Something is different in the arms race this time.

Browser development is almost exclusively funded by advertising. Chrome, in the obvious way. Mozilla is funded entirely by Google. Safari is the only surviving exception.

<comment><USER42> > Mozilla is funded entirely by Google.

Do you have a source for that?

<comment><USER8> There isn't a source, because Mozilla doesn't break it down. They just say that they get almost all their revenue from "search royalty payments", and their two biggest deals are with Google and Baidu. You just have to guess how much comes from Google (90% market share worldwide) vs Baidu (the biggest search engine in China, which is also the largest single internet market but not as well funded as the US market).

</comment></comment></comment><comment><USER24> I've been browsing with EME disabled for years, most stuff still works, I just leave sites that don't. If I accidentally hit a site with EME too much, I add the domain to my link block list so I never see links to them ever again. If most people would get on board with that for just a year, it could sway the industry to stop using it.

<comment><USER43> Same experience for me with sites that try to pull off GDPR shenanigans. If you don't make it easy for me I just close the site and never return, and let's be honest, my life is better for it. The more hostile the web becomes the more likely I am to go for a walk in the park instead. Fine by me, really.

</comment></comment><comment><USER44> At the end he mentions EME (encrypted media extensions) which may be the real front in the war. Actually the browser and video market consolidation with EME could really slant the odds in the advertisers favor because and Google and Netflix can make it really hard for people.

Eventually we may make a hard break from the old internet into a new one. I'm looking for practical and scalable cryptocurrency and smart contract solutions to become popular. After that you may see a new type of browser protocol that does not have a full operating system in it and can be implemented by mere mortals. It might depend on one or more decentralized protocols such as IPFS or dat or even one of the many less popular academic content-oriented- networking systems. There is a strong possibility it will not have any JavaScript.

</comment><comment><USER45> In the end, it's an arms race, and I don't think either side is giving up on it anytime soon. The only thing that concerns me is that one side has way too much money, while the other side has way too much time.

Let's see who wins.

<comment><USER46> the point of the article is that the wars is over.

money won by enlisting the corrupt law makers. from now on, content will have DRM (e.g. netflix) and if any adblocker even tries to touch it, the creators can be jailed.

now if you want to create/contribute an adblock, besides time, you must have impeccable opSec or also be willing to do time in jail.

<comment><USER47> Why hasn't google used this on youtube?

<comment><USER48> No idea - if you are a publisher AND the ad network, why not just serve ads from first party domain, indistinguishable from content?

</comment></comment></comment></comment><comment><USER49> IMO this war will lead to greater consolidation on publisher side. If only FB/Google are left with ability to make money of the web, we'll be left with hobbyist who do it for free or super platforms.

Right now Verge created a wordpress website put google ads on it and can afford a team to right some content. If all third party ads are blocked option left would be `paid content` or go to Google/FB platform to publish wherein you'll have lesser control but more revenue as all ads are first party.

</comment><comment><USER50> I can't use most of the sites at work because of ads and I can't install an adblocker because it would have access to corp data. When I search for something related to work, I know that most of the sites would display inappropriate junk on half screen with my colleagues probably watching behind. The solution I use us to search on stackoverflow only, but it too displays some garbage, and I have to scroll the page so the ads won't be in view. It's a hilarious situation.

<comment><USER51> Have you thought about forking/compiling ublock origin and loading it yourself?

</comment></comment><comment><USER52> Google and other ad businesses need to create "AMP for ads". Ads should allow only basic HTML elements without javascript. Figure out a way to track only what's really necessary, maybe even get allowed tracking level set by user in browser settings (an improved version of Do Not Track). That might be even used to check if user agrees to have cookies set. It should solve the annoying cookie banners issue too. Finally, let's add option for user to select "text only" mode for ads to keep additional downloaded data to minimum and maybe even make ads accessible. Update: And, of course, after a quick search I find that AMP for Ads is an actual product from Google [https://amp.dev/about/ads/](https://amp.dev/about/ads/) Sorry for not researching before commenting.

<comment><USER53> > Google and other ad businesses need to create "AMP for ads".

Is that not what Google Ads is?

<comment><USER54> No, Google Adsense allows javascript so advertisers can fingerprint and track the user's browser. Occasionally, some advertiser will drop the charade and just set top.location="[https://example.com/"](https://example.com/") and, after too many user/publisher complaints and a few days, Google will manually block them.

</comment></comment></comment><comment><USER55> I never click on ads. Never ever. I get that every ad doesn't need to be clicked e.g. videos that mindlessly show you a product. But atleast there is no direct feedback going back on those in terms of ad placement effectiveness/click-rate etc. They can keep burning their money showing ads - I just won't provide them any feedback on whether/where their money was wasted vs well spent. Also the best way to kill them is for lesser and lesser people to click on them.

<comment><USER56> Click frauders will always ensure a steady stream of 'conversions'.

</comment></comment><comment><USER57> What I find interesting about this post is that it only talks about blocking ads but not about how to replace them as a source of revenue for websites.

I actually do pay for some websites, including for not seeing ads on Youtube (with mixed results now that ads are just baked in the video, when the entirety of the video itself is not an ad) and I want an easy way to do so : I want to be able to access the content I want while its creator gets paid.

So far, ads have been a successful way to do micro payments (the only ?).

Instead of waging this increasing war between ads and ad blockers, I would rather see organizations that try to find a better solution (with privacy somewhere at the top of the checklist).

</comment><comment><USER58> Ads are forbidden on my network. I'm running a strong pihole that forbid advertising domains, obnoxious tracking and well known malware sites. Sponsored search results do not work and some websites are inaccessible, but it's fine, we don't need them. Ads are "The Great Evil" I will teach my children to fight, in all their forms, before drugs and alcohol.

If you are running an ad-dependant website and struggle to make money as a result of the campaign people like me are running, then you'll have to adapt. If you fail to adapt and your website closes, it's fine : as a society, we didn't need your services.

</comment><comment><USER59> Podcast ads are usually read by podcasters themseleves they don't track nobody sometimes they are even funny and if they are not to long, I don't skip them. So they are great example how all ads should be made.

</comment><comment><USER60> Advertisements are one thing but most of these "ads" are actually gathering more info than they advertise. JavaScript trackers are just awful if you care about privacy, which I do. It's pi-hole and no-script all the way for me until they stop with this rubbish.

Targeted ads are another kind of problem. I don't really want to be told or suggested what I should or could buy, I can make up my own mind. I know some people don't mind them and that's fine.

In all honesty I preferred the annoying pop ups.

</comment><comment><USER61> I block ads because I don't want my computers to be hijacked, and sites that sell ads do not do proper due diligence in protecting the public from hostile advertisers.

</comment><comment><USER62> It's somewhat ironic that this page contains the most impressive procession of banner ads that I've seen in a long while. And almost all of them keep changing every thirty seconds or so. Apparently I've been successful in systematically avoiding sites that would torture me like that. They may succeed once but only at the price that they won't see me again.

<comment><USER63> The EFF site is full of ads on your machine?!? That doesn't sound right (and disabling ad block doesn't cause it to serve any to me, unless you count the mailing list signup form after the article).

I'd guess that you are looking at a different page or your machine is compromised.

<comment><USER64> Originally the post was linking to boingboing.net, only later it was changed to EFF.

</comment></comment></comment><comment><USER65> I don't block ads or set up adblockers for customers and family members because I object to ads. I do it because it significantly cuts down on the number of potential attacks on systems.

