Corretto – No-cost, multiplatform, developer-preview distribution of OpenJDK - <AUTHOR> https://aws.amazon.com/fr/corretto/ <comment><USER2> The list of specific patches applied is here:

[https://docs.aws.amazon.com/corretto/latest/corretto-8-ug/pa...](https://docs.aws.amazon.com/corretto/latest/corretto-8-ug/patches.html)

Looks to be mostly or maybe entirely backports.

Good to see another option out there, it will be interesting to see how many of these get folded back into openjdk8 as it transfers maintainership.

<comment><USER3> Amazon has good developers, but the JVM is quite complex and the pool of people who can work on it is pretty rare, I wonder how well they'll be able to maintain it on their own.

<comment><USER4> Amazon has loads of money. Presumably if they care about this, they'll pay whatever's necessary to hire the developers they need.

<comment><USER5> And would still be cheaper than paying Oracle.

</comment></comment></comment></comment><comment><USER6> We use OpenJDK 8 at Datastreamer as part of our social media and blog/news crawler.

It's pretty solid for production use. We're REALLY production as we've been in business for a decade and burn a ton of CPU indexing web content. Think petabytes... :)

The only time we use the Oracle JDK is to run their profiler which is pretty darn nice. It's runtime and sampling so you can get a nice sample in a production app by just restarting it...

I've never had a problem with an incorrect sample.

What I REALLY want though is continuous profiling where we have profiling data uploaded to the cloud and alerts when we have an app regression automatically and I want to be told WHERE the regression is. ...

<comment><USER7> As of JDK 11, all commercial Oracle JDK features, including low-overhead profiler (Java Flight Recorder), are part of OpenJDK.[1]

[1]: [https://blogs.oracle.com/java-platform-group/oracle-jdk- rele...](https://blogs.oracle.com/java-platform-group/oracle-jdk-releases-for- java-11-and-later)

<comment><USER6> Yeah.. I'm really excited about that but we're not ready to move to OpenJDK 11... it's a crap shoot with the new JVMs and the forced upgrades IMO.

<comment><USER7> The difficulty isn't the new release cadence but upgrading beyond Java 9. It's not as scary as it sounds, and even large complex projects can be upgraded within hours to a couple of weeks. For most projects it's a matter of upgrading dependencies (possibly adding dependencies that have been split off of the JDK) and fixing the command line. I would say that the main barrier is if a dependency does not yet work with 9+. Most popular Java libraries do support 9+, but some don't yet and will soon (e.g. Spark).

Once you're past 9, it's smooth(ish) sailing. The new feature releases are somewhere between the old update releases and the old major releases, but much closer to the former (BTW, there was a "forced" upgrade to the old update releases, too; they weren't supported after a new one was released).

Overall, the rate of expected breakage, if any, should be the same as it was before, but happen more gradually.

(I work on OpenJDK at Oracle, but speak only for myself)

</comment></comment></comment></comment><comment><USER8> "This initial release is a developer preview release for testing and validation purposes."

Well... that's not really production-ready then, is it? I assume they intend to make it 'production-ready' at some point in the future, but those two statements are directly at odds.

<comment><USER9> Quite a number of software houses use pre-alpha-preview betas in production. I'm not sure what motivates them, my theory is that upgrading everything bi- weekly is great busywork for a startup with few users and little traction.

<comment><USER10> That theory is not only derisive but incorrect. There is always plenty of non- busy work to be done at a startup, even one with few users or traction.

</comment></comment></comment><comment><USER11> The posted URL goes to the French version of the page.

This is the primary URL: [https://aws.amazon.com/corretto/](https://aws.amazon.com/corretto/)

<comment><USER12> I am getting the text in English using the /fr/ url with a French locale on my browser.

</comment></comment><comment><USER13> Legitimate question: what is keeping stock OpenJDK from being considered "production-ready" as it is?

<comment><USER14> Lack of long-time support commitment. A lot of java users want to hear someone say "we'll push updates for any and all CVEs for the next forty-two years, and that's a promise".

They may not actually install those updates, but they want to hear someone say that they will exist.

<comment><USER15> But isn't it exactly what Oracle offers? For the money, of course.

<comment><USER14> Oracle's offering involves paying Oracle money _and getting regular phone calls from the Oracle sales department,_ which I have heard described in colourful ways.

<comment><USER16> Oracle has/had "value based pricing" for larger contracts

The discussion goes something like this:

Customer: "How much does this cost?"

Oracle sales: "How much money do you have?"

Now this isn't quite as bad as it sounds (charge based on the value that the new system will bring) but the conversation was definitely a bit uncomfortable..... Oracle was not selected as the vendor.

Edit:

SAP weren't selected either for different reasons:

SAP: "You are a manufacturing company and will use SAP like this"

Customer: "We see why you might think that but we don't manufacture things"

SAP: "You are a manufacturing company and will use SAP like this"

Customer: Next...

Obviously, there was more to both conversations - but these are reasonable summaries based upon my dubious memories.

<comment><USER17> That's how B2B sales work - the salesman works on how much the customer is willing to pay, then discounts the product down to the point the customer will pay, and the checks that isn't below cost of goods.

</comment></comment></comment></comment></comment></comment><comment><USER18> I have not used Java in _many_ years now, but I'm curious if anyone has anecdotal experience using OpenJDK in production? Performance vs Oracle Java, bugs/ idiosyncrasies due to internal API differences, etc?

<comment><USER19> As of JDK 11, there is feature parity between OpenJDK and Oracle JDK, which is the JDK that most people used until now. In JDK 8, the Oracle version had several closed source additional features (such as Java Flight Recorder and the Z garbage collector). Also, implementations of things like graphics rendering used to be different in Oracle JDK 8 and earlier. That's no longer the case. Oracle JDK and OpenJDK should be drop-in replacements for each other as of JDK 11.

<comment><USER20> Amazon's OpenJDK is 1.8.0 which is JDK8, so it still 'misses' those Oracle's closed features?

<comment><USER21> Most of those features are only relevant for UI stuff and even then you are unlikely to notice the difference since openjdk would include implementations of anything even remotely relevant. Unless you know you need this, you can safely assume you don't.

Here's a good stackoverflow post on the topic (note this is about openjdk 7). Things have only improved since then.

[https://stackoverflow.com/questions/11547458/what-is-the- dif...](https://stackoverflow.com/questions/11547458/what-is-the-difference- between-jvm-jdk-jre-openjdk)

If you are doing any kind of server side deployment, openjdk has been a drop in replacement since the java 7 days. Essentially all linux distributions include it and you have to jump through hoops to get the oracle version.

There are differences between different openjdk builds though. I've ran into issues with certificates a couple of times on Ubuntu. Also they had a strange notion of what is stable and what is not early in the life of java 8. Another issue is the licensing of the test suite. This makes it hard to test your builds. The words certified build, implies that the produced build passes the licensed test suite.

</comment></comment></comment></comment><comment><USER22> The repo is on Github:

[https://github.com/corretto](https://github.com/corretto)

<comment><USER23> Wow genuinely surprised that AWS is not using CodeCommit

<comment><USER24> Have you used it? Maybe you'd be less surprised :D

If you want open source contributions, AWS' Code* offerings are a terrible choice. For example, AFAIK you still can't display a build status page that people can view without being logged into the AWS console, like Travis CI or AppVeyor. I honestly don't know who they built those services for, but I'll take Travis CI or Jenkins over those services any day.

<comment><USER25> > I honestly don't know who they built those services for, but I'll take > Travis CI or Jenkins over those services any day.

People who aren't developing open source software and people who want integrated IAM, generally. Git repos having ARNs is pretty neat

<comment><USER24> You can use Jenkins for closed source. And if you've found a way to display HTML reports (unit tests, coverage, etc) using CodePipeline and IAM but without a hacky Lambda to proxy it from S3 with auth, I'd also love to know. But as is, I believe the offerings are inferior to open source tooling, and don't promote code quality.

</comment></comment></comment></comment></comment><comment><USER26> This is good news for Groovy developers since the Groovy project seems to have run into significant roadblocks with migrating to Java 9+. I'd recommend most other developers on the JVM rip that bandaid off now and get onto Java 11 though, because migrating is not going to get any cheaper or easier.

<comment><USER27> The roadblocks for Apache Groovy migrating to version 3 are imposed by Groovy's backers themselves. They want to keep it as is for as long as possible to keep Gradle users hooked. If a non-compatible Groovy 3.0 comes out, then Gradle users would more likely upgrade from Groovy 2.x to Kotlin instead of to Groovy 3.0 for their build scripting language. The ASF Groovy project managers want to keep their consulting-and-conferences gravy train running for as long as they can.

</comment></comment><comment><USER28> This is about Amazon removing a revenue stream from Oracle. Amazon also announced a few days ago that they were removing Oracle products from AWS.

Expect an article by Ben Thompson on stratechery.com in the next week.

<comment><USER29> To be fair I trust Amazon just about as much as I trust Oracle.

<comment><USER30> A long time ago I was looking into the cost of Oracle for a company and trying to compare it to Sql Server.

For SQL Server, you just go to the page and the price is right there.

For Oracle, you have to talk to a salesmen. That turned me off from Oracle.

With AWS, I know exactly how much a resource will cost and there are a myriad of ways you can get detailed billing.

</comment></comment></comment><comment><USER31> Given that Corretto is in production at Amazon today could this by default become the most popular (by production instances) JVM? Let's say Corretto becomes the default in BeanStalk, Lambda, and maybe some popular AMI's. Would that be enough?

Let's say sometime next year some performance benchmarks come out and Corretto is in fact faster than Oracle's JVM. Would people be quick to switch? Would enough people switch? I feel like the Java ecosystem has been at the verge of a "phase shift" for a long time. There's a lot of pent up demand for features and Oracle and the governance process just aren't delivering. So now Amazon steps in and, just think about it, what are the odds this JVM ends up faster, better, and _gasp_ with some new features people want.

