Popping a shell on the Oculus developer portal - <AUTHOR> https://bitquark.co.uk/blog/2014/08/31/popping_a_shell_on_the_oculus_developer_portal

<comment><USER2> If you didn't read:

This was done after Facebook announced that Oculus is a part of their Whitehat program. OP was awarded 25000$ total for finding the vulnerabilities.

Very effective.

</comment><comment><USER3> I haven't seen the BENCHMARK trick before. It's very clever - a variation on timing failed login/password attempts.

This is a clear and effective writeup. Congrats OP.

<comment><USER4> > It's very clever - a variation on timing failed login/password attempts.

Can you explain? To me it just looks like a way to prove the exploit exists without revealing any actual injections.

<comment><USER5> It's a pretty common technique for exploiting Blind SQLi. You can use this as the one of the Branches in a SELECT IF to be able to determine the value of something in the DB.

[https://www.owasp.org/index.php/Blind_SQL_Injection#Time- bas...](https://www.owasp.org/index.php/Blind_SQL_Injection#Time-based)

</comment></comment></comment><comment><USER6> I liked this. I also wonder if it'd be worthwhile for me to take a few months off of work and try just poking away at security bounty programs. I doubt it would pay off to start with, but it seems like a pretty lucrative path. I know the OWASP Top 10, but don't really know my way around Burp Suite or anything.

<comment><USER7> I don't know any program except FB with such bounties for bugs in web apps. If you want to hack for money, focus on FB forget about others.

<comment><USER8> [https://hackerone.com/programs](https://hackerone.com/programs)

<comment><USER7> Which one is profitable there?

</comment></comment></comment></comment><comment><USER9> Security researchers are some of the most banal people. But I won't argue with $25k. ;-P

<comment><USER10> I don't think so. There's creativity in hacking any server. You won't find a straight same path every time. I think security researchers are the most patient people or most determined.</comment></comment>


SiteCake: Tiny, simple, flat-file, drag and drop CMS - <AUTHOR> http://sitecake.com/

<comment><USER2> Having all kind of issues with this. Dropped in a subfolder (/var/www/html/sitecake)

The following AJAX errors are everywhere: Strict Standards: Non-static method String::insert() should not be called statically, assuming $this from incompatible context in /var/www/html/services/application/cake/libs/debugger.php on line 398

Strict Standards: Non-static method Configure::read() should not be called statically in /var/www/html/services/application/cake/basics.php on line 213

Warning (512): SQL Error: 1030: Got error 28 from storage engine [CORE/cake/libs/model/datasources/dbo_source.php, line 684]

It just doesn't work, which is a shame.

<comment><USER3> Hey how did you get this? Sitecake is not using cake, SQL or aything you've mentioned. Please download Sitecake from our webiste and try again.

<comment><USER4> Looks more like a configuration issue. The big clue is s/he dropped your code into a sub-directory but s/he's getting error in code not in that sub- directory (i.e. - not your code).

My guess is the docroot is set to /var/www/html with CakePHP server configuration.

</comment></comment></comment><comment><USER5> [http://sitecake.com/demo/](http://sitecake.com/demo/) File not found.

<comment><AUTHOR> Maybe it broke; it's designed for small sites after all... sorry, I'm new to HN. I didn't realize it'd get that much exposure that quickly. :(

<comment><USER6> Maybe a security issue? Someone from HN accessed the code?

</comment></comment></comment><comment><USER3> Sorry guys, server was overwhelmed by ProductHunt and Hacker News visits. We did demo part 'lean way' so it could not cope with uploaded content. It should work now!

</comment><comment><USER7> The basic idea is awesome. Because the demo doesn't work: Do you support markdown text? Or is it a wysiwig editor that expects you to click buttons above the text editor to get something formatted?

<comment><USER8> Something like a wysiwig editor. I didn't tried markdown, but it didn't look like supporting it. Small change was pretty easy to make but I didn't play with bigger changes or dropping something more heavy.

I guess we will see when the demo is back online or you can install it somewhere to try it out. It looked pretty good.

</comment></comment><comment><USER9> In the first code block (how to install) you have the "pretty" (") quote style rather than just ".

<comment><AUTHOR> Just to be clear, I'm not the original author. It's just something I've been using with success for mom & pop style websites and felt it was underexposed for being so simple (and free to boot).

<comment><USER10> Once I read it I thought this is exactly what I would use for friend projects. Personally I find most web tech to be a horrible hack and don't enjoy working on it. This would be quick and easy and allows me to just hand off quickly.

</comment></comment></comment><comment><USER11> DEMO: File not found.

</comment><comment><USER12> This didn't seem like much of a CMS to me, more like an editor.

</comment><comment><USER3> We wanted to stay simple as possible and use wide spread technologies. So HTML pages for templates, PHP for server side, file system for storage and drag and drop for editing.

</comment><comment><USER13> Cool, how does it work?

<comment><AUTHOR> Basically you just mark out some <div> tags as class="sc-content", and they'll become drag&drop WYSIWYG editable. The changes get written right back into the file, so you don't need anything other than PHP 5.4 and write permissions. You can even remove the SiteCake file again, and your site will just keep working (as static HTML).

<comment><USER13> Amazing, thanks for this. This is one of the rare cases when PHP as a language shines for a use-case like this.

</comment></comment></comment><comment><USER14> It is me or does this feel like WordPress?

</comment><comment><USER15> Remember it still requires a PHP application server to run with how exploitable (and often heavy) PHP is - I'd be hesitant to call it 'simple'.

<comment><USER16> Do you have examples of PHP's exportability and heaviness, or are you just repeating words?

<comment><USER15> Sure, not exactly hard to find though...

\- [http://www.theregister.co.uk/2014/12/31/want_to_have_your_se...](http://www.theregister.co.uk/2014/12/31/want_to_have_your_server_pwned_easy_run_php/)

\- "Over 78% of PHP installs are insecure" \- [http://blog.ircmaxell.com/2014/12/php-install- statistics.htm...](http://blog.ircmaxell.com/2014/12/php-install- statistics.html)

\- [http://stackoverflow.com/a/1567392](http://stackoverflow.com/a/1567392)

<comment><USER16> Note that the theregister.co.uk link points back to ircmaxell's blog.

The SO link is for an answer from 2009, pointing to an email from 2006.

ircmaxell's blog is spot on - if you actually bother to read what it says. Not keeping a very important part of a webserver up to date with security releases is insecure. Is that a surprise to you, or anyone?

Is Windows or OSX or Linux insecure because they have security patches coming out all the time? What's insecure is user behavior when they keep running old, unpatched versions of software.

You're spreading FUD, repeating words and showing links without actually taking the time to understand the message they are trying to convey.

Case in point: PHP being "heavy". A PHP app can be as lightweight or as heavy as you need it to be. The more you build and the more it does, the "heavier" it becomes. If you throw a proper caching solution at a codebase, it becomes much better, but this is true for anything.

Look at the TechEmpower Benchmarks [0] - PHP raw is usually towards the middle, upper-middle of the pack. Of course, it gets handily beaten by compiled and multi-threaded languages.

[0] [https://www.techempower.com/benchmarks/](https://www.techempower.com/benchmarks/)</comment></comment></comment></comment>


A majority of auto executives still think battery electric cars will fail - <AUTHOR> https://electrek.co/2018/01/08/auto-executives-battery-electric-cars-fail-survey/ <comment><USER2> If Toyota releases their Stan Meyer tech than fuel cells will most likely win. The only way to compete with that would be to release permanent batteries.</comment>


Her Task Is to Wean the White House Off Floppy Disks - <AUTHOR> http://www.nytimes.com/2015/01/04/us/politics/her-task-weaning-the-white-house-off-floppy-disks.html <comment><USER2> Article jumped the shark for me with the following gem:

"... she uses a 2013 Dell laptop: new by government standards, but clunky enough compared with the cutting-edge devices of her former life that her young son asked what it was."

I'm sorry, but while other forms of technology are rapidly replacing laptops, they are still the dominant mobile productivity workhorses (unless you count things like tweeting and facebook as productivity tasks). This quote implies that laptops are so out-of-date that the child of a well-off tech worker wouldn't know what they are, akin to VHS players and cassette tapes. Ridiculous.

Also, by whose standard _isn 't_ a ~1-2 year old laptop new?

<comment><USER3> My guess is not that they are talking about just any 2013 Dell laptop, but that she is referring to something that is not of "ultrabook" standards of appearance and (probably) battery life optimization.

My impression of government hardware purchasing is that even while newer _consumer_ models of laptops have managed to be lighter weight, have better battery life, and so on, they haven't met the litany of requirements needed for the government. She probably has a semi-custom Dell Latitude, which while a workhorse, is big and clunky and has less than desirable battery life. Oh and the screen resolution is probably 1366x768. Compare that to any ultrabook one could acquire today with a greater than HD quality display.

My guess is that her son is confused because before then she probably did most of her work with a Macbook Air, an ultrabook (perhaps even a Dell XPS), or even a Chromebook Pixel. These are all thinner, lighter, and with greater battery life. And they probably don't check the boxes the government wanted.

