Why assessing the state of the world is harder than it sounds - <AUTHOR> https://www.newyorker.com/magazine/2018/07/23/are-things-getting-better-or-worse <comment><USER2> There is some truth in this article, but a critical point is being missed.

> per-capita income has more than doubled since 1972

Actually, per capita income has plummeted since 1972. To correctly assess income, you have to know the rate of inflation, and the official inflation figures are effectively lies because they focus on consumer goods, which have indeed become cheaper, while ignoring housing (and in America, college fees and health insurance), which has become drastically more expensive thanks to artificial scarcity created by zoning laws combined with the shortage of remote or rural jobs.

That sounds like only one factor of many, but I think it accounts for much of the rest. Real income falling every decade creates negative anticipation which has difficulty finding something to latch onto because we keep being told we are getting continually richer, hence the miasma of fear and hate constantly looking for targets. Nor is the fear unfounded. For centuries, we tried to figure out what destroyed the Roman Empire. Answer: the Romans were not destroyed by any external force. They were wiped out by their own ruling class, via abuse of land ownership law.

As for what to do about it, my first suggestion would be to start voting single-issue on repeal of zoning laws.

<comment><USER3> We have to remove incentives for holding / renting property. I think it's Germany that taxes the shit out of you if the owner doesn't live in the residence. This would immediately rid the United States of all of these "investment property" owners and people buying up houses to rent with million dollar cash offers to diversify their portfolio. The stock of available homes would go up. This would also lead to the sale of any prop (?) houses being held onto indefinitely because of cheap taxes that are being rented out to fund their life actually living somewhere else. It would cut down on vacation property ownership, which again increases housing stock. It would cut down on career AirBnB-ing.

The downsides are a decrease in rental stock, and potentially less investment in any given property since a landlord is no longer maintaining it. I feel like we could find some easy fixes here with things like tax rebates for non- cosmetic home improvements.

<comment><USER4> British Columbia does this. The Vancouver housing market has seen major shifts because of their vacancy tax.

<comment><USER5> Any sources I can read about this?

<comment><USER4> [https://www.google.com/search?q=vacancy+tax+vancouver](https://www.google.com/search?q=vacancy+tax+vancouver)

<comment><USER6> ddg: [https://duckduckgo.com/?q=vacancy+tax+vancouver](https://duckduckgo.com/?q=vacancy+tax+vancouver)

From a CBC article;

Under the new rules, homes that are not occupied for at least six months of the year are subject to a tax of one per cent of the property's assessed value. The deadline to rent out empty dwellings was July 1.

</comment></comment></comment></comment></comment></comment><comment><USER7> Could it be caused by the fact that the middle class of the Western World seem to be shrinking all over the board, with job security and a smaller ration of home owners as the result?

When I grew up in the early 80's most kids would have expected to be home- owners at 25, have a steady job and a few kids with an optimistic look at the future.

Instead, most woke up into a reality where they would have to partake in an obvious real-estate bubble, or rent a smaller-than-expected apartment in a downtrodden neigborhood, and where jobs were hard to come by due to outsourcing and automation, or to the older generations simply not wanting to retire.

Most of those I grew up with now seem to be amongst the people with a very pessimistic world view.

Have the World become a better place for the majority of the World's population? Definitely! For the middle class in Europe and North America? I'm not so sure.

<comment><USER8> Branco Milanovik's "elephant chart".

[https://milescorak.files.wordpress.com/2016/05/branko- milano...](https://milescorak.files.wordpress.com/2016/05/branko-milanovice- global-inequality-elephant-curve.png)

[https://blog.realinstitutoelcano.org/en/the-western- middle-c...](https://blog.realinstitutoelcano.org/en/the-western-middle- classes-decline-stagnation-or-rise/)

</comment></comment><comment><USER9> Can I just point out I love the audio feature. I don't own an iphone so I'm never going to purchase, but I'd happily pay for it.

</comment><comment> Const-me > I just could not see anything in my memories that had to deal with > collectivization, killings, political trials, endless bread lines, > imprisoned free thinkers

The author's memory is OK. There were little to no such things in communist Yugoslavia.

Unlike Warsaw bloc countries, Russian army did not occupy Yugoslavia. The country remained independent, and human rights situation was much better than in Russia.

> he had mainly good memories—of "long dinners discussing politics," the > "excitement of new books," "languid sunsets, whole-night concerts, epic > soccer games, girls in miniskirts."

In soviet Russia, a long dinner discussing politics would cause the participants to be sent to Siberia, there were no whole-night concerts, and miniskirts only appeared on girls after the Soviet Union collapsed in 1991.

<comment><USER10> The memory is OK, but his reality was quite painted by state management of information. Many elements of totalitarian control were definitely present -- collectivism, single party, total control of media, education and international travel, Goli Otok, suppression of certain civil movements etc -- but overall it was definitely better than in Soviet Union at the time.

<comment><USER11> _> Many elements of totalitarian control were definitely present._

This is misleading. It was not a totalitarian state.

Benevolent dictatorship is even an exaggeration.

Yugoslavia had a very liberal socialist economy. Trade with the west was very common. International travel was allowed. Collectivism was common but it's misleading to suggest this is an element of totalitarianism. Strikes were more legal in communist Yugoslavia than they are in present-day United States. Control over the media is accurate.

It's off topic but citizens also had free access to healthcare.

<comment><USER10> > It was not a totalitarian state.

It most definitely was, without any doubt. However, it was achieved not by physical force like in most other cases, but by management of ideological education and control of all aspects of life, carefully choosing what will be allowed and how. This control was very subtle and by necessity needed to be carefully adapted with time, but without it the country would have fallen apart much sooner than it actually did, with catastrophic consequences.

Everything you write is exactly the result of this information control, and is what things seemed like at the surface.

<comment> barry-cotter You're describing an authoritarian state, not a totalitarian one.

<comment><USER10> Fair point, a nomenclature error.

</comment></comment></comment></comment></comment></comment><comment><USER12> > _Yet many people, like Milanović, have fond memories of bygone years, and > wonder if reports of their awfulness have been exaggerated._

I was born in Romania in '82 and was 7 when communism fell. Yet I can remember vividly that ...

We were suffering of cold in winter, as the centralized heat was on and off, we had regular electricity blackouts and my parents, both with university degrees, had jobs and working their asses off on lower salaries than factory workers and couldn't find or afford a babysitter so at 4 years old I was left alone at home, during blackouts so in the dark at around 19:00 o'clock too.

In those days people relied on families in such situations of course, grandparents making the best babysitters, however the communists forcibly moved a lot of people to the cities and distributed people where they were supposedly needed, so a lot of families were uprooted and split.

I also remember my parents listening to Radio Free Europe, with the volume barely audible, in order for the neighbors to not hear us. Paranoia of "informants" was at an all time high and any resistance and conflicting opinions were long since crushed.

You know, "1948" the book is actually boring me, compared to what actually happened in real life. Turns out that in order to do massive surveillance of the population you don't need technology at all, as you can recruit a massive army of informants that can listen and send regular reports on their neighbors for free. And it doesn't need to be efficient either, all that matters is for paranoia to set in, which will ensure compliance of the population.

My father was a party member of course, you had to be insane to not be one. But in private he hated communists with all his heart, just like his father before him; my grandfather who fought in WWII and then had his land confiscated.

The communists were responsible for raising the standards of living somewhat, compared with the period between the two world wars, plus there's this myth around that everyone had a roof over his head back then; which is why some old people feel nostalgic. It was all in a global context of economic growth of course, progress being inevitable.

But people remembering miniskirts were in a position of privilege. Yes, we had happy moments and life went on, but at least during the eighties there was this constant tension and hunger that you could feel, so thick that you could almost cut it with a knife.

Then the revolution came and we killed our dictators. Unfortunately people are dumb sheep and power was grabbed by former communists. We are far better off today, we have a better quality of life, we are part of the EU, but unfortunately this wave of populism has hit us as well and the ruling administration seems determined to destroy all progress we've made in the last 28 years. And people being stupid, still vote for them, just like they were cheering during our former communist congresses. Sometimes my cynicism takes over and I'm thinking that we deserve whatever is coming.

<comment><USER13> > _The communists were responsible for raising the standards of living > somewhat, compared with the period between the two world wars_

In many ways it was a far more progressive society despite the shortages of consumer goods and services, and partly thanks to the totalitarian control from the state. What was once a largely agrarian and rural country like Bulgaria was transformed into a modern industrial society for a few decades. The newly-born social class of "scientific-technical intelligentsia" was, although not rich in terms of wealth and property, hugely respected in society. You had electrical and computer engineers whose fathers were farmers. Cultural life was also raised to a new level, as ordinary working-class people started attending operas and theaters. Small children were encouraged to play classical instruments.

The whole system collapsed under its feet because politically, it was unable to represent the interests of these newly-born classes and that led to its erosion.

<comment><USER14> Read up on the Pitesti experiment.

<comment><USER15> Yes, that was awful, but how is this relevant here? Care to mention Guantanamo too? Also the Pitesti experiment was right after the war when the communism had a Soviet flavor. Im not arguing that communism was a good thing, though some things were more progressive back then as the Bluetomcat states above.</comment></comment></comment></comment>


God, Hawking and the Universe - <AUTHOR> http://www.bbc.co.uk/blogs/ni/2010/09/god_hawking_and_the_universe.html

<comment><USER2> Hawking is a charlatan. <http://en.wikipedia.org/wiki/Charlatan>

I would like to hear your opinion why he is -not- a charlatan.

