Path uploads your entire iPhone address book to its servers - <AUTHOR> http://mclov.in/2012/02/08/path-uploads-your-entire-address-book-to-their-servers.html <comment><USER2> I find it mind blowing that (in the comments of the blog post) someone asked the Path CEO:

> Why wasn't this [sending all the contacts to your servers without users > knowing] an opt-in situation to begin with? Isn't that against Apple's own > T&Cs?

and the Path CEO replied:

> This is currently the industry best practice and the App Store guidelines do > not specifically discuss contact information. However, as mentioned, we > believe users need further transparency on how this works, so we've been > proactively addressing this.

Really guys? REALLY? This is why developers need explicit guidelines, because as they just demonstrated if there are no guidelines companies default to the thing that exploits the end user! (incidentally, its unfair to pick on Path too much as almost all social networking applications do exactly this also.)

I actually cringed when I read this _"however, as mentioned, we believe users need further transparency on how this works"_... which is why it took someone _running a proxy and writing a blog post_ for you to suddenly be transparent about it. Mind blowing. Why even say that?

Btw, times like this? You destroy any and all credibility when you say you are trying to build a company that is built to last or one that is going to follow in the footsteps of Apple.

Apple would never do this to their users.

(do not make this a discussion about the evil and good sides of Apple. Apple has repeatedly not bowed to companies desires for owning contact information and I expect they will fix this contact hole in the near future.)

It's sad because I respect Path and their love of design. But design isn't just about how it looks. It needs to resonate through the entire vision, company, product, and how you treat people.

<comment><USER3> Wait: What about MY INFORMATION if I've never installed Path? If someone I know with my contact information installs Path, does that mean that my information is stored on their servers?

How can I remove my information if I've never installed Path before? It doesn't seem right that my contact information, which I have kept private, because someone I know has uploaded that information. Do I not have a right to keep that information private?

This would make Path and other companies that upload the entire contacts database the prime candidate for hackers and government agencies that want non-Facebook information about people, given a name, phone number of email address.

<comment><USER4> Clearly there are a lot of WTFs going on at Path, but this isn't one of them.

> Do I not have a right to keep that information private?

But you didn't. You gave it to someone else. It's not your information any more.

Information _about_ you is not information you _own_.

Privacy and anti-spam laws in various jurisdictions cover what an organisation can do with information they collect about private individuals, but that has nothing to do with ownership.

<comment><USER5> In the EU, the third party would be using personal data for other than the reason it was collected, so it is illegal.

</comment></comment></comment></comment><comment><USER6> Dave Morin, Path's CEO just responded in a comment: [http://mclov.in/2012/02/08/path-uploads-your-entire- address-...](http://mclov.in/2012/02/08/path-uploads-your-entire-address-book- to-their-servers.html#comment-432202082)

> _Arun, thanks for pointing this out. We actually think this is an important > conversation and take this very seriously. We upload the address book to our > servers in order to help the user find and connect to their friends and > family on Path quickly and effeciently as well as to notify them when > friends and family join Path. Nothing more._

> _We believe that this type of friend finding & matching is important to the > industry and that it is important that users clearly understand it, so we > proactively rolled out an opt-in for this on our Android client a few weeks > ago and are rolling out the opt-in for this in 2.0.6 of our iOS Client, > pending App Store approval._

edit: Morin responds to a response [http://mclov.in/2012/02/08/path-uploads- your-entire-address-...](http://mclov.in/2012/02/08/path-uploads-your-entire- address-book-to-their-servers.html#comment-432242293)

To the suggestion that they just hash the addressbook entries:

> _1\. This is a good alternative solution which we'll look into. Thanks for > the idea._

<comment><USER7> >we proactively rolled out an opt-in for this on our Android client a few weeks ago and are rolling out the opt-in for this in 2.0.6 of our iOS Client, pending App Store approval.

"Proactively?" How do you get into the Social Networking business and not see this issue coming before the first line of code is written?

[re: hashing] >This is a good alternative solution which we'll look into. Thanks for the idea.

Again, no. That no competent system design talent/time was dedicated to this process is a damning critique of your organization's ability to be trusted to safeguard user data.

<comment><USER8> I think the simplest explanation is that he's playing dumb.

<comment><USER9> He almost certainly is either playing dumb or is dumb. If you're not dumb, you have to play dumb, because otherwise you'll be crucified.

<comment><USER10> Playing dumb. Hashing the information is such an obvious choice, there's really no plausible explanation for the developers to have not to consider it. They probably just figured "everyone else is doing this so what's the harm?"

<comment><USER8> It's been a long time since Plaxo.

</comment></comment></comment></comment></comment></comment><comment><USER11> This is actually nothing new. A lot of apps have been doing this for a very long time. However, it _is_ one of the best kept secrets in our space. I kind of have a feeling no one talks about it because they don't want word to get out. Can you imagine the scandal if this made it on the front page of CNN or Drudge?