<comment><USER2> That's a good guess ... but I still think there's a bit of hyperbole going on. I'd think a gigantor-laptop would be similar enough to an ultrabook that the kid would figure it out. If I recast the question of 'what it was' to 'what _is_ that hunk-of-junk looking laptop?', then I guess I could believe it.

On that topic ... many of the chunky plastic boxes are actually _great_ machines. We have a choice from a few machines at work ... and almost no engineers choose an ultrabook. While ultrabooks are good for some things (watching videos, basic productivity like word, small excel workbooks, etc.), I wouldn't want to compile an operating system on one. I have a gigantic brick of a 'laptop' at work (I think it's a Precision M6700), and I wouldn't trade it for anything. It's nice to be able to slap it on and off a dock, to be able to connect it to four monitors without any janky USB video cards, and to be able to install tons of RAM.

<comment><USER4> > I wouldn't want to compile an operating system on one

The number of laptop users that actually "compile an operating system" are relatively small. This seems like a poor choice for an example.

<comment><USER5> I compile operating systems on a 2010 ThinkPad.

It's not fantastic for today's standards, but it's not terrible either.

<comment><USER6> I compiled operating systems (linux) on my clunky 486/100 MHz laptop 19 years ago. Ditto.

</comment></comment></comment></comment></comment></comment><comment><USER7> "I wish they had people in there for this last two years that could make the trains run on time, not somebody who has big ideas"

We need both. The conundrum is that improvements are done through constant iteration and ideation. Government implementation is plagued by fear of fiat and fear of failure. The implementers need to be protected by the big idea people from the skeptics.

</comment><comment><USER8> Floppy disks actually provide a rather pleasant form factor. It's large enough to feel meaningful, wide enough to not get lost between other objects, flat enough to be included in a binder with printed material. The only downsides are transfer speed, data capacity, and lifespan.

<comment><USER9> They're also AFAIK the only removable magnetic disk format that has been standardised (see ECMA-125), is completely open, and the drives are "dumb and simple" so they can't hide malware in the same way that the firmware of USB drives, hard drives, and optical drives can. From the point of view of openness and simplicity, the floppy has some advantages.

<comment><USER10> >so they can't hide malware in the same way that the firmware of USB drives, hard drives, and optical drives can.

Unless you boot the machine with the floppy in the drive. Oh, boot sector viruses!

<comment><USER11> > Unless you boot the machine with the floppy in the drive. Oh, boot sector > viruses!

That's a BIOS configuration issue.

And, if the attacker can control the BIOS, in the words of Bokosuka Wars, "WOW! YOU LOSE!"

[http://darkscarfy.tripod.com/bokosuka/bokosuka.shtml](http://darkscarfy.tripod.com/bokosuka/bokosuka.shtml)

</comment></comment></comment></comment><comment><USER12> What's wrong with floppy disks?

For certain kinds of highly sensitive information transport, a floppy disk is probably a better idea than a flash drive.

I suppose you could use CDs, but floppy disks seem easier to destroy.

<comment><USER13> What's not wrong with them? Terrible write speed. Terrible read spead. Exceptionally low information density. High error rates. Short lifespan.

<comment><USER14> For some communication channels, these are potential strengths. For the same reason why some rooms have small doors and some rooms have loading docks.

<comment><USER15> An encrypted flash drive is probably better than security through inconvenience or unreliability.

<comment><USER14> Error-correcting codes can help with reliability.

Rate-limiting is appropriate for some use cases.

Floppies don't have firmware to attack your PC: [http://www.extremetech.com/extreme/191467-badusb-returns- hac...](http://www.extremetech.com/extreme/191467-badusb-returns-hackers- publish-code-that-could-infect-millions-of-usb-devices)

</comment></comment></comment></comment></comment><comment><USER16> I find it funny how we're mostly nitpicking over something the author probably didn't spend more than 3 seconds about and are missing what most of the article's even about, including the usually inflammatory women-in-tech initiatives she's trying to jump start in the region.

I don't think it's such a big deal for someone in her position to have such a laptop mostly because she's not exactly going to fix the default constant of failure in government IT and software by coding. She'll probably have a docking station and she can probably afford a decent monitor from there.

Best of luck, but I really hate to see people thrown to the wolves like this politically by being the first in a position with such little political backing to support them. I'll say that she's done her job admirably well when my mother in law knows about her position and staunchly opposes it (she'd vote for a cat if it was Republican and Reagan was on a Democrat ballot, I think she literally said that).

</comment><comment><USER17> This strikes me as a use case where something like the USB-Armory might be really well suited. It was recently shown at 31.CCC:

[https://events.ccc.de/congress/2014/Fahrplan/events/6541.htm...](https://events.ccc.de/congress/2014/Fahrplan/events/6541.html)

</comment><comment><USER18> Meh, it jumped the shark for me in the first two paragraphs.

"We would never say that about reading."

Now this is just a hunch, but I'm guessing most highly educated people have used their reading skills on a regular basis since school as compared to, say, what they learned in Calc III.

</comment><comment><USER19> Interesting that the US now has a Digital Service similar to the "(UK) Government Data Service" [https://gds.blog.gov.uk/](https://gds.blog.gov.uk/)

Those folks have done some _incredible work_ over the last few years with no sign of letting up.</comment>


Wintergatan – Marble Machine (music instrument using 2000 marbles) - <AUTHOR> https://www.youtube.com/watch?v=IvUU8joBb1Q <comment><USER2> I'm trying to decide if this is an incredible work of art, or an elaborate waste of his time. The music was top-notch either way and it's ingenious in any regard...

<comment><USER3> Can't you apply that to any project that doesn't immediately give returns?</comment></comment>


Ask HN: What are the best alternatives to Google AdSense? - <AUTHOR>

AdSense's main appeal seems to be that its easy, automatic, usually-relevant text advertising for virtually any market.<p>Are there good alternatives? Better at providing relevant ads? Higher quality advertisers? Less commoditized, better paying? <comment><USER2> I have tried many from Kontera to Chitika. IMO there is no good alternative(in terms of payment) for adsense yet.

<comment><USER3> I completely agree to this...nothing comes as close to Adsense in terms of everything.

</comment></comment><comment><USER4> Just saw this post today actually: [http://www.ginktage.com/2010/12/top-2-google-adsense- alterna...](http://www.ginktage.com/2010/12/top-2-google-adsense-alternatives- for-blogs-targetting-microsoft-technologies/)

This is what they recommend:

1\. Lakequincy.com - Lake Quincy Media provides a network of publishers targeted exclusively to Microsoft developers. It represents some community sites like EggHeadCafe, Microsoft ASP.NET and ASPAlliance.com.

2\. TheLoungeNet - TheLoungeNet hosted by Zerk Media is another Advertising Network focussed on Microsoft Technologies.

</comment><comment><USER5> It depends a lot on how you want to implement advertising on your site. I think running affiliate links via CJ is a much better way to go, especially if you have the ability to incorporate them into your site tactically so that they are value adds and not distractions. Keep your eye out for lead gen programs as well, they often pay on sign ups as well as sales meaning they can have significant returns.

</comment><comment><USER6> I don't have any personal experience with online ads, but this seems like a good link to jump-start the conversation: <http://www.rosswalker.co.uk/adsense_top10/>

<http://www.adsensealternatives.org/>

<comment><USER5> Of all the options listed in those two articles Kontera is the only one I have seen generate a decent return.

</comment></comment><comment><USER7> I wrote this for my own use: <http://demo.qontex.com/>

It does contextual affiliate ads. I've found the returns are much better than adsense.

</comment><comment><USER8> Adsense is great when you don't know any demographics about who your website audience is. Once you do know, however, you can make a hell of a lot more with targeted affiliate offers.</comment>


Numerai, a hedge fund built by a community of anonymous data scientists - <AUTHOR> https://medium.com/@Numerai/7b208deec5f0 <comment><USER2> Some thoughts on the business model:

* traditional hedge funds have a problem with scaling: if you put more money in the same strategy returns go down. Numerai hopes to scale the number of strategies it employs by scaling the number of researchers participating.

* by providing researchers only opaque streams of data, they prevent researchers from leaving and competing directly. If you don't know how the data corresponds to the market, you can't replicate the trading at another fund. (Some big hedge funds like D.E.Shaw do the same!)

* researchers may still leave and compete indirectly, using the same algorithms on different market features. But by paying anonymously in bitcoin, Numerai may be hoping for the reverse, that programmers from other quant funds will anonymously moonlight for Numerai using their algorithms from those other funds.

* by being opaque with the data, Numerai keeps researchers from knowing the true value their strategies are providing. That information asymmetry is in Numerai's favor, letting them underpay even strong performers.

</comment><comment><USER3> Quant fund insider here.

The data is pretty pure, in the sense of not telling you any metadata at all. It's literally just a bunch of numbers and 0/1 labels.

It's hard to implement a strategy without knowing what exactly you're looking at. I get the feeling this "pure dataset" is part of some framework that Numerai thinks will beat the market, given good predictors.