I reason like this. Hawking writes ''God did not create the Universe'' because he claims that the laws of physics as interpreted by him says so. To invoke god as supporting one's own scientific opinion is the oldest form of charlatanism.

If you happen to read a Jane Doe who is a rational layman who is not a doctor of physics write ''God did not create the Universe'' you would ignore her. Because anyone can make this statement.

But when Hawking makes this statement he pretends to support it because he is a doctor of philosopy. Somehow we must believe him because he obtained a doctor of philosopy degree in physics.

I would appreciate your comments why we need to believe him rather than Jane Doe who makes the same statement.

The only reason that I can think of is that Stephen Hawking has the full power of the marketing department of Random House to support his declarations.</comment>


Netflix is now screwed..Why you should put your membership on hold. - <AUTHOR>

I was in the mood to watch a movie.
Fired up the AppleTV to see that a lot of movies were no longer in my Instant Queue (approx 20). Weird, executed a search for the movie "Grown Ups" to find out it is no longer available!
I called Netflix to be told it is a "licensing renewal" issue and that the movie studios were being difficult.  Nothing could be done.
I asked, well you are collecting my $7.99/mo and I am now down hundreds of movies. the CSR told me it was available on DVD and no big deal, upgrade my account and I could get it.
That was the end.
Funny though..When I told the CSR I was using an Apple TV she said "Who makes that Roku?". I said yes.
So the larger question here is that is Netflix doomed to lose a large amount of customers over these types of issues? It is bound to happen over and over again. In his All Things D9 session Reed Hastings said he hoped that throwing a bunch of money at licensing would be the answer. Clearly it is not! <comment><USER2> I... Don't get it? This has always been how they operated? Films coming in and going out of streaming ability?

It's kinda how the studios treat channels like HBO, Showtime, and the like. Netflix just did the online move before those guys wised up. (Though, HBO has now, and congrats to them.)

<comment><AUTHOR> I have never had this happen and I have been a Netflix customer since about late 1999-2000, IIRC.

<comment><USER2> I recommend visiting <http://instantwatcher.com> It's been around for at least two years, I know, just for this reason.

It's a good site. Each title has a "Remaining" area where it shows how many days it's got left on Instant Queue availability, and you even even click "Expiring" at the top to see what's ending soon, so you can make sure you fit it in!

<comment><AUTHOR> indeed a good resource, Thanks.

</comment></comment></comment></comment><comment><USER3> I think the real issue is that you wanted to actually watch "Grown Ups".

<comment><AUTHOR> Can you blame me? Adam Sandler, Kevin James, Chris Rock, David Spade and Rob Reiner all in the same flick? The only thing that would have made that better is adding Jim Parsons...

<comment><USER4> I have to say that IMO that movie was a terrible letdown given the people who were in the movie. Most of the people in the movie are some of my favorite comedians/actors and I expected a much funnier movie.</comment></comment></comment>


How 7 Lines of Ruby Will Speed Up Your Heroku Deploys - <AUTHOR> http://www.thirdprestige.com/posts/how-7-lines-of-ruby-will-speed-up-your-heroku-deploys-10x

<comment><USER2> Anyone have any luck getting this to work on a previously installed app? It seems to be getting the custom buildpack, and after reading the code a bit it seems, yes, it says it's caching the assets, but it never says it's using the cache on the next push. :/

<comment><AUTHOR> I'd be happy to help you debug. Would you send me an email to email@example.com?

</comment></comment><comment><USER3> The article brings up a good point: must you watch the deploy like a hawk and do nothing else while it happens? The author mentions reading HN. What's stopping you doing something else during the deploy that's actually productive, to hide the time cost?

<comment><USER4> It's hard to switch back and forth between tasks, especially if you have to poll the original task occasionally.

</comment></comment><comment><USER5> I think the Heroku Rails 4 buildpack does this automatically. And Rails 4 and Ruby 2.0 build assets faster anyway.</comment>


We are sorry - <AUTHOR> http://blog.path.com/post/17274932484/we-are-sorry <comment><USER2> Only problem is: It was not a mistake.

They did this only to cover their asses and that has been the only concern they've ever had. That they already tried to push the opt-in was of course only in fear of what just happened.

I'm sorry, I'm all for public apologies and I truly believe that it is in times like these companies have a chance to really prove themselves and really make a mishap something positive (and come out stronger than ever before). And they have tried to do that, for that I give them credit.

But. _It was not a mistake_. And this sentence really shows why: "Through the feedback we've received from all of you, we now understand that the way we had designed our 'Add Friends' feature was wrong."

They did it deliberately, there was not a mistake anywhere when implementing this nor with their intentions, and if they honestly didn't understand that what they did was wrong they don't deserve to be trusted again, not never. And if they did understand that it was unethical, which they undoubtedly did, it is _even worse_.

Their trust is not worth anything more than what they think they can get away with. The only thing that is different today from yesterday is that they think they can get away with less.

This desperately highlights why both android and iOS needs a way to spoof contacts for apps (return an empty list). Some android developers have solved this by having two apps in the market, one "private" version that requires fewer permissions. But that's a kludge (that I _really_ appreciate) that almost noone uses.

<comment><USER3> I suspect, if you probe more deeply, that some of the Path developers where familiar with how this problem is normally solved and just copied a common design pattern. A large number of IOS applications supposedly upload the contact list to make it easier to find friends server side - I further suspect that many, many of the popular social apps do this.

Hopefully at least Five good things will come out of this:

      1) Social Apps immediately remove the "upload contact list code from their
         apps"
      2) Social Apps come up with a more privacy clueful way of searching for
         your friends.
      3) Social Apps (all apps, ideally) focus more on user privacy.
      4) Apple requires permission to be granted before allowing an app to read
         your contact list.
      5) Apple is more explicit about what app developers are _not_ allowed to do
         when transmitting information off the IOS Device
      6) The App review process adds a check to see if certain user private fields
         are accessed, (Contact, Photos) - and ensures (through audit, or
         confirming with the developers) that private information is not
         being uploaded without opt-in.

If some or more of these things happen, then I'm actually happy what Path did was publicized. They've deleted 100% of the contact information off their servers - people now have to opt-in to add it back in.

<comment><USER4> It seems to me to be more a case of developers taking the easiest option, rather than spending some time considering a more secure, less creepy way of doing what they wanted to do.

</comment></comment></comment><comment><USER5> Key paragraph: "We believe you should have control when it comes to sharing your personal information. We also believe that actions speak louder than words. So, as a clear signal of our commitment to your privacy, we've deleted the entire collection of user uploaded contact information from our servers. Your trust matters to us and we want you to feel completely in control of your information on Path."

Great save for a bad mistake.

<comment><USER6> I would bold it if I were them. It's a nicely written message, but it reads like a lot of other PR apologies and it's easy to skim over it, deep in its position in the 5th paragraph.

Sometimes you need to _make_ actions speak louder than words. :)

<comment><USER7> >We are deeply sorry if you were uncomfortable with how our application used your phone contacts

Better would have been 'we are sorry we misused your phone contacts', rather than trying to make the users responsible by invoking their feelings.

Aside: interesting how the concept of theft seems meaningless when applied to copyrighted material, but meaningful when applied to private data.

<comment><USER8> I don't think that you should assume that they are sorry that they "misused your phone contacts". This, like a lot of companies' efforts, is emblematic of their efforts to find out what people's (ever-expanding) comfort zone is when it comes to giving up their privacy. They (Path) are not looking at this as a philosophical failure (which would be cause for the apology you put forth)...they simply see it as an A/B test result ('sorry about making you uncomfortable').

</comment></comment></comment></comment><comment><USER9> Honestly, I keep hoping Apple adds a permission check for the contact list (like they do for GPS location). If the user says no, they should just return a blank contact list (to keep old apps happy that aren't expecting the call to fail).

<comment><USER10> It's crazy that they haven't added this already. Facebook needs to get my permission to find out where I am, but not to scrape a hundred names, phone numbers, and addresses out of my phone? Bizarre.

<comment><USER11> I realise you might be using Facebook as an example in a theoretical sense (i.e., that Apple believes protecting your location is more important than protecting your contact database), but in case you weren't, Facebook's "find friends" feature does give you an explanation of what is going to happen, asks you to confirm.

Here's the explanation:

"If you enable this feature, all contacts from your device (name, email address, phone number) will be sent to Facebook and be subject to Facebook's Privacy Policy, and your friends' profile photos and other info from Facebook will be added to your iPhone address book. Please make sure your friends are comfortable with any use you make of their information."

<comment><USER12> Facebook is trying to push the responsibility for the privacy of your friends to you with this, and by doing so they are violating EU privacy laws.

See: <http://en.wikipedia.org/wiki/Data_Protection_Directive>

This is one of the few areas where the EU is (still...) ahead of the rest of the world. Facebook should not be able to collect data on your friends even at your request unless your friends explicitly consent to this.

Clearly your friends have no business passing on your data and Facebook has no business collecting it. "Make sure your friends are comfortable" is no excuse for facebook to go ahead and break the law.

<comment><USER13> Your neighbours to the north also have laws like this that are on par with the DPD. The EU treats PIPEDA as essentially an implementation of the DPD so that DPD compliant orgs can share data with Canadian businesses.

<comment><USER14>
      > Your neighbours to the north

Confused me a bit, b/c I don't think that jacquesm is from the US. I was thinking 'neighbors to the north' meant Scandinavia or Iceland.

</comment></comment></comment></comment></comment></comment><comment><USER15> So what changed really?