Ever since I learned this was possible, I've been very careful about which apps I download, and actually have downloaded very few since, as a result. There are a lot of random iPhone developers that I really don't think need to have access to my entire contact list.

<comment><USER12> Which apps do that? Do you have a list? Can anything be done about the data after-the-fact?

<comment><USER13> Facebook, Foursquare, Twitter, basically any app that allows you to "search my address book for friends" will do this.

All these services require either a email or phone number to sign up, so to search for friends who have also signed up for the service, you need to compare two data sets: emails or phone numbers of users you already have, and those in the person's address book.

You obviously wouldn't download your entire database of users contact information to the phone to compare the data sets, so you send the data set up to the server.

<comment><USER14> The addresses from the user's address book should be hashed before sending to the server and compared to hashed addresses on the server. Then only positive matches are registered, and the server doesn't see more private information than it needs.

<comment><USER15> Hashing data from address book doesn't work because people write the same addresses and even phone numbers in many different ways. Normalizing it on the client is not really an option either because it requires a lot of data to do decent normalization - not practical to send it all to each client.

<comment><USER14> Phone numbers are easy to canonicalize: convert to international form.

Email addresses can be effectively canonicalized by lower casing. Not many mail servers are case sensitive these days. Additionally, for the local part, you can generally strip off anything after a "+", and with gmail, you can drop any period in the local part. (Granted, it's not perfect-- so make sure that's not a security concern.)

These techniques have been working fine so far in my app for my "Find My Friends" feature.

</comment></comment></comment></comment></comment></comment><comment><USER16> Honest question: Isn't this within the kind of behavior that AppStore reviews are supposed to prevent, at least if there isn't an app specific functional explanation for it? Does Apple have a list of what kind of behavior like this is tolerated or does word just get out about what they don't reject?

<comment><USER17> Well, since you only ever only submit the compiled application binary to Apple, it'd be pretty darn hard for them to detect behaviour like this. Especially if the code to do so is obfuscated, and/or the data is smuggled out via SSL (or worse, steganography-style piggy-backed on to other data).

Sometimes it's tempting to speculate whether the real purpose of the app store review team is just to ensure developers aren't trying to access Private Frameworks (i.e. non-public APIs) or try to upsell the customer while bypassing the 30% Apple tax?

<comment><USER18> Pulling contact data requires API calls that can be detected in the compiled binary (this is one way that Apple detects calls to unpublished API's).

That said, it's humorous how a blatant abuse of trust such as this gets through unscathed but god help you if you try to access the iPod library the wrong way!

<comment><USER17> Well, the app could have legitimate reasons for linking to the required API (such as pretending to only use it after obtaining user confirmation), but then you could add additional obfuscated calls to the same API without prompting the user. So that wouldn't really help.

<comment><USER18> Perhaps, however when calls like this are noted additional scrutiny of the application could be applied to ensure they are not abused (such as using a proxy in the way described by the parent).

There are other actions allowed by the SDK that seem to have little non- nefarious use, such as the ability to hide the fact that an application is transmitting and receiving data (the network "spinner" can be disabled by the application); as others have mentioned it's interesting which API calls require authorization from the user while others do not.

</comment></comment></comment></comment></comment><comment><USER19> I begin to understand what Richard Stallman has been saying all those years. Although I don't like the guy on the personal level, this incident make him completely right - running closed source software can compromise your rights. (rights to privacy in this case).

I also want to thank the author of this post to discover this! I wanted to try Path some time ago, now I can safely avoid it without regret.

<comment><USER20> open source software can collect exactly the same information on you.

there was a furor recently where it was revealed that OS X and Windows collect data on what access points you have associated with. what was omitted was that linux does exactly the same thing: the wireless subsystem has a debug print (at a debug info level turned on in all major distributions) that will log the MAC address of the AP you just associated with.

it's still there, afaik.

<comment><USER21> I think I'm missing something.

You think people should be upset because a Linux computer knows the MAC address of the AP you are associated with? If that is a problem, then imagine what people will think when they realize that the computer knows what keys you press on the keyboard (!!??)

There is only a problem if the operating system _shares_ information with 3rd parties without authorization.

<comment><USER20> the furor (at least, that I saw) was that the devices _stored_ this information and would potentially let others look at it later.

it shouldn't be upsetting that your computer knows what keys you're pressing or what network you are affiliating with. recording that information permanently could be bad.

if you have an ubuntu laptop with wireless handy, run the following command:

sudo grep AssocResp /var/log/syslog _

</comment></comment></comment></comment><comment><USER22> I think this is Apple's problem really. Path is just one of many apps that probably do this without asking you.

Ideally the OS should prompt you if an app wants access to your address book, just like it does for location.

<comment><USER23> Android apps must explicitly request a READ_CONTACTS permission. But even there, no one actually reads those permissions lists, and apps routinely ask for far more than they need. User authorization is a very weak security mechanism in the consumer space.