That's not necessarily the case. Say I assume the 0/1 means up/down over some period. Well, being able to guess 0/1 correctly would obviously help. Say I'm right 70% of the time, then I can equal weight my bets and it will be just swell. But say I'm right about 51% of the time. Then it's going to take quite a while longer for the law of large numbers to work in my favour. Remember your ML algo will only be able to give you good predictions if some of the 21 features are actually meaningful, and we have no reason to think they are actually meaningful.

Now, let's say I have some domain knowledge in finance. I want to predict over/underachievement relatively. I would be able to guess which shares go up relative to others, but not the market factor. That would require a different framework to the one I'm supposing is presented here. Is there flexibility for that?

The secrecy thing makes me wonder, too. If it's just a matter of not showing your work, why don't you just have a website where people submit their daily/weekly/monthly portfolios and you keep track of the tally?

<comment><USER4> > Say I'm right 70% of the time, then I can equal weight my bets and it will > be just swell. But say I'm right about 51% of the time. Then it's going to > take quite a while longer for the law of large numbers to work in my favour.

That's actually very far from being true. If you trade a single instrument, sure, the variance will kill you in anything but the very long run. But if you trade thousands of securities (like say, the entire US equity market), then a 55% prediction ratio and a market neutral strategy will absolutely crush. Even if you blindly buy/sell on every signal without doing any sort of weighing (excluding low confidence predictions, etc), then you should see a several sigma strategy.

It only takes a very, very small edge to make a very low risk strategy if you can diversify.

[https://en.wikipedia.org/wiki/Signal_averaging](https://en.wikipedia.org/wiki/Signal_averaging)

Now add on top of that the fact they will have _several_ low SNR prediction signals, and the effects of signal averaging become even greater

I'm also a "quant fund insider", as you put it...

<comment><USER3> Yes, Taleb did the actual calculation in one of his books. I'm exaggerating because if I say it's 50.01% it will cause head scratching.

</comment></comment></comment><comment><USER5> I'm skeptical. There are skyscrapers in NYC's, Londons, Singapores and Hong Kong's of this world filled with people who are smart and have enormous computer resources and funds and are paid handsomely to work on solving this problem with all manners of ML and AI at their disposal, the "crowd" has no advantage over them. The "closed system" is much larger than the "crowd" in this case.

<comment><USER6> I don't think this is true at all. 10,000 people are just going to have more ideas and better individual ideas than 100 experts. The impact of that much creativity and perspective can be exponential, and it's hard to duplicate.

When I'm designing a system, I hate to have to try to out think everyone on the internet. If you have a known set of opponents you can predict what they might do. When you're up against anybody from anywhere, you never know what you're going to get. Global scale collaboration is a very powerful thing because it allows a complete exploration of the solution space, and it's difficult to stop.

<comment><USER7> I absolutely disagree. I'll take the word of 100 experts over 10,000 amateurs.

<comment><USER8> Examples of the word of 10,000 amateurs:

* Anti-vaxxers

* The healing power of crystals

* Moon landing conspiracy nuts

* Multi-level marketing

<comment><USER9> There are also 'experts' in these fields, so your point is moot.

<comment><USER10> OK, but how many physicists support the moon landing conspiracy? How many aerospace engineers support the moon landing conspiracy? What credentials do the experts of the moon landing conspiracy have that I should trust?

I think he has a valid point if you have bias in which experts you place trust. There are, in fact, a lot of experts -- and even academically tenured, credentialed, published experts -- that I agree, don't have much of anything worthwhile to say.

<comment><USER9> Ya, true. There are particular areas though where 'wisdom of the crowds' works much better than any expert, and then there are obviously areas where it does not.

I'm not sure exactly what the properties of each type of problem are, but it doesn't seem at all obvious to me that stock picking is not one in which a sort of herd optimization approach might be very effective.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> "It is intuitively obvious that an open access hedge fund will generate more intelligence than a closed system built on a pre-internet, pre-cryptocurrency, pre-AI organizational design."

Really? Because the folks with the magic black box aren't capable of funding an Interactive Brokers account to keep 100% of their upside and 100% of their IP?

(Also: risk management and order handling are harder problems than signal generation.)

<comment><USER12> Isn't that the magic of OSS? Linux::Windows, matplotlib::mathematica, android::iPhone, etc. In each case, the free variety quickly catches up to the proprietary version, and in doing so, cuts into the profitability of the parent. Furthermore, this often breaks down monopolies, as they must innovate or die.

<comment><USER13> Matplotlib covers a tiny spec of a footnote of Mathematica's functionality. SageMath (a composition of Numpy, Scipy, Sympy, matplotlib, R, etc.) is a more appropriate analogy.

</comment></comment></comment><comment><USER14> I started poking at this out of curiosity, and a desire to begin sharpening my TensorFlow axe, and one thing remains unclear. They give you two spreadsheets, one being the training data and the other is the tournament data (what you need to predict on). Each entry in the spreadsheet is 21 features and a single binary class. The latter is what you predict. But for the submissions they request a probability, not a class. They don't explain what "probability" here means. Does it mean probability of class 0? Probability of class 1? Probability of the moon exploding on a Thursday?

Overall interesting idea. Undecided whether it's real/scam/fake, but definitely very interesting at face value. I just wish their documentation was more clear. Seems kind of important...

EDIT: Found a comment on Reddit that indicates that it means probability of class 1 ([https://www.reddit.com/r/MachineLearning/comments/3wdr9e/num...](https://www.reddit.com/r/MachineLearning/comments/3wdr9e/numerai_a_global_ai_tournament_to_predict_the/cyathv5))

<comment><USER15> Have you found any good TensorFlow examples which handle financial or time series data like this? Please do share! Most of the examples I find are either image processing or text processing. Rarely time series or traditional DB type data.

<comment><USER16> Generally people use a LTSM for time series if they want to use a NN approach.

See [http://robromijnders.github.io/LSTM_tsc/](http://robromijnders.github.io/LSTM_tsc/)

</comment></comment></comment><comment><USER17> Numerai comes across as fraudulently abusing cryptographic buzzwords like homomorphic encryption [https://medium.com/@Numerai/encrypted-data-for- efficient-mar...](https://medium.com/@Numerai/encrypted-data-for-efficient- markets-fffbe9743ba8#.ifdtksq5o)

<comment><USER18> Yes, they still haven't replied to a question about this.

[https://www.reddit.com/r/Bitcoin/comments/4p5xgx/ai_hedge_fu...](https://www.reddit.com/r/Bitcoin/comments/4p5xgx/ai_hedge_fund_predictions_using_bitcoin/d4il1xz)

Based off that article they don't seem to understand the homomorphic in homomorphic encryption.

The mix of technical BS and seemingly expert advisers is weird.

</comment></comment><comment><USER19> Understanding which features to create and why is significantly more impactful than just trying new models on the same dataset.

</comment><comment><USER20> > Numerai was seed funded by Howard L. Morgan the co-founder of Renaissance > Technologies.

Very interesting. This gives this idea some legitimacy in my opinion.

<comment><USER21> Very much agreed.

For those who are not aware, Renaissance Technologies is a massively successful hedge fund that makes investment decisions solely from data, with perhaps the most sophisticated mathematical models in the marketplace.

Their approach was entirely novel when James Simons founded the firm. Simons is incredible mathematician, graduated MIT in his teens, and obtained his doctorate at 23. Before and during Renaissance, he made significant contributions to cryptology, topology, and string theory.

His firm essentially invented quantitative trading. To this day, with close to $30 Billion under management, Renaissance Technologies still makes investment decisions purely algorithmically.

<comment><USER22> To provide a counterexample, P/NP was doing quantitative trading before RenTech. I will say that I wouldn't comment on implementation details in this industry unless I've worked at the company in question.

<comment><USER21> That's fair. It was not my intention to provide a comprehensive review of the firm's approach, but rather a quick summary that glosses over a great many details.

To address your second point, I wouldn't comment on implementation details in a company for whom I _had_ worked.

P/NP is Princeton Newport Partners. I have a passing familiarity with that story ;)

<comment><USER22> I agree. I wouldn't do that either.

</comment></comment></comment></comment></comment><comment><USER23> This is where the "accredited investor" warnings are appropriate. _Don 't do this with your money if you aren't willing and able to lose it!_

In the long run, it's impossible for people to beat the market simply by looking at historic stock prices. _Impossible_. If it is possible in the short run, more and more people will do it until they don't make any money at all, or a "black swan" event occurs and they go completely bankrupt. (I suppose there's a third option, that they all make so much money that the entire rest of the world goes bankrupt, but that's absurd)

So be careful!

</comment><comment><USER24> As Peter Thiel says, great startup founders are those which can see the future in ways in which others can't. This idea certainly looks like the future to me. Very interested to see where this goes.

</comment><comment><USER25> So cool. This is the first time I've heard of homomorphic encryption. In my case, Open Listings has a lot of real estate data that we're not allowed to vend programmatically (sale prices, list prices, property characteristics). It would be interesting to be able to release this data in a legally encrypted form and let data scientists train predictors. We currently have an offer creation API that's being used by algorithmic investors but they have to get their data to decide what to bid on from another source. My immediate questions maybe someone here will know the answer to...