Between malicious code ending up on ad networks and ads that take people to malicious sites, it only makes sense to block connections to things that are not actually needed for the display of pages. Most people who get a take-over- the-screen "We are Mikrosoft and have discovred that your computer infected call us helpful people at Mikrosoft and we will fix your comptuer" messages aren't getting it because they're visiting dodgy sites or even ones that have been hacked - they're getting them because either someone got that into an ad network or because they clicked on an ad that turned out to route them to one of those.

I can't babysit everyone and really don't want to, but I can at least cut down on some of the crap that hits their computers.

</comment><comment><USER66> I think the ad blocking arms race is unfortunate because it's converging on recognizing/disguising ads so that they can be hidden/served despite what the other side wants. That's lame. I don't have any need for a hyper evolved system of coersion/rejection.

Wouldn't it be far better if instead we focused on identifying content and finding ways to serve it more efficiently? Why download the whole page and then hide 95% of the data?

I'd like to see a system where we crowd source the identification of content. If 100 people all view a page and see 100 different ads but the same article each time, a smart browser extension should be able to conclude that the uri actually refers to the static text. Store that on ipfs or somesuch and when I click the link, don't waste my bandwidth downloading the site, just serve up what I wanted in the first place.

I'm not sure how such an approach would play out--but all we're getting out of the current strategy is smarter and smarter ads. I can't imagine we're gonna look back in 100 years and be glad we aligned our incentives in such a direction, so I think trying something different would be worthwhile.

</comment><comment><USER67> So there is a technical solution to ad delivery that is pretty hard to impossible to block that is serve everything from the same domain. It's very possible today and even desirable with http/2\. You can configure this with cloud front and multiple origins or using service workers with cloudflare... I'd guess it's only a matter of time before this becomes the more common way to deliver content and ads as one origin...

<comment><AUTHOR> There are obstacles to this, for advertisers.

Tracking impressions (something advertisers seem to want) is facilitated by third-party servers. Self-served ads defeat this and raise fraud concerns.

Standardised advertising units (display sizes) mean that blocking elements strictly on dimensions is possible. One of my early userContent.css stylesheets, borrowing from online souces, did just this, and was highly effective, for a time.

Obfuscated content and JS can get around some of this, thou stylesheets whitelisting elements would be yet another workaround.

<comment><USER67> That is why the edge computing - changes this trust issue... It's just a matter of time before you have a advertising module you can install in cloud flare as a service worker implementation that both parties can trust... this with obfuscation could make it really hard to block and pretty viable for advertisers... let alone the fact that you can shift the analytics into the cloud edge servers... this both eliminates the argument of speed to access the content and removes your ability to block it. I see this as the future of adtech...

<comment><AUTHOR> What seems to happen in practice is that infrastrucure domains and hosts used for advertisig are blocked by default. Amazon's aws & s3 domains come to mind, and they're rather horribly abused (Bezos's own WashPo have covered this). Which may be why generic buckets are going away.

</comment></comment></comment></comment><comment><USER68> Here in India you might have heard of this little service called Hotstar. To start with, this is a paid subscription service, and I believe at the time I purchased it it cost me something like ₹1000 a year. This would lead you to expect that they aren't interested in Ads, wouldn't it?

No. This service is so adversarial to anyone who doesn't want to be tracked, it doesn't even work in Private windows. It stops working itself when you open the Browser's debug console. If this wasn't enough, this service stops working when you have uBlock origin (which finds that there's a /track request going out a hundred times every minute).

I responded by creating a new browser profile just for this website and routing all tracking domains (mostly segment.io) to 127.0.0.0 in my local hosts file.

I haven't used that service for a long time, but recently I heard they are now showing in-content ads between programming! So basically they've taken cable TV and put it on the internet with higher fees and shittier service.

</comment><comment><USER69> Why is JavaScript even allowed in ads? Why can't they be limited to images, text, and/or looping HTML5 videos?

Could you imagine if cable companies could control your Smart TV when showing ads and collect data about your viewing habits?

A minority of us have been saying this for years, WHEN will the tech industry cry loud enough for change?

</comment><comment><USER70> I still firmly believe that in-browser crypto mining could solve internet advertising problems fairly for both parties.

1\. As a user, you set your preference: no mining - ads will show instead. No ads, there will be some mining.

2\. The longer a user stays on a page, ie the more engaging the content is, the more money the publisher earns. In theory, this would trigger a natural correction for dark publishing patterns: click bait would diminish, articles split over X pages would reduce. True, engaging content would win.

Hitherto all alternatives for remunerating publishers have flopped (an engaged user has no easy way to remunerate aside from pulling out a credit card..) .. so we have been stuck with ads.

I was truly sad to see in-browser crypto mining get banned. For a brief moment, it seemed that pleasing everyone was going to be possible.

<comment><USER39> Gigantic waste of energy. Why drain my battery to not see ads when I can just use an adblocker? Ignoring these, why reward longer content, content I happen to keep in the background, or content I happen to leave in the foreground while away over more valuable content?

Donating directly is a much nicer solution for me, and there's so much room for improvement there too in the areas of privacy, fees, and convenience. (In a world where in-browser mining were a good idea, an out-of-browser miner could provide the equivalent for this kind of manual donation.)

<comment><USER70> Because aside from insidious advertisements, it's the only compensation mechanism that provides revenue to publishers without demanding a behavioral change from users.

Obviously, there need to be intelligent structures in place - and these can be enforced by the browser (as they already are today) - CPU limits for inactive tabs, CPU limits based off the computer's power-mode. The ability to disable mining at the cost of seeing advertisements.

<comment><USER25> I'm not sure why you think people avoiding ads would accept mining. I find mining environmentally unethical even when you're using your own resources; it's mindboggling to me that distributing this to general population is even an idea worth discussing.

</comment></comment></comment></comment><comment><USER71> Is it necessary that ad blockers be totally all-or-nothing in their approach? Pop-up blockers didn't kill all ads. They just killed pop-ups. If it's really the privacy violations that are the problem, and not the user experience of seeing a bunch of ads, why not find a middle ground?

Make an ad blocker that just dishonors cookies, clears localStorage, etc for the ad domains, rather than blocking the requests altogether. Publishers won't make _as much_ money since advertisers won't be able to track you. But at least you could give the publishers the ability to make _some_ money from ads served to you.

If this approach gained adoption, you might see a growth in the market for non-tracking ads (analogous to the growth in the market for non-popup ads described in the article).

Why not?

<comment><USER72> Adblock Plus has their "acceptable ads" feature[1] so it's already a thing. But there was some controversy around it, which I don't recall well enough to give a fair hearing.

Also, Firefox has a good deal of tracker blocking[2] built in that tries to go after browser signature recognition. I think the problem with that is it can break some sites, though I have it on and don't see a lot of problems.

Beyond that, many ad blockers let you customize the lists, and there are tracker blocking lists. But I think they all default to standard ad blocking, so the hindrance is configuration.

[1]: [https://adblockplus.org/en/acceptable- ads](https://adblockplus.org/en/acceptable-ads) [2]: [https://support.mozilla.org/en-US/kb/content- blocking](https://support.mozilla.org/en-US/kb/content-blocking)

<comment><USER26> > Adblock Plus has their "acceptable ads" feature[1] so it's already a thing. > But there was some controversy around it, which I don't recall well enough > to give a fair hearing.

You can pay the makers of Adblock Plus to have your ads declared "acceptable". However, I do not want somebody else deciding for me which ads are "acceptable".

</comment></comment></comment><comment><USER73> I love reading the views people have about digital advertising on HN, and as someone who works in the space I often agree that they are not providing a great experience and the tracking is too much, but what is the alternative for monetisation of content on the web?

<comment><USER74> Paid subscriptions. Literally way more than 99% of "free" content is so bad that world would be better without that.