Yesterday morning Path thought it was perfectly OK to scrape user's Address Book behind their back, and now they suddenly acquired moral backbone and ethics? Please give me a break. What they did today is the only sensible thing there was to try and save the company, so they did it, but should they be commended for that? Hell, no. Would you commend a landlord for dismounting a hidden camera in your bathroom? Doubt it.

The fish rots from the head. The company is still under the exact same management it was yesterday morning. Nothing's changed. I wish Path a slow, painful and very public demise to serve as a dire warning to others in similar positions.

<comment><USER16> They still think it's okay. It's the users' fault this is a problem. Read carefully:

\- _users brought to light an issue_

\- _we now understand that the way we had designed... was wrong_

\- _we are deeply sorry if you were uncomfortable_

Not sorry. Sorry if and only if you took it wrong.

\- _We want you to feel completely in control of your information on Path._

You won't be in control, but we want you to "feel" you are.

Also:

\- _stored securely on our servers using industry standard firewall technology_

Hmm. My firewall doesn't store data.

\- _We hope this update clears up any confusion_

It's not us, it's you. Stop being confused.

<comment><USER17> So many people are fooled by these weasel words I am surprised.

</comment></comment></comment><comment><USER18> Surprise: an actual apology, followed by an explanation and how they're going to do it slightly better in future, plus a remedy of sorts.

Better than ATT, VZW, MS, TW, Comcast, or any national US bank.

<comment><USER19> The fact that they've already deleted all user address book data, and have an updated version of the app available _today_ with a privacy option, is a big deal. I don't know how they managed to get an update to the app approved so quickly (24-48 hours?), they must have worked directly with Apple. A good sign, either way.

<comment><USER20> There is no proof of that they really deleted all user address book data.

<comment><USER12> You can't prove a negative. You can only prove the existence of certain data on a particular server, you can not prove that a company does _not_ have certain data unless you are prepared - and they are willing - to give you full access to audit each and every byte on their systems and to wipe any parts that they can't explain and you can't find a way to decrypt.

Clearly that is not practical so we'll have to take them at their word, as it stands I think that if path is found out to be lying about this that it will come back to haunt them big time.

<comment><USER21> It probably would help if they had an outside auditor to verify the actions that were taken. Still wouldn't be final proof to anyone who believes that they might still be hiding something but is a step further than just saying "trust us".

</comment></comment></comment></comment></comment><comment><USER22> This is a welcoming move from Path. However, "industry standard firewall technology" is gibberish.

<comment><USER23> Translates as "We don't use encryption because it would cost too much, but we have ACLs so only our staff can look at your personal data"

<comment><USER24> Hmm, I read it more as "We actually have no idea what we're doing with any of this stuff and we're not giving you any more reasons to trust us with ANY data".

Written by their CEO => icing on the cake.

</comment></comment></comment><comment><USER25> Dave Morin, 2010:

 _Path does not retain or store any of your information in any way._

Source: [http://gawker.com/5883549/dont-forgive-path-the-creepy- iphon...](http://gawker.com/5883549/dont-forgive-path-the-creepy-iphone- company-that-misled-us-once-already)

</comment><comment> k-mcgrady I was very critical of Path yesterday. Their initial response didn't really address the issue and was basically an excuse. But this has restored my faith. I never believed they were doing anything malicious with the data but the fact that they bill themselves as a trusted/private social network leads me to want to hold them to a higher standard.

The big thing in this apology is that they have deleted all the data. That was a good move and shows they listened to complaints. The app update is also smart. Hopefully they will implement a better friend finding system soon (maybe using the hashing ideas put forward in yesterdays HN thread).

</comment><comment><USER26> It reads like standard PR damage limitation, but it ticks all the right boxes:

* They've admitted responsibility.

* They've shown they understand why they were wrong.

* They've explained what they've done to put it right now.

* They've explained how they intend to proceed in the future.

</comment><comment><USER27> _If you accept and later decide you would like to revoke this access, please send an email to firstname.lastname@example.com and we will promptly see to it that your contact information is removed._

My only qualm is that you can't revoke the permission from within the app. The opt-out should be as easy as the opt-in.

<comment><USER28> I suspect this is because technically it would be a PITA to allow users to allow/revoke at their own discretion.

While I agree that it would be nice from the users point of view, the impact of pulling data from the kind of analysis I'd expect them to be doing is going to be a data analysts worse nightmare (i.e. holes in your data set can sporadically appear, so nothing is concrete and all analysis must be reverse- justifiable). If you can reduce the frequency this happens but still give the users the option, this seems like the best of both worlds.

</comment></comment><comment><USER29> It's not a perfect solution, but I don't understand why Path don't hash the contact details before uploading them, and check against the hashes. You can still infer all kinds of social graph information, of course, but they're at least not consuming raw contact details.

<comment><USER30> Preface: I will joining Path this Summer, but I do not speak for the company in any way, nor have I spoken with them about the situation. This is a purely technical reply...

You cant guarantee a unique hash. When you hash users' data there is the possibility of collision; this probability grows with every new user. Without identifying data of some sort, it's difficult (impossible?) to get the exact user.

<comment><USER31> That is incorrect. SHA1 still has no known collisions despite years of research and computing power dedicated to finding just one collision.

Edit: Furthermore since the set of valid emails and phone numbers is a very restricted set of input, it is extremely likely that there are literally no two valid email/phone numbers that SHA1 hash to the same value.

<comment><USER32> I agree that it's practically not a concern, but the local part of an email address[0] is up to 64 characters in an alphabet of size 72, and the domain part is 253+ characters in an alphabet of size 38, giving the valid email space a size of greater than 3e519, which is enough to guarantee collisions in SHA-512 and all of the SHA-3 finalists.

[0] <http://tools.ietf.org/html/rfc3696>

<comment><USER13> If the set of data did contain 3e519 entries then yes it certainly would generate collisions, however it you look at a more restrictive set of data, lets say 5 emails per person alive then you're looking at about 2^35 email addresses which could easily be hashed by MD5 with out a significant chance of collision.

Instead of an MD5 they could just as easily upload a bloomfilter which would expose even less data and would compress it significantly, however it would be more computationally expensive to generate matches that way vs. hashing.

</comment></comment></comment></comment></comment><comment><USER33> "If you accept and later decide you would like to revoke this access, please send an email to firstname.lastname@example.com and we will promptly see to it that your contact information is removed."

There it is. If you have a button that stores all contact information, Why can't you add a button that says remove all my contact information ? Ofcourse, then more people will click it. Just a stunt, nothing more.

</comment><comment><USER34> "It is also stored securely on our servers using industry standard firewall technology."

Undoubtably in plaintext. Having "industry standard firewall technology" didn't do jack for Zappos, why would Path's data be any more secure?

</comment><comment><USER35> The fact that you have to email Path to "revoke access" is still unacceptable.

This information should never be stored on Path's servers. Best case scenario they should be storing hashes of information and before people say there can be collisions so what? The number of people who would be presented with a friend that they don't know will so minuscule versus the number of people whose personal information is stored in plaintext in a database somewhere.

The idea that when someone signs up for Path and is instantly recommended to friend someone else because that person shared their personal information is scary.

Making this opt-in gives people the illusion of control when one of their tech illiterate friends who always clicks accept has already given out all of this information.

<comment><USER24> This place is a privacy disaster waiting to happen. I smell an "ideas guy".

</comment></comment><comment><USER36> I'm glad they decided to nuke the data, but can you really trust them again? This only happened because someone was hacking a project and ended up tracing what Path is doing to his address book and then blogged about it, getting enough attention and momentum to end up forcing Path to take this action.

But can you really trust a company like this in the future?

I think Dave Winer is right. One should treat others data as one would like others to treat their data.

[http://scripting.com/stories/2012/02/08/gladIDontUsePath.htm...](http://scripting.com/stories/2012/02/08/gladIDontUsePath.html)

</comment><comment><USER37> Good for the most part, but does anyone feel like they deliberately left out what it was they're apologizing for?

I can imagine a user unaware of the recent event stumbling across this article and leaving confused about what wrong was committed. They sort of just assume you knew what happened, instead of explicitly explaining what they'd been doing.

But, they're taking steps to resolve the issue, apparently; so good on them.

<comment><USER38> "We made a mistake. Over the last couple of days users brought to light an issue concerning how we handle your personal information on Path, specifically the transmission and storage of your phone contacts."

Dave explained the issue well enough in the first paragraph.

<comment><USER39> If you put yourself in a user's shoes that doesn't know what the issue was then that is still generic. As a user who doesn't know the story I'd be wondering:

\- Did they get hacked and now some unknown party may have the contents of my address book?

\- Were they selling my information to others?

\- Did something happen as it relates to storage that mixed up or deleted information

\- Was my data being transmitted in the clear

\- Was mt data being transmitted without my knowledge or approval?

Two of those things did happen but the user doesn't know for sure. To be fair though, I think their statement was enough. They really don't have to go into more details unless the situation calls for it and it doesn't right now. Those who know get the apology they deserve and those who don't continue using Path as if nothing ever happened. Win win.

<comment><USER40> Paragraph four, which answers questions 2 and 4 in your list and suggests that the answer to 1 and 3 is "No":

"In the interest of complete transparency we want to clarify that the use of this information is limited to improving the quality of friend suggestions when you use the 'Add Friends' feature and to notify you when one of your contacts joins Path––nothing else. We always transmit this and any other information you share on Path to our servers over an encrypted connection. It is also stored securely on our servers using industry standard firewall technology."

The actual problem was number 5, and they tell you exactly how they are fixing this: by deleting all existing data and letting people opt in to sharing it.