<comment><USER32> I suspect it already is in use in Lambda, an AWS rep mentioned something about them using a custom JVM internally for Lambdas when they gave a talk at our company recently, so this is probably that.

As for the default on AMIs, it probably will go that way when OpenJDK 8 support ends next year. They'll have the option of distributing RedHat's OpenJDK build with their patches, or packaging their own. It'll probably be similar to the `mysql` package actually providing MariaDB, and no one will really notice.

I am intrigued if there will be noticable performance improvements. They do mention performance enhancements on the page, but I believe this is more about dealing with Oracle's licensing changes and maintaining support for the LTS releases. But there's plenty of incentive for them to make it better performing than alternatives too.

I expect my company will switch to this because we're already on Amazon Linux 2, and have been struggling to make a decision on how to update the JDK with future releases. But if there are performance improvements, that might push some more AWS users to switch to Amazon Linux over Ubuntu and other distros in EC2.

</comment></comment><comment><USER33> If I want a free LTS supported OpenJDK build, how does this compare to AdoptOpenJDK? Which one is likely to "win" as the de facto standard JDK build used by most of the community?

<comment><USER34> AdoptOpenJDK is the much larger project with broad community backing (We even have Amazon contribute) from IBM, Red Hat, Azul, Ocado, Microsoft etc. It's got a fully open and auditable build and test pipeline and supports a massive number of platforms (arm32/64, AIX, s390, Mac, Windows, Linux x86, PPC etc) and versions (8, 9, 10, 11, amber, 12 beta et al). We've already had over 2M downloads and are definitely in production in a lot of places.

We'll be working with Amazon to make sure there's some consistency between the two, no point in fragmenting.

Corretto is an obvious choice if you're an AWS user, for everything else Adopt is also a decent choice.

</comment></comment><comment><USER35> You mean they announced a five-year supported LTS after Oracle once again told the world they want money for their LTS version? Ouch.

It was kind of nice to have Gosling announce it though.

</comment><comment><USER36> can i get an eli5 on why we care about this? why not contribute to openjdk? why do we need another flavor?

<comment><USER32> As of the latest version of Java, OpenJDK is equivalent to Oracle JDK, and they'll release new versions every 6 month. However, there won't be any security updates or bug fixes to OpenJDK versions from Oracle after 6 months. There's a few groups that plan on maintaining patches beyond that period, but most options involve paying someone (including Oracle).

It's mostly just about enterprise distribution, rather than any differences in the JDK. Updating major versions every 6 months is risky, not having security updates is more risky, and no one likes paying money for something that they've been getting for free.

So far this seems like the simplest and cheapest way of getting long term security/bugfix updates for the JDK, especially if you're already running Amazon Linux. We've been evaluating the options in my team recently and hadn't come to a decision beyond "update to Java 11 and see how it goes after that". This pretty much solves our problems.

I would have preferred to see Amazon partnering with Red Hat or other open source groups on maintaining one well supported OpenJDK, but at least as it's all open source, patches should make their way to all versions.

<comment><USER36> thank you. makes more sense now. much appreciated.

</comment></comment></comment><comment><USER37> Does anybody know how good internal OpenJDK in Ubuntu will be supported by Canonical? Somehow I could not find any information about real support in the future. I heard of commitments from and for RedHat though.

I'm sure Corretto will be at some time also available for Ubuntu.

<comment><USER38> It's likely just the work that Debian does. OpenJDK upstream will always have their repository available, it's just that Oracle is paywalling binary builds after 6 months.

Debian builds from source and is unaffected by the binary paywall.

</comment></comment><comment><USER39> It's a bit sad that they don't even package it in Amazon Linux's repos. In my eyes that's just building trust on one end and demolishing it on the other.

<comment><USER40> > Amazon Corretto 8 is in Preview

Probably a good reason to keep it out of the repos

</comment></comment><comment><USER41> At which point will they add their proprietary extensions? Am I the only one fearing this? I wouldn't want to depend on a business like Amazon.

<comment><USER42> > _At which point will they add their proprietary extensions? Am I the only > one fearing this?_

What? OpenJDK is GPL with a class path exception, so software that runs on it can be licensed however but additions/changes to OpenJDK cannot be kept proprietary. Can you please elaborate what you're afraid of there? It's not as if Amazon is the copyright holder and can thus even offer a dual license.

</comment></comment><comment><USER43> I don't really "get" software licensing but are they bound to GPL because OpenJDK is GPL? Does anyone make a more permissive JDK?

<comment><USER44> Yes, but it's really GPLv2 with the classpath exception [1] which makes it similar to the LGPLv2. Amazon's OpenJDK still has to be GPL. However, software using the OpenJDK can be licensed however you want (because of the classpath exception) [2].

[1]: [https://openjdk.java.net/legal/gplv2+ce.html](https://openjdk.java.net/legal/gplv2+ce.html)

[2]: [https://softwareengineering.stackexchange.com/q/119436/69573](https://softwareengineering.stackexchange.com/q/119436/69573)

</comment></comment><comment><USER45> Does anyone know if this Amazon OpenJDK includes a Windows 32-bit version? I can't find any mention of this in the docs.

<comment><USER46> They don't - Your best bet is probably Azul [https://www.azul.com/downloads/zulu/zulu- windows/](https://www.azul.com/downloads/zulu/zulu-windows/)

<comment><USER34> Or AdoptOpenjDK [https://www.adoptopenjdk.net](https://www.adoptopenjdk.net)

</comment></comment></comment><comment><USER47> > Amazon Corretto is a no-cost, multiplatform, production-ready distribution > of the Open Java Development Kit

I really, really wish AWS would start using practical/self-explanatory names for their products.

<comment><USER48> I'll take names over alphabet soup. My EBS EC2 machines are not playing nicely with ELB (but my EFS ones are), I think it might be to do with EMR, or maybe EKS.

<comment><USER49> You could always say: "My elastic block service elastic cloud compute machines are not playing nicely with elastic load balancers (but my elastic file system ones are), I think it might be to do with elastic map reduce, or maybe elastic kubernetes service." No soup.

<comment><USER50> It feels like English should have a provision to factor out the word "elastic" in this case.

Just assume every word in the sentence is elastic.

<comment><USER51> "My elastic block service elastic cloud compute machines are not playing nicely with elastic load balancers (but my elastic file system ones are), I think it might be to do with elastic map reduce, or maybe elastic kubernetes service."

"My elastic services are not working. Cloud compute machines..."

</comment></comment></comment></comment></comment><comment><USER52> I wonder if it works well on Windows XP 32-bit.

<comment><USER5> It doesn't, and neither should you.

<comment><USER52> Oracle JDK works well.

</comment></comment></comment><comment><USER23> Surely Amazon Corretto is just going to fracture the Java ecosystem?

<comment><USER53> You can get Open JDK from any of the following places on them intarweb tubes, and they don't seem to fracture the ecosystem. Linux is available from many places, it may seem fractured, yet Linux seems to be taking over the world. Even Microsoft now "loves" Linux.

[https://aws.amazon.com/fr/corretto/](https://aws.amazon.com/fr/corretto/) [https://github.com/corretto](https://github.com/corretto)

[https://adoptopenjdk.net/](https://adoptopenjdk.net/) [https://github.com/AdoptOpenJDK](https://github.com/AdoptOpenJDK)

[https://github.com/ojdkbuild/ojdkbuild](https://github.com/ojdkbuild/ojdkbuild)

[http://www.azul.com/downloads/zulu/](http://www.azul.com/downloads/zulu/)

[https://jdk.java.net/11/](https://jdk.java.net/11/)

[https://developers.redhat.com/products/openjdk/download/](https://developers.redhat.com/products/openjdk/download/)

[https://github.com/SAP/SapMachine](https://github.com/SAP/SapMachine)

[https://bell-sw.com/java.html](https://bell-sw.com/java.html)

<comment><USER7> Hopefully, OpenJDK would be less fractured than Linux. One thing to note, though, is that you can only call your JDK "OpenJDK" if it's a build of the OpenJDK project, with no substantial additions or removal of code[1]. Most free JDKs are, indeed, OpenJDK, with the exception of the JDK based on IBM's OpenJ9 JVM, even though it uses parts of the OpenJDK codebase.

[1]: [http://openjdk.java.net/legal/openjdk-trademark- notice.html](http://openjdk.java.net/legal/openjdk-trademark-notice.html)</comment></comment></comment>


What will happen if Trump decertifies the Iran nuclear deal? - <AUTHOR> https://www.ft.com/content/73451b82-ac37-11e7-aab9-abaa44b1e130 <comment><AUTHOR> The FT paywall is a bit weird and user/region specific, here's a backup: [https://imgur.com/a/v0CLH](https://imgur.com/a/v0CLH)</comment>


Clearing Up a Few Things About Facebook's Partners - <AUTHOR> https://newsroom.fb.com/news/2018/12/facebooks-partners/ <comment><USER4> "Did partners get access to messages? Yes. But people had to explicitly sign in to Facebook first to use a partner's messaging feature. Take Spotify for example. After signing in to your Facebook account in Spotify's desktop app, you could then send and receive messages without ever leaving the app."

Does anyone have a screenshot or remember what the opt in UX was like this for this? I have been logged in to Spotify via Facebook since basically the very beginning. I worked in tech as a dev, PM, and designer of flows. I never had the understanding that my Facebook connect with Spotify gave them read/write to all my messages. It's certainly possible that this permission was requested in an auth form that I quickly granted without realizing, which would make this more of a dubious product decision that blatantly unethical. Anyone have info?

<comment><USER5> Looks like as of 07/2013 it was this: [https://imgur.com/UdfzvGU](https://imgur.com/UdfzvGU)

Source: [https://stackoverflow.com/q/17561784/9027089](https://stackoverflow.com/q/17561784/9027089)

<comment><USER6> Nice, good find. That doesn't give permission to read (or even generate) private messages, unless you interpret "my data" to mean something in the last bullet point that's much broader than the three above.