</comment></comment><comment><USER75> Show me just one ad per page, no scripts, no movement, no tracking and I'll be fine with that.

<comment><AUTHOR> I counted _eleven_ interstitial "advertising" breaks within an article on some site recently. I use adblock, so the label. was the only trace left, but that's still absolutely ridiculous, and is precisely why I'm doing same.

</comment></comment><comment><USER76> I think we're going to need adclickers: similar to adblockers except they put the ad in a sandbox and click it. As long as this registers as a click, someone somewhere will want to be paid and sooner or later the whole ad economy nightmare will implode.

<comment><USER77> Like AdNauseam?

[https://addons.mozilla.org/en- US/firefox/addon/adnauseam/](https://addons.mozilla.org/en- US/firefox/addon/adnauseam/)

</comment></comment><comment><USER78> Also found on EFF: [https://www.eff.org/deeplinks/2019/07/adblocking-how- about-n...](https://www.eff.org/deeplinks/2019/07/adblocking-how-about-nah)

</comment><comment><USER79> The article kind of ended abruptly. The point about Encrypted Media Extensions and DMCA and rise of encrypted video playback within browser is an interesting point that needs more elaboration.

The story of how Internet grew and what made it valuable to users and what threatens it – it is worth articulating and illustrating and repeating each year as more and more people take Internet more seriously but don't know about these happenings under the covers.

Also, for the business model innovation to happen, existing business models need to be studied with care and deeper and broader understanding needs to prevail over more and more users.

</comment><comment><USER80> Everyone should click as many ads as possible. Fuck over the datasets. The ads I get are now stupid and hilarious. I broke their algorithms and I cost every crappy advertiser money.

</comment><comment><USER81> The EFF very directly is trying to blame Do Not Track being useless on browser vendors and media companies when the reality is that it was a dumb idea whose existence likely does more harm than good (as it makes people think they can avoid tracking by using it, when they have done literally nothing to people who are tracking them by turning it on except provide one more bit of browser setting variation that can be used to differentiate--and thereby track-- users). What the hell, EFF?

</comment><comment><USER82> We need to move towards an economy where many essential internet services are publicly funded and there are rational subsidies for journalism meeting very minimal standards.

</comment><comment><USER83> I really wish there was some sort of proper monetization model for rss. The web has no reason to be this obnoxious pile of bloated unreadable spyware. I want to support more of these companies because I think what they do is important but it gets hard to justify 10 bucks a month for each of them. When I try and whitelist ads I often find I can't even find content on the site anymore and my browser slows to a crawl.

</comment><comment><USER84> What is the difference (if any) between companies who nefariously, vehemently, and willfully track users and stalkers (who we classify as criminals) chasing after their obsessions? Why is it legal for the business? Aren't the end-goals pretty much the same in both contexts and the only differentiation in both cases is the fact the adversaries are either a business or an individual?

</comment><comment><USER85> FYI, The title doesn't suggest one to stop blocking ads, but means the opposite.

> _When you visit a site, the deal on offer is, "Let us and everyone we do > business with track you in every way possible or get lost" and users who > install adblockers push back. An adblocker is a way of replying to > advertisers and publishers with a loud-and-clear "How about nah?"_

</comment><comment><USER11> How about we just don't let the advertising industry develop or fund our browsers and web standards? Users need to be able to control what kind of content their device will load and display, so it's probably time to develop technology that supports it (and scrap the current web, which is now basically billboard ads for the internet).

<comment><USER48> Don't let them. Use Firefox or Safari instead of Chrome or Edge.

<comment><USER11> I use Safari, Firefox/Mozilla is wholly dependent on money from the ad industry (Google). But Safari also goes in the direction the ad industry desires through its adoption of new standardized features. There is really no way out using the current "web", we need a simple, open alternative that isn't controlled by the ad industry and adopts only features in the best interest of the users first and content creators second.

</comment></comment></comment><comment><USER86> Ny main gripe lately is with YouTube.

YouTube's gotten a lot more shitty about it, too. I wouldn't block ads on there but they treat their creators like crap and they treat me like crap. Nowadays if I don't block them I get two ads in a row and if I don't skip the first one, I have to wait on the second one, too. And often some ads go on for minutes. The longest I've seen was a 50 minute ad. Or ads that scream at you, as loudly as possible. Especially when you're trying to enjoy more laid-back content. Ugh.

And a lot of that revenue doesn't go towards paying the creators their proper share. I would gladly pay for an ad-free YouTube but they're dead-set on shafting creators, making their lives as miserable as possible. Random demonetisations, horrible handling of fair use, etc. All this without ANY kind of proper support. If I pay for a service or rely on something to make a living, I expect to be able to at least somehow talk to a human being, etc. They've gotten more and more and more hostile towards creators and users. So now they get the Brave-treatment (since they fiddle with adblock on Safari, I use Brave just to watch YouTube. If they detect adblock and can get through it, you get actively punished with longer and more frequent ads.)

Little wonder that most small people without VC investment backing them have looked for alternatives to this, they understand how sites that host content being hostile towards the userbase is a race to the bottom. With off-site patronage and superchat and burnt-in ads they're in control. Sadly you do have to be of a audience certain size to take advantage of these but they're far more pleasant for everyone involved (except the firms that host the content).

For sites in general that model seems to be viable, too. But you do depend on your audience for this which can be a good thing generally as often it seems to keep the content more honest. The content that panders is very often just going to slowly die off.

I would be okay with ads if they weren't disgustingly obnoxious and consistently trying to intrude in my life and take my data.

Lots of bigger websites have an insane quantity of ads, some even have their entire backgrounds replaced with clickable ads. One accidental misclick and you're pissed off. There are sites where the occasional ad is sometimes interrupted by content.

I simply can't take it. Performance-hogging, data-stealing, annoying, time- wasting ads. They're everywhere.

</comment><comment><USER87> This embarrassing early era of an internet built on the ludicrous house of cards of advertising can't come to an end soon enough.

I look forward to reading in the history books about how some of the world's greatest minds spent their time and energy figuring out how to build businesses on manifestly bad UX.

</comment><comment><USER88> What a weird phrase: "how about nah". Is this a reference to something I'm totally missing out on? I can barely pay attention to that point the article make when it's framed in such an odd and unclear context.

I get wanting to have style to your writing but not at the expense of clarity.

<comment><USER89> It means something to the affect of "Thanks, but no thanks, I'll do this my way", with a bit of extra snark.

I liked the term "adversarial interoperability" that they used in the article. I think it is an interesting concept. Although I might want to reframe it as protecting individual autonomy.

</comment></comment><comment><USER90> Breaking this cycle of blocker-blocker-blockers is what makes me actually like Adblock Plus's "Acceptable Ad" options. It provides a counter-offer, rather than just "No.", whereby advertisers can feed you unambiguous and untracked ads.

<comment><USER26> > It provides a counter-offer, rather than just "No.", whereby advertisers can > feed you unambiguous and untracked ads.

That ship sailed in 2001, hit an iceberg, and sank with all hands.

</comment></comment><comment><USER91> I always thought the Do Not Track option was naive. It did nothing to stop tracking except beg.

<comment><USER92> In a sane world, DNT would be opt-out and enforced by legislation.

<comment><USER93> There's legislation to stop robocalls. How many have you gotten in the last 24 hours? I've had 3, and it's been a pretty typical day.

<comment><USER94> Meanwhile I haven't gotten any in many years, because my spam call filter works a treat, and always has.

Though I am thinking of turning it off and putting up a "Hello? Hello? Sorry I can't hear you could you repeat that. Uhha, go on..." recorded message about 5 minutes long, just to waste their resources. That would actually be a promising addition to a spam filter.