<comment><USER41> Actually, in the blog post by the guy who discovered that, he said he was able to read the data - meaning that it was transmitted NOT encrypted (please correct me if I am wrong).

Also, I hope that their "industry standard" firewall is better than their "industry best practices" data sharing practices.

</comment></comment></comment></comment></comment><comment><USER42> Isn't it unfair that Path gets all this press for making a mistake and apologizing? What about all the apps that didn't make this mistake?

<comment><USER43> Sure, but on the other hand press isn't a currency system for rewarding good work. The other apps should have a competitive advantage by not making this mistake.

</comment></comment><comment><USER44> Give credit where credit is due. Zynga would never in a million years do this. Facebook probably wouldn't, either.

Dave's message is straightforward and sincere.

<comment><USER45> Facebook actually asks for your permission before sucking up your entire address book.

Even if that weren't the case, "better than Facebook" is a pretty low bar. "Worse than Facebook" is way, way out of bounds.

</comment></comment><comment><USER46> I have a question about how they store the contacts. Can't they encrypt each of the phone numbers before they get sent to the server? This way there's no breach of privacy and the friend suggestion feature still works for everyone.

<comment><USER47> How would one carry out the friend suggestion feature with encrypted phone numbers?

<comment><USER48> a cryptographic hash of a phone number on their server should match a cryptographic hash of a phone number in a contact list on a phone. The app sends the hash to the server, the server looks up users via the hash and responds with user data for matches.

To be honest this should be a third party service, since it sounds like every major social networking app is doing the same exact thing.

<comment><USER47> In my opinion, giving out your number, along with the hash of each phone number in your address book to an authority with millions of such hashes isn't appreciably better than giving them in plaintext.

(Hi Dan?)

<comment><USER48> But you wouldn't give out your number. I haven't completely thought it through but the service provider would provide an api for common platforms. All it would do is 2-way encrypt contact numbers (SSL?). Then the service would do a basic lookup using the encrypted data as a key. If there is a hit for this particular platform it'll return the platform specific data (in this case, like a path specific user id).

Of course the other side would be maintaining users in this service, which again is pretty straight forward.

(Hi David?... I'm the OTHER DJB, probably not the one you are thinking of)

</comment></comment></comment></comment></comment><comment><USER49> So now they have admitted what they have done, is someone in the UK going to prosecute them, I wonder?

It seems they may have broken the data protection act in more than one way.

* First, they collected personal data about UK citizens without their permission (as a 3rd party cannot give that permission),

* Secondly, personal information was kept for longer than is necessary (it should have been deleted after it was used)

* Thirdly, they allowed personal data to leave the EU.

Note that personal data includes name and address, telephone number or Email address.

<http://en.wikipedia.org/wiki/Data_Protection_Act_1998>

<comment><USER50> This may be a calculated risk. Hopefully they did more due diligence, but a quick search shows a Dec 2011 case [1] where an estate business was prosecuted for collecting info, but was fined a small amount (< £1,000). The extenuating circumstances were that they had already complied with the law by the time the case was heard by the court. [1]: [http://www.ico.gov.uk/news/latest_news/2011/estate-agent- pro...](http://www.ico.gov.uk/news/latest_news/2011/estate-agent-prosecuted- for-offence-under-the-data-protection-act-02122011.aspx)

<comment><USER49> But they are still not complying. They are allowing people to opt-in on behalf of their friends which strictly speaking is against the rules.

</comment></comment></comment><comment><USER51> As someone who is always concerned about my own privacy and the privacy of people who trust our company with their data, i am very pleased to see that when things do go wrong honesty is being appreciated.

While i don't think its acceptable to ever make this kind of mistake, we should also encourage companies to be upfront and honest about what went wrong and what they're going to do to make things better when issues come up.

This is a positive step forward for this company and tech companies as a whole. Having said that, maybe i would feel different however if i actually used this app?

</comment><comment><USER52> Might be worth pointing out that presumably Path's business model is still to collect as much data about their users as possible and sell it to advertisers.

</comment><comment><USER53> "In the interest of complete transparency we want to clarify that the use of this information is limited to improving the quality of friend suggestions when you use the 'Add Friends' feature and to notify you when one of your contacts joins Path––nothing else." Is "complete transparency" == me trusting you just because you say so?

</comment><comment><USER54> I don't understand how they could think it's not a terrible thing and feel dirty for doing it just because they can. It's less about making mistakes and more about developer greed. They could have md5'd the email addresses before sending them or used any number of simple to implement techniques that would still have retained the original feature. Stop telling us it was a mistake! This was a premeditated privacy breach, 1st degree. They decided to hedge their bets and profit from their users by blatant disregard for their own users privacy -- the user's why they have a job and VC in the first place. In the end all this is just going to reduce the user experience with unnecessary confirmation dialogs and prompts because a few lousy startups couldn't keep it in their pants. These companies do not deserve forgiveness; they deserve a class action lawsuit.

</comment><comment><USER55> It is of course stupid that iOS doesn't sandbox and require permission of apps to access the address book. Apple needs to fix this. But it is not enough.

I keep a lot of data about people in my address book in addition to phone numbers and email addresses: birthdate, names of children and spouses, residential and work postal and physical addresses, gift ideas, group affiliations, etc.

I am happy to click "OK" if an app asks for essentially the social graph information that I've already exposed through Twitter and Facebook. I don't want an app to have the other data I've curated. Even if you can trust the app vendor to not be evil, you can't guarantee they won't leak the data through incompetence.

So while Apple really should require permission for apps to get access to the address book, we really need a new model more sophisticated than all or nothing.

</comment><comment><USER25> It's a step in the right direction, but doesn't clear up all of the confusion. I can't update to 2.0.6 (it's not an option on my device, a 4th gen iPod touch running 2.0.5). In addition, how will adding friends work going forward -- Facebook Connect, or manual searches by name?

Will hashing be implemented?

<comment><USER56> If you can run Path 2.0.5, you can run Path 2.0.6. I think you're confused because the AppStore hasn't actually updated yet to show 2.0.6. Try again later today.

</comment></comment><comment><USER57> Nobody seems to be talking about the obvious issue here: they are essentially asking us to trust them again when they tell us they have deleted everyone's contact info from their servers. "We fucked up. But we fixed it, trust us." Am I the only one that finds this odd?

</comment><comment><USER58> Nice to see a transparent and timely response to this issue. I get the feeling that the startup world learned some serious lessons in crisis management after seeing the Airbnb nightmare unfold. At the end of the day, the customers/users are the real winners here.

</comment><comment><USER59> we are sorry you found out what we were doing and couldn't do much other than apologize about it.

<comment><USER60> Yeah. They should just shut down completely.

/s

</comment></comment><comment><USER61> Path is one of the most well-managed apps I have had the privilege of using to date. Their response to this 'scandal' was as close to flawless as it gets.

Not only did they take full responsibility for what they did and apologize instead of making excuses, they deleted all the data people were concerned about, wrote a well-worded blog post about it that hit the top of hacker news within a couple hours, AND pushed a fix for the issue to the app store all within less than a day of the concern becoming public.

Path's attention to detail not only in the gorgeous design and user experience of their app, but in the way they handle PR crises like this one only makes me trust them more. Well done Path, well done.

</comment><comment><USER62> Its very surprising that no one who was involved with the implementation of the feature thought that they were doing something wrong.

Only when someone caught them "in a compromising position" they said sorry.

Its like Bill Belichick saying "I misinterpreted the rule" :)

</comment><comment><USER63> Path should come up with a Privacy Protection Program that commit them not to repeat their mistake. It's too easy to do something and ask for forgiveness later on. That would distinguish themselves from Facebook's way of doing things.

<comment><USER64> The could set up a company in the European Union, and hence be subject to EU Data Protection Law, which is stronger than the USA. They would then be risking fines and court orders for things like this. It would show that they don't think it'd happen again.

It would be a bit of an beaurocratic pain in the ass though.

</comment></comment><comment><USER65> Companies make mistakes. In the rush to develop great products decisions are made rather quickly. When your intentions are pure, the fact that you might be doing something wrong simply doesn't cross your mind.

Unfortunately, these things happen.

What you have to do now is look at how Path reacted. The second the article exposing their mistake was published Path became very open and honest. Above that they offered reassurance to their users, deleted the data (I never expected that), and pushed a feature to opt-in to sharing your private data.

In my opinion they couldn't have handled this any better. For that reason, I give Path all the trust and respect in the world.

</comment><comment><USER66> Call me a cinic, but suggesting that we shouldn't be concerned by saying "It is also stored securely on our servers using industry standard firewall technology" seems somewhat naïve. As if that means that our data was adequately protected from prying eyes...

I'd be impressed if they'd turned round and said "We realise it looks like we were trying to expand our business off the back of your private data, and have therefore decided that in our next release we will stop uploading user's contact details altogether. We'll make our social network so compelling that it'll go viral without abusing your privacy."

</comment><comment><USER67> The photo of Dave Morin and the words "sincerely" felt like a bit of a mismatch.

</comment><comment><USER68> A proper apology. Unlike what Google did with their fiasco in Kenya a few weeks ago, the company actually did away with any benefits they derived from the bad conduct. Google simply apologized (great because it's free) yet didn't mention deleting all data scraped, deleting all contact information collected for the businesses, and cancelling all orders for hosting and other such services. I presume they must have maintained all profits generated by their conduct. It's good to see that Path at least understand what it actually means to be contrite.

