Russian FOSS activist arrested in Russia for his Tor exit-node - <AUTHOR> Dmitry Bogatov was arrested on the 6th of April: he became part of the big penal case initiated by Russia's Investigation Committee on "incitations to mass riots" during the protest action that took place on the 2nd of April in Moscow. According to the Investigation Committee, Bogatov was publishing messages on the forum sysadmin.ru, inciting to violent actions, for example, "he" was suggesting to bring to the Red Square "bottles, fabric, gasoline, turpentine, foam plastic". According to the Investigation, the experts had analyzed the text of these messages and proved a "linguistic and psychological characteristics of incitations to terrorism". However, Dmitry claims that he has nothing to do with posting the incendiary messages.
Dmitry Bogatov, 25 years old, teaches maths in MFUA (Moscow Finance and Law University) was a free and open source software activist (https://sinsekvu.github.io/pages/about.html). Dmitry was administrating a Tor exit node (https://atlas.torproject.org/#details/2402CD5A0D848D1DCA61EB708CC1FBD4364AB8AE) from his house. In fact, the author of "incendiary messages" (called "Airat Bashirov") was using Tor, and, by lack of chance, he used the ip adress of Dmitry's exit node.
Dmitry's lawyer, Alexei Teptsov, presented videos from surveillance cameras, that proved that, during the moments when the "incendiary messages" were posted, Dmitry was away from his computer. He was coming back from a fitness center with his wife, Tatiana, a genetician, and then went to a supermarket, where cameras were also working. Moreover, "Airat Bashirov", the author of the provocative messages, continues to post on sysadmin.ru, while Dmitry is under arrest. The last post was seen on the forum on April 11.
Dmitry will stay in pre-trial detention center until June 8 at least. Now the Investigation is examining all his seized devices. <comment><USER2> Not to excuse the behavior here, but anyone else who would like to run a Tor exit node can learn from this situation. Follow the best practices[0] for running an exit node, which would include not running it from your home.

You are much less likely to be raided and arrested if a cloud server in a datacenter somewhere, leased by an anonymous LLC you control, is the subject of an investigation.

[0] [https://blog.torproject.org/blog/tips-running-exit- node](https://blog.torproject.org/blog/tips-running-exit-node)

<comment><USER3> If you _actually_ think you run a high risk of being raided for your behaviour, is it ethical to put some poor saps running your data center in that position instead of you?

Admittedly, I guess data centers run this risk automatically by the fact of providing data storage/transfer services.

<comment><USER4> I am involved in a non-profit that operates Tor exit nodes for a while ( [https://nos-oignons.net](https://nos-oignons.net) ), and before then I was running exit nodes on my own.

The main benefit of setting up a non-profit is not shifting the risk to "the poor saps in the data center": the police isn't going to kick down the door of the datacenter any more than they would raid your ISP.

The main benefit is that you get listed as abuse contact, and you get contacted the same way an ISP gets contacted: you get a somewhat-polite email (or a fax <3) asking who that IP address belongs to. At that point, you can explain what Tor is and that you do not know the origin of the connection; somehow, it's more difficult to have that conversation when you are in an interrogation room, talking to someone likely believes you are guilty.

</comment></comment></comment><comment><USER5> Sources:

[https://meduza.io/en/feature/2017/04/10/mathematics- teacher-...](https://meduza.io/en/feature/2017/04/10/mathematics-teacher- accused-of-inciting-mass-riots-now-also-accused-of-supporting-terrorism-and- once-again-detained) (English, Tor is not mentioned yet)

[https://geektimes.ru/post/287944/](https://geektimes.ru/post/287944/) (Russian)

[https://zona.media/news/2017/11/04/home](https://zona.media/news/2017/11/04/home) (Russian)

Liveblogs from the court (Russian):

[https://zona.media/online/2017/07/04/2april](https://zona.media/online/2017/07/04/2april) (Day 1)

[https://zona.media/online/2017/08/04/bogatov-2](https://zona.media/online/2017/08/04/bogatov-2) (Day 2)

[https://zona.media/online/2017/10/04/bogatov-3](https://zona.media/online/2017/10/04/bogatov-3) (Day 3)

</comment><comment><USER6> The "This happens in the US too" comments are an annoying pointless digression.

Just like in the Wikileaks threads when people go on about the abuses in other countries, and how unfair it is that JUST America's/ the DNC's/ the CIA/ the NAS's dirty laundry gets aired.

Repression and abuses of power should concern us all. One evil does not negate an other.

<comment><USER7> It is the primary mode of Russian paid trolls to use the "tu quoque" method of argumentation ("You do it too!") in online discussions. However, tu quoque is a fallacy. It is irrelevant to the discussion if other places do other things. We are talking about this specific instance. It also is trying to create a false equivalence, stating that if a bad thing happens once in country A, it is as bad as country B. However the frequency and severity of these matters is almost universally different, which shows the false equivalence.

<comment><USER8> The idea is to shift the conversation from one of utter disapproval for Russia's actions, to one where positions are negotiable.

If the US has even one instance of doing this, then questions arise such as:

1\. Maybe this is unavoidable, and if so how much time/money should we spend chasing down an unavoidable issue?

2\. Maybe there are specific circumstances where this is okay? Why isn't this one of those specific circumstances? We should trust the Russian government, just as American's give their own government the benefit of the doubt.

</comment></comment></comment><comment><USER9> What's concerning to me here is "Now the investigation is examining all his seized devices". It's possible, although perhaps slightly paranoid, that the message posting was intended to create pretext for seizure.

This may be a little far-fetched - there's likely easier ways to generate pretext - but it might be something for owners of Tor exit nodes to be aware of.

<comment><USER10> It's more likely that Russia just does not like Tor in general, so they find excuses to put users in jail and mess with their devices just to dissuade other people from using Tor.

From that perspective, your theory is not so far-fetched because it's not like the Russian government went through a lot of effort to frame this activist in particular. Any other Tor user would do.

<comment><USER11> Added to that, they need to show they are fighting terrorism online. Finding actual terrorists is hard and dangerous. Finding people reposting memes on Facebook or running Tor exit nodes and jailing them under terrorism and "extremism" laws is much more cost effective, and looks the same in the statistical reports. Since there is no independent courts in Russia and prosecutorial abuse is almost never punished (it's very hard to punish it even in the US, in Russia it's orders of magnitude harder), and acquittal in Russian court is vanishingly rare (only 0.4% criminal cases end in acquittal) - there's no risk involved except for maybe couple of articles in the press.

</comment></comment></comment><comment><USER12> When are authorities, or people in general, going to realize that IP addresses are NOT a "smoking gun".

<comment><USER13> It's Russia, They don't likely believe him to be the culprit, instead they're trying to break down the spirit of the masses for using or the facilitation of TOR which they cannot control.

<comment><USER14> Exactly. And what a silly move, since even shutting down all the Tor nodes in Russia would not stop Russians from using Tor for the same activities.

It will be interesting to see if Russia adopts a network monitoring and censorship strategy as China has[0]. Of course, it would be tragic if they did.

[0] [https://en.wikipedia.org/wiki/Great_Firewall](https://en.wikipedia.org/wiki/Great_Firewall)

<comment><USER15> It will be adopted in Russia. I have an acquaintance who's working on deep packet inspection for Rostelekom and he tells me it should be ready within the next 2 years.

<comment><USER16> I suspect we'll do it here in the US too eventually, under a "national security" umbrella to, "protect ourselves some foreign cyber-terror" or such nonsense. The UK will probably do it first...

Edit: Remember that a huge portion of this country is demanding a 2000 mi long _wall_ be built along one border... don't underestimate stupid and scared.

<comment><USER17> It is already happening in the US, just slightly differently. Befitting our "national character", as the Chinese term it, our great wall is made of advertising.

Deep packet inspection is here today for Comcast and other ISP customers. The nominal reason for the surveillance is typical adtech panty-sniffing, but of course the data is also available for subpoena, assuming ISPs actually ask for one, or just freely given out (that's more of an ATT thing).

And given that we know the FBI recruits Geek Squad techs to become informants and collaborators[1], who really thinks the FBI, DEA or another TLA won't do the same/hasn't already started doing the same with, say, network techs at Comcast? The same come-ons that worked for the Stasi work just fine elsewhere.

The people down-voting this comment, if they're doing so out of the belief that "it won't happen here", are simply wrong.

The surveillance-entertainment complex was born in the US, and the tools are massively attractive to anyone who covets power. Anyone who doesn't think the world-empire of the day will use them is deluding themselves.

[1] [https://www.washingtonpost.com/local/public-safety/if-a- best...](https://www.washingtonpost.com/local/public-safety/if-a-best-buy- technician-is-a-paid-fbi-informant-are-his-computer-searches- legal/2017/01/09/f56028b4-d442-11e6-9cb0-54ab630851e8_story.html)

</comment></comment></comment></comment></comment></comment><comment><USER18> 1) The title is misleading.

2) If someone using your TOR node posts a message threatening to kill someone, YOU will be SWAT-ed first and only then police will find out you run TOR exit- node and maybe you are not the one who posted it. You implicitly accept risks associated with your operation.

<comment><USER19> Why would running a Tor exit node ever imply that the people exiting at that node are speaking on your behalf? Is a coffee shop "vouching" for you by letting you use its wifi? Is your ISP?

And if you're a cop, why would you dispatch a SWAT team to a Tor exit node at all? You can see if the IP is on the list and if so you'll have a hell of a time proving that the traffic came from the person running it even if they did (after all, why would they even use their own IP address when _you could have used Tor_?). At that point, you're basically punishing a random, innocent person for the (legal) act of running an exit node.

<comment><USER18> > Why would running a Tor exit node ever imply that the people exiting at that > node are speaking on your behalf?

If we imply that TOR exit-node owners are innocent by default, what stops me from installing TOR node, posts threatening messages and when police comes say "hey i am humble TOR node owner, look somewhere else"?

> why would you dispatch a SWAT team SWAT was just an example.

Whatever law enforcement agency that investigate your case.