<comment><USER7> > _unless you interpret "my data" to mean something in the last bullet point > that's much broader than the three above..._

Hmm. It seems this may sound weird to you and many others, but that's _exactly_ how I interpreted it. When looking at that screen I was wondering why anyone in their right mind would grant Spotify these rights?

The only thing Spotify does is play songs for you, right? They shouldn't really need access to _any_ of your FB data to do that.

<comment><USER6> Alright, I confess, your interpretation was the same as my immediate hot-take reaction, but then I stopped and said waiiiiiit a sec, they can't literally mean, all the data, right? They must mean, like, "my data" in the sense of that stuff above, right?

Only now does FB reveal themselves to the be treacherous jerk they've always been and abuse whatever leeway you give them. Use recovery phone number for marketing? Why not!

<comment><USER8> Only now!!! Where have you been?

<comment><USER6> I agreed they've always been treacherous jerks, I meant about the counterintuitive broad reading of "my data" on this page.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> The language of this post seems _extremely_ carefully chosen and to present as 'let me explain why what Facebook did was fine' and 'Facebook is full of great features that people use.' The language is somewhere in between reductive and manipulative.

"this work was about helping people" and "people could have more social experiences" and "People want to use Facebook features"

and then: "Our integration partners had to get authorization from people. You would have had to sign in with your Facebook account to use the integration offered by Apple, Amazon or another integration partner."

I read the last quote as "we used a dark pattern[1] to get your permission for this"

[1][https://darkpatterns.org/](https://darkpatterns.org/)

<comment><USER5> this isn't clear to you? [https://i.imgur.com/UdfzvGU.png](https://i.imgur.com/UdfzvGU.png)

<comment><USER9> There's a reason the post wasn't worded as "you would have had to explicitly give permission for Spotify to access all of your messages."

It is my opinion that Facebook recognizes exactly how unethical their behavior was, as evidenced by the language they choose to use to describe their behavior.

</comment></comment></comment><comment><USER10> The whole article seems odd. I have no training in public relations, but I assumed the narrative would try to at least seem sincere about end-user's privacy concerns.

There's none of that at all, not that it would be believable at this point anyhow. But it reads like a bully trying to justify to a teacher why he chose to eat another kid's lunch. It's clear fb has no moral guilt here and actually implies that all blame is shifted off of themselves.

<comment><USER11> It's extremely poor PR. I was caught up in the 2012 FTC investigation on social networks and data brokers. Public just wants to hear how you are going to protect their data. Doesn't matter if you're right or wrong. Pushing that you weren't wrong narrative just alienates your users even more.

</comment></comment><comment><USER12> What did I just read? Is this a legitimate Facebook post? Are they actively trying to defend and justify their actions? First step in crisis management would be to acknowledge the crisis for what it is. Without that stage Facebook will never get out of this. It's like Microsoft's security before Bill Gates's trustworthy computing memo. Facebook you have to change.

</comment><comment><USER13> I assume someone at Facebook, hopefully the person that wrote this, or someone who has more influence over this issue, is reading.

I am an engineer. I understand technology better than most of the general population. When I sign in to my Facebook account to use Spotify, I am absolutely not expecting that Spotify will now have access to read every single one of my private messages. This is a gross violation of trust, and if this is what happened, then the fact that you not only made this mistake, but also then published this blog post defending it, marks a low point for Facebook. Perhaps irrecoverably so for me.

"After signing in to your Facebook account in Spotify's desktop app, you could then send and receive messages without ever leaving the app. Our API provided partners with access to the person's messages in order to power this type of feature."

This is a write permission. So you needed to give Spotify permission to create a message. It seems that your system combines the read and write permissions, since you just grouped them together by saying "access to the person's messages". It also seems from your defense that you see absolutely no issue with this. In order to share a song through Spotify, you are giving them access to every single private message the user has ever written.

I find it hard to believe that Facebook refuses to acknowledge any fault in this: The initial product decision, the upholding of this decision through previous privacy investigations, and this PR response. Am I misinterpreting the facts or scale of this?

<comment><USER14> Well if you want to receive a message that someone sends you then you'd also need to grant Spotify read permissions. In essence, you'd be using Spotify as a client app for fb messenger. How else could that work without Spotify getting read/write access to your messages?

<comment><USER13> I assume the point here to send someone a message on FB with a Spotify link, so they click on it in their messages and it opens up the Spotify app. If you just want to send a message from one Spotify user directly to another in Spotify, you don't need FB messages at all, right? Spotify has a list of all your FB friend IDs already and knows which Spotify accounts each is connected to

<comment><USER15> I think the use case is closer to Spotify acting as an alternative client to the messenger backend, much like Adium is an alternative client for Google Chat. Which in this case you have to trust the client. It feels grosser because Spotify isn't just a desktop application, they could in theory have stored and mined your chats.

</comment></comment></comment></comment><comment><USER16> I was too young to really keep abreast of the Microsoft anti-trust lawsuit, but I've never seen a technology company come under so much sustained pressure than Facebook over the past 18 months.

The New York Times in particular has definitely made it a mission to air out all of Facebook's dirty laundry. Overall, I don't think that this will result in users becoming more concerned about privacy (although their governments may) but it does seem like Facebook from a product perspective is vulnerable, even considering the amazing backstops that are Instagram and WhatsApp.

<comment><USER17> > The New York Times in particular has definitely made it a mission to air out > all of Facebook's dirty laundry.

There are two thoughts here that people here assume are mutually exclusive, but they're really not.

(1) What NYT has reported is true, and highlights some serious issues that Facebook needs to address.

(2) NYT _also_ , without saying anything untrue, takes negative news about Facebook out of context and gives it more prominence/repetition than is appropriate.

Both of these are possible simultaneously. I happen to believe both are true. The "providing a platform" argument was much more relevant at the time most of these actions occurred, even if that doesn't fully excuse them. And even if this significant news, that might not justify burying other important stories (e.g. imminent government shutdown) so that it can be top of the news multiple times in the next week. As it surely will, even if there are no new revelations.

As for the substance of the OP or the NYT story to which it responds: no comment. Facebook PR is going to have to do this one without me. >:-(

<comment><USER18> What?

Facebook has so far admitted to everything, or in other words, the gross mishandling of privacy of a billion people for a decade and an unwillingness to improve.

Is your point that we shouldn't worry about Facebook being an evil company because there are worse things out there?

Why can't we worry about multiple things at once?

Even if we go down the road of whataboutism, don't you think Facebook has earned its place in the spotlight? Facebook has shown itself to be an existential threat to liberal democracy and truth in recent years, it's hard to imagine a bigger threat than that. I mean, if it wasn't for a gazillion fake accounts gaming interest groups on Facebook, a lot less people would think things like climate change was fake. Which means that at its very worst, Facebook is being used to kill the planet.

Don't get me wrong, I still think Facebook can be really good, at its best, and that's exactly why I think the focus on their missteps is welcome. We need to tell them where the line is, so we can get more good and less bad.

<comment><USER15> Mass communication is a threat to democracy? That somehow only more censorship (fake news screening or whatever people want to call it) can fix? This is such a profoundly anti-democratic position, with extra overtones of "these voters didn't know any better".

<comment><USER19> > Mass communication is a threat to democracy?

Why did you think that strawman would work on HN of all places? FB didn't invent email, chatrooms, message boards, or the internet, things that actually support mass communication.

<comment><USER15> Curious how you can call that a strawman without knowing OP's actual position. I mean to be fair I likely misrepresented his ideas but to do otherwise requires a lot of back and forth questions to really understand the positions at hand.

I hope we don't have a long internet argument about what "mass communication" is, that would be a great waste of time.

I just suspect that if facebook didn't exist, message boards and chatrooms would have launched Trump into the white house just the same, and we'd be casting them as a "threat to democracy".

<comment><USER19> > I hope we don't have a long internet argument about what "mass > communication" is, that would be a great waste of time.

100% agree. That is why I don't bother reading the comments where the discussion veers into the semantics of the label used ("socialism" and "market forces" related stories being the worst offenders).Usually the story isn't about that at all, but people seem to love rehashing their college-era debates that ended nowhere.

> I just suspect that if facebook didn't exist, message boards and chatrooms > would have launched Trump into the white house just the same

I partially disagree. Without FB, Twitter could still have spread mass misinformation and divisive propaganda. Either way, the scale of either isn't comparable to message boards of yore. Those allowed for total anonymity. You weren't mandated to provide a real name. You weren't encouraged to share details of your personal life (relationship status, alma mater, location). Message boards also didn't have ad networks built into it that incentivized data gathering on a mass scale. Finally, message boards were not built around "sharing". That's what got fake news posts outside of your crazy uncle's FB circle and into local news website comments page, etc, giving it visibility it wouldn't have otherwise.

What were the biggest message boards back in the day? Something Awful? Digg? 4chan? A few million members max. FB has 2 billion + on a single network. A single point of entry where the network gives you (as an advertiser/bad actor) near-unprecedented targeting ability for promoted posts and ads. If you popped into your local phpBB baseball forum and dropped off a meme showing Clinton with the Star of David with no additional context, you'd get booted by a moderator for being off-topic and thread would be locked. No way to spread it to the outside world. Not so on social networks.

</comment></comment></comment></comment></comment></comment></comment><comment><USER20> It's hilarious. Facebook misbehaves like a three year old and lies to your face about it. Fifteen years later and the same dysfunctional relationship continues. In a few days, in a couple of weeks there will be some post from their engineering department regarding some fantastic thing they are working on, they released, whatever. And this hate love debate will dissipate to the far end of your minds. When will you say enough?

</comment><comment><USER21> I think what they are failing to address here, and what is incredibly misleading of them in this message, is that they fail to define what "public information" or "public activity" means to them. They define this in their TOS & Privacy Policy as pretty much anything you do on facebook, or a separate property that integrates with them, that you don't EXPLICITLY set as private. This statement tries to make it sound like they use very little data, when in all actuality most of what you do on FB is considered "public" to them even if they don't show this stuff publicly. That's not okay.