<comment><USER24> Like FB apps, even legit Android apps ask for the moon, with no option to dole out granular permissions.

"The Weather Channel" is a default icon suggesting a free download on the Kindle Fire.

It asks for:

        Set the wallpaper
        Send SMS messages
        Write to external storage
        Access info about Wi-Fi networks
        Access coarse location
        Initiate a phone call without going through the Dialer user interface for the user to confirm the call being placed
        Write (but not read) calendar data
        Read calendar data
        Required to be able to access the camera device
        Open network sockets
        Access fine GPS location
        Access vibration feature
        Access info about networks
        Record audio

I haven't installed it, so I have no idea why it should be able to silently dial out without my permission or send SMS messages.

If legit apps are demanding all this, then a Chinese weather app dialing those toll numbers in the Caribbean could do the same.

<comment> mike-cardwell FWIW, if you have a rooted Android phone, you can install an app called "LBE Privacy Guard". It lets you install apps which require permission to send SMS, make calls, read contacts, access the network and a bunch of other things, but then prompts you when an app tries to do any of these things and lets you block/allow it temporarily/permanently.

</comment></comment></comment></comment><comment><USER25> You'd think people would learn. I mean, this is the _original_ scandalous practice in mobile apps. See this from _2008_ :

[http://gizmodo.com/5028459/aurora-feint-iphone-app- delisted-...](http://gizmodo.com/5028459/aurora-feint-iphone-app-delisted-for- lousy-security-practices)

</comment><comment><USER26> I'm at a loss as to how this is surprising anyone. How did people think that these apps found other users you know? This is built to support: A) finding existing people on the service and B) so they can (theoretically) send you notifications if a friend joins. If you want those features (and it seems that users do), this is the only way to do it. Admittedly, most apps are more explicit about it with a "find friends from address book," but if you want to lower the friction as much as possible, this is the way to do it.

</comment><comment><USER27> So does Facebook, as shown 107 days ago, and continuing today. <http://news.ycombinator.com/item?id=3145857>

<comment><USER28> Yeah, I've noticed that too. After my first sync with Yahoo! Address book years ago, I ended up getting Facebook suggestions to people I didn't really know but who were in my Yahoo! address book.

</comment></comment><comment><USER29> A few years ago, at a "Facebook developer garage" event, I personally asked Dave Morin (Path Founder and CEO) a very similar question to the one in today's news. At the time, he was in charge of the Facebook developer platform, having not yet left Facebook to start his own social network. I asked him about the amount and variety of information Facebook gave freely to applications using their platform (there were far fewer privacy controls at the time).

I also asked about whether and how Facebook intended to enforce their platform terms of service, which essentially said apps could use such information temporarily, but that they must discard it no later than 24 hours after a user's most recent use of an application.

I remember that in answering those questions, he essentially said that his preferred approach was not to try and make violations of those terms difficult or impossible through technical means. His inclination was to give apps the benefit of the doubt, and deal with troublemakers if and when issues arise. He also relayed a story about his college days, in which he said that his study of the workings of government was better preparation for his web career than anything directly related to technology.

</comment><comment><USER14> One can fuel a lot of user engagement by scraping the address book and notifying users every time one of their contacts signs up.

The "Beluga" app did this, without user permission or warning, and it boomed ahead of competition that did not. "Kik" did something similar. "Industry best practice" indeed.

Sadly, it's a winning strategy, and will continue to be until someone fixes the rules of the game.

</comment><comment><USER30> Just a quick note to also point out, regarding this from the CEO: "if you'd like your account deleted, including all data, we're happy to do this as well."

I emailed to have my Path account deleted a few weeks ago and was told it had been 'deactivated'. After querying this, it was confirmed that they did not yet have the functionality to delete your data, only hide it. Worrying that he said they can.

</comment><comment><USER31> This sounds like a wonderful Cydia / iOS Jailbreak app opportunity. MobileSubstrate allows easily hooking system methods. An app which replaces the Address Book API with something returning empty data for all non-system apps seems pretty easy and quite urgent.

Morin and company need to provide an "opt-out and wipe all of my contact data now" option if they don't want legal action and backlash, as well. Simply making the app require opt-in to share this data in the future isn't nearly enough (and, especially in the EU, isn't legal).

Update: I'm working on a MobileSubstrate tweak to neuter AB* functions in non- Apple apps, and it's now possible to get your information wiped from Path... by emailing firstname.lastname@example.com.

</comment><comment><USER32> From the Wikipedia entry [<http://en.wikipedia.org/wiki/Path_%28social_network%29>]:

 _"Contacts are suggested from among persons in a user's electronic address book, as well as people with whom the user is communicating by email."_

It's been there for over a year. [http://en.wikipedia.org/w/index.php?title=Path_%28social_net...](http://en.wikipedia.org/w/index.php?title=Path_%28social_network%29&action=historysubmit&diff=475202633&oldid=404280654)

<comment><USER33> Though it's quite a difference whether the contacts are checked client-side or all sent over to THEIR server including all (unnecessary) info.