>You can see if the IP is on the list

You have to know there is such thing as TOR exists & see first part of the comment.

<comment><USER20> > If we imply that TOR exit-node owners are innocent by default, what stops me > from installing TOR node, posts threatening messages and when police comes > say "hey i am humble TOR node owner, look somewhere else"?

If you're savvy enough to run a Tor exit node and want to post threatening messages, why wouldn't you use Tor yourself?…

But anyway, at least in the United States, everyone is "innocent by default" \- that is, until proven guilty beyond a reasonable doubt. If the presence of a Tor exit node, or an open proxy, or an open Wi-Fi network, or any number of other things makes an IP address insufficient evidence by itself, well, that's too bad. It may still be sufficient evidence to launch an investigation into the owner of the Internet connection, to gather more evidence - but even then, the standard is based on the likelihood that they committed the crime, not something about incentives to run exit nodes.

<comment><USER21> >But anyway, at least in the United States, everyone is "innocent by default"

The presumption of innocence only applies to the jury. Even with it, you can be arrested and the prosecutor will make the best possible case against you. It does not apply to anything that has happened in this story so far.

</comment></comment></comment></comment></comment><comment><USER22> In Soviet Russia you do not critique the government, the government critiques you. If necessary, jails you. If absolutely necessary, poisons you with Polonium-210.

<comment><USER23> If someone in the US posted publicly about bringing "bottles, fabric, gasoline, turpentine, foam plastic" to a protest, they'd get a visit from the FBI. Speech that incites violence is something they investigate regularly.

<comment><USER24> It looks like he didn't post any of that though.

<comment><USER25> Exactly. It looks like. You can't just blame authorities because they arrested him for investigation while the only thing you know is that it looks like he hasn't written them.

<comment><USER26> They have to make sure he didn't queue up messages to be automatically posted according to a predetermined schedule while he was establishing an alibi away from his computer.

<comment><USER24> Obviously he's a FOSS extremist..

</comment></comment></comment></comment></comment></comment><comment><USER27> This happens in the U.S., too.

</comment><comment><USER28> I know this opinion is not going to be popular, but here it goes: by running a Tor exit, you're letting anonymous people do whatever they want in your behalf, because the exit IP address relates their activities to you. I believe it's irresponsible to do so. This kind of stuff is going to happen.

I also don't believe the "an IP address doesn't identify a person" mantra that's so widely used in the privacy-aware circles. Your ISP gives you an IP address for yourself, and if you let others use it, you know you can get yourself in trouble, the same you'd get yourself in trouble if you let anybody who asked you use a rifle of yours, or a car. Would you let someone you don't know at all drive your car? What if he runs over someone? Would you be responsible of it for letting him use your car? Would you risk going to prison?

The alternative is worse: I could be looking at pedophilia or terrorism sites all day and if they catch me say "well I also run a Tor exit node so how do you prove it was me!". Your IP identifies you, so be responsible!

<comment><USER29> > ...the same you'd get yourself in trouble if you let anybody who asked you > use a rifle of yours.

You lost me here. This is more like letting someone make a call with your phone. Rifles are inherently dangerous, even gun enthusiasts agree on that. We're talking about information more broadly here.

<comment><USER28> For what reason would a person want to use Tor instead of his regular connection?

And before you tell me Tor is nothing more than a privacy tool, remember that most sites ban Tor exits because the majority of users are troublemakers.

<comment><USER30> Seriously? I imagine >95% of consumers would adopt tor quickly if browsing performance was comparable to standard browsing (hell it would be packaged with firefox). The general public hates being tracked and having their privacy invaded. Just look at the political mess created when congress gave ISP's the right to sell user browsing data at the end of last month.

<comment><USER28> >The general public hates being tracked and having their privacy invaded. Just look at the political mess created when congress gave ISP's the right to sell user browsing data at the end of last month.

You gotta be kidding me. If that were the case nobody would ever use Facebook, or browse the web without an ad blocker and blocking 3rd party cookies. I also like privacy but we have to understand that nobody really cares about that. Maybe it's because they are not educated and don't know what the risks are, but whatever the reason, privacy is ignored by most people.

<comment><USER31> In the case of Facebook, users might very well not know the extent by which Facebook tracks them. In the case of ad-blockers, users (at least those I've met) tend to not know they exist, and are excited to try them out.</comment></comment></comment></comment></comment></comment>


A life lesson from the majors: Smile, you'll live longer - <AUTHOR> http://www.boston.com/sports/graphics/Life_Lessons_from_the_majors/ <comment><USER2> My knee-jerk reaction to this is, "Another useless confusion of correlation and causation! Stupid media! Stupid HN!"

But...

A family friend had a stroke. It affected his gate and speech. He found that if he smiled broadly, both his gate and speech became more fluid. This suggests that the _act_ of smiling can change function of the rest of the nervous system.

So who knows?

</comment><comment><USER3> As others mention, another potentially incorrect causation/correlation confusion. Smiling for you baseball photo is not necessarily indicative of smiling in general. Perhaps. But it's quite possible that the players who smiled for their photo were already well-established, could afford to seem less professional, etc. And if they were more successful by the time of that photo, then perhaps their careers on average were more successful, and hence they had easier, more-stress free and perhaps longer lives.

Or to continue the success-at-time-of-photo idea, maybe they smiled because the photographer smiled at them more, because the photographer was more familiar with them. Could by any number of reasons that the two things were correlated, all of which wouldn't necessarily imply that if you, reader, smile more, then you, reader, will live longer.

Though that's probably true. But yeah, easy to forget that a smile itself is very much an effect of something else. Concluding that if you 'smile more', something good will happen is sort of a false optimization. Smarter to figure out what you should be smiling about. And if you're not, be in search of why.

P.S. In other news, the New York Giants? Really? There's more concrete psychology in that Freudian slip. And then you look at who they chose for the info graphic. The Brooklin Dodgers? Nice try, Boston.

</comment><comment><USER4> I've been using a mood hack recently which has been working great for me. It might work for you too but no gurantees as everyone is different. So the hack goes like this. Whenever you're feeling down or not particularly cheerful, force your face into a smile, a really big one and hold it for 30 seconds. Really tense up your facial muscles like you're flexing your bicep, but on your face. Empty your mind of all negative thoughts. At some point during the 30 second hold, you'll feel a little happier. The muscles will trigger a release of neurotransmitters like serotonin and other happy chemicals.

</comment><comment><USER5> OP forgot a few variables...

Roy Campanella spent most of his life in a wheelchair after a horrible car accident.

Mickey Mantle drank more alcohol than many small countries.

Do you think these things just might have a little more impact on longevity than smiling?

<comment><USER6> Hence the reason you try to take a large sample size (230 photos), to control for effects like that. Those players are just examples.

Besides, Mantle drowning himself in alcohol typically = unhappy. As they did not explicitly say SMILING MAKES YOU LIVE LONGER, but that players who tended to smile tended to live longer, that still fits the results. The unhappy guy is killing himself, and it shows up in his facial expression.

</comment></comment><comment><USER7> _Classify the players' smiles, from none to light-up-the-locker-room. Then see how long the players lived._

I haven't read the research article, and I agree that smiling doesn't hurt, but this post surely doesn't make it sound very scientific. I wouldn't drop the "Correlation is not causation" bomb, but they seem to have missed it.</comment>


Understanding ECMAScript 6 by Nicholas C. Zakas - <AUTHOR> https://leanpub.com/understandinges6/ <comment><USER2> Just bought the book.

This is a front-end tech lead for Yahoo writing a book about a new language revision, and this is when I buy in and really start paying attention.

I've been reading some interesting ES6 materials, but the absolutely most worthwhile reference is that written by a hardcore practitioner that's a key contributor to massively used products.</comment>


Ask HN: Not-SaaS analytics - <AUTHOR>

Hello HN,
We've been looking for analytics for web application, which could be run in our own servers. I like Mixpanel, but because of the nature of the service, we have to keep the data on our servers.
Any recommendations or experiences? <comment><USER2> If you're looking for Google Analytics-style "high level website stuff" (visitors, pageviews, per-page, yadda yadda): <http://haveamint.com/>

If you're looking for MixPanel/KissMetrics style arbitrary event tracking, I do not have a good recommendation for you for an OSS or off-the-shelf solution. I'd be interest in hearing others' experiences.

A lot of consulting clients end up rolling their own. You can get pretty far with Postgres or Redis and hourly/daily cron jobs which dump their output to a few admin screens. They're several orders of magnitude more expensive than the SaaS alternatives (+), marketing can't use them w/o engineering helping out to set them up, and they're generally going to produce less pretty output, but they're often perfectly adequate for decisionmaking.

(+ I struggle to think of a consulting client which does metrics in-house that does not have six figures or more of implicit engineering cost in their metrics systems.)

</comment><comment><USER3> I've read a previous thread a few months ago asking for advices on analytics for a startup, you can find it here : <http://news.ycombinator.com/item?id=4707903>

In it you can find multiple open source solutions such as Piwik (see sheff comment), snowplow (<https://github.com/snowplow/snowplow>) and Graphite (<http://graphite.wikidot.com/start>).

Hope this helps.

<comment><AUTHOR> Didn't know about those, thanks. Going to look over them.

We don't need to know where our users come etc, but more following certain events and patterns and how they engage with the app.

</comment></comment><comment><USER4> Have you looked at Piwik ?

Its open source, fairly well established and can be self hosted.

A list of its main features can be seen here : <http://piwik.org/features/list/> .</comment>


New Form of Matter? - <AUTHOR> http://www.rdmag.com/News/2012/06/General-Science-Physicists-Make-New-Form-Of-Matter/

<comment><AUTHOR> Summary: An announcement by a Stanford University team in Physical Review Letters that it has created the world's first dipolar quantum fermionic gas from the metal dysprosium—"an entirely new form of quantum matter," as Stanford applied physics professor and lead author Benjamin Lev put it—represents a major step toward understanding the behavior of these systems of particles. And this understanding makes for a leap toward the supernatural- seeming applications that condensed-matter physics conjures.</comment>


The impossibility—and the necessity—of distinguishing science from nonscience - <AUTHOR> https://www.weeklystandard.com/daniel-sarewitz/all-ye-need-to-know <comment><USER2> On Hossenfelder's book, but not so much on the (IMO doomed) philosophical project of logically demarcating some ideal notion of scientific practice, see also mathematical physicist and long-time String skeptic Peter Woit's review[1] which goes into some interesting details of her conversations and comes with a copious and interesting comments section.