</comment><comment><USER22> So basically it's totally OK because someone clicked sign in with fb? I bet the majority didn't realise that implied giving access to private messages.

Seems pretty dark pattern-y at best

>this work was about helping people do two things

One of the most disengenious things I've read in a while. Nothing about this was about helping users.

I hope they get slaughtered on the markets tomorrow (again).

</comment><comment><USER23> There are 3 parts to a genuine apology. 1 we're sorry 2 we messed up 3 here's what we're doing to fix it

This is a poor attempt at an apology. It just shows how desperately they acted to grow users with little to no regard for user privacy. That's a typical footprint for a mercenary company, not one who's mission is to respect its users.

Just look at how Apple apologized about their battery dilemma. Here's a great way to show you care about your users [https://www.apple.com/au/iphone- battery-and-performance/](https://www.apple.com/au/iphone-battery-and- performance/)

<comment><USER24>
      > Just look at how Apple apologized about their battery dilemma. Here's a great way to show you care about your users

In Apple's case, users are also customers and everybody take genuine care about their customers.

In Fb's case, users are not their customers, they are product for them. and product are meant to be for sell, and this is what they do.

</comment></comment><comment><USER25> > To personalize content, tailor and measure ads and provide a safer > experience, we use cookies. By tapping on the site you agree to our use of > cookies on and off Facebook. Learn more, including about controls: Cookie > Policy

> By tapping on the site

> use of cookies on and off Facebook

So an accidental interaction when trying to navigate away after seeing your cookie policy opts me into your cookie policy.

You bastards are full on assholes, huh?

<comment><USER26> There's no way "any interaction with the page" could possibly legally constitute agreeing to any sort of policy. I hope someone sues them over this.

</comment></comment><comment><USER27> Do we have any reason to believe anything this company says about anything anymore?

It's like they know they're in a very deep hole - yet with every press release they just keep digging themselves in deeper.

</comment><comment><USER28> And now you know why Google is _really_ shutting down Google+ earlier than planned. Someone should also take a look at Android, where there are some insane permissions available, like accessing your messages and call log. I wonder how much those have been abused by third parties far less trusted than e.g. Spotify. Granted, you have to consent to all of this crap, but 99% of users perceive this as a speed bump and click OK without reading, and the remaining 1% won't touch Android with a 10 foot pole after seeing one of those permission dialogs.

<comment><USER29> Ah the inevitable, "it's all Google's fault" reply.

<comment><USER28> I don't see how you could misconstrue my comment in this way, but what I meant to say is "Google should also receive scrutiny" for these very similar privacy issues. I don't think anyone can argue with this in good faith.

</comment></comment></comment><comment><USER30> Can someone clear this up (preferably if you've worked with the FB API):

when NYT published that spotify and netflix have accessed to private messages, isn't that simply for them to do a POST call for sharing a tv show or song?

<comment><USER31> Facebook appears to have designed their system in such a way that permissions were not granular enough to do things like "Spotify can only post certain types of messages". Instead it had to be "Spotify has full read/write access to all private messages".

Given Facebook's history it's hard to believe that the lack of granularity, and resulting incentivizing of users to grant as much access to personal data as possible, was an accidental oversight.

<comment><USER32> Looking at the Spotify sign-in image from 2013 that jahlove found above, Spotify didn't even ask for that auth permission.

The full messaging access seemed to be a hidden bonus for their larger partners.

</comment></comment></comment><comment><USER33> I think a very common problem with OAuth (way beyond Facebook) is that people often underestimate the permission they are giving to a 3rd party. For example, if you use some email client to manage your Gmail, the email client would request permission to "manage your Gmail", exactly what you want, but that actually gives the 3rd party permission not only to read all your mails, but to send out emails on behalf of you.

</comment><comment><USER34> The Title should be corrected. The title of post is actually:

"Let's Clear Up a Few Things About Facebook's Partners"

This distinction is notable for it's patronizing tone.

Of course the assumption that we all have it wrong. "There's nothing to see here, please move along." Everything that was done was done to make the world a more connected place and for us to have more "social interactions."

This post is a case study in how not to do PR. There's wasn't even a remote hint of concern for what their users might be feeling in the wake of this story. But perhaps it doesn't matter anyway since this company has zero credibility at this point.

</comment><comment><USER35> So CuteApp allows you to read FB messages and email from their app. They cut deal with FB but you still need to want to do it and then enter your FB credentials while in CuteApp. Unless messages are saved in the app, unsecured, I see no problem. FB users read _his_ messages somewhere else but using their FB credentials. (If I understood it correctly)

<comment><USER36> No, CuteApp allows you to read FB messages and email from their app. They cut a deal with FB and even if you don't use the service, CuteApp can still access your messages. You don't actually know about the service - it isn't in the permissions and you didn't give explicit consent for it. Doesn't matter.

<comment><USER37> Do you have any evidence to back up these claims?

<comment><USER36> Yes, actually. 1\. There is no record of an explicit permissions check, and there are records of other checks.

2\. Facebook has acknowledged (multiple times, now) giving read/write access as long as you were logged in through Facebook to one of these systems - <USER2> don't have to explicitly enable it _and_ engage the message service, which is what OP was saying.

3\. They say: "No third party was reading your private messages, or writing messages to your friends without your permission." They aren't saying that no third party was reading or writing messages, just that you gave it permission to do so. Unfortunately, that permission was, again, not explicitly given. It was a blanket (access data) permission. Facebook has a documented and admitted history of obfuscating what permissions you are actually giving it - <USER3> messaging app being one example.

<comment><USER37> You said:

> even if you don't use the service, CuteApp can still access your messages. > You don't actually know about the service

I don't disagree that permissions dialogs can be confusing and misleading, but you were initially claiming that CuteApp could access your messages even if you have never used it. Are you no longer making this claim?

<comment><USER36> No, I am making the claim that you don't have to use the message service for them to read your messages. I was unclear.

</comment></comment></comment></comment></comment></comment><comment><USER38> Title seems aggressive, yes?

I spent an hour trying to remove all of the advertisement connections, have no idea how far into it I got. Mostly realtors and car dealerships

</comment><comment><USER39> They are no good at all at apologizing. They somehow manage to be consistently condescending. Facebookers, take this into account next time (or the next dozen times) you have to write up an apology. [https://news.ycombinator.com/item?id=6116544](https://news.ycombinator.com/item?id=6116544)

<comment><USER40> He's been apologizing since 2006... think they'd get better at it by now.

[https://www.fastcompany.com/40547045/a-brief-history-of- mark...](https://www.fastcompany.com/40547045/a-brief-history-of-mark- zuckerberg-apologizing-or-not-apologizing-for-stuff)

</comment></comment><comment><USER41> > Did partners get access to messages?

> Yes.

(o_O;

...and every time I think FB can't get any worse, it does.

Serious Q: is there a way to find out what services I've ever authorized into using my Facebook account, and nuke those links/permissions? I haven't done that in years, but who knows how many of these there are still lying around.

</comment><comment><USER42> Facebook can't be regulated into the ground and then sued into a fine dust fast enough.

It is really hard to overstate the ambient anger out there at a general sense of exploitation. FB have made themselves a lightning rod for that anger.

Couldn't happen to a more exploitive, manipulative company.

</comment><comment><USER43> Remember when fb blog posts used to be about cool tech problems? How much more unfun and 'last year' can this platform get?

</comment><comment><USER44> Its funny how the article keeps repeating "people had to explicitly sign in" to give access. Well that should not be enough let 3rd party apps read my messages.

</comment><comment><USER45> It all boils down to convinience. People are so easy manipulated with just a little incentive. Just keep one thing in mind. If at any given time there is a product or service that has no cost or fee to use, the first thing should pop in your head is: "There is nothing free in this world." If you hit Accept / OK for a free service / product the blame is on you/us, not them.

</comment><comment><USER33> Is it just me that couldn't find the feature in Spotify desk app to actually send a message to a friend from the app?

<comment><USER46> These features were removed in 2015.

</comment></comment><comment><USER47> If not the US, other nations should take stringent measures to reign in the out of control Facebook horse. They have broken most ethical and moral boundaries of trust. They not only treated users like a product, but exploited them. I hope they find their day in the court of law.

</comment><comment><USER48> There's just one thing that really struck me:

"Apple, Amazon, Blackberry and Yahoo"

I think the person who wrote this piece first ordered those companies on alphabetic order to look as neutral as possible, then somebody standing behind the editor leaned over and said "Perhaps you could move Apple to the first spot?"

There isn't a single comma accidental in this article.

Anyway: as somebody pointed out the dialog clearly stated that Spotify could access your data even without using Spotify. I think people should be a bit more conscious about what they trust to a third party to begin with. No, you're not paranoid running your own mail server.

</comment><comment><USER49> In case people want to read the original story and discussion:

[https://news.ycombinator.com/item?id=18712382](https://news.ycombinator.com/item?id=18712382)

</comment><comment><USER50> This has been the de facto practice for ages in API integration. Everyone is doing it. When you grant Dropbox access to an app, can you say Dropbox is colluding with app developer?

<comment><USER51> That is what confuses me. It is a widespread issue in the industry, but somehow Facebook is getting singled out for it. And the particular integrations in question were disabled years ago.

</comment></comment><comment><USER52> Crisis management playbook in action.