1) Is it legal to vend a dataset that is encrypted this way if you're not allowed to vend the original? The OP implies that it is, but that seems too good to be true.

2) Is there software purpose-built for this type of thing? What's good in this domain? Our stack is mostly ruby but we're polyglots.

</comment><comment><USER26> So in exchange for giving a hedge fund a stock tip that earns 20% in a month, the guy gets $10k? That sounds like a ripoff to me! If you have the skills to do that repeatedly you can make a whole lot more than $10k doing the trades yourself.

<comment><USER27> The point is that you probably can't do it repeatedly, or predict with any confidence that you can even do it once. Numerai enables you to bet using someone else's money, with a vastly reduced reward, but no risk to you.

Numerai won this time (hence the PR piece) but I don't think we should judge their performance on one action in isolation. We should judge whether their approach works based on a year or two of trading on these predictions. Maybe longer, if reacting to unusual events (economic collapse, freak speculation on tulips, etc) is something you care about.

<comment><USER28> Plus, Numerai gives them opaque features for ML training that correspond to real-life data in ways that only Numerai knows. So you can't bail and use your model on your own.

</comment></comment></comment><comment><USER29> Interesting idea. Not that crowd driven investment algorithms are new, but I have not seen a machine learning one before.

What really ennoys me about this kind of businesses is that they pay tiny prices and shut the competitions once they have found what they were looking for, however Numerai might be completely different in that regard and I wish them the best!

Btw: The article kind of conveys the feeling as if machine learning is something new to the hedge fund business and that's absolutely not the case. There are already smart people working on really complex algorithms since a couple of years now.

<comment><USER30> Even more than "a couple of years". About 15 years ago I worked at a day trading firm and we were writing models that used machine learning. At the time we thought of it more as "computational statistics", but its basically what is called ML now and taught in ML courses (although we didn't use Neural Nets).

BTW, even in 2001 we were far from the first to do this.

<comment> T-A Depending on where you draw the line between statistics and machine learning, it could be argued to have originated with Bachelier's thesis in 1900 [1], or Thorp's adaptation of Kelly's work first to gambling and then to finance in the early 60s (he may have been first to use computers for this kind of thing) [2] or maybe with James Simons' Renaissance Technologies in the early 80s [3].

[1] [https://en.wikipedia.org/wiki/Louis_Bachelier](https://en.wikipedia.org/wiki/Louis_Bachelier)

[2] [https://en.wikipedia.org/wiki/Edward_O._Thorp](https://en.wikipedia.org/wiki/Edward_O._Thorp)

[3] [https://en.wikipedia.org/wiki/Renaissance_Technologies](https://en.wikipedia.org/wiki/Renaissance_Technologies)

<comment><USER31> Regarding Rentec, the only decent book on their history has been in "The Quants". Are there any others?

[https://www.amazon.com/Quants-Whizzes-Conquered-Street- Destr...](https://www.amazon.com/Quants-Whizzes-Conquered-Street- Destroyed/dp/0307453383)

</comment></comment></comment></comment><comment><USER32> _When you're standing at the beginning of a super exponential curve, that's the time to buy insurance against any negative outcomes along that curve. So today, we're allowing users to donate Bitcoin to the Machine Intelligence Research Institute (MIRI) as a hedge against things going horribly right._

If you're the kind of person that falls for this kind if thing, then you should know I'm also standing in front of a super exponential curve raised to the power of infinity and beyond. You can also send me bitcoin as a hedge if you wish.

</comment><comment><USER33> I've been looking at this a few times. Its like a giant ensemble. But I'm not sure ML will be able to beat chance on average on a data source like this.

And if someone discovers they are making money consistently on numerai, I think they would set up their own fund quite quickly.

I do like the encrypted system though, could be used for other ML competitions where you don't want to give your model away

<comment><USER34> I know why they're paying out Bitcoin and keeping everything anonymous. They are hoping quant hedge fund insiders submit their model to the site.

<comment><USER33> You don't submit a model, just results

</comment></comment></comment><comment><USER35> But _why_ did the machine want to go long Salmar ASA?

<comment><USER36> Does it matter? The machine saw a pattern, and it responded to the pattern. We don't need to know.

<comment><USER37> If the machine is "anonymous", it does matter. Scenario #1: A human gets insider information that a Solar City will be bought. Makes his anonymous "AI machine" predict that Solar City is a great stock to buy!

<comment><USER38> That's not possible. The data is encrypted. None of the participants can see which stocks (or anything) about the data they train with. Numerai turns stock prediction into a pure ML problem.

<comment><USER39> Doesn't the encrypted chart still need to display price history or volume? If so it seems like it'd be a trivial task to match it up with its real-world counterpart.

<comment><USER40> It would be easy to match an obfuscated stock market dataset with some third party dataset, and this has happened on many Kaggle competitions (data leaks). That's why the encryption here is important.

<comment><USER41> But how do you encrypt a stock's historical performance without removing the information (performs better in summer, went up after 9/11…) hidden inside it?

You can add noise, but I doubt that will be enough.</comment></comment></comment></comment></comment></comment></comment>


The Improbable Success of the Curveball - <AUTHOR> https://lithub.com/the-history-behind-baseballs-weirdest-pitch/ <comment><USER2> This story eloquently captures what it is that people who like baseball really like about baseball. It's a game of small elements and subtle differences. It's not a game of force against force or jamming a ball into the place it needs to go. It's about secrecy and expectation, experience and intuition and how to subvert them.

I'm not really a baseball fan myself. The things that fans love seem to require intimacy; it's not something I could acquire with casual acquaintance. But I think the story presents a compelling case why that acquaintance could be worth developing.</comment>


Ask HN: mobile development with Phonegap vs. native? - <AUTHOR>

Pretty straightforward story here: Android dev here looking to make a CRUD-type application that can deploy to the iOS platform as well. Seems like PhoneGap might do the trick.
What are your experiences with Phonegap? Is it generally permissibe for making enterprise mobile applications? What features could be missing? Why doesn't everyone use Phonegap if it can deploy to multiple platforms?
Cheers <comment><USER2> >What are your experiences with Phonegap?

I started very early in PhoneGap. Keeping up with the changes as the product has matured has been a pain, but expected. You'll be glad it's pretty mature at this point.

That said, starting with v3.0 the move to NPM has taken development reliability back a few steps in my opinion. I like the new command line interface, I just wish it worked more consistently. I'm sure it will get better.

>Is it generally permissibe for making enterprise mobile applications?

That's what I use it for. It works well for this purpose. I wouldn't use it for B2C apps though, especially for Android because the browser on Android performs poorly, especially for scrolling - very laggy and spastic.

>What features could be missing?

There are a lot of plugins that fill in the gaps. I don't recall not being able to do something a native app could do. I've used, the GPS, photo gallery, camera, enabled "Open In", FileTransfer, media recording, and probably a few other plugins.

>Why doesn't everyone use Phonegap if it can deploy to multiple platforms?

Because there are other platforms that could be used. If C# is your thing, you could check out [http://xamarin.com](http://xamarin.com) With that you could write apps in a MVVM style and reuse your ViewModels in a PCL that could be reused across Windows Phone, Android, and iOS.

The thing is, mobile apps are now typically an extension of a web app, so if you already have web developers then PhoneGap gets you there faster. The end result will be a good product, but will never be a truly great product.

</comment><comment><USER3> In my limited experience, PhoneGap is good for getting a quick proof-of- concept up and running on a few platforms or for wrapping basic mobile HTML sites in a native wrapper. Once you start using native functionality (camera, accelerometer, location, etc), you'll find that you have to customize your code for each platform. You will likely hit the biggest wall when you want to do notifications. That's where I gave up on it and went native, so to speak.

<comment><USER4> There is already something like Notification as a Service. You can push notification to iOS, Android, Windows Phone, Windows desktop, Mac OS and even to all browsers.

check [http://push.io/](http://push.io/)

</comment></comment><comment><USER5> We had to make the same choice a couple months ago with my startup. After some feedback from native & phonegap developers and building a quick prototype with Phonegap we went with native.

Basically Phonegap is cool if you want something for both platforms pretty fast and the UI is not too complex (works well for showroom apps for example). However, performance might be an issue (especially since iOS throttles Webkit outsides of safari), and I've heard that you'd more or less need to use pure JS since existing frameworks (e.g. Sencha) would be too slow. Last thing is that you'd generally still need to write 5-15% of native code for your app, depending on its complexity (again, haven't been far enough but got it from devs who use Phonegap for most of their apps).

</comment><comment><USER6> I had to revert from Phonegap to Java (native/android) for eCommerce mobile app when I found that I had to write too many "plugins" and tweaks to Phonegap to accomplish what i need.

Phonegap and alike "wrappers" are ok if you have general purpose type of app.

But if you need more optimizations for high performance, or fine grained "under the hood" control - native is the best/only way to go.

Otherwise you're risking to find yourself spending too much time trying to squeeze square peg into round hole.

</comment><comment><USER7> Have you seen Steroids.js?