1: [http://www.math.columbia.edu/~woit/wordpress/?p=10314](http://www.math.columbia.edu/~woit/wordpress/?p=10314)

</comment><comment><USER3> Here is a link to an excellent discussion between Sabine Hossenfelder and Julia Galef about this issue: [http://rationallyspeakingpodcast.org/show/rs-211-sabine- hoss...](http://rationallyspeakingpodcast.org/show/rs-211-sabine-hossenfelder- on-the-case-against-beauty-in-phy.html)

</comment><comment><USER4> a few interesting points here, but the author misunderstands one critical idea: science is always wrong by design. this is why the author claims that popper is irrelevant.

he doesn't understand what popper understood: each scientific experiment is an asymptotic step towards a 100% accurate understanding of reality. that's it.

it doesn't matter if the experiment "failed" or succeeded, so long as it was methodologically sound. you don't even need to understand that you're making an asymptotic step at all! every element of a hypothesis built this way is falsifiable by another such asymptotic step. note: falsifiable does not mean that the entire hypothesis is discarded -- just one element.

is this process inherently self correcting? not on the timescale we'd like, but ultimately, yes.

the current institutional problems with science are severe, but largely inconsequential in the very long run of human knowledge. institutional science as it is currently practiced is not the only "science" nor is it so flawed as to be unworkable. simply put, problems of scientists and people performing science can slow down the march of science, but it can't stop the production of new knowledge.

the same goes for editorialization of findings, misuse of descriptive language by scientists, misuse of quantitative models, etc. these are problems which MIGHT cause a smaller number of asymptotic steps, but only on the scale of a hundred years at the worst. we're in the game for thousands or maybe millions of years. we have the time to make these mistakes and get over them. and often, when we realize our mistakes, we make a ton of progress immediately after.

so, then, what is science? an intentional use of objective methodology to improve knowledge of reality.

</comment><comment><USER5> The topic itself is important, but I thought a few statements were subtle attacks on the scientific community. Perhaps I'm too suspicious. But here are the statements, with my italics emphasizing the key parts:

"In a time when expertise and science are _supposedly_ under attack, some convincing way to make this distinction would seem to be of value."

It seems to me that science and rationality are under heavy attack in this country, and the author is attempting to undermine that view.

"According to the New York Times, the Higgs discovery confirms "a grand view of a universe described by simple and elegant and symmetrical laws—but one in which everything interesting, like ourselves, results from flaws or breaks in that symmetry." _Whatever that means_ —but I'll come back to the question of meaning later."

I take _whatever that means_ as a dig at those highfalutin egghead scientists and their mouthpiece, the _New York Times_ , who are trying to put something over on us. It's unbecoming of an author who is himself a research scientist.

"But if all this activity is just self-correction in action, then why not call _alchemy, astrology, phrenology, eugenics, and scientific socialism_ science as well, because in their time, each was pursued with sincere conviction by scientists who believed they were advancing reliable knowledge about the world? On what basis should we say that the findings of science at any given time really do bear a useful correspondence to reality? _When is it okay to trust what scientists say?_ "

I see this as more undermining of science.

"What we nonexperts choose to believe about such matters will depend much more on _whom we trust_ and what we find to be helpful than on what can be known to be true."

Don't trust liberal scientists.

As I say, maybe I'm too suspicious, and this author has no agenda.

<comment><USER6> It's from the Weekly Standard (a conservative opinion magazine). It certainly has an agenda, but that doesn't mean it can't make valid points. And I think it does.

</comment></comment><comment><USER7> What makes something a science is actually a good question, and most practicing scientists don't have a good answer for that because they have only seen their own field, which is shaped by the peculiarities of its topic of study. I didn't have a clear view until I had been through three or four fields and spent several years resolving my mental dissonance.

I [wrote a book]([http://madhadron.com/into_the_sciences- sample.html](http://madhadron.com/into_the_sciences-sample.html)) on the structures I found. Sadly, I don't think it's an effective teaching tool. It's made most people's eyes glaze over except for other people who have also worked across different scientific fields who breezed through and say, "Yeah, that's it exactly."

</comment><comment><USER8> _> Popper's idea that scientific theories must be falsifiable has long been an outdated philosophy. I am glad to hear this, as it's a philosophy that nobody in science ever could have used . . . since ideas can always be modified or extended to match incoming evidence._

I don't know what is the context of this quote, but this sounds like a deep misrepresentation of Popper's position. As far as I know, he explicitly addresses the issue of ad hoc and auxiliary hypotheses. Unless this is part of a bigger point about some the "fine-tuning" of theories i.e. just how much the main proposition can be off the mark given the additional hypotheses.

</comment><comment> 08-15 > ecology, epidemiology, cultural anthropology, cognitive > psychology, > biochemistry, macroeconomics, computer science, > and geology? Why do they > all get to be called science?

They do?! Well, then the term "science" clearly means nothing anymore.

<comment><USER7> On the contrary, it does mean something. It just doesn't mean "looks like physics," which is actually a really strange science. Add musicology and history to that list, too.

<comment> 08-15 So, what does it mean?

As far as I understand, science means to have at least one theory with some explanatory power, to test that theory by experiment, and, crucially, to discard the theory if it is invalidated by experiment. That quite obviously does not apply to many of those listed.

> Add musicology and history to that list, too.

History?! Well... nope, it isn't. I might change my mind if you (or anyone) can come with a definition of "science" that includes history and doesn't also include astrology, though.

<comment><USER7> I wrote a book about it. :) See elsewhere in the comments.

The framework is a little more than a theory. The basic unit is some kind of trial (experiment, observation), which is an attempt to adequately approximate an idealized trial. Whether that approximation is adequate is a matter of reasonable practice in a given time and setting. Trials produce values of some kind of primitive notion: a velocity, a drawing of a typical dandelion. Then you construct a formal system (a theory) that recapitulates the values of primitive notions that emerge from trials.

History and musicology certainly fit this.

<comment> 08-15 So do astrology and bioinformatics.

Let's look at (a particular application of) bioinformatics. I sequence the DNA of a bunch of humans and a neanderthal. I apply some statistics and proclaim that humans and neanderthals admixed. Later, I sequence more humans and another neanderthal. Applying the same statistics, things look a bit messy now. So I proclaim that there were two admixture events, but I also change the estimated amount of admixture and pretend that this is still consistent with the first claim. Years later, another genome, another admixture event, more hand waving excuses for the numbers that don't seem to fit the big picture.

Is that science? Some kind of trial is there. It is appropriate given time and setting. Some kind of value (a p-value) is produced. Even the theory is there, even though calling it "formal" is a stretch. So this is science? I don't think so.

<comment><USER7> Yes, there's more to it, otherwise I would have written a blog post and not a book.

</comment></comment></comment></comment></comment></comment><comment><USER9> " _It's one thing for theoretical physicists to chase the wrong theory about fundamental particles for 25 years with nothing to show for it but high- prestige publications. That's fun._ "

 _Nothing_ to show for it? Nothing?

Supersymmetry is a very successful theory. Alzheimer's research had actually learned a lot. Sure, there are a lot of problems with how science is done, but there are a lot of problems work how anything is done.

If you go into science expecting that your theory is the perfect answer and that anything else is failure, you are going to be disappointed.

<comment><USER10> Those examples seriously undermined the article.

If you want to be annoyed that an MRI of a dead fish gets publishable results, go ahead. I am too. But this very quickly took a detour into "sometimes hypotheses are wrong, therefore science is stupid".

We haven't had 25 years of a wrong belief about Alzheimers, just 25 years of "shit, this is hard to understand". And given the history of non-scientific- theory medicine (we cured scurvy ~5 times before word got out), it still seems like a winning score.

I know it's fair to criticize something without having a better solution, but it's still jarring to see science attacked on topics where it has a better track record than anything else ever devised.

<comment><USER11> I agree, but I won't not disagree. We are due a resurgence in responsible Hegelian dialectics, but it's easier said than done. I think both arguments fail the test in this case.

</comment></comment></comment><comment><USER12> I'm sorry, but why is the neo-con anti science article on HN?

The article is attempting to say that modern particle physics is not science because there are a ton of failed experiments to find exotic particles and test theories.

This is how science works!! Your doing science correctly if you fail a lot. Yes it costs money to set up an experiment that fails to prove a hypothesis. That's just science.

Read more about "The Weekly Standard" here..

[https://en.m.wikipedia.org/wiki/The_Weekly_Standard](https://en.m.wikipedia.org/wiki/The_Weekly_Standard)

Edit: Here's an excerpt

"Of course the standard explanation of the difficulties with theoretical physics would simply be that science advances by failing, that it is self- correcting over time, and that all this flailing about is just what has to happen when you're trying to understand something hard. Some version of this sort of failing-forward story is what Hossenfelder hears from many of her colleagues. But if all this activity is just self-correction in action, then why not call alchemy, astrology, phrenology, eugenics, and scientific socialism science as well..."

Umm... seriously?

<comment><USER13> > _I'm sorry, but why is the neo-con anti science article on HN?_

Knee-jerk labelling much? What exactly do you disagree with the article with and why?

Reading things outside of one's echo chamber and comfort zone is not something to be avoided. Even if it's something "anti-science" and "neo-con" \-- you get to learn the ACTUAL points of anti-science people and neo-cons (as opposed to just second-hand reading your favorite writers disparaging their claims)

<comment><USER12> Okay, shall we upvote articles about how the earth is flat, or how evolution is false? Those are outside the echo chamber.