<comment><USER34> How do you propose to check them client side? :) You still have to send each contact over to the server...

<comment><USER33> As Matt Gemmell proposed: send over the hash codes of the email addresses or whatever else needs to be compared.

<comment><USER34> Yeah, but you still have to store the hashes server side in the case where you want to notify people when their friends join (which is how Path was using the data).

</comment></comment></comment></comment></comment><comment><USER35> Why am i not surprised, this is from a Facebook alumn after all. Uninstalled Path, kind of a dealbreaker since its whole angle is privacy and the CEO can't even get this one basic thing right.

</comment><comment><USER36> I e-mailed Path and they replied. The only thing I am worried about is how to verify my information is actually wiped out. And what about all my other friends who have me in their address books? How do I get rid of that?

Zack S. FEB 08, 2012 | 05:19PM PST Hi Jeff,

Thanks for getting in touch with us! I have erased your contacts and their information from our servers.

On behalf of the team, I'd like to apologize for any privacy concerns that you may have had. Our current release of Path for Android requests permission to access your address book. In the next iOS release, we will have this same permission request added.

Until the update is released for iOS, selecting "Add Friends" will display the names of contacts that you have stored on your phone. But now that you've opted out of contact uploading, we will never re-store this data on our servers.

Please let me know if there is anything else I can do to help you. I'm more than happy to address any further questions or concerns that you may have.

Best, Zack

</comment><comment><USER37> So I have read the responses and it seems that there are a few schools of thought here and I just want to make sure that I understand the possible solutions.

Per user Steko is this the ultimate solution to the problem -

(0) we get your permission (is this in the ULA, the in app screen? The privacy page of the app?)

(1) we check for your contacts in our database (hashing your contacts). The method of hashing yet to be determined or what info to hash and match if anything other than the email address or maybe the phone number.

(2) we let you know if any matches are found.

(3) we throw away all your data afterwords.

My question is - do you go through steps 1,2,3 each time that you boot up the application or click the add connections button. Compare the hash, report on the matches and dump the rest? Rinse and repeat?

Is the issue more the keeping the address book for later matching, or the passing it in the clear part?

If you were going to have an opt-in or disclosure what would you want it to say?

</comment><comment><USER38> Combine this with the fact that some times syncing your iPhone in a corporate server brings the whole company address book to the phone. They must have a lot of contacts stored.

</comment><comment><USER39> It would be nice to go a single week without seeing how utterly complete the notion of privacy has been destroyed.

<comment><USER40> Here's a question: was there a concept of privacy 100 years ago? Or 500? Whenever someone had a baby, or bought a cow, or had an affair on their spouse, didn't everyone in town know about it? Did they ask people's permission when the first telephone book was published?

Or was the first response, "hey, that's an invasion of my privacy!" I doubt anyone said that before the 1950's.

I think privacy is an invention of the late 20th century. I am truly curious if any real notion of "invasion of privacy" existed for most of man's history.

<comment><USER41> This is a patently absurd notion.

I haven't heard an assertion so patently foolish and I'll considered since the Path CEO claimed that uploading every users "little black book" onto the Path servers without permission or notification was an "industry standard best practice."

What a bunch of hogwash.

</comment></comment></comment><comment><USER42> Can someone explain to me exactly how I could be harmed by this? My contact list is just a list of names and phone numbers of people I contact. Even if I had an escort service in there or something, I don't think anyone on Path's end is individually looking through the data.

<comment><USER43> An employee at Path might very well decide to start looking through that data. There have been other cases where employees gave in to temptation to access someone's data. Imagine for example if a celebrity is involved and someone decides to leak their address book.

Now one would hope that employees wouldn't have unrestricted data to this access, but one would also hope Path wouldn't do this in the first place. The fact that they collect all this information in the first place, unnecessarily and without consent does not inspire much confidence in their internal safeguards for access to this data.

Also, if anything were to happen to the company, it's hard to know what hands all that data will end up in.

<comment><USER42> I don't know any of the Path employees personally, why would they decide to go after me? The possibility seems rather remote.

<comment><USER44> Maybe not you personally, but think of the NOW scandal going on right now. Information about people's mobile contact info is valuable to a number of organizations in ways not immediately apparent.

</comment></comment></comment></comment><comment><USER45> The fact that address-book upload should be opt-in is obvious, and was stated so many times here it was boring. But, there's also the other side: me, and quite a few of people I know, have good reasons to have an opt-out from being discoverable this way. If someone knows my email address, let them send me an email with an invitation code. They shouldn't even know I'm signed up until I accept.

Though I also don't really think it's something private companies should solve. Now, I can of course avoid services that let me be too easily findable, but the proper solution is to make said opt-out required by law. Otherwise it's just not beneficial for the company to provide it.