[http://www.appgyver.com/steroids](http://www.appgyver.com/steroids)

Check out the video on that page, it uses PhoneGap and the results are pretty impressive.

</comment><comment><USER8> From what you are describing, phonegap would work really well. Easier to maintain that ways. You would need to get into more specifics to work out what features you may miss, but for a CRUD, it should work out well.

</comment><comment><USER9> For iOS Users in particular when someone tells us their app is "Native" we expect it to be just that! Not a website wrapped in some native code. Further more wrapping your web app in native code is a good way to get you picked on in reviews. No one likes it. We want it designed for the device we are running on. Not something that was put together for to simply check something off a list.</comment>


Show HN: Stay with founders in San Francisco - <AUTHOR> https://www.staywithfounders.com/ <comment><USER2> I would be more happy if there was a stay with "Builders" alternative. I would love to live around with technically smart people who are building something on their own rather than "founders"

<comment><USER3> There is just something with "staying with founders" that feels so pretentious...

<comment><USER4> A meta startup; a startup making money from other startup founders... Sounds parasitic...

<comment><USER2> The whole Digital Nomad fad works similarly

</comment></comment></comment></comment><comment><USER5> Seems cool.

But honest question here. Who cares about staying with founders? Why is that a benefit? Founders of another wave of generic startups don't seem like the most interesting people

<comment><USER6> People that value ambition, drive, maybe want to pursue their own start-up and want to pick someone's brain? I stayed in San Fransisco last year and while my BnB host was great, I didn't really get the feel that San Fransisco was "the" start-up city in the world, which it is. I thought of it more like a very European city-thing with functional public transport and _a lot_ of homeless people. I walked by Twitter's office though. Other than that, networking?

<comment><USER7> > functional public transport

San Francisco? The city that had to invent Uber because it's so hard to get around otherwise?

<comment><USER6> Compared to other cities I traveled to in the USA? Yes.

</comment></comment></comment></comment><comment><USER8> Interesting! Seems like something that fits nicely between the chaotic couchsurfing.com free for all and pricey soulless Airbnbs.

Does anyone know how the pricing compares with airbnb? Could be handy for early/young founders coming to SF to pitch investors for the first time.

<comment><AUTHOR> Hey Chris! We usually end up being a bit cheaper than Airbnb, since the hosts on here aren't trying to make a profit, but just cover their costs and meet awesome people.

<comment><USER9> > ... and meet awesome people

what if I'm not awesome? would the hosts still want to meet me? what if I don't have anything interesting to say and I'm just a mediocre shlub?

<comment><USER10> You and me both. Let's start www.staywithshlub.com but in Kansas.

<comment><USER8> If you want to meet my awesome parents they have some empty bedrooms in their house in Kansas!

</comment></comment></comment></comment></comment><comment><USER11> Fantastic idea. I've been doing this for various musicians & stage actors (free) for a few years and it's been very rewarding.

<comment><USER12> Cool! As a musician myself, i've Often thought of hosting like this. How did you make first contact?

</comment></comment><comment><USER13> Great idea - just signed up. I'd make it more clear up front that the signup questions are short and simple. I was pleasantly surprised that it didn't drag on.

<comment><AUTHOR> Thanks for the feedback! Added a little note that it only takes two minutes :)

</comment></comment><comment><USER14> Very cool - Airbnb feels like it got overrun by professional property managers, cool to see a more personal alternative with a genuine community.

<comment><USER15> Also, it's something like $300/night on average these days in SF, which is bananas.

<comment><AUTHOR> It's insane. One of our core hypotheses is that a lot of people in SF don't want/need to rent out their rooms for a profit. They'd rather just meet and host particularly awesome people.

<comment><USER16> > One of our core hypotheses is that a lot of people in SF don't want/need to > rent out their rooms for a profit. They'd rather just meet and host > particularly awesome people.

hmmm, I think "a lot of people" referred to above is actually the group of startup founders with a room to rent? In which case probably not a lot per se?

Is this a side project or a product? If it's a product it doesn't seem like it will "scale" (sorry to use that lingo).

<comment><AUTHOR> Many good products start as a side project :)

Yeah, that's definitely a concern we've heard. We're starting with startup founders because that's a niche we know well, but it can work for any frequently traveling professional.

There's a big tailwind for more people traveling for work and working remotely, and staying 1+ weeks in a hotel/Airbnb is prohibitively expensive. There are startups working on solving this by creating their own custom spaces, but we know tons of people who just leave their room unoccupied because they don't want to deal with minor hassles like key exchange, cleanings, making sure the temporary visitors get along with roommates, etc. We think solving all that will open up a massive new supply of short to medium term housing.

</comment></comment></comment></comment></comment><comment><USER17> Can you add direct link to their startups website or app from their profile? Only name is there and many are having too generic name and its difficult to find their website/app.

</comment><comment><USER18> A few years back there was a start-up doing something similar called StartupStay a.k.a BiZpora ( [https://www.crunchbase.com/organization/bizpora](https://www.crunchbase.com/organization/bizpora)). I hosted some founders in London, it was a great experience and I made some friends. I am glad this is being looked into in SF! All the best with it!

<comment><USER19> Pretty cool, thanks for sharing this. If you're up for hosting founders in London again, let us know :) we're looking to expand to other cities soon.

</comment></comment><comment> 100-xyz Hi, This is very timely for us as we will be in the Bay area during Dec and Jan. However, I am not able to fill out or even see any forms. I live in China, so perhaps some js libraries from google etc are blocked? Any alternate ways to register? Our company website [http://www.100-xyz.com](http://www.100-xyz.com) Tx

<comment><AUTHOR> Sure! Here's a direct link to the application form: [https://swapspace.typeform.com/to/Bg59Xe](https://swapspace.typeform.com/to/Bg59Xe)

If that doesn't work, send me an email (it's in my hacker news profile).

<comment><USER20> Just doing a little test to see if typeform have closed the little vuln I submitted months ago: [https://testytest.typeform.com/to/Bg59Xe](https://testytest.typeform.com/to/Bg59Xe)

<comment><USER20> ... appears not. People can still pose as others. You'd think they'd care a bit more about security after the hack in June. I recommend against using typeform for this reason.

<comment><AUTHOR> Woah, crazy. Thanks for pointing this out...

</comment></comment></comment></comment></comment><comment><USER21> Looks cool! I've been lucky to have found places for my visitors through my networks in the past and they had a great time meeting startup people in SF.

I wondered if we can advertise the idea of "meeting interesting people" as a perk for our potential interns. However it's hard to be sure it's reproducible.

<comment><USER19> For sure - we're trying to be really thoughtful of maintaining the high quality community aspect. We're actually experimenting with student internships, and have a pilot with MIT for their January externship.

<comment><USER21> Interesting, let me know if we can get in on the beta too ;)

<comment><USER19> Yep! Ping us at firstname.lastname@example.com

</comment></comment></comment></comment><comment><USER22> Interesting that their _entire population_ consists of attractive/fit white and Asian people between the ages of 22 and 35...

... more or less like every SV company's "Work with us!" pages.

</comment><comment><USER23> Awesome, signed up. Travelling through SF in mid-Nov, would love to try it out!

</comment><comment><USER24> Just returning from SF. I would definitely prefer this to Airbnb.

</comment><comment><USER25> What a cool idea! Next time I'm in SF for business going to check it out.

</comment><comment><USER26> they should pay homage by renaming this to _The Erlich Bachman_

</comment><comment><USER27> Awesome service. Definitely going to bookmark this

</comment><comment><USER28> 10 js imports according to NoScript? No thanks.

<comment><USER2> Hey can you give what is the rationale behind the JS hate? I am building a website that relies heavily on JS. What should I be aware to steer away from the JS hate?

<comment><USER29> > Hey can you give what is the rationale behind the JS hate?

JS has its overhead in terms of data and, more severly, performance. Many people tend to put unecessary JS stuff like custom scrolling, needless animations and needless interactivity, etc. This stuff more often than not just ends up getting in the way of normal browser function and is of questionable benefit or none at all.

> I am building a website that relies heavily on JS. What should I be aware to > steer away from the JS hate?

Don't add any JS interactivity that only makes a website "look cooler"* and that's not actually critical to your website's functioning. For example, stuff like google maps needs javascript. Stuff like blog most likely doesn't.

Remember to try out how your website works on a device with weak hardware and slow connection. This will not only make it far more accessible for people with older hardware, it will make better for recent hardware as well.

*) today's expression would probably be "rich user experince" or somesuch, but the meaning is the same - it's just vanity

<comment><USER2> Thanks for the detailed answer. This makes much more sense.

I am building a web based chat bot, so it is essential as without animation, it kind of look bland and uninteresting. Although, I will try to check in weak hardware and slow connection. Although not IE previous versions though.

</comment></comment></comment></comment><comment><USER30> cool! any plans to come to other cities?

<comment><AUTHOR> Yes! We are alpha testing other locations and have around 25 homes between NYC, Boston, LA, and abroad. You can fill out the form and mention the city you'd like to go to in the freeform question, and we'll contact you!