</comment><comment><USER69> Private social network seems almost oxymoron. To create large social network, a company has to tap into user's vast social network and try to get the user's friends/contacts to join in as well. And then to increase engagement or stickiness, you have to keep reminding them to come back. Otherwise, the social network company might not grow as fast as founders/investors would like and also most likely affect revenue.... It's a tough place to be, really. I don't condone their action. At the minimum, they should've gotten user's permission first.

</comment><comment><USER70> How do you know they did delete the data?

Do you honestly believe they are sorry and they deleted your data just because they said so?

I personally doubt it. It's valuable for the company and it would be foolish (from their perspective) to delete it. Somebody has to write & test code, to make sure that the code uploads all your contacts.

I find it hard to believe that you have access to all the data, see what is coming in, and then discover, when you're caught that "ups, we did a mistake". Our implementation sucked.

</comment><comment><USER71> The thief is sorry to get caught.

</comment><comment><USER72> I like the apology. They are doing to right things as well by deleting all of the existing data, but it is a lesson to all companies playing in the business-to-consumer space: Have clear and easy-to-read privacy policies and get explicit consent from users before you collect their data.

After reading the post, it is apparent that Path did nothing wrong except poorly communicating their procedures and policies.

</comment><comment><USER73> """We are deeply sorry if you were uncomfortable with how our application used your phone contacts."""

Or do they mean they are sorry you found out about it?

<comment><USER74> a.k.a - the non-apology:

<http://en.wikipedia.org/wiki/Non-apology_apology>

</comment></comment><comment><USER75> They really need to update their privacy policy, which is currently mostly generic nonsense. <https://path.com/privacy>

Regardless of whether they throw up a confirmation prompt, their privacy policy needs to clearly describe what information is scraped from your phone, how it's used, and how long it's retained.

</comment><comment><USER76> There was a great discussion about hashing strategies as an alternative to storing all of this contact info. Did any specific code/examples follow?

It'd be great to see a new "best practice" emerge from this discovery. If it's easy to use, everyone building an app will just default to comparing hashes vs. matching phone numbers.

</comment><comment><USER77> Perhaps I'm too cynical but as I subvocalized this, I added "now" to the end of every sentence.

<comment><USER78> But there are all sorts of sentences in that post that don't make sense with "now" tacked onto the end of them, wouldn't that bother you?

</comment></comment><comment><USER79> I see a trend of pushing the envelope of what is admissible. If users don't like it they are quick to apologize (lusers..., we'll iterate over this...)

If they do it often enough, in the end one of them will even claim they're using the "standard industry practice"

<comment><USER79> "Standard industry practice" in the second paragraph. I can't believe it:

<http://uncrunched.com/2012/02/13/we-are-better-than-this/>

</comment></comment><comment><USER80> I like the "sorry if" comment ...

<comment><USER81> Yeah, I don't consider an apology that blames ME an apology. You screwed up, full stop. You're shirking your responsibility if you're talking about my response to your mistake.

</comment></comment><comment><USER82> I wonder how many backups of their database still have remnants of this contact info?

</comment><comment><USER83> Bah, "We are deeply sorry if you were uncomfortable with how our application used your phone contacts." Is still a non-apology. We're sorry that YOU feel this way. Not, we're sorry that WE screwed up.

</comment><comment><USER84> We are sorry.

We are guilty. We took your contacts...and no, you can't have them back.

</comment><comment><USER85> I was hoping to see that they would just drop the entire database, and then implement hashing from here on out. Otherwise, the apology feels sincere and I appreciate it.

<comment><USER86> "So, as a clear signal of our commitment to your privacy, we've deleted the entire collection of user uploaded contact information from our servers."

That sounds like exactly what you were hoping for.

<comment><USER87> Except for the "and then implement hashing from here on out." part.

So, they haven't changed their implementation, they've just added the ability to opt out of the poor implementation.

<comment><USER88> But hashing doesn't add any protection in this case. There are a very limited number of phone numbers in North America and so those hashes can be pre- computed and rainbow-tabled in a short, reasonable timeframe.

<comment><USER87> Is this true if they were salted with a very long phrase?

<comment><USER88> But the app would need to contain the salt in order to send it to Path's servers hashed and salted. So a hacker could decompile the app to determine the salt.

</comment></comment></comment></comment></comment></comment><comment><USER89> Im SORRY to post this but i just couldn't resist <http://www.youtube.com/watch?v=BeP6CpUnfc0>

</comment><comment><USER90> (This will be an unpopular opinion)

The community response to this is ridiculous. Off the top of my head, I can't think of any other company that has responded to community criticism within a day or two with a policy reversal, a software change, and a deletion of offending data.

Guys and gals, stop picking on Path. They are AWESOME. They deleted your data and changed their app so it would never happen again. Try that with Facebook.

As a nerd, on some level I too lament that they didn't fix this with a cryptographic hash and a bloom filter, but come on, as businesses go, this is top notch.

<comment><USER91> So if I do something bad and then when someone finds out I reverse it, am I instantly forgiven and innocent? And anyone with half a brain can figure out that people would get pissed about this, which means they took the risk to do this secretly. They did not do this accidentally.

<comment><USER90> Occam's razor disagrees with you. It is perfectly plausible that some engineer with little interest in cryptography/privacy implemented the most obvious solution.

Also, yes, I typically forgive people when they reverse their actions and ask for forgiveness. It makes for good relationships.

<comment><USER92> Forgive people, yes. Companies? Eh, plenty of other fish in the sea.

</comment></comment></comment></comment><comment><USER93> A sincere apology always adds value to this world. And I guess, it's sincere, even if there are flaws in it here and there. Just my perception ...

</comment><comment><USER94> Trust - difficult to earn, easy to lose. Let us see whether their users give them a second chance. At least they are open and honest about it.

</comment><comment><USER95> This comes to mind <http://www.youtube.com/watch?v=BeP6CpUnfc0>

</comment><comment><USER96> I still don't understand how someone, maybe even a friend, can allow Path to access/store my information from his/her contact book.

</comment><comment><USER97> Not bad, but could have done without the "As we continue to expand and grow we will make some mistakes along the way." sentence.

</comment><comment><USER98> how do you know they actually deleted all? I'm not saying they did not, but at some point, I expected you to say "pics or it didn't really happen" Many people are getting emotionally attached with companies, apps etc. so that it hinders their ability to even think about whether there is evidence or not.

</comment><comment><USER99> Is anyone cataloging public apologies like this for future reference by start ups and other online businesses?

</comment><comment><USER100> The right thing to do. However, their 2nd paragraph should have been the one starting with "We believe you should have control when it comes to sharing your personal information..."

The rest of it is a repeat of yesterday and is really not necessary.

I do want to know how I can backup by Path to a S3 or Dropbox account. Does anyone know if they support this?

</comment><comment><USER79> Are you guys buying into their PR BS? They knew exactly what they were doing!

</comment><comment><USER101> I wonder if when Path 'deleted' the data, they shredded the hard disks too?

[http://www.networkworld.com/news/2011/042511-google-hard- dri...](http://www.networkworld.com/news/2011/042511-google-hard-drive- shredding.html)

<comment><USER12> That's a good point, and then there are of course back-ups to be considered. Deleting data is surprisingly hard, but fortunately for path this is 'bulk' so that makes it a little bit easier.

Making sure you really lose a single record is a lot more expensive because then you have to selectively remove it from your spinning back-ups as well, in this case you can just wipe the back-ups of the file by opening the file for 'update' and overwriting it with random data.

Tapes are a bit harder again...

</comment></comment><comment><USER102> Sorry doesn't make it OK to start with.

</comment><comment><USER103> Dear Path, go F __K yourself. BYE.

</comment><comment><USER104> I have a real IMPORTANT question...

Did you know that Path by default and always does not store android phonebook address entries on their server?

In facts its against standard android dev practices to the point where its prohibited by Google..

So when Path found out about that in completing the android app why did they continue to insist that it was right on iphone to do so?

Now I would not say the Path CEO is directly lying, but it stinks pretty bad..

</comment><comment><USER105> "we've deleted the entire collection of user uploaded contact information from our servers. " -- I doubt it based on how he define "delete".

</comment><comment><USER106> Seems like they did the right thing. Kudos to a company that reacts appropriately.

</comment><comment><USER20> They still didn't respond to my email that I sent >24 hours ago.

</comment><comment><USER107> Note to PR dicks: never include a mission statement in an apology if that very mission statement is the reason you were hired to write an apology.

Note to app builders: never hire a PR firm to do your dirty work.

<comment><USER108> I have to say, of all the comments here (and the large volume of downvoted ones), I don't see the problem wiht jsavimbi's comment. It does seem very strange to say "We are all about user choice and privacy" while apologizing for violating that credo.

</comment></comment><comment><USER109> Hahahhaahah what a fucking joke

</comment><comment><USER110> I'm kind of sick of this "let's revolt against everybody using my data" mentality. They don't persist your contact data to their server. What exactly is it that you're afraid of?

Moreover, how on earth did you think the "Add Friends" feature worked? I'm assuming at least some of you program software, and you should know that data doesn't just appear out of nowhere. Do you really expect a software startup to move every piece of data sorting & analyzing to the client side that has potential to piss off its userbase?

I understand that it's easy to just encrypt the information, or some other X remedy. I'm just saying there's a line between a software mistake and the let's-grab-the-pitchforks rhetoric that inevitably stems from stories like this.

<comment><USER111> I agree in general, but they do actually store your data on the servers.

<comment><USER110> Oh. Nevermind, then.</comment></comment></comment>


Ask HN: What will be the next big thing after "Big Data" and "AI"? - <AUTHOR> <comment><USER2> It's already here: Blockchain and crypto.