</comment><comment><USER46> I don't have a problem with this as long as they ask permission up front before doing so. I don't recall having been presented with that question myself though.

Disappointed in Path, especially since their focus was on a more private, tightly knit social network.

</comment><comment><USER47> So I download an IM app that automatically finds your friends based on your phone directory. I launch it and scrolling through my friend's list I see my mom. Some contacts later, I see the real name of the hooker. Both my mom and the real hooker are on this IM platform...just a click away from chatting with me _under the same identity_. This can be more than creepy, fortunately this is a made up example ;)

I thought about this with whatsapp. This is scary because while we are used to having multiple emails for different parts of our lives, juggling multiple phone numbers is still a chore despite services like google voice.

<comment><USER48> I feel like we're missing part of this story. :)

</comment></comment><comment><USER49> I don't know if any you remember, but this is why Guido van Rossum quit using Twitter. The official twitter client for Android uploads your entire contact book without showing more than a notification stating 'find your friends' or similar; you click this notification and by that time it's already too late. More on that here:

[https://plus.google.com/115212051037621986145/posts/YguETTsM...](https://plus.google.com/115212051037621986145/posts/YguETTsM4K5)

</comment><comment><USER31> I wrote a MobileSubstrate (jailbreak only, sorry!) tweak to block the use of ABAddressBookCopyArrayOfAllPeople, the most common method of stealing contacts in this manner.

It's rough around the edges, but check it out: <http://news.ycombinator.com/item?id=3564968>

It should be available in the BigBoss repository as "Address Book Privacy" sometime tomorrow.

</comment><comment><USER50> Even if Path buried this disclosure deep in a TOS page, would anyone read it? I just posted a startup idea I have to generate easy-to-read summaries from website TOS pages: [http://clearsignal.posterous.com/do-we-value-our-laundry- mor...](http://clearsignal.posterous.com/do-we-value-our-laundry-more-than- our-privacy)

</comment><comment><USER51> Call me crazy, but I prefer it when companies do this. If I'm interested in using their service, then I'd be happy to be alerted when my friends sign up for it.

That being said, I wholeheartedly agree it should be opt-in (or at least have an opt-out) for people who are concerned about their personal data.

<comment><USER52> Well that's the whole problem isn't it?

If they had asked up front for permission this article would not have been written.

</comment></comment><comment><USER53> Has anyone looked at Path's privacy policy?

Do they explicitly state that what personal information they download to their servers, what they use it for, and how long they retain it?

If not then they're breaking the law in many countries, regardless of what Apple's current developer guidelines happen to be.

</comment><comment><USER54> Dave Morin's (Path CEO) response:

Arun, thanks for pointing this out. We actually think this is an important conversation and take this very seriously. We upload the address book to our servers in order to help the user find and connect to their friends and family on Path quickly and effeciently as well as to notify them when friends and family join Path. Nothing more.

We believe that this type of friend finding & matching is important to the industry and that it is important that users clearly understand it, so we proactively rolled out an opt-in for this on our Android client a few weeks ago and are rolling out the opt-in for this in 2.0.6 of our iOS Client, pending App Store approval.

Dave Morin Co-Founder and CEO of Path

</comment><comment><USER55> This is an accident waiting to happen. Whoever does this is doing it wrong. The case was well-made here by Colin Percival (the tarsnap guy) in his blog: "Playing chicken with cat.jpg" [http://www.daemonology.net/blog/2012-01-19-playing- chicken-w...](http://www.daemonology.net/blog/2012-01-19-playing-chicken-with- cat-jpg.html)

>> "The answer isn't for (any company) to prove that they can be trusted; the answer is to ensure that their customers don't need to trust them ... The best way to avoid privacy breaches is not to formulate a detailed privacy policy; it's to reduce your capabilities so that you're unable to violate anyone's privacy"

</comment><comment><USER56> In our Q platform, we specifically upload only the hashes of the address book. There is absolutely no need to have the actual email or phone number of people in order to find "who is on the service". However, when you INVITE people, we specifically download the full email address because we send them an invitation ourselves.

This is just one out of 100 things that our platform does while solving the usual stuff of apps: user signups, importing address books, invites, etc. However, we applied for a patent on some of the stuff we do. Even though I personally don't like patents, it's the thing to do in the current environment. Going to write a blog post about it soon.

</comment><comment><USER36> So my entire address book is on Path's servers right now?

Well shit. How do I get it off their servers?

</comment><comment><USER57> One-way hashing the phone numbers and emails would at least be a good solution to alleviate the privacy concerns, while still allowing you connect with your friends on Path.

<comment><USER58> One-way hashing phone numbers cannot really be one way, unless you are using an inherently really slow hash function.

Without it, generating the table of say 10^10 hashes is within range of almost everyone (especially on a GPU). At say 1ms per input, it would take 10M seconds, or about 4 months.