</comment></comment><comment><USER31> your wix site takes very long to load for me</comment>


SlideGame – Free, editable slide templates - <AUTHOR> https://slidegame.io/ <comment><USER2> I think what would set this collection apart more is actual standout slides and designs that were used to explain something or get something remarkable accomplished. See the books of Edward Tufte, for example. What are some of the best slides ever? That's what will keep people coming back.

Of course, that is a much harder thing to assemble than a collection of blank slide templates. A collection of templates will just be another website that some people visit once and then probably not visit again...

Best of luck!

<comment><USER3> > See the books of Edward Tufte, for example.

Better to see his manifesto on slides: "The Cognitive Style of PowerPoint: Pitching Out Corrupts Within." [https://www.edwardtufte.com/tufte/powerpoint](https://www.edwardtufte.com/tufte/powerpoint)

</comment></comment><comment><USER4> I'd recommend adding a clear and permissive license to your templates, as well as a clear privacy policy when collecting emails.

<comment><AUTHOR> Thanks for the feedback - I'll add a Privacy policy and look into the license

</comment></comment><comment><USER5> Thanks, but could you link to your Privacy Policy (before I give you my email address)?

<comment><AUTHOR> Thanks for the feedback - I'll add asap

</comment></comment><comment><USER6> Nice one!</comment>


Improve your PageRank with outbound links, yes, OUT-bound - <AUTHOR> http://inperc.com/blog2/2011/10/23/improve-your-pagerank-with-outbound-links-yes-out-bound/

<comment><USER2> The original PageRank paper is irrelevant today, except as an introduction. The scheme here dosent work anymore because Google catches it. Remember the "rings" of a decade back, where you added your site to a ring and got a boost because all the other members of the ring linked to you?..You dont see them any more because Google caught on.</comment>


Why you should work at Xobni (YC S06) - <AUTHOR> http://blog.xobni.com/2011/09/07/why-you-should-work-at-xobni/

<comment><USER2> Great post from my coworker Ryan on why what we're doing at Xobni is interesting.</comment>


Retailers are turning to facial recognition software (2018) - <AUTHOR> https://www.buzzfeednews.com/article/leticiamiranda/retail-companies-are-testing-out-facial-recognition-at <comment><USER2> "privacy advocates and industry stakeholders are debating ... how shoppers should be informed about when their faces are scanned"

I don't want to be informed when my face are being scanned, in the same way that I don't want to be informed when a website is about to sell my data. What I want is for the law not to allow such things.

<comment><USER3> I want the law to allow such things, because it is extremely useful to me as a consumer and a customer if the system can automatically identify me and attach me to my past history with the company.

This dimension of privacy is still open for debate.

<comment><USER4> Strongly disagree. While I can accept that it's supposedly valuable for you as a consumer to be "identified and attached" to a company—even though it's something that I want nothing to do do with and consider a net bad for society—the notion that whole-scale identification of persons entering a store may be an acceptable default behavior is absurd, even before considering the so-called "dimension of privacy."

As the other child comment mentioned, there are many ways to identify yourself to a store that don't require facial recognition. The YMCA for example has a system that lets users track their exercise history; there's no reason Macy's couldn't do the same for your purchases. If indiscriminate ID'ing is the default position, then you have decided that _your convenience is more important than the freedom of every other person in the store._ It should be the responsibility of the person who wants this convenience to opt in, not the responsibility of the rest of us to opt out.

The desire to not have PiD stored by anyone should be reason enough to close the debate. But if it's not, we fortunately have hundreds (thousands?) of cases of corporate consumer abuse and irresponsible data storage to point to.

<comment><USER3> Amazon has an entire grocery store experiment that utilizes this is a core element of the experience.

It seems to be getting largely positive reviews from its users.

> The desire to not have PiD stored by anyone should be reason enough to close > the debate.

Why? There is an open question of societal benefit versus personal benefit regarding how PID is tracked and used, to say nothing of the actual ownership of that PID (if you walk into a store's private property and their security cameras record an image of your face while you're standing in their private property, do you own that image? Why should you? You're in their property and it was recorded with a camera they own on to media they own).

</comment></comment></comment></comment><comment><USER5> There's already many services that exist for accessing databases of personal data, it's just a matter of combining them into some sort of mesh to really tip the scales to the extreme.

With facial recognition being able to query a face against a number of databases, and payment information able to be queried as well, it just takes a matter of some SaaS subscriptions to be able to know someone's: name, address, email/phone/social media, wealth, education, employment history, what they look like, where they go, who they associate with, when they go places, what they buy/own, etc, etc.

It's like having a stalker behind your back all the time letting subscribers know someone's life history in exchange for trying to extract as much money and value out of person as possible until they are completely used up.

We might as well just back to feudal society and slavery because the game may be different but the motivations are the same.

<comment><USER6> Maybe it's time to run an e-commerce marketplace with no tracking, no "personalization" of anything, no ads, no marketing emails, non of that bullshit.

With a focus on quality, peace of mind, and best value for money products, focus on minimizing SEO plays and fake reviews.

The infrastructure exist and is rentable from many(although a bit pricy).

Maybe all of those, together, would offer enough value to enough people to make prices reasonable.

<comment><USER7> Good luck. We may constantly decry the erosion of privacy on HN, but I _guarantee_ you that the populace at large (like 95%+), even if they may sometimes complain about a lack of privacy, also generally really _like_ the stuff that personalization provides. People (again, the vast populace at large) make their purchasing decisions based on things like price and perceived quality; privacy considerations are a distant follow up. Why do you think the ad-supported web is the dominant model in the first place? Because to most users it feels like "free", because the stuff they're giving up (like privacy and the cost of advertising baked into things they buy) isn't readily apparent.

Privacy is a concern that really doesn't matter much, until it does. For other concerns like this it seems like regulation is the only thing that works. For example, insurance companies are highly regulated because the default risk of an insurer is something so amorphous for the average consumer to determine that it's basically impossible for them to judge on their own. So that's when government steps in and says there are basic standards an insurance company must adhere to to operate at an acceptable level of risk. I feel like that's the same for privacy. The average user isn't really able to comprehend, or value, the gradual long term effects of privacy erosion, so that's where the government steps in to demand all players must have basic standards.

<comment><USER8> > Because to most users it feels like "free", because the stuff they're giving > up (like privacy and the cost of advertising baked into things they buy) > isn't readily apparent.

This is currently because the internet treats data collection as an "opt-out" feature, if you're even allowed to do that. Changing the law so that it is "opt in", and via a mechanism that is clear to a layman, might significantly change that for people. Wasn't that the point of GDPR, anyways?

<comment><USER3> And it does not seem to have succeeded, If the mass proliferation of cookie tracking warnings is any indication.

<comment><USER9> Counterpoint, robo-call/text laws do influence some companies. I worked with one who required double opt-in for text to avoid getting blacklisted.

<comment><USER3> People actually hate robocalls and unsolicited texts, because they are an inconvenience.

Cookie tracking is transparent and doesn't bother most of the populace; In fact, what bothers them is being annoyed by nagging cookie tracking notifications.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> I think I did hear brick-and-mortar stores complaining recently about having too many customers, and wondering whether there was something else they could do, something they hadn't thought of yet, to annoy and anger customers, maybe add a little friction to keep them from walking in the door. /irony

No but, ever since "the Schneier piece" [0] I've been thinking differently about this whole issue. It's about _identifying_ you, and well, the store already knows exactly who you are as soon as you use your credit card. So does Amazon.com of course, though ironically they might not have an image of your face.

If you were going to that physical store and planning to use cash (or shoplift), THEN this affects you. Although even without "AI," you would still get captured on security cameras. So if your presence there became a matter of interest - let's say for example, to corroborate or debunk your alibi for a more serious crime elsewhere - someone would invest the time to identify your face the old-fashioned way. Like probably a subordinate of the senior detective on the case, watching hours of camera footage looking for you.

You can see how it was a series of small, slow, incremental steps, each one not necessarily big enough to create an uproar, that got us here.

[0] [https://www.nytimes.com/2020/01/20/opinion/facial- recognitio...](https://www.nytimes.com/2020/01/20/opinion/facial-recognition- ban-privacy.html)

<comment><USER11> I work on identity resolution problems among other data challenges at a big retailer. We get very few details when a credit card is used in-store -- pretty much just the basic card info. We don't own the payment networks and a variety of legal and business reasons prevent us from doing what may seem to be possible to get an individual's data based on a card number (from the networks themselves or other data brokers). What's possible is mostly limited to what you can do with the name on the card and store location. We've invested significantly in the problem and the answers are a patchwork of guesses.

There's an interesting related issue here for brick & mortar businesses with CCPA and GDPR in effect: you can do some useful analytics, personalization, and fraud prevention work with probabilistic identity info, but if someone verifies they actually are Person X and wants to download or delete whatever data you have on them, what can you confidently say is actually their data?