The worst about this comment is that _even I_ cannot decipher if I'm being sarcastic or not.

</comment><comment><USER3> Bioengineering. Soon enough those AIs will be making better humans than we do..

<comment><USER4> Yep. Bioengineering and Bioinformatics, especially with recent gene editing technologies invented. We still don't know what gene patterns cause most of the diseases. Sifting through genetic data (with the help of computers) and finding the patterns responsible (so that they can edited out or modified) for these diseases is going to be a huge industry. As a result, diagnosis and medicine would become personalized to a certain extent.

</comment></comment><comment><USER5> It's contentious but I think it's clear that AI is the final big thing.

</comment><comment><USER6> The existing big things are still getting bigger - chemical engineering, processors, websites, web infrastructure, apps, clean energy, nuclear fusion, AI, IoT, VR, AR, etc.

It's just that advances in one field unlocks a new level in an old field. AI has been around forever, but the changes in processing power and data brought in a new era. Electric cars have been around as long as gas cars, but the changes in batteries brought in a new era. Cloud... augmented by handheld computers that were easy to build programs (apps) for.

The next big thing will likely be some old thing. Maybe improvements in ML will make AR much more useful. Maybe blockchain would make IoT affordable. Maybe VR would make drones a hype again.

</comment><comment><USER7> Beowulf clusters of AI scripted big data machine learning block chain crypto ledger.

</comment><comment><USER8> If you are asking to figure where job demand will go its security. All of the emerging fields will create a tremendous need for security expertise, be it in AI, IoT, blockchain, bioengineering etc.

</comment><comment><USER9> Optogenetic biometrics peg Proof of Self to blockchains mined on nanodrones.

<comment><USER10> gesundheit

</comment></comment><comment><USER11> It won't be as big or as buzzy, but I think we'll see more and more task specific ASICS as Moore's law continues to slow down.

<comment><USER12> And, as it becomes quicker and easier to fabricate these things. But then, isn't the problem with this kind of innovation that, while it might be a revolution, it probably won't spawn a billion blog articles? Consider, for instance, the photocopier. It absolutely upended the office, putting millions of people out of jobs, upturning entire industries - and I doubt many articles was written about it. There are lots of inventions like stirrups, froth flotation, or barbed wire that don't really get much fanfare, but irrevocably alter the world. I think it's the same with tech.

<comment><USER10> It's probably just that the photocopier enabled offices to change but didn't allow many new fundamentally different companies to come into existence which only exist because of this new tool. The bloggy technologies (Internet, smart phones, better batteries) all enabled people like us to start new companies that depend on the tech.

</comment></comment></comment><comment><USER13> In-store paiement / in-shop experience.

The fact that mobile are now / will very soon nbe used in every shops for paiement will open a huge new array of in-shop experiences. This is not a new idea, but wechat is proving time has come.

</comment><comment><AUTHOR> OP...

I went out to eat with friends and we were all arguing about the "next big thing".

It was basically between blockchain, bioengineering, and clean energy.

Curious what others think. (I went with Bioengineering).

</comment><comment><USER14> After Big Data and AI? I'd say MEMS and MOEMS. Not as sexy yet but give it ten years.

</comment><comment><USER15> Distributed ASCII.</comment>


Software for the nuclear industry - <AUTHOR> http://www.plantation-productions.com/Nuclear/Nuclear.html <comment><AUTHOR> "Software for TRIGA ® Reactors TRIGA ® Sites with software developed by Plantation Productions, Inc.

Armed Forces Radiological Research Institute (AFRRI) - Was running QNX software maintained by Plantation Productions, Inc., current upgrading to Linux software created and maintained by Plantation Productions, Inc. (GA Installation)

Bangladesh (BAEC) - Running Linux-based software created and maintained by Plantation Producitons, Inc. (GA Installation)

Dow Chemical - Running Linux-based software created and maintained by Plantation Productions, Inc. (Plantation Productions Installation)

Idaho National Laboratories (INL) - Running Linux-based software created and maintained by Plantation Productions, Inc. (GA Installation)

CNESTEN (Morocco) - Running QNX-based software enhanced and maintained by Plantation Productions, Inc. (GA Installation)

National Tsing Hua University (NTHU/Taiwan) - Running QNX software maintained by Plantation Productions, Inc. (GA Installation)

UC Davis - Running QNX software enhanced and maintained by Plantation Productions, Inc. (GA Installation)

USGS (Denver) - Running Linux-based software created and maintained by Plantation Productions, Inc. (GA Installation)

UT Austin - Running QNX software maintained by Plantation Productions, Inc. (GA Installation)"</comment>


Google: Make source code available after innovation is complete - <AUTHOR> http://3.bp.blogspot.com/-GBSGBbc9UtA/TmexwLaJN9I/AAAAAAAAAKs/06OaexCT5Ms/s1600/Lead%2Bdevice%2Bconcept.png <comment><USER2> All those 'really smart' people and this is their result? "Takeaway: Provide incentives--carrots rather than sticks"</comment>


iOS 8 randomises the MAC address while scanning for WiFi networks - <AUTHOR> https://twitter.com/fredericjacobs/status/475601665836744704 <comment><USER2> If this becomes the trend (which in my opinon would be nice) it will become a big problem for companies that specialise in customer tracking e.g. for supermarkets and big department stores. Previously it was quite easy to track a customer, how long he or she spends time in the store, which floors he or she visits, etc. by putting up dummy WiFI-networks that the customers phones find by giving out their MAC-addresses.

<comment><USER3> It's disturbingly creepy to think that stores would even think of doing this, but on the other hand it's also an indication of how clueless the general population is about the amount of identifiable data they're unconsciously "leaking" through personal, (nearly) always-on devices. My laptop is setup with a random MAC precisely to prevent this sort of tracking.

Interestingly, the unbranded Android phones I have (one looks very much like an iPhone, ironically enough) all came with this "feature" of a random MAC every time the WiFi is turned on/off, although that was more likely the manufacturer not bothering to give each one a unique MAC.

All the more reason to keep the WiFi turned off unless you're actually using it, and this might be a bit on the paranoid side, but I do the same for the cell radio (airplane mode) - it's on only when I'm expecting a call or making one.

At the other end of the scale, this tracking via MAC almost invites making them think several million customers have suddenly entered the store...

<comment><USER4> I'm a technologist and I didn't know that devices advertise their MAC addresses when scanning for WiFi until someone in that business told me. I always thought it was the other way around (base stations advertise themselves and devices affiliate with ones they recognize).

Though accurate, "clueless" is a bit harsh. I don't expect the general public to know the implementation details of WiFi any more than I expect them to understand how a catalytic converter works. The beauty of an abstraction is that you get to reap its benefits without understanding precisely how it works.

<comment><USER3> _The beauty of an abstraction is that you get to reap its benefits without understanding precisely how it works._

...and get to be manipulated and screwed over by the people who do.

While I don't expect the general public to know the details of WiFi down to e.g. the level of the 802.11 spec, I think that some general ideas, like the difference between passive/active scanning, are both simple enough to be understood by analogy and critical to privacy that they should be known more prominently.

</comment></comment></comment></comment><comment><USER5> It's pretty clear that Apple is positioning themselves in stark contrast to Google, they want to be the privacy/security company. Internet companies with advertising business models are a dime a dozen so that is a real advantage that differentiates Apple.

<comment><USER6> The FT brought up a similar contrast two weeks ago when discussing Apple and Google's smart home strategies. They speculated that Apple is likely "to emphasise the privacy protections built into its smart home system... Apple considers privacy a key advantage over Google...since Google relies on targeted advertising as its main source of income" [1].

This will be an interesting competition. Google, for openness and transparency; Apple, for control and privacy.

[1] [http://www.ft.com/intl/cms/s/0/1bef71b8-e433-11e3-a73a-00144...](http://www.ft.com/intl/cms/s/0/1bef71b8-e433-11e3-a73a-00144feabdc0.html)

<comment><USER7> > Google, for openness and transparency

I'm not entirely sure what you mean — that Google openly and transparently tracks user behaviors so that they can make money on targeted advertising?

If you try to compare the two companies, I'd say the difference is that Apple charges you a premium for their devices (thus making money), while Google gathers data about you so that it can be sold to advertisers (thus making money). Theoretically, each company could do both, but recently Apple started differentiating itself by actually emphasizing privacy and limiting access to data about users, in many places.

I do agree that it will be interesting, though.

<comment><USER4> I suspect OP is comparing the way the companies embrace technology. Google has been an big proponent of the open web and of supporting the same standards as everybody else. Apple has been pretty single-mindedly focused on being proprietary whenever possible. (They support open standards on the web, but the rest of their platform is only inner-operable with itself.)

</comment></comment></comment></comment><comment><USER8> This is Apple forcing the in-store analytics companies like Euclid to use iBeacon rather than WiFi. With the market share numbers the way they are, though, for all but the highest-end stores what Android does matters more.

<comment><USER9> I feel like this comment might give a mistaken impression, so I'd like to clarify.

Simply rolling out iBeacons does not replicate the copious data that one can currently get by monitoring WiFi probe requests. iBeacons, as designed, broadcast packets at a set rate using Bluetooth LE, and devices scan for those broadcasts. There is no two-way communication, and no probe requests from client devices.

In order for a company to use information from an iBeacon installation, they must have software running on the client scanning for unique iBeacon UUIDs, optionally filtered by "major" and "minor" uint16s to represent separate locations and nodes. Apple limits iOS apps to scanning for 20 UUIDs at any given time.