</comment></comment><comment><USER59> Does this mean that the standard HTTPS stack on the iPhone is insecure? Shouldn't certificate verification fail when it attempts to send data via the mitmproxy?

<comment><USER60> Actually I think you can manually add SSL certs to the iPhone, so just add your own cert and the iPhone will trust your MITM.

</comment></comment><comment><USER61> I feel like this is [unfortunately] a regular practice of app makers nowadays. I'd love to abide by "let the industry govern itself" but I don't think that's realistic. I've seen so many apps that have abusive and opaque permissions.

Is there any regulation to protect consumers here? If not, are any legislators drafting any? Would the FTC step in or does this only happen when a giant like MSFT/GOOG/FB makes a mis-step?

</comment><comment><USER62> > industry best practice

Did he say that with a straight face? Heard a lot of corporate BS in my time but this takes the cake.

This is Apple's fault for allowing all apps access to the address book. But there is a deeper issue here, trust. Just because I leave my office unlocked doesn't mean my colleagues can steal from it.

I love this app and had great hopes for it but trust is a limited commodity and Path just lost mine.

<comment><USER63> There's a dozen or so people right in this discussion that are repeating it with a straight face, that this behavior is normal and acceptable.

I know for a fact it is illegal in Europe, know for a fact it is a violation of their contract with Apple, and I am almost positive it is criminal in the US as well.

Therefore the names and affiliations of the engineers here who are claiming data theft of private information is normal are very interesting to me, and I am noting them carefully, as should we all.

</comment></comment><comment><USER64> Albeit too late, after reading this I uninstalled Path from my Android. I did not buy into this.

</comment><comment><USER65> 1\. I just changed my phone # 2\. I notified all of my contacts to change their phone #s 3\. I contacted both Apple and my State senator.

I am outraged by this scandal, and I still can't bring myself to believe that Path has been collecting this sensitive personal information. My 6-month old's pediatrician's # is in my phone. If this were EVER exposed or shared with a 3rd party, I can only image what kind of damage could occur. Path should suffer for this. I forgive Apple for secretly tracking my iPhone's location for a year, but I DO NOT FORGIVE PATH. Not this time. This went to far. Dave Morin should know better. I bet an engineer voiced that he felt morally wrong doing this, and Path just fired him. This is just wrong. A defining moment in our industry. We need to stand united on this issue, and just try to move forward.

<comment><USER66> Your child's pediatricians phone number will somehow cause inconceivable damage if this number gets out? I bet calling up all of the pediatricians in your town phishing for this info would be much more productive than worrying about it being stolen off of a database from Path.

</comment></comment><comment><USER67> I always wondered what the purpose of Path really was, given that it offered little over and above Facebook itself (apart from an arguably nicer UI.) It would seem the purpose is to data-mine users' handsets.

</comment><comment><USER68> It's worth noting that the AddressBook API dates back to mid 2008:

"The Address Book framework provides access to a centralized contacts database, called the Address Book database, that stores a user's contacts."

It has been there since iOS 2.0

</comment><comment><USER69> I didn't know HTTPS requests can be traced so easily from a proxy. I was planning to start coding an authentication endpoint with SSL but obviously it is tracable that quickly. Is there no way to avoid that?

</comment><comment><USER70> Quora best handles this situation. There can be a lot of benefit for the user to have the contact lust on the server, but it needs to be (1) transparent, (2) obvious, and (3) come with a delete button.

<comment><USER71> I'd like to keep my contact lust private, thank you.

</comment></comment><comment><USER72> Moral of story: don't target techies as your end users. They'll just look under your hood to make sure you're not doing anything embarassing like this, and passing back clear-text password in JSON.

<comment><USER73> That's not the moral of the story; techies are great early-adopters and end users for that reason.

The moral is to treat customers privacy with utmost respect.

</comment></comment><comment><USER74> Anyone know if they have an Android app? Does that share this feature?

<comment><USER11> Android asks for your permission on what information you want to give the app. iOS just simply gives it whatever it asks for, without asking you first.

<comment><USER74> Interesting. What else can an iOS app get access to without permission? location? browser history? other installed apps list? emails? notes? pics? vids? music list? podcast list? itunes username?

<comment><USER75> Location: Permission is asked for

Browser History: There is no way to communicate directly with what Mobile Safari stores.

Other installed apps list: Apps are sandboxed so it is impossible to know what else is installed. If you've developed one of the other apps you can share the same App ID which gives you access to the same storage space so you could create a flag to indicate one of your apps has been installed. Some apps respond to certain protocols so you can ask iOS if a given protocol will be handled and if it returns yes then you know the app is installed. Again because they are sandboxed you really can't do anything harmful and responding to the protocol only allows the other app to receive information, not expose it.

Emails: No, the only way you can do anything with email is prompt the user to compose an email.

Notes: Same as Mobile Safari.