</comment><comment><USER53> The FIRST thing I see when I visit this site (on mobile) is a popup telling me this...

```To personalize content, tailor and measure ads and provide a safer experience, we use cookies. By tapping on the site you agree to our use of cookies on and off Facebook. Learn more, including about controls: Cookie Policy. Cookie Policy```

I know they have to do that, and it was already there... but doesn't that feel like a slap in the face?

</comment><comment><USER54> This is their remorse:

"Still, we recognize that we've needed tighter management over how partners and developers can access information using our APIs"

</comment><comment><USER55> I cannot proceed to reading the article because I refuse to accept fb's cookie policy that doesn't seem to give a way to read the content without accepting a cookie from them.

<comment><USER51> Why not browse in incognito, so the cookies clear out when you close the window?

</comment></comment><comment><USER56> > _Today, we're facing questions about whether Facebook gave large tech > companies access to people's information and, if so, why we did this._

> _To put it simply, this work was about helping people..._

Putting it simply would be to answer YES to the first question instead of sleazing your way into a thousand words false apology where you don't admit to have ever done anything wrong besides leaving old APIs running for longer than they should have (!)

Also, nothing Facebook does is about "helping people". That is not their business. Their business is exploitation.

<comment><USER15> Is all business exploitation? And capitalism is the problem?

Businesses have to have customers and users to survive, even tobacco companies provide value to users even if their product kills them.

If Facebook provides 0 value, stop using them and all the other rational people will too. If they provide a modicum of value, then people will use them if the value delivered is below the cost (cost includes privacy violation and bad trust).

</comment></comment><comment><USER57> "Did partners get access to messages?

Yes."

That's all the article needed to be.

</comment><comment><USER58> Why would I believe the fibs from an ad company?

</comment><comment><USER10> > We're already in the process of reviewing all our APIs and the partners who > can access them.

Translation:

      chmod 777 *

</comment><comment><USER59> > To be clear: none of these partnerships or features gave companies access to > information without people's permission, nor did they violate our 2012 > settlement with the FTC.

Always take note of the defense, "It was legal." It is the last defense of an opponent who knows they have lost the moral battle.

</comment><comment><USER60> there's nothing to clear up. the statement is a non-denial denial when you read it closely.

<comment><USER61> I don't understand your point.

It reads like a fairly clear and descriptive statement to me and in-line with actual facts reported by the newsmedia (without the messy presentation of the newsmedia).

</comment></comment><comment><USER62> This is just more NYT slander to finish off their biggest advertising rival. Nothing about this was out of the ordinary or hidden from the user. The next article will be the NYT saying Zuck broke the public's trust because Facebook had this thing called an API which is totally evil and corrupt. It probably stands for Anti-Privacy Interface.</comment>


SoundCloud Go – Ad Free and Offline Listening – $9.99 - <AUTHOR> https://soundcloud.com/go <comment><USER2> SoundCloud Go isn't available in your country yet. Cool brah.

Tell me again why this is better than already established, well functioning and cheaper music streaming services?</comment>


Boeing fired midlevel executive following embarrassing emails - <AUTHOR> https://www.wsj.com/articles/boeing-fired-midlevel-executive-following-embarrassing-emails-11581521922 <comment><USER2> From the article:

Mr. Cooper didn't send or receive the messages, the latest batch of which Boeing disclosed to lawmakers and the news media in January, this person said. Those messages show Boeing employees mocking airline officials, aviation regulators and even their own colleagues. In one, an employee said the 737 MAX had been "designed by clowns, who in turn are supervised by monkeys."

Boeing Chief Executive David Calhoun, who has called the messages "totally appalling," has said he aimed to stamp out such behavior and hold managers accountable. "Awareness in the leadership ranks around whether that's happening or not is not an excuse if it's happening," Mr. Calhoun said in a call with reporters in January, shortly after taking over as CEO. "Disciplinary actions have to be taken."

\---

To summarize:

They fired a guy for not knowing about emails he did not send or receive where engineers were voicing their internal concerns that the 737 MAX design was lacking.

Boeing's take away wasn't, "People knew something was wrong and didn't have a way to properly voice that concern."

Boeing's take away was, "Middle management should have sufficiently threatened those under their supervision into self-censoring their concerns."

Seems like a super-healthy corporate culture that would simultaneously be a fun place to work and produce the best products /s

<comment><USER3> This kind of an article sounds incredibly damning to me. It indicates that Boeing is essentially rotten on the inside and that anybody doing business with them should be wary.

<comment><USER4> Perhaps related: [https://orgprepdaily.wordpress.com/2007/04/22/on-keeping- you...](https://orgprepdaily.wordpress.com/2007/04/22/on-keeping-your-soul)

This is a chemist's view from the trenches. A manager who hasn't been brought up in the engineering mindset wouldn't even be able to understand any of the points in that blogpost, which partially explains the trouble that pharmaceutical companies are finding themselves in. You cannot bribe or cheat observable reality.

<comment><USER5> As an engineer, I sort of disagree with this. Doing a shoddy job and trying to get away with it is inexcusable, but "good enough" is the gold standard in engineering. No one is helped by spending development time and money by making things better than they have to be.

Sometimes you have to go with a less capable result because the alternative will take too long or cost too much to develop, or (since we're talking aerospace here) weigh too much.

The trick, of course, is to know exactly _how good_ is enough.

<comment><USER6> > _" good enough" is the gold standard in engineering._

This doesn't really make sense given any common meaning of _good enough_. A well engineered system or product is _optimized_. If you want to say that _good enough_ means solving the inherent tradeoffs between safety margins and cost with careful design and precise specs, then you're not talking about the same thing as that blog post, nor would that accurately describe the way Boeing appears to design commercial aircraft nowadays.

<comment><USER5> Isn't the common meaning of "good enough" "sufficiently good to meet my requirements, even though I can imagine it being even better"?

But you're right, I'm clearly not talking about the same thing as that blog post. What I'm arguing is that there's this appropriation of language where people use "good enough" to mean exactly " _not_ good enough", and I don't think that's helpful.

</comment></comment></comment></comment></comment></comment><comment><USER7> I'm reminded a lot of the Challenger explosion investigation [1]. Specifically, Feynman's discoveries and analysis while investigating NASA. He discovered a huge disconnect between engineers and management. What's more, the commission seemed less intent on identifying the systemic issue and more on giving the appearance of a quick resolution, which Feynman hates. "For a successful technology," Feynman concluded, "reality must take precedence over public relations, for nature cannot be fooled."

I feel like it's the same problems at Boeing, and the same pattern of addressing problems. It will be interesting to see if a publicly traded company will be more effective than a government organization at solving these problems.

[1] [https://en.wikipedia.org/wiki/Rogers_Commission_Report](https://en.wikipedia.org/wiki/Rogers_Commission_Report)

</comment><comment><USER8> Firing people is always an interesting way to prove you are doing something about a problem which has already happened and is already being addressed. Generally it try's to show that you are "taking responsibility" but generally the people who are _actually_ responsible are just doing the firing to avoid the stigma of being the screw up[1].

[1] At one group in Netflix (which has an aggressive fire fast culture) that I interviewed with, I came to realize the position existed primarily to provide shielding for the managers above it. I reached out to the former person in the role and they confirmed my suspicions. Not the behavior that Netflix was trying to encourage but there you go.

<comment><USER9> > _I came to realize the position existed primarily to provide shielding for > the managers above it_

Basically, employees are used as ablative armor for management?

</comment></comment><comment><USER10> Boeing CEO David Calhoun vows to stamp out 'such behavior' and hold managers accountable. What behavior? Well he reassigns the Boeing pilot who lied to regulators, and fires the Boeing manager overseeing external pilots, who called out the bad design and incompetence within. Got it.

<comment><USER11> Looks like that for them building defective planes is not as bad as sending "embarrassing" emails

</comment></comment><comment><USER12> Note that this person did not write or receive any of these messages; he was a manager of those who did.

</comment><comment><USER13> [http://archive.is/hk4Cd](http://archive.is/hk4Cd)

<comment><USER14> thank you - you are my favorite kind of person!

(use https though)

<comment><USER13> You're most welcome. I always do this with WSJ articles I submit to HN. However, the paywall busting site I use — [http://archive.is/](http://archive.is/) — doesn't have https

<comment><USER15> >However, the paywall busting site I use — [http://archive.is/](http://archive.is/) — doesn't have https

This seems to have changed as the following works for me: [https://archive.is/hk4Cd](https://archive.is/hk4Cd)

<comment><USER13> Excellent. It works for me too. From now on, that will be my paywall buster of first resort.

</comment></comment></comment></comment></comment><comment><USER16> Typical PR move by Boeing, they're going to start beating the drum on accountability and turning a new corner. Which is all BS, but executive leadership will be applauded on wall street for their efforts. Sad to see especially when you consider the role the company has around the world.

</comment><comment><USER17> > Boeing leaders have faced questions from federal lawmakers about who has > been held accountable for the MAX crisis.

so, apparently the leakers?

</comment><comment><USER18> He was a VP. I'm not aware VP is a mid level management job. I always thought director level and below would be the case.

<comment><USER19> > I'm not aware VP is a mid level management job

A lot of companies ( _especially_ finance) suffer from title inflation, and also flip Director and VP (i.e, Director is a higher rank than VP).

For example, at Goldman Sachs _30% of all employees_ are Vice Presidents.

<comment><USER20> Yeah, I work at a bank. The VP track is often on an 'Officer of the Company' track (Officer, Associate VP, VP, Senior VP, etc). Then there's the 'Job Title' track (Manager, Senior Manager, Director, Senior Director, Executive Director, etc). Usually, you have to be a minimum job title for certain officer title, but less the other way. So you can have a Manager who is a VP and a Director that's a AVP, but not a Manager that's a Senior VP. In any case, the job title is what gives you rank, and officer title is honorary.

Other places do weirder things. I have a buddy at an insurance company who's a "Second VP" and is basically an "Assistant CIO". Never figured that out.