If the user does not have software that in some way scans for and does something with data from a particular iBeacon UUID, then the implementer gets no information. Thus, iBeacons move control over location and identity data from third parties to users. If a user installs, say, a Target iOS app, it can now scan for an iBeacon UUID that Target generates and can roll out across the country. Only once the user has made that affirmative choice can Target acquire information about that user or device.

<comment><USER10> > iBeacons, as _currently_ designed, broadcast packets at a set rate using > Bluetooth LE, and devices scan for those broadcasts.

It is possible that iBeacons will provide the copious amounts of data themselves, and this is the first step to that end, as the parent points out.

</comment></comment></comment><comment><USER11> It's about time. I quite intentionally keep my wifi mode off for this reason until I intend to use a network. No doubt someone is tracking and selling every transmission you make.

FWIW, once you read about a PoC of an attack/tracking vector on HackaDay, you can be sure it's already in production tracking you.

[http://www.tomsguide.com/us/how-to-bluesniper- pt1,review-408...](http://www.tomsguide.com/us/how-to-bluesniper- pt1,review-408.html)

[https://www.schneier.com/blog/archives/2008/04/tracking_vehi...](https://www.schneier.com/blog/archives/2008/04/tracking_vehicl.html)

<comment><USER11> For the click averse, the above links are

* BlueTooth Sniper Rifle

* Tracking people by air pressure chips in car tires

</comment></comment><comment><USER12> MAC address ranges are assigned to device manufacturers, I wonder if they'll only randomize inside the Apple device range or if they'll go outside of it. Analytics companies might start seeing people carrying their sparcstations into the grocery store.

<comment><USER13> _Globally administered_ MAC address ranges are assigned to manufacturers. The slide said "random, "locally* administered" addresses, which aren't assigned that way. There's a bit in the first octet to distinguish them; see [https://en.wikipedia.org/wiki/Ethernet_address#Address_detai...](https://en.wikipedia.org/wiki/Ethernet_address#Address_details) .

<comment><USER14> excuse my ignorance but does that mean if one is to use a locally administered address a device is free to take whatever they please? What would be advantage of paying to the IEEE for a universally administered block?

<comment><USER13> > does that mean if one is to use a locally administered address a device is > free to take whatever they please?

I think those have traditionally been set by network admins, not randomly chosen by devices, but pretty much: nobody apart from local admin coordinates addresses with the local bit set.

> What would be advantage of paying to the IEEE for a universally administered > block?

The promise that no device built by other legit companies will have an address from that assigned block, so customers won't have to worry about MAC address conflicts, provided they use only widgets from those who honor the assignment scheme.

<comment><USER15> Legit devices have had duplicate Mac addresses even though they're not supposed to. In practice a totally random MAC is probably safer than the one assigned to a cheap network card.

<comment><USER16> Speaking of practice, I've found recently this: "Five thin client machines with same MAC Address?" ( [http://superuser.com/q/760238/2357](http://superuser.com/q/760238/2357) )

</comment></comment></comment></comment></comment></comment><comment><USER17> This is interesting. If _I_ did this while trying to find an open network, I'd probably be described by the FBI man who tries to charge me with unauthorized network access as using countermeasures learned from al Qaeda's IT guys. If Apple does it on behalf of users though I'm sure it would be fine.

And yes, I've been involved in a criminal proceeding where the government tried to claim that changing a wifi MAC was evidence of malice.

<comment><USER18> well changing the MAC _can_ be evidence for this:

imagine you get banned from your university network for breaking the terms of use (lets say torrenting) - you change your MAC address so you can get back on the network. you know you've been banned and you've made the conscious decision to bypass the security of the network.

</comment></comment><comment><USER13> We learned during the prosecution of Swartz that MAC addresses are the analog of VIN number numbers, and that tampering with them is a sign of ill intent. I await the federal case against Apple or an Apple customer with bated breath.

<comment><USER19> >VIN number numbers

PNS syndrome _plus one_?!

<comment><USER20> What number numbers in VIN number numbers convinces you to number it as a number of numbers that numbers highly enough to be PNS syndrome?

</comment></comment></comment><comment><USER21> There's a great app for rooted Android devices called Pry-fi that generates random MAC addresses while you're not connected to a network.

edit: [https://play.google.com/store/apps/details?id=eu.chainfire.p...](https://play.google.com/store/apps/details?id=eu.chainfire.pryfi)

<comment><USER22> Thanks for the tip!

In reaction to the iOS news, the developer of Pry-Fi wrote this post about the state of the application:

[https://plus.google.com/+Chainfire/posts/Y4fjP6cH45v](https://plus.google.com/+Chainfire/posts/Y4fjP6cH45v)

Since the phone-specific Wifi stacks/drivers seem to be the main compatibility problem, I guess MAC randomization could be implemented as a Cyanogenmod feature on the device level.

</comment></comment><comment><USER23> Many Bluetooth LE devices (including iOS 7) do something similar -- otherwise you'd be able to track people by all of their BT LE devices which are constantly advertising their existence. They cycle their advertised MAC addresses every 15 minutes or so (and some provide a "random resolvable address" which you can use to find out the physical BT MAC address after pairing for easier reconnection).

From my office in downtown Los Altos, I can currently see a FitBit Flex, a FitBit One and a couple of phones -- the randomized MAC address is all that prevents someone bad from tracking them (BTLE scanners/phones are cheap!).

I guess you could still use the 15 minute MAC to track people through a train station or other semi-public space (to gather metrics on where people are coming from and going to). If you had a lot of antennas then you could circumvent the MAC cycling by linking devices in the same area with the same name and similar RSSI...

<comment><USER24> Yeah, our road authority uses anonomised Bluetooth tracking to calculate performance measures for particular routes (Automated numberplate recognition cameras are also used sometimes).

With Bluetooth, not just phones, but a lot of car stereos advertise their MACs.

</comment></comment><comment><USER25> Is there something like this available for Linux desktops?

<comment><USER26> There is a package called macchanger which is said to have the ability to spoof a random MAC address at each reboot. I have a new laptop with Ubuntu 14.04 freshly installed and I can't get it to work though. It's not a high priority but I would like to have this working soon. I used to do this about ten years ago on a laptop running XP and whatever program I was using worked flawlessly. I'm thinking it should be even easier in Linux but haven't found an 'it just works' solution yet.

<comment><USER27> IME the most reliable way to do this is with a udev rule.

Here's my setup (Fedora, so YMMV). /etc/udev/rules.d/51-macchanger.sh:

        SUBSYSTEM=="net", ACTION=="add", DRIVERS=="iwlwifi", RUN+="/usr/local/bin/change-mac.sh wlp0s1"

/usr/local/bin/change-mac.sh:

        #!/bin/bash
        (
            if [ "$#" != "1" ]
            then
                echo "mac changer script must be given iface name as argument: $@"
                echo "Using default of wlp0s1 instead."
                iface="wlp0s1"
            else
                iface=$1
            fi

            /usr/sbin/ifconfig $iface down
            /bin/macchanger -r -b $iface #change to any random MAC address
            /usr/sbin/ifconfig $iface up
        ) >/var/log/change-mac

Note that you would need to specify the correct interface name in the udev rule (or figure out a way to get it dynamically--I never bothered). This also only works for Intel WiFi cards that use the iwlwifi driver; other cards with different drivers need their udev rule changed appropriately.

</comment></comment></comment><comment><USER28> If you're wanting to accomplish this on your desktop/laptop... check out Arch Linux: [https://wiki.archlinux.org/index.php/MAC_Address_Spoofing](https://wiki.archlinux.org/index.php/MAC_Address_Spoofing)

Every single time my laptop boots up, it randomizes it's MAC address.

</comment><comment><USER29> The FTC held a workshop this spring about location tracking, particularly the retail analytics kind that this is calculated to thwart. I spoke there and was the person on the panel categorically opposed to the tracking (though I placed the blame on the wifi device makers for leaking a tracking identifier, rather than the people taking advantage of the tracking opportunity).

[http://www.ftc.gov/news-events/events- calendar/2014/02/sprin...](http://www.ftc.gov/news-events/events- calendar/2014/02/spring-privacy-series-mobile-device-tracking)

You can also read the comments that various organizations filed about this:

[http://www.ftc.gov/policy/public- comments/initiative-516](http://www.ftc.gov/policy/public- comments/initiative-516)

</comment><comment><USER30> If only they thought of that a few years ago [1] [http://blog.erratasec.com/2013/01/i-conceal-my-identity- same...](http://blog.erratasec.com/2013/01/i-conceal-my-identity-same-way- aaron.html)

I hope all the people with IOS8 won't be charged with wire fraud.

</comment><comment><USER31> I've asked the HostAP mailing list about this as a feature request for wpa_supplicant.[1] From what Jouni Malinen says, it should be relatively straightforward.[2] (I think. I used a poor choice of words in my request.)

BTW AFAIK Android uses hostapd/wpa_supplicant.

Its beyond by technical abilities, but hopefully someone submits some patches. (Or Jouni graciously does the deed. Because he is awesome.) HINT HINT WINK WINK.

[1] [http://lists.shmoo.com/pipermail/hostap/2014-June/030405.htm...](http://lists.shmoo.com/pipermail/hostap/2014-June/030405.html)

[2] [http://lists.shmoo.com/pipermail/hostap/2014-June/030406.htm...](http://lists.shmoo.com/pipermail/hostap/2014-June/030406.html)

</comment><comment><USER32> I wonder what effects this has on law enforcement. It seems probable that if stores are using systems to track people by WIFI Mac, then law enforcement is probably doing the same. An interesting trade off.