How about considering if an article has points that are valid rather than nut case propaganda.

<comment><USER13> > _Okay, shall we upvote articles about how the earth is flat, or how > evolution is false?_

Why not? The scientific method doesn't preclude anything a priori.

> _How about considering if an article has points that are valid rather than > nut case propaganda._

Where is this consideration though? And where are the counter arguments? I only see a quick labelling?

<comment><USER12> > Why not? The scientific method doesn't preclude anything a priori.

You're right it doesn't. But my criteria for an interesting and worthwhile article isn't one about crazy ideas that have been beaten to death 1000s of times already. If HN front page had tons of those types of stories, no one would come here!

</comment></comment></comment></comment></comment><comment><USER12> An actually question for HN readers. Why do we think this article is worth discussing? Why shouldn't we be discussing things like how maybe 2+2=4 might not be correct?

This article is attempting to refute the value of the scientific method. Why is science alone worthy of "debate" about if it's useful or worthwhile or not?

Is it perhaps because science often makes statements about the world that cause problems for those with an agenda?

If we discuss articles like this seriously (who's "philosophy" has been debunked 1000s of times already) then we're giving voice and allowing doubt to sow about science.

I'll leave you with a quote from Carl Sagan...

"Science is more than a body of knowledge; it is a way of thinking. I have a foreboding of an America in my children's or grandchildren's time -- when the United States is a service and information economy; when nearly all the manufacturing industries have slipped away to other countries; when awesome technological powers are in the hands of a very few, and no one representing the public interest can even grasp the issues; when the people have lost the ability to set their own agendas or knowledgeably question those in authority; when, clutching our crystals and nervously consulting our horoscopes, our critical faculties in decline, unable to distinguish between what feels good and what's true, we slide, almost without noticing, back into superstition and darkness..."

Edit: Just because it's hidden in a comment below, I'm adding it here. Some more examples of articles from The Weekly Standard to gauge whether they have a political agenda or not:

Calling climate change a religion: [https://www.weeklystandard.com/irwin-m- stelzer/the-sacred-sc...](https://www.weeklystandard.com/irwin-m-stelzer/the- sacred-science)

Some Hawking bashing about climate change: [https://www.weeklystandard.com/nathan-cofnas/dadaist- science](https://www.weeklystandard.com/nathan-cofnas/dadaist-science)

Or how about some Bill Nye bashing: [https://www.weeklystandard.com/the- scrapbook/bill-nye-the-qu...](https://www.weeklystandard.com/the- scrapbook/bill-nye-the-quisling-guy)

An attempt to show that Democrats are astrologers: [https://www.weeklystandard.com/the-scrapbook/anti-science- li...](https://www.weeklystandard.com/the-scrapbook/anti-science-liberals)

This list goes on...

<comment><USER14> Although you present it as ridiculous, whether or not 2+2=4 is actually a serious topic among mathematicians. The search term you are looking for is "alternative axiomatic set theories". The alternatives may or may not be useful, but a lot of math we use today was not originally useful and it's a good thing people worked on it.

I understand that you are concerned about a general distrust of science that stands in the way of human progress. I am too. But this distrust is only partly caused by "those with an agenda". The other part is that science is sometimes oversold by zealous adherents. Then, when the results are more moderate, people feel lied to and they grow distrust. Being more critical about science, far from being the problem, is actually the solution to the problem you are concerned about.

Elsewhere in the thread the question of eugenics etc have been raised. And I understand you know they are psuedo-science etc., but without you personally labeling all the pseudoscientists how is someone supposed to tell the difference? (And if there's an oracle who can tell us what is true or false we can just use that, we don't need science.)

A more modern example might be this paper: [https://www.ncbi.nlm.nih.gov/pubmed/26834996](https://www.ncbi.nlm.nih.gov/pubmed/26834996). tl;dr it is a quite well-designed, peer-reviewed meta-analysis published in the _Journal of Personality and Social Psychology_ from a credible researcher who concludes that precognition exists (which is ESP, basically). Now obviously that is bullshit, but A) isn't it a little backwards to say something is obviously bullshit when it has strong evidence behind it, B) if obvious bullshit can make it through the scientific process what does that say about the usefulness of that process?

The scientific method _as it is practiced_ is deeply flawed. It is operated by fallible humans, funded (or not) to advance an agenda, and so on. At various times it has been the scientific view that the sun revolves around the earth, that electricity exists in two fluids, that flies are spontaneously generated from rotting meat, and on and on. Modern times are actually the golden era for scientific acceptance and its influence on human lives, and yet it is those same scientific discoveries – the combustion engine, atomic bomb, antibiotics and mass communication technology – that threaten our civilization.

Being critical of the scientific method is not only important, it is necessary. The temptation throughout human history is to find some "holy grail" that will lift humanity beyond its current vantage point. Once upon a time this was _actually_ a holy grail, but in modern times science – perhaps due to its effectiveness – has often captured this slot in human psychology. But a grail science is not; it's a human system with human triumphs and human weaknesses and the sooner we get a realistic picture of that, the better for learning how to use it to achieve our objectives effectively.

<comment> 08-15 > credible researcher who concludes that precognition exists

See, that's exactly what Popper referred to when he said that theories cannot be confirmed, only rejected. Simplified to that extent, it's not nearly correct, but apparently we need to simplify it even more to get through the thick skulls of people like Bem.

The theory Bem et.al. refuted is "ESP doesn't exist and if ESP does not exist, there is no effect in these experiments." That's a much bigger theory than "ESP doesn't exist". And indeed, every single time somebody purported to have evidence for ESP, it turned that the typically tiny effect was a flaw in the experimental design, be that due to fraud or incompetence.

> obviously that is bullshit

No, not at all. Nothing is obvious. It's bullshit by sound reasoning.

There aren't just two theories that are competing here ("ESP" and "no ESP"). There's also "this researcher is incompetent", "this researcher is a fraud", "these statistical methods are useless", "I'm high on crack and none of this real", etc. A priori, "ESP" and "no ESP" might be the most believable among those, but all the past evidence points strongly towards a combination of "this researcher is incompetent" and "these statistical methods are useless". That's why we can say that this is bullshit and not feel bad about it.

> if obvious bullshit can make it through the scientific process

A pay-to-play journal like F1000Research is part of the scientific process? That may be where your confusion comes from.

<comment><USER14> > but all the past evidence points strongly towards a combination of "this > researcher is incompetent" and "these statistical methods are useless".

Your arguments seem to be based in unfamiliarity with the paper. Bem is an extremely well-regarded researcher in social psychology, he has hundreds of papers, several of which are seminal in the field and boast thousands of citations (this paper in particular has a citation score of 700+). Moreover this is a meta-analysis, not his own study.

While there has been some chatter about the statistical methods in those 700 citations, the fact is the methods are a lot better than the average social psychology paper (and this paper has attracted extraordinary scrutiny for the obvious reason). So if there is a problem in the paper (and of course there must be) there is a much larger problem in the standard practices in the field.

> pay-to-play journal like F1000Research

The original paper was published in the _Journal of Personality and Social Psychology_ ([https://webcache.googleusercontent.com/search?q=cache:vd-Z7x...](https://webcache.googleusercontent.com/search?q=cache:vd-Z7xDcvxwJ:https://prevention.ucsf.edu/wordpress/wp- content/uploads/2011/02/bem2011.pdf+&cd=1&hl=en&ct=clnk&gl=us)) but their website is down

> every single time somebody purported to have evidence for ESP, it turned > that the typically tiny effect was a flaw in the experimental design, be > that due to fraud or incompetence.

This is incorrect for the simple reason that it is much easier to make claims than it is to investigate them, and therefore, _not all claims can be investigated_. Perhaps you meant to say that of the proper subset of things we _investigated_ turned out to be methodologically flawed, but then we have situations like the present paper, which somehow got through peer review. Of course we can continue to poke at it until we find what is wrong since we "know" it "has to to be there", but if science only produces the correct answer when we make it match the answer in the back of the textbook, it doesn't seem a good method for finding anything out.

</comment></comment></comment></comment><comment><USER15> This article is literal nonsense from start to finish without a single compelling or novel point.

<comment><USER12> I'm actually starting to worry about how much of this type of anti science stuff is getting pushed. It really feels like a campaign of some sort.

<comment><USER16> I'm more worried about the science zealots who try to push some faux purity test on legitimate scientific pursuits

<comment><USER12> Can you give me an example? Is intelligent design your example of legitimate scientific pursuits?

<comment><USER17> You're way overposting in this thread and turning it into a mediocre flamewar. Please stop. We don't need bickering about 'intelligent design' or 'Bill Nye'. Those topics are extremely well covered elsewhere, and HN is for things that haven't been repeated a million times. Let me put it this way: if it would sound repetitive on Reddit, it's definitely off topic for HN.

It's clear you didn't like the article, and that was clear a dozen or two comments ago.

<comment><USER12> You're right. I'm sorry. I've spoken with the moderators and won't continue. I did flag the article now, not because I didn't like it, but because I genuinely think it's off topic and meant to insight political flame wars. I also genuinely want HN users to be aware of subtle disinformation campaigns that seem to be growing in social media from the alt-right.

Sorry for exacerbating it. Won't happen again.</comment></comment></comment></comment></comment></comment>


Show HN: We'll save your ass one day - <AUTHOR> https://custodly.ssl.dotcloud.com/

<comment><USER2> Oh, hai.

I tried this idea in application to the graphic design area specifically targeting logo and brand designers [0]. It was called CertTime and it failed _spectacularly_. It was pretty much like selling insurance to the ignorant.

The actual idea got substantial support of the Logopond community when I first described it [1]. I also solved the usability and trust issue by outsourcing time stamping and actual signing to VeriSign. The service took the client's file, made a self-extracting archive out of it and then signed the exe with Microsoft's AuthentiCode [2]. Checking the time stamp was as easy as right- clicking on the .exe and checking the Digital Signature tab. I think this idea was a stroke of genius... but in the end it did not matter.