Will companies be held to different standards based on how much money they've invested and success they've had in identity resolution, in which case this might be a factor dissuading them from doing more identification and personalization? Or if they haven't invested millions in trying to figure out who people are, but it's possible to do so, are they liable for some kind of misconduct if they don't produce all the data they have that could have been tied together for that person? Is the choice binary, i.e. either invest big in identity resolution and take it as far as possible (with parallel governance investment) or de-identify everything you can? A privacy advocate might think on first pass that it's as simple as choosing the latter, but that's mostly not possible due to requirements we face related to other regulation and business realities: fraud, anti-money laundering, age-related laws, shoplifting, intense competition in a razor thin margin industry, etc.

Data privacy is complicated.

<comment><USER12> Hobestly it doesn't have to be. Ban majority of data collection aspects and be done with it.

We are wringing our hands over the issue when in reality we can solve it like the Gordian Knot.

</comment></comment></comment><comment><USER13> What do you do? Start growing all of your vegetables in your backyard, and order what you must with a fake identity from behind a proxy online?

I was going to question if we'd reached the point where it is not only impossible to avoid handing over intimate identifiable data, but necessary to participate in society - and I realized that we probably passed that threshold a few years ago, although this does make things seemingly worse.

I wonder how long before they'll ban adversarial masks or hats in the name of safety or some other such nonsense...

<comment><USER14> _" I wonder how long before they'll ban adversarial masks or hats in the name of safety or some other such nonsense..."_

In the US it's long been illegal to wear masks in public. From what I understand, this was done as a response to KKK members wearing masks to intimidate their victims and hide their identity.

However, I've personally never seen or heard of the anti-mask laws enforced, and I see Asian people wearing surgical masks in public relatively often, without any legal consequence that I'm aware of. People wearing masks on Halloween also seems to be not only tolerated but encouraged. And, while concern about the Wuhan coronavirus lasts, I expect to see a lot more masks worn in public.

Of course there are certain locations like banks, jewellery stores, courthouses and other government buildings, where wearing a mask probably won't be looked upon too kindly.

<comment><USER15> It is not illegal to wear masks in public in _The United States_. It may be illegal to wear masks in certain _states_, but that's quite different.

</comment></comment></comment><comment><USER16> Six years ago I interviewed at a company that was working on this technology. My background was in image processing and segmentation. I knew someone else would work on it if I didn't but I still couldn't sleep with myself at night working for a company whose monetization depends on data mining people. It deeply saddens me that even this shopping mall where I'm currently posting from, tracked customers secretly and got busted with a bit of luck. Eventually they will win. :(

<comment><USER17> It's a funny thing. You hear on HN constantly that everyone's backend is a mess, that the SQL tables are incomprehensible, the AWS server has crashed again. Surely these scummy companies must be in the same state?

I know that security through obfuscation is not a valid method for storing bitcoin keys. But privacy via idiocy is more common than not (exceptions do apply: [https://en.wikipedia.org/wiki/History_of_the_Jews_in_the_Net...](https://en.wikipedia.org/wiki/History_of_the_Jews_in_the_Netherlands#The_Holocaust))

<comment><USER18> Talented people write unmaintainable spaghetti code all the time.

</comment></comment></comment><comment><USER19> Loss/theft prevention is a priority for retail adoption of FR, but the cherry on top is the creation of real world consumer tracking that every website gets "for free" due to their web platform, which until FR had no equivalent in the real world. With an FR enhanced retail location, the store knows your face visited just as a web site knows your IP address visited. This will overlay a tracking capability on the real world with as much capacity as the out of control tracking of people online. For this key reason, we need regulation to prevent the sharing of any and all personal data between organizations. Wrong identification and junk/incorrect/false data in retail/non-authoritative databases must never be combined to create an uber-database of dirty data we get impressed as "official".

</comment><comment><USER20> > "It's making Illinois a technology desert."

It makes me want to move to Illinois. How tone deaf is this company?

I also noticed that they couch their losses in "lost sales", as if the shoplifters would have purchased the items had they only been caught.

<comment><USER21> _Someone else_ would have purchased the items, had they not been stolen.

<comment><USER22> Extraordinary assertion without evidence.

How often is a desired product unavailable because some of the inventory was shoplifted?

<comment><USER23> Even if it is not lost _sales_ , there's obviously an increased cost associated with breakage in that you have to buy new goods at the wholesale price to replace the ones that were stolen. Grocery stores, for example, have gross margins of about 10-15%, so even if "lost sales" is not entirely accurate, it's close enough that it's not going to severely misrepresent the size of the problem. Perhaps in the case of a luxury goods shop where the gross margins are 50%+ this is not the case.

</comment></comment></comment></comment><comment><USER24> I was going to complain about "consent" being removed from the headline, but the consent model for this is all wrong anyway.

Even if you had to sign a EULA when you entered the store, there's no way to meaningfully consent to submitting your biometric data into a legally unlimited universe of analysis, cross-referencing, marketing, credit reporting, law enforcement, and whatever else ingenious minds can invent. This just isn't a consent problem. It's a regulatory problem.

Under a proper regulatory regime, you shouldn't need to consent to a computer recognizing your face any more than you should for an employee to recognize your face, because the laws constrain what the computer can do with that recognition, and you can reasonably expect those limits to be in line with what the employee could do.

</comment><comment><USER25> Las Vegas has been doing this for DECADES.

The casinos all have facial recognition, and share the data.

The card sharks and other troublemakers are greeted at the door and shown the exit.

source: have a friend who works in las vegas.

<comment><USER26> TBH, casinos are not brick and mortar shops. When you go into an establishment that attracts troublemakers(casinos, night clubs, etc.) you expect the security-privacy balance to tip towards the former as that's the easiest way to keep out scammers and troublemakers.

</comment></comment><comment><USER27> Ten years ago I thought there would be a cultural shift towards wearable spy technology. Now I wonder if there will be a shift towards developing anonymous masks worn as part of a cultural norm.

<comment><USER21> Honestly, wearing a mask in public is really creepy.

I'm sure I'm far from alone in assuming you're out to commit violent crime.

<comment><USER28> Wearing of masks in public has actually been a social _norm_ at times, notably in Venice:

[https://www.veneto-explorer.com/history-of-the-venetian- mask...](https://www.veneto-explorer.com/history-of-the-venetian-masks.html)

</comment></comment></comment><comment><USER29> This has been going on for more than five years in California; Target and Chipotle are rumored early adopters. Individual vendors are supplying and installing the setup into corporate chain retail locations, creating "jobs".

<comment><USER30> Target stopped this, per the article.

</comment></comment><comment><USER31> This has got to be a US thing, as this would almost certainly be illegal under the GDPR.

Facial recognition is processing of biometric data, which belong to the "special categories of personal data", which are protected under Article 9 GDPR [1].

Customers would need to give _explicit_ consent to this.

Contrast this with normal security cameras, which don't use biometric data: these do not necessarily require consent. For example, security cameras filming a cashier's desk are usually lawful because of legitimate interests (see Article (6)(1)(f) [2]).

But legitimate interests don't work with Article 9 data.

[1] [https://gdpr-info.eu/art-9-gdpr/](https://gdpr-info.eu/art-9-gdpr/)

[2] [https://gdpr-info.eu/art-6-gdpr/](https://gdpr-info.eu/art-6-gdpr/)

</comment><comment><USER32> I like how the gif showing the shoppers they should "observe" as being a risk is of two burn out looking dudes. A total stereotype. It begs the question are these type of stereotypes baked into the FaceFirst software?

The other image of a violent offender is more along the Ted Bundy type. Less a victim of traditional bias but a total serial killer stereotype - white, inconspicuous male.

It's usually a slippery slope with these kinds of biases being perpetuated at the software design level - "stoner" types, minorities, and other marginalized groups often getting the short end of the stick.

I understand retail wanting to reduce shrinkage (the term for stock loss via theft). I guess that's one concern as a whole, how is it ethically being handled?

</comment><comment><USER33> Casinos have been doing this for a long time.

You've also got a GPS becon in your pocket, and are probably paying with a card attached to your name and government ID number.

So unless you're paying in cash and not carrying a phone, you're already a big red dot.

<comment><USER34> I live in Texas, and I've seen awkward moments at dinner parties where pro-gun people say the government must not ever have a registry of owners or civilization will collapse. I bet that the next day, to let off a little steam, they bought bullets on their iPhone and had Google maps take them to the range...

<comment><USER35> Why is it awkward? Because only you recognize the extent of their privacy loss? Enlighten them.

<comment><USER34> This is not a case of consistent logic through ignorance. The same friends who will literally go out guns blazing before letting law enforcement take their AR15, believe Snowden was a traitor and the intelligence agencies would never abuse their power ¯\\_(ツ)_/¯

</comment></comment></comment></comment><comment><USER36> So if someone starts getting misidentified, or is erroneously put into a database somewhere and passed down the data brokerage systems, who does one petition to be removed? With the government, you (usually) know where the data is. With private databases, who knows where it starts and ends?

And once all major stores link up and you get banned from everything, how do you survive once you can't buy anything anymore?

</comment><comment><USER37> Minority Report movie predicted eye iris identification. 25 years ago irises were thought to result in fewer false positive matches than facial parameters, but the latter has improved since then. A problem with iris identification is building a large database. Face images are collected by the government. DNA is collected by police and ancestry companies. Not so much for irises.