Also, does this apply to the other ID being broadcast, the Bluetooth MAC?

<comment><USER33> Im thinking this wont affect LEOs as they go through cell towers which is not wifi or bt. see: [https://www.aclu.org/blog/national-security-technology- and-l...](https://www.aclu.org/blog/national-security-technology-and- liberty/us-marshals-seize-local-cops-cell-phone-tracking-files)

</comment></comment><comment><USER34> I hope it still connects with the real MAC address. Otherwise that could get very problematic.

<comment><USER35> Why is that? The only good use that comes to mind is MAC filtering, and that's easily defeated anyways.

<comment><USER36> DHCP with static (reserved) IP addresses comes to mind.

<comment><USER37> Yes, I do this at home because it resolves the problem of a duplicate IP addresses on the network caused by a device assuming it still has the same IP address (Apple devices seems to do this in particular) while meanwhile another one has taken it.

<comment><USER38> What? IME Apple devices are extremely polite about refusing/deactivating IP addresses that are already in use.

<comment><USER37> My experience is I get home, open my laptop, and it seems to by default assume it has the same IP as last time it was on my home network. Meanwhile my kid's 2DS game is using that IP, and I have a few minutes of chaos. I just assign fixed IPs to all the regularly connected devices and I don't encounter that.

<comment><USER39> Are you sure this isn't a router problem? A number of routers have an issue where they occasionally drop their table of DHCP allocations and just start again; this mostly only manifests when a new device connects.

</comment></comment></comment></comment></comment></comment></comment><comment><USER40> This will probably throw Ruckus for a loop - [http://www.ruckuswireless.com/products/smart-wireless- servic...](http://www.ruckuswireless.com/products/smart-wireless- services/spot)

</comment><comment><USER41> I don't know if anyone does that, but if you are making your access point only discoverable to known devices (i.e. known MAC addresses) then this would be a problem, right?

<comment><USER39> I think that's rare enough now that strong encryption is readily available for wireless, but yes, it would be a problem.

</comment></comment><comment><USER42> Has anyone stopped to ask if this is confirmed/true? TechCrunch/Gizmodo/etc... all picked up on this from Frederic's tweet but is a tweet really a definitive news source? Apple has been historically taciturn about documenting these things but does anyone have any more docs or sources for this issue?

</comment><comment><USER43> Depressing that this is not done for OSX as well, but par for the course as iOS remains the focus of apple.

</comment><comment><USER44> RIP Density [0].

[0] - [http://www.density.io/](http://www.density.io/)

</comment><comment><USER45> I think this is a _feature_ for stores implementing WiFi tracking systems, not a hindrance. If I own a store, I _really_ want to understand traffic patterns. If I can do that without causing a privacy shitstorm, I think that's a benefit.

<comment><USER46> You can't understand patterns from random data. Am I missing something you're seeing?

<comment><USER47> They can still understand when anonymous shoppers arrive and when they leave. However, I think zaroth is underestimating how much more useful it is to track an individual shopper's visits over time.

<comment><USER46> If the devices now send a random address for each probe request, you can't even do that anymore... all you'll have is a database full of single requests for a ton of random macaddress

</comment></comment></comment></comment><comment><USER48> I've got a new iPod touch that I've upgraded to the iOS 8 beta and I'm still seeing probe requests with the real MAC address. I wonder if this feature isn't turned on yet, or if it only works in certain conditions.

</comment><comment><USER49> Is it randomized using Dual_EC_DRBG? Seriously though, it's something that should have been done a long time ago, and for Bluetooth too. Hopefully no iOS8 users get arrested for changing their MAC addresses.

</comment><comment><USER50> Here is the bug requesting this feature in Firefox OS: [https://bugzilla.mozilla.org/show_bug.cgi?id=1022444](https://bugzilla.mozilla.org/show_bug.cgi?id=1022444)

</comment><comment><USER51> Princeton's guest network allows users to join for up to 3 days a month. I guess this change will nullify that restriction. :)

<comment><USER52> Once connected the devices will use their actual mac address (else how would mac address filtering work with iphones?), so nothing will be different to usual.

But generally yes changing a mac-address can avoid limitation restrictions like this.

</comment></comment><comment><USER53> Couldn't they just have my device spoof the first smartphone MAC that I see inside the store? That would be a lot more fun.

</comment><comment><USER54> Great tech, but am I the only one who noticed "administrated"?

</comment><comment><USER55> they also randomize bluetooth mac address fyi

</comment><comment><USER56> If only Yosemite would do the same.

<comment><USER57> You can do it with spoofmac - [http://feross.org/spoofmac/](http://feross.org/spoofmac/)

It should be easy to wrap some Applescript around it to make it automatic.

</comment></comment><comment><USER58> What about Bluetooth?</comment>


Ask HN: How does this online guessing site work? - <AUTHOR>

http://en.akinator.com/<p>I'm quite amazed at how its able to guess even obscure people. <comment><USER2> It uses a method named "Divide Et Impera" I think. [http://en.wikipedia.org/wiki/Divide_and_rule](http://en.wikipedia.org/wiki/Divide_and_rule)

</comment><comment><AUTHOR> I dont know i somehow ended up submitting it twice.</comment>


Digg Reader Rollout - <AUTHOR> http://blog.digg.com/post/53894365994/digg-reader-rollout <comment><USER2> Well, I'm getting "There was a problem submitting your email."

It would be nice to know if that's just code for "no more signups" or if the problem is actually with _my_ email.

<comment><USER3> It's being wonky on my end, as well. I had participated in their surveys months ago, which should have afforded me access by now, but still no email. I also signed up manually, and still nothing. I guess there are kinks in the invite system, no biggie, I'll give it a day.

</comment></comment><comment><USER4> Would love to hear from anyone using this what their thoughts are. Pity that they didn't post any screenshots up.

<comment><USER5> Here's a screenshot: [http://i.imgur.com/beNrvCU.png](http://i.imgur.com/beNrvCU.png)

My initial thoughts are that it's dead-simple (not what I had expected) with minimal functionality. The only feature I requested in my survey was to add a Mark All As Read -> Older Than A Day option.

I'm not too fond of the excessive whitespace in the reading pane. It could just be my browser.

<comment><USER6> I'm looking forward to trying this because it's a simple UI (maybe I drank the cool aid). I tried Newsblur but found the UI way too busy and some of the functionality confusing.

</comment></comment></comment><comment><USER7> I've only been registered for about 15 min, but so far it's good. It's very basic with a decent layout, but it's really fast. That might just be because no one is on yet, but the UI seems faster than reader.

I also agree that less whitespace would be nice.

</comment><comment><USER8> Is it just me or is the article text too far to the right? Had it with every feed I tried.

On the plus side, lightning fast (especially the import).

<comment><USER9> hi! yeah, we are going to move the content more to the left instead of centered. glad to hear it's fast for you!

</comment></comment><comment><USER9> hey guys - Mike Young from Digg here. thanks for the comments. would love hear everyone's feedback if you give it a try. i agree on the whitespace too - something we are updating now. lots of fixes+features coming. we're rolling it out today but if you'd like an invite link, please drop me an email...which is my username at digg. thanks!

</comment><comment><USER10> Considering that this is Digg Reader's first public outing, it is very, very good. This can only bode well. Well done guys!

<comment><USER9> thanks Nick - really appreciate that! still a lot of fixes/features to add..

<comment><USER10> One thing I have noticed is that the boldface on unread articles appears to be off.

For example, one of my subscriptions is Hacker News ([http://news.ycombinator.com/rss](http://news.ycombinator.com/rss)). If I 'mark all as read' then the unread count goes to 0 and all articles titles appear in plain text, as expected. 10 minutes later the unread count is now 4. Click on that subscription and there is now maybe a dozen or more titles in bold text - and not just the top dozen (the most recent) but randomly spread out.

</comment></comment></comment><comment><USER11> Anyone want to replace Google's SMS search feature -- that they cancelled. (I don't use it).</comment>


Ask HN:  Where is the Tivo social network? - <AUTHOR>

For many years now I've been wondering when the Tivo social network would show up.  Why hasn't Tivo, DirecTV, Comcast, someone with the content built one?<p>http://blog.louisgray.com/2008/06/tivo-is-zero-on-social-web-its-time.html <comment><USER2> Comcast bought one (Plaxo) and BTW Comcast is the only company you've mentioned who owns content. Comcast is also active in pursuing a new recommendation and rating systems similar to your post - its going to be rolled into new versions of their guide and interactive tv strategies. The hard part about this is that Comcast is glacially slow and deploying something like this. (By "this" I mean new set-top-box based interactive technologies - they're not really looking to deploy these apps as a "two-screen" experience)

But I think what most content providers are looking for are ways to leverage existing social networks (twitter and facebook come up a lot) as opposed to a new type of social network.

Oh and BTW Tivo's popularity is dropping precipitously and not a good example right now most people are switching to cable provider DVRs (especially if they start implementing network DVRs)

[http://tvbythenumbers.com/2009/11/24/tivo- loses-314000-subsc...](http://tvbythenumbers.com/2009/11/24/tivo- loses-314000-subscribers-worst-quarterly-subscriber-fall-yet-now- below-3-million/34484)

<comment><AUTHOR> Instead of "own the content" I should have said tv usage data ( season passes, what's recorded, etc ). Too bad these companies aren't into sharing their data and providing open apis like netflix.

They would be smart in leveraging existing social networks like facebook. The only good facebook integration I've seen is visual bookshelf.</comment></comment>