I got ZERO traction. In retrospect I should've paid closer attention to the lack of interest I got on Typophile [3][4], where the community is more mature and less excitable than on Logopond.

That said, there is a number of companies that offer similar service - Surety, GuardTime, Recomobo, Digistamp, MyOws, etc. Some are based around a technical solution [5] while most are based around "we are lawyers, we swear it was done on Jan 1, 1913, and you must trust us" kind of approach. MyOws would be the most active in consumer segment, and they have accumulated their current user base through iPad giveaways and what not.

Finally, I want to say - good luck, guys, hope you can pull it off. There is a need for a very simple digital notary service, but it comes with the need to educate your target audience. I was not up for that, but perhaps you are.

[0] <http://swapped.cc/certtime> and <http://certtime.com>

[1] <http://pondpad.com/forum/viewtopic.php?id=3578>

[2] [http://msdn.microsoft.com/en- us/library/ms537361(v=vs.85).as...](http://msdn.microsoft.com/en- us/library/ms537361\(v=vs.85\).aspx)

[3] <http://typophile.com/node/62669>

[4] <http://typophile.com/node/63838>

[5] <http://www.ietf.org/rfc/rfc3161.txt>

( _edit_ ) Oh, by the way. Regarding the "what is it in you" point. My idea was to establish a sizable userbase of people routinely using the service (in part by integrating with various graphic design galleries and portfolios around the web), use that to demonstrate the consumer-level need for trusted timestamping to VeriSign and other companies and then try and sell the company to them. See, they are in a situation when a lot of money and effort is spent on deploying and running timestamping infrastructure (for example to support codesigning), but they have no way of charging for its services directly. If one can prepare and proof a paid market for them, they could not not be interested.

Trying to charge people directly for this sort of service is unrealistic at best.

( _edit_ ) Dug up the Q&A, which took me several weeks to put together - <http://swapped.cc/certtime/faq.png> \- it has some lesser obvious points to consider and mull over.

<comment><AUTHOR> Thanks for describing your experience. This site really was some kind of a hackathlon for us. Not to mention the need for it.

Sometimes I was in the need to secure a document, sealed at a lawyer. My clients wanted to be sure that the information won't change in case we have to say good bye. :)

Anyway... This is our very first public product made for anyone. I hope you guys like the idea. We can take it to any level if needed. :)

<comment><USER2> With all due respect - your service as it exists is completely useless. You either need to be prepared to go to the court to testify for other people _or_ you need to provide reliable, court-tested technical solution for trusted time-stamping.

Basically consider this - if the push comes to shove and someone is getting served C&D letter or worse yet getting sued over their idea, how _exactly_ does your service help them? Or even how would _you_ use in such situation, since you said you built it around your personal need?

<comment><AUTHOR> Oooooo... that's way too serious. I will be more than happy if I can just show you as goodfellas what have i thought of a little earlier.

And again... this is a concept, that maybe useless, but it was a lof of fun to create and learn from comments it receives.

</comment></comment></comment></comment><comment><USER3> Reminds me of the old "Poor Man's Patent": Write your idea, invention, etc. on a piece of paper, and mail it to yourself in a sealed (possibly certified) letter as proof of date of invention.

Unfortunately that, and likely this, will provide little legal protection:

[http://spectrum.ieee.org/at-work/innovation/the-poor-mans- pa...](http://spectrum.ieee.org/at-work/innovation/the-poor-mans-patent)

Bragging rights, however, are now yours for posterity, which might have its own value to many - just don't think this will help you out in court, particularly without third-party auditing (not that _that_ would help much, either).

<comment><AUTHOR> True!

This actually is the poor entrepreneur's experimental patent.

We should settle this case outsite the courtroom ;)

</comment></comment><comment><USER4> While I understood (I think) the purpose of the site, I couldn't help but hold a reserved amount of skepticism. "What's in it for you?" underlined my consideration of using this service. It appears to be free. I don't see any ads that might supply you with ad revenue. I'm keenly aware it costs money to purchase a domain, host a site and buy an SSL certificate so obviously you'll incur costs--so how is it you plan to recoup them. I can't imagine I'm being provided a service out of the generosity of your kind heart. So then I start thinking, maybe they'll charge you to unlock it? Or worse, maybe this is not a protection service at all, maybe it's a mining scam, to steal ideas.

Perhaps I'm being overly skeptical, but I thought I'd share my thoughts so that you might be aware of them, and figure out a way to address them to alleviate some paranoia of your potential customers.

<comment><AUTHOR> Here is my corresponding blog post: <http://hagyma.posterous.com/entering>

We are totally working on something else by the way... As you see in my blog post, I saw one of my ideas appear on another site... so we came up with this concept to save my ass on the first place. :)

And using the generous offer from dotcloud for beta users, this with the ssl is hosted for free.

</comment></comment><comment><USER5> What a brilliant way to steal ideas, upload your best stuff to me :)

<comment><AUTHOR> Thanks! If the concept works out though, we'll implement some client side encryption, so we won't be able to see what you submit.

There are no attachments yet, but if there will be, you can just have your own way of encryption and load a single file up... but that won't prove you later on...

Not easy...

</comment></comment><comment><USER6> I can't figure out the point of this website.

From what I can tell, you enter in your idea, and it basically timestamps it for you. Then if someone else makes it big with the same idea, you can say "Hey I thought of that first."

You seem to be saying that the website will help prevent the idea from "getting out" before I can implement it. But I don't see how entering my idea to a website will stop other people from finding out about it or independently thinking it.

I'm confused, and could use some more explaining about what this is and why I need it.

<comment><AUTHOR> This site is not a time machine... too bad... but... Let's say you have an idea. Obviously somewhere else on the planet anybody can come up with the same thing same idea.

That other guy publishes it first while you are still in the making. If you save your idea here, you'll be able to prove that you did not steel it.

It is just a concept site. Tell me why it sucks! :)

</comment></comment><comment><USER7> A truly useful trusted timestamping system should prove that Alice said x at y time. By asking only for name/email on your form, I don't see any way of cryptographically verifying Alice's identity.

<comment><AUTHOR> You are right.

This is one of the reasons why this concept site is a tiny, tiny idea saver, that may save a couple of rookies along the way.

I can't see custodly in a defense case just yet.

</comment></comment><comment><USER8> Is that an advert in your captcha? Seriously?

<comment><AUTHOR> Crappy, ha? I saw it over on techcrunch the other day. Solvemedia. I thought we should try it out.

<comment><USER8> Why?

<comment><AUTHOR> mostly it looks really bad... but sometimes it surprises you with a logo :)

</comment></comment></comment></comment><comment><USER9> I may be not enough informed but if someone create a patent one of your idea, even a website like that won't do anything?

<comment><AUTHOR> If you have proof that you had something working before a patent was filed, you are saved I think.

Still, legal issues are hard to crack... we should just keep thinking on how to avoid lawsuits and patent trolls.

</comment></comment><comment><USER10> Why is this better than encrypting a text file with my idea written down and sending it to myself via email?

<comment><AUTHOR> You can manipulate emails later on, while on this exerimental site, your released info has the lock up date, so visitors can be sure, it has not been changed since creation.

</comment></comment><comment><USER11> It should be "lose", not "loose". Please fix that.

<comment><AUTHOR> Thanks! Will be fixed in a minute! dotcloud push :)</comment></comment>


How the F.B.I. Reviewed Thousands of Emails in One Week - <AUTHOR> http://www.nytimes.com/2016/11/08/us/politics/hillary-clinton-donald-trump-fbi-emails.html <comment><USER2> Can this be discussed with respect to its technical aspects only? Leaving politics aside? Actually not very much technical information in the article.</comment>


Zepto (Data Analytics Tool) Launches in USA - <AUTHOR> Hey everybody,
I'm Apurva the Founder of Zepto, I take this opportunity to inform you guys that we recently launched our Data Analytics Tool Zepto in the USA. Zepto is a Data Analytics Tool which helps users analyze the data automatically and provide actionable insights in the form of charts and stories so that any business user could understand.
At Zepto, we believe in keeping things simple and clean and well was indeed quite a challenge to build a simple tool for a complex task.
We understood how an ordinary user could use and benefit from an analytical tool and merged it with design elements and thought the process of a user. Oh, the fun part is that realizing the power of data, we integrated Zepto with AI so that our users could harness better out of their data.
As a result, we ended up building a simple yet powerful tool that could help our users get more out of their data with less complexity.
Currently, we help brands like KPMG, Kotak Mahindra (India's 2nd largest bank), Setu, Alliance Finance and few leading finance companies to get their maximum out of their data. We have considered customer feedback as an important feedback and have revised the complete product continuously and will be in order to make it better continuously.
The key benefits our users enjoy are:
1) Faster & Self-service Implementation
2) Automated Insights to dig buried market info
3) Award Winning One-click Time Series Predictions
4) Plain English Queries (NLP-Tech) ( Just like Googling)
Please do log in to https://www.zepto.io and sign up for your free trial and begin analyzing your data with Zepto. Trust me you will be surprised by what your business data has to say about your business.
Looking forward to your feedback and insights. <comment><AUTHOR> Here's a hyper link to my website- [https://www.zepto.io](https://www.zepto.io)

</comment><comment><USER2> Data Analytic Tool integrated with AI and NLP, sounds interesting. Let me give it a try.</comment>


Show HN: My first MVP – Menswear as a service - <AUTHOR> https://casual.firebaseapp.com/

<comment><AUTHOR> Hi HN, OP here. I was hoping to get feedback, not only on the idea, but on the actual MVP. I'd greatly appreciate any insights you guys are able to offer!

This product is intended for anyone who wears casual clothing often and just doesn't want to worry about washing, throwing out old clothes, and buying new clothes.

Disclosure: I posted this yesterday ([https://news.ycombinator.com/item?id=7442767](https://news.ycombinator.com/item?id=7442767)) but I wanted to give it one more shot on HN. If this is inappropriate, I'll take it down immediately.