Pics: You can display a popup to the user that asks them to select an image from their camera roll/iPhoto and if they select a photo you then get a reference to an object that represents the photo. You can't just search their camera roll.

EDIT: rbritton points out that with the AssetLibrary framework you can actually search through all pics/videos and for some reason it gives a location access prompt when you do. <http://news.ycombinator.com/item?id=3563336>

Vids: Same as pics.

Music List: You can get a list of every song in the users library without asking for permission:

Podcast list: Same as music list.

iTunes Username: To my knowledge there is no way to access this but I've never been asked to so I really haven't spent time looking. In theory because you can access the Address Book you could make a best guess at which contact is the user and then assume one of their emails is their iTunes username.

<comment><USER76> You can access the Picture/Video library since iOS 4. It does prompt at least once for location access (apparently since they can contain GPS metadata), but it does not mention anything about _why_ it's asking for that location access.

[https://developer.apple.com/library/ios/#documentation/Asset...](https://developer.apple.com/library/ios/#documentation/AssetsLibrary/Reference/ALAssetsLibrary_Class/Reference/Reference.html)

<comment><USER75> Really? It asks for location access to get access to your asset library? That is pretty stupid.

Thanks for the heads up. I was unaware of the AssetLibrary framework.

<comment><USER77> This is because the photos contain GPS data about where they were taken.

<comment><USER75> Ah that would make sense. So that would mean that if you turn off location services any app could access your asset library without any prompt then. Good to know.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER78> So my choice is easy, but for the life of me I can't figure out how to delete my Path account. Both online and mobile interfaces appear to be missing this function. Help?

</comment><comment><USER79> I was thinking of using Path as a personal diary. But not anymore. Just deleted Path app. I would suggest everyone to do the same. A lesson for Path and others.

</comment><comment><USER80> You know... I think Google uploaded my entire contacts list to its servers, and I don't recall being informed very clearly about that either.

</comment><comment><USER81> I'm pretty sure that Instagram is doing this too as I get push notifications whenever a friend signs up. Can anyone confirm?

<comment><USER82> I briefly looked into it. Logging in and registering with Instagram apparently won't work behind an http proxy (mitmproxy)

</comment></comment><comment><USER83> With social apps, trust is everything. Without it, you've got nothing. I wonder if this increases vanity user base numbers.

</comment><comment><USER29> I wonder if this use of address book information explains the sudden spike in Path's growth since their recent relaunch?

</comment><comment><USER84> Such a blatant and fundamental failure to be transparent in regards to user privacy should make everyone doubt Path's ability to function as a private social network. Whether this incident is a reflection of their technical incompetence or a lack of actually caring about their user's privacy (as their Values would otherwise have you believe) the expectation that their product can live up to its purported goal is misplaced.

This is pretty basic stuff.

</comment><comment><USER85> I'm happy this is brought up again. So many apps do this unknowingly. One reason I prefer web over apps.

</comment><comment><USER86> from a company that claims they "don't currently have the internal tools to delete an account" I'm sadly not surprised.

The above was their official response to me when I asked to delete my account... and I had to ask by email since there is no link on their website to close your account...

</comment><comment><USER87> This is clearly of lost opportunity to position Path as the "trusted network" against Facebook.

</comment><comment><USER17> I sure hope they have implemented proper ACL for the REST api.

</comment><comment><USER67> Uninstalled Path. Incredible violation of privacy.

</comment><comment><USER88> So does whatsapp

</comment><comment><USER89> I believe Bump does the same thing and I am willing to guess other do as well.

</comment><comment><USER90> Brought to you by: <https://path.com/team>

Their collective decision making has proven to be a huge liability. Would you hire them for your next venture?

A 14 year old girl could tell you that her address book is private, private, private!

<comment><USER91> Umm, hell yes I'd hire them. And so would any major software engineering company in the world.

You seriously think that this is out of the ordinary or unusual? How many huge privacy fiascos has Facebook had? And yet, they're about to IPO for $100 billion.

The only group who _really_ cares about this is on HN. In a week, most of us will have moved on to the next big drama. In a year, no one will remember this at all.

The memory of the voting population is short, but the memory of the Internet is so infinitesimal as to almost not exist at all. And truthfully, I'm not sure if that's a good thing or a bad thing.

<comment><USER90> That doesn't make it right. Privacy is privacy. What happens when their servers get hacked and all of that info is out in the open? This ranks way up there with storing passwords in plain text. OK, sure, the entire team isn't at fault, but one or a few people are. I would not want those people making decisions that could take down my business. No way.

Downvotes me all you want. The fact remains that, if you asked a teenage girl if it would be OK to grab her address book without consent it is very clear what kind of an answer you'd get. Why is it that a bunch of smart adults think that they can get away with it then? The apology is bullshit. They knew what they were doing and got caught.

As far as only HN caring, I'll bet that users of this app would disagree with you on that point. How many people do you know that are OK with a company of strangers secretly downloading their private data onto their servers?