<comment><USER95> And that spam call filter probably requires proprietary software, which has access to your call logs and theres every chance that the spam filter app company can steal your data.

> Though I am thinking of turning it off and putting up a "Hello? Hello? Sorry > I can't hear you could you repeat that. Uhha, go on..." recorded message > about 5 minutes long, just to waste their resources. That would actually be > a promising addition to a spam filter.

This a nice idea but on the rare occasion that your filter incorrectly blocks the wrong person, you might be annoying someone who really needs to talk to you.

<comment><USER96> Android phones do it automatically, assuming your carrier hasn't monkeyed with the phone app.

I think Google keeps a spam probability score for callers' phone numbers based on how many people have marked a call as spam.

<comment><USER97> Spam call numbers are randomly generated. Blacklisting can't work without collateral damage.

<comment><USER93> I'm surprised it helps at all. Why wouldn't a robocaller generate a new random number every time?

<comment><USER37> They do. The common strategy is to pick numbers with the same area code to pretend to be legal, and some advanced callers try and pick numbers that match even more recognizable digits (like your office). All this traffic is a major source of revenue for VOIP operators.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER98> Couldn't we solve this problem by always clicking on ads we don't like, then close the tab?

If I like a company, I tend to scroll down in Google Search until I find their organic result. Hopefully that makes a difference to their bottom line.

<comment><USER99> Like this [1] browser extension? It hides all the ads and also clicks them in the background.

[1] [https://adnauseam.io/](https://adnauseam.io/)

</comment></comment><comment><USER100> If I buy the paper version of the New York Times the ads are on every page but I don't mind them. They are not watching me. Nor would I mind ads on a page, if they are rendered as plain HTML. Just no Javascript

<comment><AUTHOR> I subscribe to the print edition of the local paper.

I'm not interested in logging in to the paper's website so that it can 1. feed me yet more ads and 2. track in minute detail exactly what I'm reading and for how long.

</comment></comment><comment><USER101> The real problem is that the browser does not give enough ropes for the user to hang themself and also a few more just in case, and gives too much control over it by the data received from the server instead.

</comment><comment><USER102> i'm on a vpn that blocks ad networks no software in my browser is needed

<comment><USER103> Which VPN is that?

<comment><USER102> PrivateInternetAccess

</comment></comment></comment><comment><USER104> > setting Do Not Track in your browser does virtually nothing to protect your > privacy.

It sends another signal, that this person is an aware contrarian, and may be receptive to this or that source or style of engagement.

</comment><comment><USER104> Is there a way to make an ad "blocking IO" from the point of view of the ad network, but my browser can keep on going (sans ads of course).

Sort of like laying the phone down when a telemarketer calls.

</comment><comment><USER105> > and indeed, some ad-blockers actually track users!

Can someone please explain this?

<comment><USER106> Browser extensions can see quite a bit of your activity. And if they know your browser/IP/OS and the sites you visit, there's money to be made.

Here's an article on it: [https://www.wired.com/2016/03/heres-how-that- adblocker-youre...](https://www.wired.com/2016/03/heres-how-that-adblocker- youre-using-makes-money/)

</comment></comment><comment><USER107> Nobody was bothered with ads the way they used to be. But currently you can't use internet without ad-blockers.

Advertisers are pushing too much and they are overheating their market.

</comment><comment><USER108> Most companies overdo the ads on their sites. If it was one or maybe two banners or the like, it would be okay, but no, let's cover 2/3 of the content with ads.

</comment><comment><USER109> Just install noScript. All the really nasty stuff ads do gets blocked but people being sane (things like what project wonderful used to do) still works.

</comment><comment><USER110> Are there any advertising companies that don't target ads with tracking? But just serve ads based on content of websites?

</comment><comment><USER111> We've made full circle again. Were back in 1999. Tons of ads pace being bought with clickfraud (facebook). Zillions of scripts etc, when all you want is someone to put a text link + a pitch which is relevant to the _page_ (current search, current article, type of content in the video), not the user.

Problem is they can't. Publishers earn through the massive amount a low quality traffic, bots, and even misreporting impressions and clicks.

I _want_ ads, if they're relevant.

<comment><USER112> I really like [https://tab.gladly.io/?u=antupis](https://tab.gladly.io/?u=antupis) which raises money for nonprofits through adds.

</comment></comment><comment><USER113> The title could've been worded better. It makes it sound like the article is against ad-blocking.

</comment><comment><USER114> So has anyone found a reliable solution for a ad blocker blocker blocker?

</comment><comment><USER115> 500th comment.

(Wow, this must be one of the most discussed HN posts.)

</comment><comment><USER116> They are not ad blockers, they are HTML firewalls.

</comment><comment><USER117> So what can I do to fuck them over?

</comment><comment><USER118> J'aime l'application

</comment><comment><USER119> Why not use the original eff source? [https://www.eff.org/deeplinks/2019/07/adblocking-how- about-n...](https://www.eff.org/deeplinks/2019/07/adblocking-how-about-nah)

<comment><USER120> Thanks! We've updated the link from [https://boingboing.net/2019/07/25/largest-boycott-in- history...](https://boingboing.net/2019/07/25/largest-boycott-in- history.html).

<comment><AUTHOR> Appreciated -- I realised the EFF's link was better 10s after submitting.

</comment></comment></comment><comment><USER121> When I loaded the BoingBoing version of the article my browser contacted 53 third-party domains and a grand total of 373 cookies were set. The BoingBoing privacy policy does not mention "Do Not Track", usually a signal it is ignored, and it discloses nearly none of the third-parties. The cookie opt-out link goes to the NAI site which does not work on Safari because Safari won't allow the third-party cookies required to opt-out by the NAI. BoingBoing's privacy policy lists nine types of advertising, none of which are behavioral.

The author of this article, Cory Doctorow, is an editor of BoingBoing and has some level of control of this.

In contrast, I got zero tracking from the EFF site. Exact same content, completely different privacy experience.

I'm not an absolutist that you can't criticize a system you benefit from (it's ok to criticize Apple's labour practices if you own an iPhone), but there is a big difference between admitting participation in a flawed system and passing yourself off as an objective critic of a system you benefit from.

Doctorow knows where his paycheck comes from.

<comment><USER122> Does that changes anything to the truth and validity of the points he is making, though ? Because if yes I would like to know what and how, and if no then this is an ad-hominem.

Nobody said advertising wasn't paying the bills.

<comment><USER123> Yes it says boingboing are hypocrites and not the right people to spread this message. At the very least they could have used this as an opportunity to say "you may have noticed we have tons of tracking on this article, here's why...".

There's something to be said about being a trustworthy source.

<comment><AUTHOR> The capitalist will gladly sell you the rope you hang him with.

</comment></comment></comment></comment><comment><USER124> There are more countries besides United States. I don't know why people here always refer to it as if it were the only ruler of the internet. It's not. In fact it does a piss poor job at playing its part.

<comment><USER125> You mean, aside from the fact that we invented the internet?

You are welcome.

<comment><USER126> The net add people know it was invented by a brit at a major European project. You're welcome.

<comment><USER127> That's the web, not the internet. The internet existed continuously for over 2 decades before the web was created (although the general public didn't know about it).

"Existed": had actual users. (The US government started funding continuous research into packet switching in 1960.)

Also, if Tim Berners-Lee (TBL) hadn't created the web, someone else would probably have _used the internet_ to create something like it in a few years whereas if the US hadn't invested heavily in packet-switching in the 1960s, 70s and 80s, a much longer interval of time probably would've gone by before someone created anything capable of enabling an ordinary programmer or sysadmin like TBL was to create something like the web.