<comment><USER21> i didn't understand that at all. i thought a director is a person elected by shareholders onto the board of directors. but i normally work for small companies!

<comment><USER20> It is that, too. Welcome to the totally non-standard world of job titles.

</comment></comment></comment></comment></comment><comment><USER22> [https://archive.md/hk4Cd](https://archive.md/hk4Cd)

</comment><comment><USER23> [https://outline.com/8tVAdC](https://outline.com/8tVAdC)</comment>


Show HN: Pingpong – The Antidote to Slack - <AUTHOR> https://usepingpong.com <comment><AUTHOR> Founder of pingpong here. We built pingpong to prioritize long periods of uninterrupted work so that your team can be more productive. It's made for async communication and can be realtime when needed.

For our team, we found that slack was stealing our time and attention, making it difficult to do our best work with the barrage of notifications for things that aren't urgent, inter-mixed conversations, fear of missing out on a conversation because you're heads down, and the green, "presence" dot (aka hey everyone, I'm available to be interrupted).

So we made pingpong to be the antidote to its endlessly-distracting, anxiety- inducing nature. If your team feels similarly, give pingpong a spin. We'd love to get some feedback and I'm happy to answer any questions.

<comment><USER2> Sounds like an interesting problem to solve. But the link only let me enter an email.

<comment><AUTHOR> Hey Ben, we've been doing a quick walkthrough the app with people over Google Hangouts because we haven't built onboarding inside the app. :) I can get you set up today if you're interested.

</comment></comment></comment><comment><USER3> can you import from Slack? That is going to be a must if you want people to switch. Also do you support integrations/bots/plugins?

<comment><AUTHOR> We're thinking of how we'll address the import from Slack. Out of curiosity, why is that a must from your perspective?

We plan to support integrations. Which ones are must haves for you and why?

<comment><USER3> You are positioning yourself as a Slack competitor, so I would imagine the most obvious objection is that "we have so much data in slack already". We have a bunch of bots that are useful like SecurityBot and VacationTracker, and our CI process sends out useful slack messages at various points. Those would be the minimum I would think for my company to switch. Of course the real stakeholders probably have higher demands</comment></comment></comment>


The Epidemic of Mental Illness: Why? - <AUTHOR> http://www.nybooks.com/articles/archives/2011/jun/23/epidemic-mental-illness-why/ <comment><USER2> On the advice of people here on HN, I've started reading Whitaker's "Anatomy of an Epidemic", which is one of the books reviewed here. It's a solid book, but not doing a lot for me. As a counterpoint for pro-drug advertising it's fine, but it feels more like a journalistic expose than science. It's not that it's wrong, rather it feels like the author started out with a conclusion and then did a lot of fine research to find supporting evidence. I feel like I'm being given only half the story: a well-founded and less-told half, but still I worry that the author might have chosen to omit any evidence that weakened his case.

I'm enjoying another book (not reviewed in this article) that I grabbed off the new book shelf much better. "What is Mental Illness" by Richard McNally. He's a Harvard psychology professor who's served on committees for DSM-IV. It touches on a lot of the same issues, seems a little more current rather than historical, and by and large I trust that he's representing the field as he sees it. I also like the prose better: a fun combination of low brow and erudite. It's highly critical of the field, but also balanced in a way that I don't find Whitaker to be. <http://mcnallylab.com/>

<comment><USER3> IANAP, but after reading about the process towards the DSM-V,[1] I'm reluctant to give its "authority" much credence.

[1] <http://www.wired.com/magazine/2010/12/ff_dsmv/all/1>

<comment><USER4> Doctors don't diagnose purely on the basis of the DSM or similar statistical tools, and haven't for decades, at least here in the UK which is the system I am most familiar with.

This is too big a subject area to go into here in a HN comment but if you want to know more, a good place to start would be by familiarising yourself with the difference between nomothetic and idiographic knowledge, which is completely key to modern diagnostic practices in psychiatry.

<http://en.wikipedia.org/wiki/Nomothetic_and_idiographic>

VERY VERY simply, while someone might be considered severely abnormal from a nomothetic viewpoint, from an idiographic viewpoint clinicians might decide that they have always been that way and they have a history of being happy and getting on well in their society and with those around them and being successful, and therefore they _cannot call that person crazy,_ however statistically abnormal their actions may be.

But yeah, it's a lot more complex than that.

EDIT: an important point to remember is that not every doctor is some sort of sucker, prescribing whatever big pharma tells them to. When you see a microsoft press release, do you read it and say "well that sounds convincing!" and start building everything on MS platforms? Thought not.

Obviously this largely depends on the economic relationship between healthcare practitioners and big pharma in your country and your healthcare system, whatever that might be.

If you were unlucky enough to live in a country where MS could just pay you per line of ASP.NET checked in, well I guess there would be a lot of misery and shitty code.

</comment></comment></comment><comment><USER5> Buddhism for computer scientists:

The default state machine

        thought: if good, go to grasping. if bad, go to repressing. if neutral, ignore.
        grasping: increment mood, repeat until fail. go to fail //always fail
        repressing: repeat until fail. go to fail. //always fail
        fail: decrement mood, goto thought.

The enlightened state machine

        thought: go to observe
        observe: go to thought

[http://www.urbandharma.org/pdf/mindfulness_in_plain_english....](http://www.urbandharma.org/pdf/mindfulness_in_plain_english.pdf)

<comment><USER6> Interesting, but (at least Theravada) Buddhist Enlightenment is quite free from thinking. (Notice _free from_ , not _devoid of_ ). I suggest:

thought: go to null

<comment><USER7> As I understand Theravada, it's about observing what is happening rather than stopping or nullifying; so thought -> observe -> repeat is quite appropriate for it.

<comment><USER6> null not as an act, but as the absence of act :) (the analogy is lacking, I know).

<comment><USER7> That's actually what I'm speaking to.

The Mahayana tradition (in particular Zen) is the one that focuses more on not doing; where-as Theravada very much puts forth the practice as an act of doing. The usual language is to "turn towards" what is happening, not to simply "be one" with it.

</comment></comment></comment></comment></comment><comment><USER8> There are a few comments from a previous submission here:

<http://news.ycombinator.com/item?id=2622912>

Perhaps most notably that the author of this piece is the former editor of the New England Journal of Medicine. In addition to the three books reviewed, Crazy Like Us is definitely also worth a read. It's a more anthropological look at mental illness so it's maybe not quite as good as Anatomy of an Epidemic as the first of these books to read, but it's still incredibly fascinating.

</comment><comment><USER9> As someone who has taken a variety of treatments for depression (never SSRIs -- only Bupropion, St. John's Wort, and most recently S-Adenosyl methionine, or "SAM-e") I can say from my own personal experience that they most definitely do _something_, and for me it's almost always positive. In fact, the only reason I've begun to suspect the role of "chemical imbalances" (which are likely caused by the environment and my own response to it) is because of SAM-e's effectiveness.

I have absolutely no financial interest in saying so, but because of its positive effects I'd like to make a plug: SAM-e has been completely wonderful for me -- it's worth checking out the extensive literature on it, which show results that are arguably more impressive than those of the SSRI and tricyclic crowd, especially because SAM-e has virtually no negative side-effects.

<comment><USER8> The problem is that virtually every form of sensory or neurochemical novelty elevates mood: acupuncture, aromatherapy, sex, exercise, socializing, sensory deprivation, electrical stimulation, god helmet, music, binaural beats, self- mutilation, menthol, etc.

Similarly, every conceivable way you can possibly monkey around with your brain also raises your mood: raising dopamine, lowering dopamine, raising serotonin, lowering serotonin, raising norepinephrine, lowering norepinephrine, etc. You'd literally be hard pressed to find any form of novel sensory stimulation that didn't improve mood, at least in the short term. So why the focus on serotonin depletion? There's no real evidence for it, it was just an arbitrary decision made by drug companies based on the very early research in the field.

I don't think anyone would argue that messing around with a person's serotonin levels can't elevate their mood, at least for a while. The issue is that there isn't any real evidence that the depression springs from a chemical imbalance, and there is definitive proof that longterm messing with your neurotransmitter levels causes semi-permanent changes to the structure of the brain which we don't really understand.

Also, for what it's worth, St. John's Wort is believed to be an SSRI, at least according to Wikipedia.

<comment><USER10> _The issue is that there isn't any real evidence that the depression springs from a chemical imbalance_

Well, if its not a chemical imbalance, what is it? Neurotransmitters do the work of transporting signals through the brain - they tell neurons when to fire and what intensity to fire with. If its not a neurotransmitter issue, then what is it?

<comment><USER11> If the brain only had a couple of neurons, then it might make sense to pump up the transmitters between them to get a more intense response because you don't need very refined control. However there are 100 billion neurons in the brain, and are connected in very complicated ways.

Since there's evidence that cranking up the seratonin for _every_ neuron or suppressing the dopamine for _every_ neuron isn't healthy, it stands to reason that treating "mental illness" is more complicated than turning a water faucet on or off. Who knows exactly what causes it? It could be related to patterns of connection, i.e. neuron A is better off connected to neuron B at site C, but is connected strongly to neuron D at site E. And then comes the question of whether the neuron is sending weird patterns of action potentials. Or it could be the timing, speed or synchronization compared to other neurons is off. Or it could be poor overall health of each individual neuron. Or subtle brain damage. And the problem might be localized to just some neurons in one part of the brain, and not another, making treatment of the whole brain with drugs a messy approach. You see, there are no obvious answers right now, but there are plenty of alternate explanations besides global chemical imbalance. :)

EDIT: Also, you could think of mental illness as being psychological, and something that the brain can heal on its own, given the right environment.

</comment></comment></comment></comment><comment><USER12> This all makes sense to me. My mom has been one one psychoactive drug or another since 1989. Her cognitive ability is in the toilet and she's on a cocktail of different things now. I had a breakdown 5 years ago. Was on some drugs for a few weeks until I stabilized and I've been ok ever since. I think the standard course of action would have been to stay on them indefinitely. Thank goodness for lack of healthcare I guess. I wish there was a way society could actually help the mentally ill instead of causing harm as usual.