<comment><USER38> > Not so much for irises.

High quality selfies might be sufficient to build a database. But since faces are larger features that don't need close-ups they're commercially more useful.

</comment></comment><comment><USER37> At 2019 SIGGRAPH a Chinese software company was creating free unique 3D avatar characters for whomever voluntarily stopped at their booth. They probably archived your face photo and badge ID for future research and other database uses(!!!). Other booths could probably collect face and badge from walkerbys, but not of the quality of someone who voluntarily submitted to their pictures taken. I realized this shortly after getting my avatar (-:

</comment><comment><USER39> I don't mind stores protecting themselves with this.

I do mind when the line is crossed and my information is shared with unrelated external entities to monetize me

</comment><comment><USER40> Will this be crosschecked to identify known illegal aliens and notify ICE to come and grab them for deportation?

</comment><comment><USER41> Anyone remember the movie Minority Report? Specifically the part where he walks into a store and the sign recognizes him and shows him a targeted ad for an item in the store?

I feel like that use of facial recognition would have a far greater ROI than loss prevention.

<comment><USER25> gotta get a clean set of eyeballs.

</comment></comment><comment><USER42> We can name and shame companies who use facial recognition tech. If the bad pr outweighs the benefits then they will abandon them. The challenge is to educate the general public about the dangers of it.

</comment><comment><USER43> Instantly reminds me of the "Forbidding face-recognition is the wrong step" article posted yesterday.

</comment><comment><USER44> Isn't this what B8ta does, which I haven't heard much criticism of or about?

</comment><comment><USER45> going to need to start wearing bandanas to go to the store to get bananas

</comment><comment><USER46> Not okay.

</comment><comment><USER47> Shouldn't this have a 2018 tag?</comment>


Do Ex-Vegans' Stories Make the Case Against Vegan Diets? - <AUTHOR> http://www.theveganrd.com/2010/11/do-ex-vegans'-stories-make-the-case-against-vegan-diets.html

<comment><USER2> you know, the few vegans i've met might as well have been fanatics. so it does hold up that they'd willfully eat themselves into an unhealthy situation.

That said, I've met way more people who called themselves vegan who surely were not. after all, lots of things that arn't immediately apparent are not vegan. the biggie for the wannabes was beer. the militant vegans i knew when i was a kid swore it was not vegan.

Also I was at a vegan bbq onces (isn't that an oxymoron) and I swear it smelt like burnt tires. that can not be healthy for anyone.

</comment><comment><USER3> The plural of anecdote ...

Such stories, for or against this or that diet, may be handy insofar as they bring to light current research or practices, but it's the scientific data, not the stories, that make or break a case.

<comment><USER4> Weird that I find myself agreeing along when reading both the pro and anti vegan accounts, as you say these 2 anecdotes could be both right in aspects but without any hard data that attempts to remove extraneous variables (from all the nutritional claims and counter claims I've read this is very hard to do) it's merely going around in circles.</comment></comment>


Capuchin Monkeys Reject Unequal Pay - <AUTHOR> http://www.youtube.com/watch?v=g8mynrRd7Ak

<comment><USER2> I normally hate youtube links. But I upvoted this one because you really have to see it. And the reaction of the unhappy monkey really does express so eloquently how quickly we can become unhappy with a perfectly satisfactory deal simply because we become aware that someone else is getting a better one for the same work.</comment>


JPlayer : HTML5 Audio & Video for jQuery - <AUTHOR> http://www.jplayer.org/ <comment><USER2> We used JPlayer at the Facebook University Hackathon series this year, and while it wasn't always a joy to work with it was far faster than rolling our own. As others have said, super easy to reskin, handles cross-browser compatibility fairly well; overall a great boon to anyone looking to quickly get up and running with HTML5 a/v

</comment><comment><USER3> I used this to make a simple player for my personal audio portfolio website, and it was super easy to use and reskin. I had trouble getting multiple tracks to play, but I just started messing around with jQuery, so I think it was a factor of that learning curve. Highly recommended. Once you get multiple songs working you can make an interface for adding or removing them as well, I would love to implement this as well. I guess the point of my long rambling post is use it because it works and it is compatible and awesome. Edit: You can also easily use the Soundcloud or Bandcamp api to stream your tracks directly to your jPlayer, which is super useful.

</comment><comment><USER4> As one of the developers of jPlayer - it's great to see this discussion. We're a building up the motivation to create a new release and we'd be interested in hearing any ideas the HN community has.

[https://groups.google.com/forum/?fromgroups&pli=1#!topic...](https://groups.google.com/forum/?fromgroups&pli=1#!topic/jplayer/LuZk0MS9l1g)

(Comment here or in the group).

PS Little known fact - pandora.com uses jPlayer or at least it used to when I last used a VPN to check it :)

</comment><comment><USER5> We use JPlayer here at Senzari (<http://senzari.com/>) and it's been a blast to use, very easy to skin and supports fallbacks (HTML5, Flash) for every supported file format.

My only issue with it is the progress bar integration with the flash player.

We reskinned and moved every single element of it: <http://cl.ly/2s323p2a1a3D3I1f1H44>

</comment><comment><USER6> I have written a simple WebAudioPlayer around it. You give it an URL with some MP3 directory listing, it loads that and plays them all in queue.

<https://github.com/albertz/WebAudioPlayer>

E.g.: [http://albertz.github.com/WebAudioPlayer/#http://28c3.ex23.d...](http://albertz.github.com/WebAudioPlayer/#http://28c3.ex23.de/CCC/28C3/mp3-audio- only/)

<comment><USER7> Very neat.

What i don't understand- probably to do with the jPlayer- is that it seems to know the length of the song before it has all loaded (because of the seekbar lengths), yet it only increases the time string as the file is loaded.

</comment></comment><comment><USER8> Just discovered a week or so ago and have been using on a little side project. So far nothing but good things to say about JPlayer. Skins are easy to create, it loads well, looks nice enough. Great for prototyping with if nothing else.

Though with all the good things about JPlayer, the codec issues and incompatibilities amongst browsers, I cannot say the same for HTML5 video in general.

<comment><USER9> If you're prototyping with JPlayer, what is your final product gonna be in?

I was thinking about using on a project, that's why I'm asking.

</comment></comment><comment><USER10> I've used JPlayer for some personal projects (e.g. <https://github.com/pfarrell/pshare3>). It's very easy to setup and use. I haven't gone as far as creating my own skins, but since it's all jquery and css, modifying existing ones is a no-brainer.

</comment><comment> lupin-binb I've used JPlayer as a cross-browser audio player in a small project (<https://github.com/lpinca/binb>). The javascript APIs are very well made.

</comment><comment><USER11> Can anyone say how this compares to mediaelementjs? They seem to be very similar. I liked mediaelement.js, but ran into massive problems when using it in a colorbox under IE8.

</comment><comment><USER12> So what is the advantage in using this over say jwplayer? Don't we still need to prepare the video in different formats to target various browsers?

</comment><comment><USER13> This is a great solution for audio and video, I've used it on several projects. The docs are top-notch as well.

</comment><comment><USER7> I know it isn't the typical use case but is there anything similar that (also) supports flac? (or even wma?)

<comment><USER14> Are you planning on serving (or streaming with a lot of buffering) FLAC audio on a public site? Why not re-encode and save everyone bandwidth?

<comment><USER7> No, it would be for LAN use with a web-app.

<comment><USER14> Wouldn't that still potentially affect your LAN's performance? At >1Mbit per stream, it seems they could add up fast. Even on a LAN, I'd want to minimize traffic volumes where possible in most cases.

I'm just curious if this is a matter of convenience, wanting to avoid re- encoding, or if the fidelity is actually critical, and these would be playing back on studio monitor speakers for close scrutiny.

I guess if I were trying to play FLAC and WMA files from a local server, I would typically mount the remote share and use native client-side software to play them, which is typically a more pleasant user experience than browser- based solutions.

<comment><USER7> Yes, it is wanting to avoid encoding and the associated delay and/or disk space. If I could re-encode and immediately stream with insignificant latency, with a weak CPU, then that might be a reasonable option.

</comment></comment></comment></comment></comment><comment><USER15> What are the shortcomings of using JPlayer?

I heard only positive reviews, and would love to get the flipside, if there's any.

<comment><USER16> i have experienced some issues when using internet explorer 8. the ready event of the player is not fired so you cant bind any media to it..

</comment></comment><comment><USER17> Does it read chapter titles via the track tag? I don't see it mentioned anywhere.

</comment><comment><USER18> Love this thing, I've used it on a bunch of projects. The javacript API is great.</comment>


Ask HN: Which open source Android OS do you use? - <AUTHOR> <comment><USER2> What exactly is your definition of open source? Technically, Android is open source, but it's basically impossible to contribute upstream, and many of the drivers are closed source.

If you were to use the definition of "Free Software" according to the Free Software Foundation, the only 100% Free Android OS is Replicant. LineageOS is partially free, but has many closed-source proprietary blobs and binaries.</comment>