"Ordinary": not able to command a lot of capital or labor.

TBL persuaded his boss to let him create the web during working hours. His boss agreed largely because he thought that the project would be a good way for them to evaluate a new computer the boss had bought (by NeXT). In other words, the existence of the internet (which in turn enabled the existence of a community of programmers interested in donating code to innovative projects, a community that got a very big boost when Stallman started publishing _on the internet_ in 1983) enabled the creation of the web without any serious commitment from government, corporate executives and people with lots of money.

In contrast, the creation of a network that allowed an ordinary programmer to recruit open-source contributions to his project and to easily deploy server and client software of his own design required massive outlays of capital over 3 decades. It easy for such massive outlays to go awry in various ways. The US government avoided its going awry. In contrast, the French government retained so much centralized control over Minitel that at no point in Minitel's history could an ordinary programmer have used Minitel to create something as innovative as the web.

(It wasn't until the internet had been almost completely turned over to the private sector in the early 1990s, for example, that any software started to track users more than absolutely necessary for the operation of the network: in the early 1990s, anyone could send and email with firstname.lastname@example.com in the "From" field. The reason it worked that way was to maximize anonymity of senders. There was no way for the sender of an email in the early 1990s to know whether the recipient read it, the reason again being a desire among the designers and maintainers of the infrastructure to maximize privacy.)</comment></comment></comment></comment>


Project management: A surefire way to kill your software product - <AUTHOR> https://techbeacon.com/project-management-surefire-way-kill-your-software-product <comment><USER2> Mostly a rant. Of course bad project management will kill a project.

The one good insight is that many products are not really projects; or rather, products that are treated as projects will eventually fall behind. Look at Google Docs. Revolutionary when it was created, now stagnant. Many software products are killed by success (they reach a certain point, then go no further.)

</comment><comment><USER3> This article has some correct points but only by coincidence and often out of incorrect analysis that is actually counter to the point the author is trying to make.

A good number of the "delusions" are the result of the lack of anything resembling a proper engineering process in most projects.</comment>


Intel subsidiary fined for unlawful export of software that enables encryption - <AUTHOR> http://www.goodwinprocter.com/Publications/Newsletters/Client-Alert/2014/1015_Software-Companies-Now-on-Notice-That-Encryption-Exports-May-Be-Treated-More-Seriously.aspx <comment><USER2> How utterly pathetic.

Encryption export restrictions are an absolute joke. I can go read a Wikipedia article right now that heavily details the inner workings of most block ciphers. They're still fining people for exporting anything over 64 bits (which is most things), even if almost every individual let alone government has access to the technological knowledge to reproduce such encryption at home.

Seems like this fine is about them exporting a custom Linux distro' with all the normal encryption libraries still in-place (e.g. 256 AES).

Why do I get the strong sense that this fine isn't really about exporting encryption and is really about Wind River failing to place backdoors into this equipment? Because frankly that makes a lot more sense than what it appears to be on the surface.

Wind River got fined for "something" to do with encryption. Now you can either take the government at their word and assume that that thing is just exporting AES 256 within a standard OS, or maybe consider it a little deeper and wonder if it was punishment for something else Wind River did or didn't do.

<comment><USER3> >Encryption export restrictions are an absolute joke.

I don't think you give BIS & NSA the credit they deserve. Experto crede. The restrictions may serve a useful purpose and if you can't see it, that doesn't mean _they_ are the ones missing the point.

Having myself had to pass the export control for one of my apps, and so having the opportunity to pour over the these regulations in great detail, I came to conclusion that the actual purpose of the crypto export regulation is not to control export of the _technology_. That sort of restrictions is impossible to implement, as you noted, and it's also quite unnecessary.

The actual purpose of the law is to prevent export of _expertise_. Implementing a crypto _system_ that would be secure end-to-end is pretty much impossible without being an expert, and even then it's exceptionally hard. The best chances belong to a team of experts with a track record of fruitful collaboration and rich history in a particular area. Unlike bits and pieces of code, cohesive teams of experts are relatively easy to keep track of.

The way this control regime works, is that the entirety of the regulation revolves around two questions: 1) Are you supplying a turn-key end-to-end system to the client? 2) Are you supplying services to setup a complete, tailored system for the client? If the answer is "yes" to either question, that raises the red flag for the BIS/NSA, and they want to see what's going on there. Otherwise it's just a minor bureaucratic hoop to jump through. You are certainly welcome to export bunch of crypto code, and they even have a special open-source exception to the paperwork requirements.

So, you may disagree with the goals of this regulation, but it's certainly not a joke you make it out to be.

<comment><USER4> > 1) Are you supplying a turn-key end-to-end system to the client?

> So, you may disagree with the goals of this regulation, but it's certainly > not a joke you make it out to be.

It remains a joke, when you consider how much really good open source software implementations are in the wild already. Think about the crypto in Debian and OpenBSD, including GPG, LUKS, openvpn, OTR, Open/LibreSSL with their support in Apache, nginx, etc. Even for Android, the best end-to-end encryption software (security-wise, not interface-wise) is open source. Let's face it, we have won this crypto "war" long ago. (This is not to say, we don't have other problems to deal with, regarding the immense power the NSA, etc have.)

And even all sufficiently secure software was closed source, as long as it is reasonably widespread, it will be easy to pirate the software instead of importing it from the US.

> 2) Are you supplying services to setup a complete, tailored system for the > client?

What kind of systems do you have in mind? Afaik, the case referred to in the article does not fall into this category.

<comment><USER3> These are all components, not systems. A system would be something akin to a full-bank installation with all the computers, cabling, routers, crypto protocols, key generation/escrow/rotation/destruction, fall-back procedures, firewalls, hotglued USB ports, etc.

You can use those components to build a system like this, but you have to be an expert in it. This is why component export is restricted - all they want is to look into your design to see if you are an expert capable enough to design and implement a secure _system_. What happens if they pick interest in you is beyond my experience. I know, it speaks poorly of my crypto skills, huh?.. :) I imagine they would start looking into identity of the client(s), and see if they are connected to embargoed entities. Or something...

<comment><USER4> Fair point. I didn't recognize you had such a high level view of "system". But this raises the question whether one can really call these laws " _cryptography_ export restrictions". Because, sure, cryptography is involved, yet the restrictions only apply to (/ are meaningful in regard of) the procedures involved in secure IT systems in general. I'd argue that this expertise is somewhat independent of cryptography, as you can swap the cryptography implementations with any other and the procedures would stay the same.

Even better, leave the cryptography out of the package entirely and just include an "apt-get install" line or a list of open source projects you have to install. Instructions for "cabling, routers, crypto protocols, key generation/escrow/rotation/destruction, fall-back procedures, firewalls, hotglued USB ports, etc." aren't cryptography in themselves, are they?

<comment><USER3> Fist, it adds more moving parts, making the system more likely to contain a hole, which might be just enough for NSA. Second, consider that typical buyer is a beauracracy, and they are are either buying a crypto system, or the are not buying it. The upgrade might be trivial for you, but a beauracrat has no way of knowing that, so he has to play by the rules.

I think they key to scale of the word _system_ is however big it needs to be to establish actual security. You can have perfectly good crypto, but if you're relying on certificate authorities you may be safe from street hackers, but as far as NSA is concerned its wide open.

It's just reading tea leaves, of course. I imagine that NSA is not enjoying reading thousands of applications from iOS app devs like me, so if they keep doing it they must be getting something for their effort.