<comment><USER6> That's terrible, and I'm sorry for you. I'm very thankful for my medication though, because whilst not dependant on them, they do patch a few annoying bugs.

</comment></comment><comment><USER13> I'm a little surprised the review doesn't mention the Thomas Szasz critique of the idea of 'mental illness':

<http://en.wikipedia.org/wiki/Thomas_Szasz>

</comment><comment><USER14> Partly: if you look, you see.

Mental illness may have been formerly under-diagnosed.

<comment><USER15> When we look at poor societies, or even much of Western Europe >100 years ago, we see vast swaths of the population with stunted physical growth suffering from preventable and treatable nutrient deficiencies. E.g., currently around 50-70% of people in Africa are anemic, in large part due too deficiencies in dietary iron [1].

In the same way, I'm wondering if at some point in the not-too-distant future we'll look back to today and see the mental health of whole populations as "malnourished", the psychological equivalent of mean population height being 5 feet tall.

[1] [http://whqlibdoc.who.int/publications/2008/9789241596657_eng...](http://whqlibdoc.who.int/publications/2008/9789241596657_eng.pdf)

</comment></comment><comment><USER16> I am not a chemist nor a psychiatrist, so I know next-to-nothing about any of this. However, I have on occasion read various reports on trace pharmaceutical presence in drinking water supplies (e.g., [http://www.cbsnews.com/stories/2008/03/10/health/main3920454...](http://www.cbsnews.com/stories/2008/03/10/health/main3920454.shtml)) -- clearly the amounts are too small to have acute effects, but, taken over the course of an individual's life? Especially in the earliest stages of childhood? Is it a possible contributor towards this "epidemic"?

I know there are a few HN folks better versed in this kind of stuff. I'd love to hear why those reports are bunk, or why it doesn't work that way. Just curious.

</comment><comment><USER17> Humans aren't meant to stare at a computer all day, and they're not meant to stay inside an isolated domicile the rest of the time. I think our lifestyle is mostly to blame.

</comment><comment><USER18> Here's my guess:

* people eat shit

* people don't exercise, not even a little, like walking a couple of miles

* doctors are too eager to medicalise everything so that they can put you on drugs

<comment><USER19> As someone who suffers some psychological issues... I sometimes wonder whether it's the result of our consumer-whoring-omg-think-of-the-children-be-vewey- afraid society than drugs/exercise. I mean, are you really going to be all you can when people are condescending towards you because you don't have an iPhone? Shit, what are they going to be like if they ever heard what I've been through _scared_ _hides_ _runs away_

<comment><USER20> If people are condescending towards you because you don't have an iPhone, I think you should try to find other people to be around. Running away is the correct response. :) It's easier said than done, of course.

</comment></comment></comment><comment><USER21> I think that should be "there is an epidemic of diagnosis of mental illness".</comment>


Understanding Waiting Times Between Events in a Poisson Process - <AUTHOR> http://nbviewer.ipython.org/github/nicolewhite/notebooks/blob/master/Poisson.ipynb

<comment><USER2> A similar model applies to analyzing Bitcoin blocks. The "event" in this case is a block that is at its maximum capacity: [https://www.reddit.com/r/Bitcoin/comments/38zww2/tom_harding...](https://www.reddit.com/r/Bitcoin/comments/38zww2/tom_harding_block_size_experiment_underway/)

<comment><USER3> The Poisson process equation is actually in Satoshi's whitepaper. The 6-block confirmation rule-of-thumb comes from it.

</comment></comment><comment><USER4> I am nervous he should first very from his server logs these visits are indeed described by a Poisson process (which is very likely the case).

<comment><AUTHOR> It's not from the server logs that I would verify this is a Poisson process; it's from the intuitive understanding that these events occur independently from each other and at a constant, known rate. This process also possesses the necessary properties[1] of a Poisson process.

[1] [http://en.wikipedia.org/wiki/Poisson_process#Definition](http://en.wikipedia.org/wiki/Poisson_process#Definition)

<comment><USER5> Of course, for many web sites, the events are not independent.

If I visit one page, I'm likely to visit several more. If I see an interesting page, I'm likely to forward it to friends. If I happen to have 1M twitter followers, my visit could spark a cascade of visits.

Unless your models of site visits are very good (good enough to verify independence), you would need to examine logs to determine if effects like those above kick you completely out of a domain where independence is a good approximation.

Note, time-dependence (a non-constant but deterministic rate λ(t)), is usually easy to cope with. Lack of independence is much harder, because then you are left with Cox processes ([http://en.wikipedia.org/wiki/Cox_process](http://en.wikipedia.org/wiki/Cox_process)) and worse.

<comment><AUTHOR> Those are good points. The event in question is not a simple user visit, however. Let's say it's a particular user action that's a bit more involved, e.g. filling out a form. The assumption here is that users fill out this form independently from one another.

<comment><USER5> Ah, I just noticed you are the OP.

Sure, you have to start somewhere with any analysis, and Poisson is the place to start. Anyone (like me) can then question independence assumptions from the sidelines.

I was moved to speak up originally because a commenter referred to inspecting the logs to verify the Poisson assumption, and in my experience, looking at the data is always an excellent principle, and generally preferable to just stopping at an intuitive understanding of the arrivals process.</comment></comment></comment></comment></comment>


Upgrade your cargo cult for the win (2017) - <AUTHOR> https://meaningness.com/metablog/upgrade-your-cargo-cult <comment><USER2> Incidentally the «utter honesty» described here, but impossible to define, is probably the most important key to intelligence.

An honest wish to understand the word as it is probably the best way to have adequate cognitive reaction in order to survive.

</comment><comment><USER3> Never thought about it before, but is Rusts package manager named after cargo cult?

<comment><USER4> Nope, it's because it's how you ship crates.

</comment></comment><comment><USER5> I am deeply troubled by this article's recurring use of the phrase "stupid savages" to refer to the non-white native people of New Guinea. Though it may be intended as tongue-in-cheek, it is unnecessary and distracts from the article's intended message.

<comment><USER6> The author clearly means to mock other people's perception of the natives as "stupid savages", as implied by directly following this statement with "Except, this is a perfect metaphor for most of what is called "science," done by people with PhDs". It implies that the people that would say that are the ones getting their science PhDs, who are doing the same thing while being full of themselves as superior.

You seem to recognize this, by referring to it as being used "tongue in cheek."

So, to be clear:

You are offended that the author used an offensive phrase in an ironic manner clearly meant to both vindicate the targeted minority and point out the failings of the people that would use that offensive phrase in earnest?

In short, you're now upset by the form of the communication, rather than any of its actual content or meaning.

Another commenter suggested that you are partaking in some cargo culting of your own. I think they're onto something.

<comment><USER7> What about the second use - "So what about those stupid savages, doing their silly rituals on their Pacific islands?" ?

This is much less clearly tongue-in-cheek, and even if the tone is meant to be generally humorous, that wouldn't exclude it from being actually offensive.</comment></comment></comment>


Battery power alone can be used to track Android phones - <AUTHOR> http://www.bbc.co.uk/news/technology-31587621 <comment><USER2> The article mentions that the required permissions are "very common permissions", and then in the next paragraph says that 179 apps on the Google Play store require those permissions. As of July 2014, there were 1.3 million apps in the app store [1]. That's ~0.014% of the apps on the store. Not exactly "very common" in my mind. Although the remark that they are "unlikely to raise suspicion" is valid, especially for the typical consumer, who probably isn't reading the permissions anyway.

[1] - [http://en.wikipedia.org/wiki/Google_Play#Android_application...](http://en.wikipedia.org/wiki/Google_Play#Android_applications)

<comment><USER3> I am ver surprised there is still no mass outrage over Android permissions.

1\. They are not properly named or explained. And no, this shouldn't be on some obscure website. This should be right there, in the menu that asks for them.

2\. There is no way to filter apps in the play store by permissions. This isn't just a privacy thing. Apps that require the least permissions are often least bloated and the most skillfully written.

It's obvious that both of these thing are deliberate, it's obvious that this is an issue, and no one cares.

<comment><USER4> Also, there's no way to download an app but deny it some permissions. iOS gets this right: apps don't get to ask for any permissions when you download them, they have to request them at runtime and the user can deny any of them (and the app is still expected to function)

<comment><USER5> This was briefly added in Android 4.something, but Google removed it.

<comment><USER6> Appops. Supposedly there as a test system for apps. I guess to see if they would crash in case of malformed data from sensors etc.

Some OEMs, like Huawei, offer similar functionality on their products.

<comment><USER7> It is possible to "activate" this functionality on some phones as well. I have it enabled on my Samsung Galaxy S4, which is rooted, but otherwise is running the stock ROM (though not by choice).

</comment></comment></comment></comment></comment></comment><comment><USER8> This is really selling a quite interesting intellectual effort on meaningless paranoia. Who would have any interest in tracking people in this manner?

Any government based group can grab the data much more conveniently via the phone towers. Anyone else? Well you've got to trick someone into downloading this thing, so it's probably not that good for targeting a specific individual.

If you can think up some nefarious scheme which involves grabbing lots of peoples locations, just get permissions to use GPS or cell location, way more apps have that privilege. I'm not sure what you do with it afterwards though.

New research reveals people can be tracked just by watching where they go...

<comment><USER9> Not sure if the "Who would have any interest in tracking people in this manner?" is really relevant. Based on the collect all, hoover all metadata etc that seems to be going on, _anything_ remotely possibly useful seems to be interesting.

And the big thing is that this data can of course (and will be) correlated with things like cell tower location, wifi hotspots all kinds of other metadata.

<comment><USER6> Makes one wonder what STASI could come up with had it still been operating...

<comment><USER10> Given how bad NSA and GCHQ (the presumed good guys) have been, STASI would have truly been frightening. They probably would have terrified Sauron.

</comment></comment></comment></comment><comment><AUTHOR> Original research paper: [http://arxiv.org/abs/1502.03182](http://arxiv.org/abs/1502.03182)

PDF link: [http://arxiv.org/pdf/1502.03182v1.pdf](http://arxiv.org/pdf/1502.03182v1.pdf)

<comment><USER11> This snippet (from the PDF) reveals the effectiveness of the technique:

"To evaluate the first algorithm for distinguishing routes we recorded reference profiles for several different routes. We used a dataset of 43 profiles for 4 different routes about 19 kilometers each. Driving in different directions along the same roads (from point A to B vs. from point B to A) is considered two different routes. We perform a leave-one-out cross validation, each time using one of the profiles for testing. Figure 5 is a confusion matrix, which shows a high success rate in classifying the routes. The achieved successful classification rate in this case was 93%."

So, given a bunch of known routes (like a stretch of highway), this algorithm is able to match your phone's battery-usage signature to one of those routes, sort of like how a service like SoundHound is able to identify a piece of music based off of a few seconds' recording.

<comment><USER12> But that if the battery discharges exactly the same. I think that is not the case, for example the battery when is at 50% might discharge (doing the exact thing) differently than when is at 20%. Maybe the battery is not well calibrated or the internal part of the battery are more wasted than others.

<comment><USER13> I would guess that even if the curve is different from say 50% to 40% than 20% to 10% for the same journey it would be easy enough to normalise the data after profiling a couple of phones.

<comment><USER12> Plus continuous change, but not even, would not be that easy.

</comment></comment></comment></comment></comment><comment><USER14> This is a 'tour de force' study for sure, but has a very limited scope (and reliability)- First, it only works if the attacker knows both the route(s) ahead of time _and_ the power consumption profile of the routes, which requires careful mapping of the region with a recording device. Second, its accuracy degrades drastically depending on the number of apps running -- they only tested with background apps, which already rendered the method only slightly better than a random guess, with an arbitrary app running in the foreground the power consumption goes bananas and so does their method.

Storm in a glass of water, if you ask me.. (But you wouldn't know this by reading that abstract alone ;))

-@r2r

</comment><comment><USER15> Maybe I am a bit dense here, but how does battery drain map to a location? What would they be cross referencing to gather location?

All I can gather is that they would also need to know what tower you were talking to, and then based on the drain they could probably guess where you were based on some heuristic. Meaning, if you are talking to tower x, and the battery drain is high, you could guess that you are either far from the tower or indoors somewhere. It still seems to me that this is dubious at best. I get that technology is always changing, but wouldn't it just be easier to exploit a security hole?

<comment><USER16> As you move, your distance to the closest cell tower changes. You also move past signal obstacles, so the change in signal strength isn't linear. They claim that these changes are characteristic enough that you can track movement that way.

<comment><USER15> I get that part and to some degree understand. Maybe I am misinterpreting the "track your location" as something more accurate than "this person is in a 10 mile radius of this tower". For instance, wouldn't you need to know details of how different buildings are constructed? If you are in a busy downtown area, tracking with this method seems impossible. I could see if it was a remote area with few buildings to sift through.

<comment><USER16> Yes, it's not as trivial as just grabbing the data and running a generic algorithm. Ideally you would want to measure all routes where you want to track people. Kind of like how google knows where every wifi access point is and uses that for location information.

Also, you need people to move. Because you only have power data, you only know the aproximate signal strength if the person isn't moving.

<comment><USER15> That makes more sense. So to me, the headline reads as "Location can be tracked just by measuring battery usage" when in reality its "Location can be tracked if: A) they know the tower you are speaking to B) they have information on how buildings are constructed in this area C) You move around D) they have some other crowdsourced info about how much power is required to talk to the tower you are connected to."

I can see this "technique" being used in an episode of NCIS, CSI or similar cop show. <plot> We need to find this guy, but all we have is his cell number.

Police tech #1 "Sure no problem, I will just connect to his phone and measure the battery drain..... Got him, he is Downtown at 5th and Main- lets go arrest him!!!" </plot>

<comment><USER17> The article links the article where the authors suggest they don't need to know which tower you're connected to (in which case you could get a more accurate location from the towers themselves).They assume the only information you have _from_ the phone is the power usage. However, they also assume the attackers have a general idea of your habits, and can therefore map out cell reception in the city where you live.

The "general habits" assumption seems implausible, but it isn't. Let's say you want to track all the citizens of the Bay Area. You know that, in general, ppl from the Bay area are in the Bay Area. Therefore, you map the cell reception in Bay area. You also take note of major transportation routes and patterns. Now, if you want to track a particular target, all you'll need is their power usage.

</comment></comment></comment></comment></comment></comment><comment><USER18> So what makes this specific to Android phones? Developers can't (get permission to) access this information on other platforms?

<comment><USER19> It's available on iOS:

[https://developer.apple.com/library/ios/documentation/UIKit/...](https://developer.apple.com/library/ios/documentation/UIKit/Reference/UIDevice_Class/#//apple_ref/occ/instp/UIDevice/batteryLevel)

<comment><USER20> No it's not. That does not expose voltage and current.

The research paper says they're doing this ...

      ... by repeatedly reading the following two files:
      /sys/class/power_supply/battery/voltage_now
      /sys/class/power_supply/battery/current_now

<comment><USER19> Not at a simplistic level, no, but voltage you could derive from the discharge curve of a characterized battery (since we know fraction of charge remaining), and current could probably be approximated by looking at the rate of discharge.

</comment></comment></comment></comment><comment><USER21> What a sensasionalist headline... The results of the study can only be achieved under a very controlled environment and even then they're not accurate. From a practical point of view this is irrelevant when there are other ways of getting a user location that are far more accurate and easy. But from an academic point of view I can see the interest.

</comment><comment><USER22> Seriously? Have you not heard of side channel and timing attacks? This is called information leakage and is a big deal. Because it is not common/easy _now_ doesn't mean it won't be in the future. The nature of information disclosure (whether data or metadata) is that people find "impractical" methods of accessing information we might prefer they not have, then make them practical. It may also be the case that the researchers cannot make it practical, but that doesn't mean there aren't actors who can and possibly have already done this.

This is a very useful article OP, thank you for posting

</comment><comment><USER23> [http://www.phdcomics.com/comics.php?n=1174](http://www.phdcomics.com/comics.php?n=1174)

<comment><USER24> The p-value of 0.56 is a joke right?

<comment><USER25> It's not a p-value, it's Spearman's rho, or rank correlation coefficient. It's a value in [-1,1] and when deviating from zero indicates a statistically dependent relationship: [http://en.wikipedia.org/wiki/Spearman%27s_rank_correlation_c...](http://en.wikipedia.org/wiki/Spearman%27s_rank_correlation_coefficient)

</comment></comment></comment><comment><USER26> Isn't the assumption that "the noise of playing music,social media, etc" is not correlated with the phone's location, pretty weak? I know I have distinct patterns of when I scroll up twitter or listen to music, which depend on where I am..

</comment><comment><USER27> I'm thinking about when Whistler decodes the kidnapper's route in Sneakers.

</comment><comment><USER28> The first thing that popped into my head to get around this technique - and in one fell swoop would defeat all others - was : "Switch the phone off and remove the battery".

Of course, as soon as you turn the phone back on again, your adversary can pinpoint your location.

I guess the best overall solution would be to eschew having a phone at all.

</comment><comment><USER29> Just ask the user for their location right away. Most don't care anyway.

</comment><comment><USER30> I think this has the potential to be as good as the location of MH370 by satellite data

Basically, locate the user over a wide range of possible locations.

I wouldn't loose my sleep over this, really</comment>


Ask HN: What's that first software you made that just hooked you with coding? - <AUTHOR>

For me it was that snake game i made in C when i got my first computer. It was one pixel headless never ending snake with speed adjustment, made it with GD library. Probably the worst logic ever to make a snake game. But boy i was amazed that really I MADE A WORKING GAME !
My little bro played it, friends played it and absolutely loved it. After that i never thought i could be anything but a programmer.
So what was your first software that just got you ?
Shally <comment><USER2> My first home computer was an Amstrad 64, I was using an apple at school. My sister and I checked out a book from our library and started typing in all these BASIC instruction. Yes, a whole thick book was the listing of the source code for Roland in the Cave. After weeks of typing and then a couple more weeks of bug fixing (spelling correction), we had a little guy hopping around in a cave with flying pterodactyl and creepy, blinking eyes. I still think about that game once in a while.

</comment><comment><USER3> In 1980 I wrote a program to take horizontal and vertical seismic waveforms and plot them in different 3-D perspectives on a Gould plotter connected to an IMB 360. But let's be honest here, like most serious programmers the nature of the first program I wrote was irrelevant. It was glorious just to write software of any type in any language running on any machine! Hooked on my first byte.

<comment><USER3> Dang, I answered too quick. In 1978 I bought a TI-57 and wrote software to study tetration or iterated exponentiation. This was something that necessitated a computer. Soon I began to realize that I was looking at an example of chaos. I now have a web site at <http://www.tetration.org> with fractals and all documenting my research on tetration.

</comment></comment><comment><USER4> [http://www.cs.washington.edu/education/courses/cse142/10au/h...](http://www.cs.washington.edu/education/courses/cse142/10au/homework/9/spec.pdf)

</comment><comment><USER5> My first computer was a TRS-80. I remember copying some random-maze-generating code out of a magazine from Radio Shack. I didn't understand how it worked but I remember there were lots of POKE statements (to write directly to memory using BASIC). It got me very excited with what was possible, an excitement I still have today.

</comment><comment><USER6> A TIC TAC TOE game in GWBASIC. I figured out how to make it never lose.(I was 10-11, so this was a big deal). My parents thought the game cheated somehow.

</comment><comment><USER7> I was a late bloomer and did not start programming until 28 yrs which was through my degree program in BS Software Engineering. I had taken js. java, sql and really did not fully enjoy it. It was not until I had taken VB.net in my senior year where I changed. I had a project that I was working on that performed financial calculations. One day I started a new version of the application and literally started at 7:00am and did not eat or move until 8:00pm that night.(I think I went to the restroom and drank water, can't remember) I had code high and ever since then I have been in love with programming now I'm 34 and a .Net Developer for a mid-siz company.</comment>