</comment><comment><USER2> How will you handle the liability of the disease factor? What if you provide used clothes that have lice, bed bugs, etc?

<comment><AUTHOR> All of the clothes will be washed and disinfected as soon as we get them back so I'm not sure how much of a problem that would be. I will look into what kind of insurance (if any) we would need to provide this service though.

</comment></comment><comment><USER3> How do you differentiate yourself from all of the other companies already in this space? You offer used clothing at a discounted price?</comment>


1and1 ask for passwords over the phone - <AUTHOR> http://blog.tim-rogers.co.uk/posts/1and1-ask-for-passwords-over-the-phone <comment><USER2> > Help me HN. Has anyone else had experiences like this with 1and1? What did > they do to get things resolved?

I use 1&1, and I ran into the same situation a couple months ago: I was terminating one of my contracts, and they asked for my password over the phone to verify. To be clear: I was not closing my account, I was only terminating a single contract.

The way I "resolved" the matter was quite simple: as I am not stubborn, I just gave them my password. The person sitting on the other end of the phone call already certainly has godlike access to my account anyway, I am not stupid enough to use the same password for multiple accounts, and barring insanely epic hacks I know they are a real representative as I called them at their phone number; so, there is really very little to lose handing over my password to the customer support person.

In the end, rather than getting morally outraged and posting an article asking a question to an online community in the hope of unblocking your ability to conduct what is fairly simple business, you should just change your password when you are done with the call and move on with your life. It will save yourself a bunch of time and frustration.

Then, afterwards, if you don't like the way 1&1 operates (maybe you believe that this is indicative of a more underlying set of security mistakes, or maybe you simply don't agree with the practice and don't want to support it), you might then consider moving your accounts to a different provider: there are tons of people you can use to host servers, domains, or whatever else you may be using 1&1 for. However, it shouldn't block your ability to make things happen right now.

<comment><USER3> I know I personally am happy to have read the OP's article. It made me aware of this backwards practice by 1&1, and I also learned that 1&1 stores these user passwords in plaintext. As a consumer of internet services, I will now steer clear of 1&1, and I have the OP to thank for the possible headaches I may have avoided.

I have no problem with someone standing up for what they believe in, taking a stand, and "rallying the HN troops" for what might be a relatively minor issue for most. I'm sure we all have made fusses about more trivial things :)

<comment><USER2> So, I don't actually disagree with the brunt of what you have said here (that if someone has an issue with something that it might be valuable to tell other people in the communities you are a part of who might care); however, it doesn't really apply to this article: my response is attempting to directly answer the question posed in the bold text at the end about "how to get things resolved".

Now, that said, I actually do believe people "rallying troops" is often knee- jerk and incorrect vigilante justice masquerading as valiant. It isn't always the case, and there may be places where such behavior is legitimate (although I think figuring that out is an interesting and horribly long off-topic discussion). It certainly, though, isn't always positive.

As an example, there person claiming on HN a couple days ago that Apple must be storing passwords in plain text because of a 32-character password length restriction[1]; I doubt that was actually the case, and much more argument and research should have been made before trying to incite such panic.

(edit: Hell, I didn't even notice that you did it yourself here until I saw the response from Fargren, but you just did it, too: there is no reason to believe that 1&1 "stores these user passwords in plaintext". It is much more reasonable to believe that they have a box on their end for "customer password" that verifies it using the same mechanisms the website does. It is not at all reasonable to "rally the troops" over assumptions.)

Again, however: that is not what this article was about; this article was not attempting to "rally troops", this article was asking for help making progress with an account they have at a vendor because the OP "make a point of _never, ever, ever_ giving [his] password out to anyone" (emphasis his).

After all, you can still "rally the troops" after you get your job done: you can change your password afterwards, you can even change your password beforehand as borlak indicates (although that implies your password was important, which is already a mistake), you know this person is a real representative to within any reasonable margin of error; the morale stance here was just stubborn. :(

[1] <http://news.ycombinator.com/item?id=4376029>

<comment><AUTHOR> I'm not trying to "rally the troops" as it were under the assumption that they're storing passwords in plain text. That's not the issue, though it would obviously be an issue if it <were> the case.

I just wanted to make sure people were aware of this kind of practice at 1and1, and hopefully (but probably not) drive some change in the practice.

</comment></comment></comment></comment><comment><USER4> Perhaps I'm misunderstanding the nature of this complaint, but it sounds like this guy is dealing with a service at which:

* Tier 1 customer service people do not have plaintext access to customer passwords, _and_

* Tier 1 customer service people do not have the ability to manipulate customer accounts without their passwords (and thus consent).

On the scale of security/customer-service interactions at service providers, this sounds like MONUMENTAL EPIC WIN. What exactly am I missing here?

And,

How on earth could you possibly input a password into some random text field in an application that you would not provide to the CEO of the company hosting that text field?

<comment><AUTHOR> I'm not convinced that the Tier 1 customer support reps _do_ lack access without the password. It just seems to me like a misguided attempt at verifying identity.

As for your second point, all that is based on trust in the company that they're not storing in plain text and opening it to the CEO...which I hope is the case for most companies. I was more trying to give a sense that I'm really not happy giving my password to any person. When it's a web form, you just have to have trust or the whole idea of passwords is broken.

<comment><USER4> In case you missed it, the subtext of my comment is that neither of those bulleted items are true for most service providers. At most large service providers, you can count on tier 1 CSA's having direct plaintext access to your password and those CSA's being a mouse click away from taking any action on your account you can conceive of.

Your first point is just innuendo, right?

<comment><AUTHOR> I'm not sure I understand what the point you're trying to make is. In a hypothetical (but unlikely) world where they <really> did need my password to manage my account, this would be a poor practice to have and it should have some kind of other verification, even if it was character [x] and [y] of my password. The same applies if they don't need it really...this doesn't seem a good idea regardless.

<comment><USER5> That specific solution doesn't work. If they have access with just characters x and y of your password, then they (as good as) have your password, and access to your account.

<comment><AUTHOR> Well, yes, but it's expected and somewhat necessary that administrators (that is, people with some kind of administrative responsibility) of online services have access to your account.

<comment><USER6> So you do not trust them with your password (that you're going to change later anyway), but you do trust them with unpassworded access to your account?

<comment><AUTHOR> All I'm saying is that you have to have that trust, it's always going to be the basis of how customer support works in businesses like this. Requiring that you give out your password to a person is not acceptable.

<comment><USER6> I've had a few days to think about this.

Now, having seen some of the alternative systems suggested, I think I agree.

I instinctively do not want to give my password to anyone. And that's a great habit to get into, and we want regular people to get into that habit. That would make phishing less useful.

In this case it seems they're trying really hard to protect your domain from harm. But yes, I've been mostly persuaded.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> This doesn't sound good, but it got me thinking.. How do you verify someone is who they say they are in situations like this?

As we've seen with recent breaches, the last 4 digits of your CC # aren't incredibly hard to find out. "Secret" questions and answers are generally quite poor, in that very few of them don't suffer from laughably small keyspaces or rely on semi-public information. Passwords almost seem like the least bad option.

I get that giving a password to a human isn't a very comfortable feeling, but if you don't trust the CSR to not misuse the password, do you also not trust the developers to not have put in something to grab your password one of the various times you enter it into a web application that they control?

<comment><USER8> Assuming that all you need to verify is that the person on the phone knows that account name and password, one way that would not be too difficult to implement would be to have a way for support to mark the account with a random 8 digit number. The support person does this, and then tells the customer to log in to their account management page. There should be a link there that shows the random 8 digit number. The customer then reads this to the support person over the phone.

<comment><USER7> Something like that would certainly work - I was thinking a one-time code could be emailed to the email address on the account, but either way would be fine.

Given the relative simplicity, I wonder why nobody (at least that I know of) has implemented something like this?

<comment><USER2> This is how PayPal support works: you use the website to get a random six- digit "customer support PIN" which you then dial in when you connect to their system.

<comment><USER9> Media Temple operates this way, as well. I like this approach, as I can never remember those "4-digit account pins" (looking at you, AT&T), and I'm happier knowing any given pin is only usable for the next hour, anyway.

</comment></comment></comment></comment></comment><comment><USER10> I don't get it. At all. The only purpose of the password is to authenticate you against your account. Why would you refuse to use it for this? It's __the point __of a password that you submit it.¹ Oh yeah. Because you don't trust the guy on the telephone. He could easily hijack you account and do nasty stuff. 1) He could do if he wanted if you didn't tell him 2) You're not trusting him/her? Why are you doing any business with a company you don't trust?

Or is the point that somebody could wiretap you? Get off your tin foil hat and think about keyloggers.

¹) Or do a challenge response. It does not matter. It's a _shared_ secret.

<comment><AUTHOR> The point is simply that established practice is to never share passwords, and this eschews that practice. I can see your point, but they have a variety of other data they could use to verify who you are. This is about the worst idea.

<comment><USER11> Actually, no it's way above better than other ways they could verify your identity. Did you not read account of the Wired reporter who had his online identity stolen and wiped because companies used easily obtainable information about the person to identify the person's identity? If they had used a password instead it never would have happened.

I don't understand what your issue is with telling them the password? Just change it to something random and change it back after if it's not something you are comfortable sharing or saying out loud. It may personally offend you, but t's certainly not a bad practice.

</comment></comment></comment><comment><USER12> I've avoided using 1and1, but I recently made the switch from GoDaddy to Hover.com for my domains and it was like an amazing breath of fresh air followed by a clear mountain spring water chaser.

Seriously. There are way better providers out there.

<comment><AUTHOR> I probably will do, I just want to make sure that people know about this bad practice, and hopefully encourage 1and1 to sort this out.

</comment></comment><comment><USER13> I hate 1and1. I had to deal with their awful Website interface for a client of mine recently. I had to transfer over 100 GB of stuff on this guys "unlimited" storage account. they capped the speeds around 500KB/s. it seriously took all week. uploading to amazon and rackspace cdn's were a godsend after that.

<comment><USER14> As a long customer in Germany, I can only agree. They have a lot of shady practices and I wouldn't recommend them to anyone.