</comment></comment></comment></comment></comment></comment><comment><USER5> Wind River is the vendor behind vxWorks, which is one of the most widely-used embedded operating systems in the world. vxWorks isn't especially common in consumer products (although you can find SOHO-type routers running it) but it's very important in industry, aerospace, manufacturing, RF and telecom, and things like that.

The "sharp departure" Goodwin refers to here is the detente between industry and the USG for the past ~12 years. In the late '90s, crypto export controls were vigorously enforced. When you went to download Netscape, you had to select the US-specific installer to get cryptography that wasn't trivially brute-forced. If you shipped products that included SSL/TLS, or even just MD5, you had forms to fill out.

It seems like there'd need to be a backstory on this Wind River enforcement action. Surely there's quite a bit of crypto code in various vxWorks distributions, but it pales in comparison to the cryptography shipped by Mozilla and the Chromium projects. Maybe the issue is "enabling technology" versus consumer products?

It's also unclear to me whether this is a return to form or the BIS being especially aggressive about deliberate exports to specific countries.

<comment><USER6> Incorrect... You sometimes had to download binaries from a source outside the US. Usually not, since the user was simply expected to click the link for the non-US version.

In cases where the server actually looked at your source IP you could either proxy or just download the binary from a source in Europe. The dev teams were and still are seldom located in the US alone, but distributed all over the world. The authors of encryption packages were often not US citizens, either.

The rest of the world looked at the US policy on encryption with wide-eyed disbelief due to the horrifying ignorance that just had to lie behind it.

<comment><USER7> > The rest of the world looked at the US policy on encryption with wide-eyed > disbelief due to the horrifying ignorance that just had to lie behind it.

[http://en.wikipedia.org/wiki/Authoritarianism](http://en.wikipedia.org/wiki/Authoritarianism)

<comment><USER8> Back in Australia in 1994 or so, I clicked on a download link for PGP without really reading the warnings, reading them during the download, and then wondering when the US SWAT team was going to swing through my window.

</comment></comment></comment></comment><comment><USER9> If this type of thing is interesting to you, here's some lovely historical perspective about government restrictions on crypto: [http://www.foia.cia.gov/sites/default/files/DOC_0006231614.p...](http://www.foia.cia.gov/sites/default/files/DOC_0006231614.pdf)

In particular, related to this $750k Wind River violation:

 _Bidzos realized that there was a simple way to skirt the export limitation laws. Both the AECA and the ITAR are US laws, and, as, such, they pertain only to US companies. Bidzos went to Japan and established a Japanese subsidary, Nihon RSA. Nihon RSA qualified as a distinct Japanese company, subject only to Japanese law, and Bidzos was able to do whatever he wanted with his strong encryption technologies. Knowing that his encryption technology was a desired commodity, he shopped it around the Japanese marketplace. He promptly struck a deal to produce encryption chips for Nippon Telephone and Telegraph Corporation._

If the US government continues to fine Wind River, then couldn't they just set up a foreign corporation?

<comment><USER10> That is likely going to be a consequence of these actions. Digital security is a huge industry and is going continue being a huge industry for a long time. US companies are decreasingly in a position to market themselves as genuinely secure companies.

Companies that want to have credibility in the industry are going to need to bring themselves out of the jurisdiction of restrictive laws, or lose business to companies that have set themselves up in more friendly jurisdictions.

</comment></comment><comment><USER11> US Company Fined for Exporting Math.

We ain't got enough Math in the US to be sending it abroad!

<comment><USER12> Isn't that like saying someone fined for exporting missiles was fined for "exporting physics", or someone fined for exporting chemical weapons was fined for "exporting chemistry"? If not, how do you distinguish them?

Note: I'm not suggesting that the cryptography export restrictions are useful or make any sense it all. They don't, as far as I can tell. I'm just trying to get some discussion going as to whether reductionist arguments like "exporting math" make sense.

<comment><USER13> Missiles and chemical weapons are _physical objects_ which one can reasonably presume to maintain at least some degree of control over.

Encryption algorithms are math, theory, information. They can be reproduced, copied, and transmitted at-will, for no cost.

If the difference is still non-obvious, google around for instructions to make ricin. Easy to find, and it's not illegal to share that information. Why should it be illegal to share any other data? And how could one reasonably expect to enforce it?

<comment><USER14> It's definitely illegal to commercially export information in those areas as well, at least past some level of detail. For example it's illegal to sell missile or reactor blueprints without approval. It's not just selling the physical objects (missiles or reactors) that's illegal, but also selling the information on how to construct them.

</comment></comment></comment></comment><comment><USER15> Time for DJB and the EFF to bring their old case back?

[https://en.wikipedia.org/wiki/Bernstein_v._United_States](https://en.wikipedia.org/wiki/Bernstein_v._United_States)

"On October 15, 2003, almost nine years after Bernstein first brought the case, the judge dismissed it and asked Bernstein to come back when the government made a "concrete threat"."

This sure sounds like a concrete threat.

<comment><USER5> It needs to be a concrete threat _to Daniel J. Bernstein_.

<comment><USER15> Yeah, you're likely correct. I didn't catch this at first due to my immediate feeling of threat simply for having published a few tools which use high-level cryptography libraries.

<comment><USER5> Wind River seems to have been dinged for completing commercial transactions with organizations that happened to be on the BIS export blacklist. You're not going to get fined for posting code to Github.

<comment><USER15> But Wind River is only guilty of exporting the same already public information which I may be and it's quite possible that anyone on that "BIS export blacklist" could feel free to obtain my code.

<comment><USER5> No, I do not think that accurately captures what the USG is fining Wind River for.

</comment></comment></comment></comment></comment></comment><comment><USER16> Sorry, my time machine appears to be on the blink. I appear to be in the 1990s.

<comment><USER17> Seems like they are trying to reignite the crypto wars, what with the FBI talking about mandatory backdoors.

It's just utterly confusing. You would think their reaction to Snowden would be appeasement, not further repression and surveillance. Can't make it too obvious this ain't a democracy.

<comment><USER18> I can actually see their reasoning: "you thought we were being _hard_ on you? So the gloves are off now? Ok, so we'll show you what happens when we _really_ play hard".

</comment></comment></comment><comment><USER19> It was an Intel subsidiary. The article is not very informative. It appears as if Wind River didn't file for an export permit and the BIS fined the because of it; moreover, they voluntarily disclosed it [0].

[0]:[http://www.theregister.co.uk/2014/10/17/intel_subsidiary_cry...](http://www.theregister.co.uk/2014/10/17/intel_subsidiary_crypto_export_fine/)

<comment><USER20> Yes because one should have to file for a permit to export math (or anything else)

<comment><USER21> The law says you do. If you want to change that law, fine. But if you choose not to comply, don't complain when you get fined for it.

<comment><USER22> Why shouldn't someone complain about a law, even if they already knew about it? The false dichotomy between "obey and complain" vs. "get caught and shut up" isn't necessary.

<comment><USER23> Because sometimes it's annoying and simply stupid.

Case in point: posting stupid reductionist arguments about "exporting math" are obnoxious and completely frivolous, especially when it literally ignores everything substantial about the law.

After all, if I give north korea blueprints for nuclear reactors, that's just _paper_ right?! It's just math on paper! What, that's not the same? Sure it is - quit trying to stop me from exporting paper!

You do see how the grandparents point is obnoxious and stupid, right? Or do you not because it simply aligns with your worldview?

</comment></comment></comment></comment></comment><comment><USER24> This is exactly what I fear happens when we allow bad laws to stay in a "well it's there but we don't enforce it" state.

Is the way around this to develop crypto systems outside the US?

<comment><USER25> If I remember correctly, someone published a book which contained source code in monospace for PGP so that it would fall under freedom of speech and was allowed to leave the US. But that's from memory, I'm not sure it really did circumvent that law or that it was PGP.