</comment></comment><comment><USER15> I have been long time user of 1and1 for domains. Their initial product offering is always sweet (free, 1$ domains) etc. Their renew rates are not bad as well.

But the place where I hated them most was NS change propogation, it took 24 hours to get that done.

Also their admin panel is awfully slow.

If you guys don't already know it, here are some of the links to help

To transfer/cancel domains you must go through : <http://cancel.1and1.com>

Admin: <http://admin.1and1.com>

<comment><USER16> 1and1's Control Panel is quite painful to use, but you don't have to go through cancel.1and1.com to transfer a domain - just make sure your domain is unlocked and you have the EPP code handy.

</comment></comment><comment><USER17> 1and1 is a hosting company for the uneducated masses. Those do not care about telling some 1and1 employee their passwords because they think it is safe to do so. 1and1 is a great hosting company for someone who just needs a website. Nothing more. No Dns handling, passwords over the phone. Great advice has already been given: Leave them and make sure your account is terminated. And I mean really terminated.

</comment><comment><USER18> If you can get your transfer codes from them without having to give your password over the phone then start transferring now. You lose none of your registration period and you can find other registrars that don't suck. Even if you find a way to get what you want done with 1&1 you probably don't want to be doing business with a company that can't follow the most basic of security best practices.

<comment><AUTHOR> I probably will!

</comment></comment><comment><USER19> Personally I think it is hilarious to say things like "ampersand" or the "little carrot arrow thing err.. you know shift six" over the phone. I once had to leave my password in a voice-mail to my nurse, she told me "most people just make it something simple like their doctors name you know." I refrained from launching into a tirade about the importance of strong unique passwords.

</comment><comment><USER20> I had the same experience over the weekend. Wanted to use google apps for one my domains. They wanted me to email .html file which google gives you to a hotmail (really?) address and then give them the password as well to my 1and1 account. #fail

<comment><AUTHOR> Completely ridiculous. How do they get away with this kind of stuff? I genuinely think the only way to put a stop to it is for an article like to get popular so they're forced to think.

<comment><USER20> I asked the rep if I could give any other form of identification, guess what - your email address on the 1and1 account would do. I tried sending them the html file from the same email as the one on my 1and1 account and they did what I requested. This boils down to - they really don't need your password.

</comment></comment></comment><comment><USER21> Thanks for reminding me I have an expiring domain to transfer away from them!

</comment><comment><USER22> To be honest, I've asked customers for passwords over the phone before. Usually it's because they have called reporting a problem with their email, now about 70% of the time it's because of a problem at their end but I have to humour them anyway.

Now I can of course access their mailbox by going into a shell on the server but the quickest way to check everything and satisfy the customer is to setup their email account on my computer and check I can get it to work.

Since the passwords are securely hashed, the only way I can do this is by asking for the password from the customer.

<comment><USER23> I see that as a failure of process. Your tools should already be constructed in a way that using them is easier and more reliable than asking for a password. Coupled with auth logging on the server side to diagnose failures on their side, there really should be no reason to ask for a password for this stuff.

</comment></comment><comment><USER24> 1and1 is horrible anyhow, leave, fast!

</comment><comment><USER25> I had this with Virgin Media (UK ISP). I called them and the support guy asked for my secret password. I assumed it was a security answer so I went through a couple of obvious ones like mother's maiden name. After a few attempts, he stopped me and said my password was strange because it was just a bunch or random characters. At this point I realised that not only was he expecting my actual account password for verification but it was available in plain text for him to manually verify!

</comment><comment><USER26> I recall when I first heard of this outfit. I think it was 10 years ago. They wanted you to fax forms over to them. Perhaps early man got his domains that way.

<comment><USER27> My recollection is that in the bad old days of Network Solutions, you have to fax in domain registration and change forms. I seem to recall someone stealing a big brand's domain name for fun simply by faxing in some instructions on bogus letterhead.

</comment></comment><comment><USER28> Give Badger a try... we salt and hash passwords. <http://badger.com/>

<comment><USER29> That doesn't (technologically) stop you from asking for a password to verify, though.

<comment><USER30> I'm sure 1&1 actually does encrypt the password, otherwise the tech support guy probably would have just opened up tim_rogers.txt and found his password there.

This sounds like 1&1 just doesn't have a real customer support story and should probably just be avoided if possible. Or find somewhere that lets you provide 2 part security (ie, one for personal access and another for support access).

Author of the post said they should have some backend, and maybe they do, but I think the biggest problem was that they wanted him to authenticate himself as genuine with them by providing his password... they should have some other way to verify his identity without that.

(This is my personal opinion as a security professional and not the opinion of my employer)

<comment><AUTHOR> I agree with your first point, or at least I'd imagine so. I've heard it suggested though that they don't so who knows!

To me, it seems like they just have a badly thought out verification process when they should be doing something else - for instance, they could just the last four digits of your payment card or some other piece of relatively secret information. You have indeed crystallised what my issue is in this situation there!

</comment></comment></comment></comment><comment><USER31> Perhaps it's time to consider another host? I've been happy with Dreamhost as a bargain-priced hosting provider.

</comment><comment><USER32> FYI: So does Citicards.

</comment><comment><USER33> Change the password to 1and1sucks, call back, and give them that. Oh wait, now everyone knows your new password.

</comment><comment><AUTHOR> What registrars are good who support *.uk domains? I've had good experiences with Gandi previously.

<comment><USER34> +1 for Gandi, I've only heard good things about them. I've been with fasthosts.co.uk for 10 years now(with zerigo for as long as I can remember as well), I've currently got 20 domains registered with them and I can't remember having had any problems with them.

<comment><AUTHOR> I do like Gandi, they're quite pricey though. Shall have to compare prices across the board! Zerigo seem good though.

</comment></comment></comment><comment><USER35> while I agree 1&1 shouldn't ask for passwords... why not just temporarily change your password to something stupid, call support, and then change your password again?

<comment><AUTHOR> I could (and may well) do that, but my issue is more one of principle. I could do this, but it shouldn't be necessary.

</comment></comment><comment><AUTHOR> In this situation, I don't think emailing their complaints department is going to help - I need the force of HN!</comment>


Can you infer the purpose of these tools? - <AUTHOR> http://farmtools101.blogspot.com/

<comment><USER2> Wow:

<http://farmtools101.blogspot.com/>

<http://toolanswers101.blogspot.com/>

I think they win the prize for best (ab)use of free Blogger accounts. And reading the answers page alone is better than the quiz, unless you already have some agricultural knowledge.

<comment><USER3> mos def. this was fascinating. made me question what i see in 3d printers when more public hackershops and forges could enabled so much!

</comment></comment><comment><USER4> Unless they blatantly scraped the information from somewhere, this is indeed the best splog I've seen, actually interesting enough to read.</comment>


Berg is shutting down - <AUTHOR> http://blog.bergcloud.com/2014/09/09/week-483/

<comment><USER2> I wondered when this might happen. You can't really rely on any of these devices with a 'cloud' based backend to work a couple of years after you've bought them (As anyone with a Nabaztag gathering dust in a corner will tell you).

I made my own version of the little printer based on the open source plans here: [https://github.com/exciting-io/printer/wiki/Making-your- own-...](https://github.com/exciting-io/printer/wiki/Making-your-own-printer)

It's really easy to get up and running and interfacing with it is simple. I have mine print out reminders for when to plant seeds for the garden and it also notifies me when automated downloads via FlexGet have finished.

<comment><USER3> Beyond the issues of relinquishing control over a service to a third party, I think another disturbing aspect is all the waste this causes: perfectly good electronics get thrown out just because some company goes out of business. The fact that these "cloud connected" devices are often proprietary and locked- down (for "security reasons") makes it worse.

<comment><USER4> Except the email I just got says if they can't find a way to keep the service running, they will open source it and open source the firmware on the cloud device.

<comment><USER5> This is possible, but rare. If your GPS navigator requires "cloud maps", it will be useless the moment its provider goes out of business or turns off the v1 servers in favour of v2 servers. This as already been discussed in the Ars Technica's article about Android and the problem of old phones with "broken" apps.

(Well, the reality is that it will be useless for 3 years, after which somebody will finally crack the DRM and put a OSM-based replacement on it that has 90% of the features of the previous software, but it nowhere as polished as it.)

[1] [http://arstechnica.com/gadgets/2014/06/building- android-a-40...](http://arstechnica.com/gadgets/2014/06/building- android-a-40000-word-history-of-googles-mobile-os/)

<comment><USER6> > This is possible, but rare. If your GPS navigator requires "cloud maps", it > will be useless the moment its provider goes out of business or turns off > the v1 servers in favour of v2 servers.

I have a 10 year old GPS receiver in a box, with no way to update with maps from Garmin, not because Garmin went out of business but because they just choose not to support the device anymore.

Do I want to spend hours trying to figure out how to update a 10 year old device? Or would I rather spend $100-$200 on a brand new one with the latest maps?

Obsolescence isn't a bad thing, its how we move forward. We just need a clean process to recycle the waste that process generates.

<comment><USER3> The issue is that a GPS navigator is basically a solved problem, and the only part that requires updating are the maps.

 _Do I want to spend hours trying to figure out how to update a 10 year old device? Or would I rather spend $100-$200 on a brand new one with the latest maps?_

The ideal situation would be a device that you buy once, but it's also one you could use with whatever map data sources you want (OSM, commercial, etc.) - based on an open format.

(I know GPS is also dependent on the satellites being available, but since it's government-owned and critical to many parts of the infrastructure, it's likely to stay around for the forseeable future.)

<comment><USER6> > The ideal situation would be a device that you buy once, but it's also one > you could use with whatever map data sources you want (OSM, commercial, > etc.) - based on an open format.

Like an iPhone/iPad/Android phone/Android tablet? Tomorrow's tech will be available to me soon, and much cheaper than today's tech. Support = people's time = expensive.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> One of those things I always convinced myself I really wanted, but the fear of the cloud service going down put me off dropping the cash. £200 for a device that's useless if the business went under was not my cup of tea.