Edit: Ah, AlyssaRowan actually mentions[1] this further down the comment thread:

> PGP 2.6.2 was exported as a book to call the bluff of the whole thing

[1] [https://news.ycombinator.com/item?id=8552169](https://news.ycombinator.com/item?id=8552169)

<comment><USER21> That doesn't prove anything. You can also export a physics textbook without the issues you would run into exporting a nuclear weapon.

<comment><USER25> Except that you don't really need to buy expensive and probably-hard-to-get-by stuff to turn the book with code into something useful (or munition, in the US government's eyes) whereas with nuclear weapons you somehow need to get a radioactive warhead or something.

<comment><USER21> No, you need something even harder - expert knowledge.

</comment></comment></comment></comment></comment><comment><USER26> The damage to the US economy and tech industry caused by this sort of thing seems likely to outweigh any supposed security benefit. Celine's First Law: "National Security is the chief cause of national insecurity." [1] Related stories on HN recently involving Twitter et al [2] are enough to make one wonder how long before some of them relocate overseas.

[1] [http://en.wikipedia.org/wiki/Celine%27s_laws#Celine.27s_Firs...](http://en.wikipedia.org/wiki/Celine%27s_laws#Celine.27s_First_Law)

[2] [https://news.ycombinator.com/item?id=8422581](https://news.ycombinator.com/item?id=8422581)

</comment><comment><USER27> So if you're a U.S. software developer, perhaps opensource, working on something that uses encryption, how do you stay out of trouble?

Are you ok if you use standard libraries, rather than implementing your own crypto algorithms?

<comment><USER28> Publicly available encryption source code is exempt from the ECCN[1] according to the License Exception[2], section 740.13(e), provided you notify the BIS. But do read the documents, IANAL. Interestingly, though I'm EU based, but ECCN list is literally the same over here. Have been wading through these documents countless times.

[1] [http://www.bis.doc.gov/index.php/forms- documents/doc_downloa...](http://www.bis.doc.gov/index.php/forms- documents/doc_download/951-ccl5-pt2)

[2] [http://www.bis.doc.gov/index.php/forms- documents/doc_downloa...](http://www.bis.doc.gov/index.php/forms- documents/doc_download/986-740)

</comment></comment><comment><USER29> American tech companies still in america are becoming the unluckiest bunch. Their competitors pay a third of tax, are free from having to answer to the NSA, and generally don't have to put up with cold war nonsense from the likes of the BIS. If it weren't for american talent, many many more companies would make the move.

<comment><USER30> I agree with your comment. There are also a lot more reasons than just talent for why the US tech industry does so well.

It's the largest singular market in the world. A very technologically advanced economy in general. It's a very diverse economy, with the second largest manufacturing sector, the largest agriculture sector, the largest biotech + pharma sectors, as well as the largest space industry and service sectors - which provides for a very diverse tech demand and stimulant. Businesses in the US have very high productivity rates, so they seek out productive gains as a matter of fact, which incubates a higher demand for technology. The US tends to adopt technology rapidly, the culture is mostly accepting of new tech, which plays into that huge market. Businesses can change state locations fairly easily, shifting to jurisdictions that are more friendly in various ways (either for taxes, regulation, weather or talent depending). In the US the tech industry is regulated at a _mostly_ low level, leaving the market free to innovate and change rapidly. There are a lot of other good reasons.

</comment></comment><comment><USER31> Could this all be a positive thing if it promotes development of open source libraries and tools ?

Not only that, but I wander how feasible is to create binary APIs for most operating systems and CPU architectures, where you could download, verify (that they were build from a commit id of some know open source implementation), and plug in crypto modules as binaries.

So you buy your software from any vendor, any country. If they implement the use of this API, then get your verified crypto modules and plug them in. Or you build your own in house from source.

I can see how that mechanism would of course be a massive attack target by all kinds of actors, but in theory is that possible? Maybe make it decentralized as much as possible.

</comment><comment><USER32> This might be an attempt to use existing means to pressure mobile device manufacturers from enabling full device encryption by default. I know the executive branch hasn't been too happy with the latest announcements from Google and Apple.

<comment><USER33> I would speculate they did something closer to providing source code to Chinese defense contractors.

(Which probably doesn't really matter in the scheme things, but it's the sort of thing that will really piss off the U.S. Government)

</comment></comment><comment><USER34> If US tech companies cannot legally offer encryption to international clients then we international clients shouldn't be using US tech companies.

</comment><comment><USER35> The country classifications are interesting [https://www.bis.doc.gov/index.php/forms- documents/doc_downlo...](https://www.bis.doc.gov/index.php/forms- documents/doc_download/944-740-supp-1)

A:1 countries are our friends. E:1 countries are "terrorists". The rest are in between. There is also the list of "Supplement 3" exception countries (friends): see last page of [http://www.bis.doc.gov/index.php/forms- documents/doc_downloa...](http://www.bis.doc.gov/index.php/forms- documents/doc_download/986-740)

This charts shows what's allowed if you have crypto in your product: [https://www.bis.doc.gov/index.php/forms- documents/doc_view/9...](https://www.bis.doc.gov/index.php/forms- documents/doc_view/98-license-exception-enc)

I assume vxWorks is 5E002 (tools to create non-standard crypto systems), which is banned for D:1 countries. Well there is an exception "‐ 5E002: no D:1 countries (unless HQ'd in Supp. 3)".

</comment><comment><USER36> does this mean if I have developed a product based on encryption it is better to incorporate outside of USA? and perhaps register a satelite in US only to import said products?

<comment><USER37> It is better to not be in the US as a crypto developer, yes (especially since there are some concerns that CALEA, National Security Letters and other provisions have been used to strongarm people into backdooring crypto products as described in the classified "SIGINT Enabling Project" budget, although so far I have not seen any backdoors that were not put in willingly).

That has pretty much always been true. The crypto export laws are weaker than they used to be back in the PGP days, when PGP 2.6.2 was exported _as a book_ to call the bluff of the whole thing, but they're still there and of some concern (especially if you intend your software to be used by citizens inside oppressive regimes which might be on The Export List).

I don't see why you'd need a 'satellite' to 'import'. There are no _import_ restrictions I'm aware of in the US?

For a brief, non-normative summary of crypto law, please see: [http://www.cryptolaw.org/](http://www.cryptolaw.org/)

</comment></comment><comment><USER38> Correction: "against Wind River Systems, an Intel subsidiary" not Intel.

</comment><comment><USER39> What is the justification of this law? Seems arbitrary to me. Another question. Is not providing ample security the same as explicitly granting a backdoor?

<comment><USER40> The justification is we don't help our enemies, even if it doesn't make a difference in the grand scheme.

Edit: looks like one of the countries is our ally... so that's weird. For the rest of them makes sense from a geopolitical standpoint.

<comment><USER41> It can get weird. I remember when the export list was significantly expanded for high-bit crypto (2000? 2001?), and France was still on the no-go list - not because the US prohibited export as such, but because France prohibited import (except through authorized channels). Israel may be in the same camp.

<comment><USER42> To be more precise, France allowed import of 128-bit crypto before US allowed export of it and months after US allowed 56-bit crypto to be exported. I also found out that it took until 2004 for France to formally allow import of 256-bit crypto.

</comment></comment></comment></comment><comment><USER43> What better way to prove that your chips aren't NSA backdoors than to pay a hefty fine to the people you're supposedly in bed with?

<comment><USER44> Prove?

</comment></comment><comment><USER27> Do we need to go back to Zimmerman's old trick and publish the code in books? What happens if we put the code in non-DRM'd ebooks?

</comment><comment><USER45> Few years ago, I was in a team implementing IPSec/IKE protocols for a US based company in Pakistan. Though implemented in Pakistan, that product could not be sold there :)

</comment><comment><USER46> So vxWorks on the Curiosity Rover is - presumably - exporting strong encryption to Martian terrorists, right?

</comment><comment><USER47> Would this include the export of Navajo?

<comment><USER44> What do you think the reservations are for?

</comment></comment><comment><USER48> All this will eventually amount to American companies losing credibility around the world.

</comment><comment><USER49> Can anyone provide details on what is forbidden to distribute and to where?

<comment><USER33> [http://www.bis.doc.gov/index.php/regulations/export- administ...](http://www.bis.doc.gov/index.php/regulations/export- administration-regulations-ear)

I guess you have to read it all before you can go back and try to understand part of it (that is, I got a headache looking at a few paragraphs, and don't think I learned anything).

</comment></comment><comment><USER50> Is open sourcing the sensitive bits a possible defense against this?

</comment><comment><USER51> I feel like the title should be updated, a tad misleading IMO.

</comment><comment><USER52> Is it illegal to opensource encryption implementations?

<comment><USER53> No, however, the export of it is still punishable. The GNU gcrypt tools, for example, are hosted exclusively on European servers for this reason.

[http://www.gnu.org/software/libgcrypt/](http://www.gnu.org/software/libgcrypt/)

<comment><USER50> What do words like "import," "export," and "country" mean in an Internet context?

<comment><USER54> They mean whatever the regulator wants them to mean, when you're handcuffed to his table.

Prudence dictates that you not expose yourself or your business to unnecessary risks. So by that standard, the "country" is wherever the enforcer has the power to hurt you, an "import" is bringing something within reach of the enforcer, and an "export" is moving something beyond his reach.

Just stay out of the "country", and you never have to worry about being punished for "exports". If you look at the Byzantine import/export regulations, you don't have to be physically located outside of the geographical boundaries of the U.S. to be considered a foreign entity for the purpose of importing and exporting technical information.

Just feed in this new input to your lawyer/accountant tax avoidance machine, and everything should be all sorted out by next fiscal year.

<comment><USER55> Incorrect, the USA are known for messing with money, goods, people (CIA abductions) or even the airplanes of foreign heads of state (Snowden), even if there is no applicable jurisdiction.

Behave like a bully everywhere, then some day resistance will rise to you...

<comment><USER54> I put "country" in scare quotes for precisely this reason.

If what you do impedes the state, even if it is outwardly legal, it will impede you right back, with whatever means that seem most convenient. If you want to develop strong encryption and distribute it worldwide, your operational security had better be impeccable.

There's good reason why Bitcoin developer Satoshi is a secret pseudonym, and why the real person or people behind it should be reluctant to link their public identities with it. There would certainly be either a character assassination in the media, or an "unfortunate accident" on the streets.

There have always been men in this world more willing to serve power than to uphold principles. It hardly matters what flag patches they wear on their uniforms.

</comment></comment></comment></comment></comment></comment><comment><USER56> So what better software or hardware encryption?

</comment><comment><USER57> 1 goal: Destroy Mid-size and Small USA business 2 goal: Destroy Software, IoT, embedded software 3 strategy: 2.3.1 Stomp the grass to scare the snake 4 scope: ALL business uses encryption

5 past: destroy short term crypto by brute force 6 present: destroy mid term crypto by Quantum Computing 7 future: destroy long term crypto security aka NTRU

8 open source: sel4 proved secure and safe 9 open source: Post-Quantum Cryptography NTRU 10 open source: secure against D-Wwaavve Goooogle cracking.

11 crime UNnatural: Nature, internet and Cybersecurity 12 crime UNnatural: Big banksters too big to fail. 13 crime UNnatural: Scapegoat the small business software 14 tactic: firing a drone is expensive. 15 tactic: firing malware at Michael Hastings car is easy 16 pretext: Wind River Fined for Encryption Software

17 bibliography 18 --books many titles destruction of middle class USA 19 en.wikipedia.org/wiki/Thirty-Six_Stratagems 20 --[PDF]On the Cryptographic Long Term Security 21 www.scienpress.com/Upload/JAMB/Vol%203_1_1.pdf 22 [http://sel4.systems/](http://sel4.systems/) 23 [http://arxiv.org/abs/1405.2034](http://arxiv.org/abs/1405.2034) 24 [http://arxiv.org/abs/1410.8317](http://arxiv.org/abs/1410.8317) 25 --Insights from the Nature for Cybersecurity 26 --[PDF]Provably Secure LWE Encryption with Smallish Uniform ... 27 eprint.iacr.org/.../164.... 28 [https://pqcrypto2014.uwaterloo.ca/.../post- quantu..](https://pqcrypto2014.uwaterloo.ca/.../post-quantu..). 29 --[PDF]Making NTRU as Secure as Worst-Case Problems over ... 30 www.iacr.org/.../6632... 31 --Michael Hasting's Car Allegedly hacked? 32 [http://www.huffingtonpost.com/2013/06/24/michael-hastings- ca...](http://www.huffingtonpost.com/2013/06/24/michael-hastings-car- hacked_n_3492339.html)

</comment><comment><USER58> $750,000? That'll show them!</comment>


To Get Hired, Send a Video Pitch (Not a Resume) - <AUTHOR> https://crash.co/how-it-works <comment><AUTHOR> With many people in need of work (or changing careers), curious if anyone has tried a video pitch before. Or sent portfolio projects instead of a resume.

(Full disclosure I work for Crash. I love the mission and helping people).</comment>


Show HN: I built an app to help you split the tab - <AUTHOR> https://split.mrhuq.com <comment><AUTHOR> Currently it only supports splitting the expenses equally among all members of the group.

I recently went on a trip to New York with some friends and we all made miscellaneous group expenses. When we came back we used this app to figure out how much we owed each other.

If you're interested you can find the source code here: [https://github.com/radihuq/split-the-tab](https://github.com/radihuq/split- the-tab)

</comment><comment><USER2> ... I don't get it. If it's only splitting equally how is this easier than a calculator app that's already installed on every persons phone? Or, you know, having some basic ability to do simple math in your head or on a piece of paper?

<comment><AUTHOR> Yeah you're right that in my personal example using this app was overkill.

The use case I actually had in mind while developing this was continuously using this to track expenses while on the trip - that way you don't need to pull together all the receipts & verify expenses at the end of the trip

<comment><USER3> Have you heard of YSplit? [https://techcrunch.com/2019/03/13/ysplit-wants-to- make-it-so...](https://techcrunch.com/2019/03/13/ysplit-wants-to-make-it-so- you-never-owe-your-friends-money-again/)

I think it's a newer YC company, might be interesting for you to take a look at to see how yours is different/similar

<comment><AUTHOR> I haven't heard of them - looks like they're a wallet that automatically conducts pre-authorized transactions. Pretty cool. Biggest limitation I see is that they only support splitting transactions from select vendors.

I think it would be cool if they allowed you to split anything - but I guess the problem is coming up with a viable business model. If you use something like Stripe to facilitate transactions, the added fee can be pretty deterring to potential users. I'm not sure what would be the best business model for an idea like this, apart from maybe a subscription more & betting on users not actively using the product?

<comment><USER3> Hmm. Doesn't Venmo do an instant (about 2%), or 2-3 days (0%) bank transfer fee business model? Something similar might work for them. I don't know how Venmo does the free bank transfers though, that could be anything from partnerships to VC money to tech.</comment></comment></comment></comment></comment>