<comment><USER8> Ironically this mindset contributed to them going under. Not criticizing you, just a funny observation.

<comment><USER9> I'd like to think that charging £200 for a device that has little better use case than being cute and quirky played a part as well.

Especially considering that you can buy a professional POS thermal receipt printer for the same price for any viable projects requiring printing in that general form factor.

<comment><USER10> They were a leading speculative design studio, not another manufacturer of printers. Coming from a different place, more similar to how sci-fi stokes the fires. I'm shocked and sad that they went under given that they had been doing consulting for years. I wonder how taking VC last year affected this.

But not shocked that Little Printer or the Berg Cloud was commercially unsuccessful. Perhaps they just bet a little too much thinking that their excellent design and particular approach would translate to enough value for enough people.

</comment></comment></comment></comment><comment><USER10> Berg has for a while explored speculative product experiences in the vein of Dunne & Raby (1) - though being design consultants, Berg's work tends to be optimistic. D&R embrace the dystopian aspects of future products, and I think they'd enjoy this conversation that's cropped up around what happens when connected objects lose their parents. (Especially when the objects are personified!) Hopefully Berg appreciates their inadvertent final contribution as well.

Does the Internet of Things need a federated model to be as trustworthy and successful as Internet classic?

1\. [http://www.dunneandraby.co.uk/content/home](http://www.dunneandraby.co.uk/content/home)

</comment><comment><USER11> First I've heard that Haitian proverb ("Behind the mountains, there are more mountains."). Very appropriate for this community.

<comment><USER12> berg also means mountain in german!

</comment></comment><comment><USER5> Did anybody reverse engineer the Berg/Little printer protocols? OK, I have found this from 2013, not very detailed though: [https://github.com/pipt/little-printer-payload- inspector](https://github.com/pipt/little-printer-payload-inspector)

It think the printer's form factor is very nice, much much nicer than the other hacked-up solutions I have seen around.

I would pay those £149 for a thermal printer that was so cute and also completely open.

<comment><USER13> While I enjoy a spot of reverse engineering as much as the next hacker, it's probably easier just to ask them for the protocols in this case; try [http://twitter.com/nickludlam](http://twitter.com/nickludlam)

</comment></comment><comment><USER14> I hadn't heard of this before but it doesn't seem dissimilar to the adafruit internet of things printer. No "cloud" to speak of - you consume web services via scripts run on the raspberry pi.

[http://www.adafruit.com/blog/2012/02/21/new-product- adafruit...](http://www.adafruit.com/blog/2012/02/21/new-product-adafruit-iot- printer-project-pack-internet-of-things-printer/)

</comment><comment><USER15> I did a small exploratory project using it, and my takeaway was that it was a solution in search of a problem, at least the Cloud aspect, which did absolutely nothing useful, other than sparing you from setting up your own endpoints, but in exchange your had to deal with a really limited (and limiting) API and a more complex infrastructure.

</comment><comment><USER16> I'm not surprised. I was really excited when I heard about this device and although it seemed like a bit of a novelty, I really wanted to try it out. Then I saw the price - $260. I understand you are paying for added value and well thought out design, but $260 was an insane price for a niche product like this

</comment><comment><USER17> Square or similar should pick this stuff up. The personality the Little Printer exhibited was a refreshing (and for me, important) distinction. Not saying that they should put it out there 1:1, but there's a lot to learn in how this thing was made, branded and communicated.

For me, this wouldn't then just be a receipt printer -- you could just as well have it push the "opposite" direction. It's essentially a straight tunnel to a specific business or person from its maker. "Here's your daily summary", "Sara from London just asked about shipment costs". Push notifications to phones does that too, but sans this - for the lack of a better word - bond. For the right business, it feels like a very interesting point of difference.

<comment><USER18> Maybe I don't quite get it, but how does "a straight tunnel to a specific business or person" differ from e-mail?

<comment><USER19> There is a good usecase for devices like these: companies that place orders remotely with a large variety of suppliers. For instance, if you have a website where you allow people to order take-out food you could place one of _your_ printers at their premises. No need to rely on their infrastructure at all, especially not if the device has it's own cell modem on board.

<comment><USER20> I spent a couple months working at a company that had almost that exact business model. We just used normal, cheap, thermal receipt printers attached to a Raspberry Pi.

</comment></comment></comment></comment><comment><USER21> That happened quickly! They just raised $1.3m eleven months ago:

[http://blog.bergcloud.com/2013/10/28/berg- raises-1-3m-round-...](http://blog.bergcloud.com/2013/10/28/berg- raises-1-3m-round-launch-berg-cloud/)

<comment><USER22> You can see there's 8 of them here [http://bergcloud.com/about](http://bergcloud.com/about) . They probably burned through that 1.3 with a year of wage expense.

</comment></comment><comment><USER23> I'm not sure why we're surprised to see functionality disappear from online- tethered services when it's been happening in other arenas for years now - most visibly, online gaming. The oldest example I can come up with offhand (because it's the Dreamcast's birthday) is Phantasy Star Online. That game was fun, but really only as fun as it could be played online, and the servers have been off for a long time now. EA has started turning off servers for old games in the same way. This shutdown is a shame, but hardly unexpected, especially given how niche Little Printer was.

<comment><USER24> PSO was playable just fine offline and split-screen however. And if anyone is interested SCHTSERV[1] is a PSO private server that is still up. They have gamecube, dreamcast, and PC clients.

[1] [http://www.schtserv.com/](http://www.schtserv.com/)

<comment><USER25> Sickeningly me and a few friends each played the Game Cube incarnation of PSO I & II for over 100 hours offline

<comment><USER24> Yea I've been there, the local co-op was a ton of fun really. The only downside was that the framerate drops a bit if you have more than 3(2?) players.

</comment></comment></comment></comment><comment><USER26> I've not heard of Berg before, just having a quick look on their front page, shows its hardware to connect an embedded system to wifi to their cloud.

Isn't this a big worry if you're using anyone else's cloud service for your own embedded hardware.

Interestingly other platforms exist that perform similar functionality using the same WIFI chip Ti CC3000 (such as Spark Core). There seems to be a number of new chips from china which look to potentially give Ti, a run for its money, such as the ESP8266.

<comment><USER27> Note that "their cloud" (what they called Berg Cloud) was actually primarily a local wireless access solution, not a cloud in the cloud computing sense. It was supposed to make configuration and connection of the Little Printer and other future Berg devices easier. As other commenters have pointed out, you can have an LP-type device that connects directly to a normal wifi network (e.g. Adafruit's) and the content doesn't in principle need to come from a remote web service either: it could be provided by a script running on a local machine.

The quality of presentation and the user experience provided by Berg (not just this product but other things the same guys have worked on) is great, but they show their roots in the design school. The products feel to me more like the product of brainstorming at an ad agency than a mature response to necessity. London's design scene is full of this kind of "creative" activity, and it's super enjoyable to watch but probably a form of decline or decadence in terms of real manufacturing and craft. The pace of change is so great now in tech that designers tend to get left behind or reinvent the wheel.

Imagine Twitter redesigned by someone both technically knowledgeable _and_ UX aware. (No race conditions, URL shortening, or crippled API functions.) the reason we don't have this is a cultural gap between the hip designers and the technically informed.

<comment><USER26> Ah sorry I misunderstood then, what they meant by cloud.

<comment><USER27> No need to apologize... There is a remote element to the Little Printer service as I understand it, but they created their own concept when they invented to Berg Cloud.

</comment></comment></comment></comment><comment><USER28> Crap -- I have a Little Printer still in the box that I've been meaning to play with. Really hope they open source the protocol so I don't end up with a Little Paperweight.

<comment><USER29> This is what really hit me one day. I had things in the box unopened from companies that no longer existed. That really put me off buying cute 'toys' unless I could commit to using them and exploring them in 90 days.

</comment></comment><comment><USER30> I think the biggest problem is that they assumed that people would like to have this disposable bite-sized information internet spews at us printed on physical medium instead of being displayed in some corner of a screen somewhere where it belongs. The kind of stuff that will be irrelevant after you've read it once. Not economic. Cute thing though. I give you that.

</comment><comment><USER31> Looks like they plan to open source the Little Printer backend (if it's not sold).

[http://littleprinterblog.tumblr.com/post/97047976103/the- fut...](http://littleprinterblog.tumblr.com/post/97047976103/the-future-of- little-printer)

<comment><USER32> Yep, we're opening up the relevant repos, and writing up documentation about how to deploy them, and I'm also arranging for a patch to the Bridge unit which allows you to repoint it at a different control URL.

Also, if I have time, I'm going to make this a shink-wrapped AMI to make deployment a little easier. There's sadly not a great deal of time left for this, though, so we'll see what I can get done!

</comment></comment><comment><USER33> Sad to see that they're closing down, but understandably a nieche area of business. The Little Printer was such a cute piece of tech, and I'm sure that they could've done a lot if not this fate was upon them.

</comment><comment><USER34> I would be in favor of opening the code., especially if it was opened as FOSS

</comment><comment><USER35> Hooray for cloud-tethered devices!

<comment><USER36> I prefer the term cloud-encumbered device. Tethered does not sufficiently convey a negative connotation.

<comment><USER37> I'd suggest "cloud-slaved". You're a slave to someone else's "cloud". They can turn you off at any time. They can even take away features from your purchased device. They can start charging for a previously free service. They can shove ads into your device. They can raise your price. They can turn your device off. (The median life of cloud services is only a few years.) The cloud owner is the master. You are their slave.

Grovel.</comment></comment></comment>


Ask HN: A site that can simulate investments? If I'd bought x AAPL I'd have y - <AUTHOR> I'm looking for something that can tell me the history of stocks/investments and also simulate investments.<p>if I invested 350 euro a month into x then I would have y at various points since the start date. <comment><USER2> Have you tried [http://www.investopedia.com/simulator/](http://www.investopedia.com/simulator/) ?</comment>