This, in my opinion, is a very serious transgression.

</comment></comment></comment><comment><USER92> This is NOT controversial. You give them permission to do this. If you don't want Path to import your address book, then don't ask Path to import your address book.</comment>


Ask HN: What makes you switch from desktop to web application? - <AUTHOR>

Recently I have seen very complex "wedding excel", large spreadsheet file with many sheets dedicated to tracking tasks and information related to wedding preparation. As usual, excel file was shared via email and versioned manually ... :)
There was no special feature which required desktop version - it would be piece of cake to accomplish same task using web alternative (for example Google Docs). And a lot faster.
My question is: what makes you switch from desktop to web application?
Compared to desktop most web apps provide less features, but do not require installation, provide new features like "use everywhere", cloud storage and sometimes Ehterpad-like synchronization. However with services like DropBox cloud storage is not that big advantage any more.
So what was the killer feature which recently convinced you to abandon desktop <insert your favourite application here> and start using web app? <comment><USER2> Uh, nothing? I'm very happy with my desktop apps which keep on working when the umbilical cord to the Central Brain of Mankind is severed, thankyouverymuch. As you have noted, Dropbox keeps my files nicely synced even through spotty connections - but the files don't disappear when the link inevitably drops (yeah, yeah, 99.99999% uptime, complete 4G coverage, yada yada yada; pull the other one).

Quite the opposite - using various web interfaces for e-mail drove me _back_ to Thunderbird: hey look, it can search messages without any network connection at all (le gasp!).

Of course, I'm all for using appropriate tools: e-mailing a collaborative work around is very much like trying to use a hammer as a screwdriver. But for single-user tasks, web apps are definitely worse, IMNSHO.

Disclaimer: I'm not a representative sample, nor do I play one on Youtube.

</comment><comment><USER3> In my computer, it's even faster to open a new tab and go to Google Docs and open the file, than search it in my hard disk and open it on Office.</comment>


It's Going to Get Worse - <AUTHOR> https://danco.substack.com/p/its-going-to-get-worse <comment><USER2> It seems like the thesis of the post is that everyone will keep getting mad at each other, and we'll be frustrated by the slow pace is recovery. Which seems likely, but I'm not sure I agree that is worse than what we're going through now? Less people will be dying, we'll be more prepared for the next waves, and the economy will slowly be recovering. If you're not spending your time watching / reading the news and arguing with people online, it feels to me like things will just be getting better (albeit slowly).

</comment><comment><USER3> This guy seems like he's projecting his reaction onto the whole world. People have different reactions and motivations to things and you'd be surprised how different they are to your own.

</comment><comment><USER4> "It may seem a ridiculous idea, but the only way to fight the plague is with decency." ~Camus

</comment><comment><USER5> I've got a theory about our reaction to the virus, and it's related to the idea that many people want a general strike. Before coronavirus hit, many people were frustrated with _everything_ : capitalism, politics, wages, etc. Yet the world kept turning. With this shutdown, and the knowledge of the economic effects, it has become a tool to hold the system hostage and demand accountability.

My basis for this theory is that I believe if everyone who was mad about everything before, could organize effectively and shut down the economy like we're doing now, _without_ needing a virus, I believe they would, as a protest. It's a form of a general strike, in a sense, and it's forcing everyone to talk about capitalism, healthcare, wages, etc. Even though it hurts us.

So in my opinion, people are collectively going to make it as painful and drawn out as it can be, because it's too useful as a tool to highlight issues that they feel haven't been adequately addressed. This is not to say that I don't believe that "flattening the curve" is real or effective (I do), but I believe there are more powerful subconscious factors at play here.

</comment><comment><USER6> I don't get it. He starts with a vignette about driving by a Starbucks and wishing he was sitting in the half-hour-long drive-thru line. _Huh?_ His neural patterns are apparently configured to fire in a way that is totally alien and unrelatable to me.

I don't think the article improved from there.

</comment><comment><USER7> It is. Good post. I already said the same things but fear of writing like this - so many still choose to ignore or be overly optimistic. It will get worse, much much worse before it gets better.

</comment><comment><USER8> The problem is divide-and-conquered mentality of tribalism, mob rule, dog- piling, conspiracy theories and scapegoating out of weakness, ignorance, and/or cowardice. The main global root cause is the weakness of the people to not come together through solidarity and rational, constructive purpose to push back the tides of the rich neoliberal inverted totalitarian establishment who is destroying the planet and impoverishing/exploiting billions of people through corruption and force.

Also, it will get better. The virus will evolve to be weaker, antibody and/or surface antigen vaccines will come online, IgG/IgM ELISA tests will eventually be $10, and habits and behaviors will adapt. This isn't the end of the world, climate change is a much larger existential threat. To that end, it's worth ending meat agriculture because of the following reasons that I've been shouting pointlessly into a hurricane about for years:

\- climate change

\- _pandemic evolution_

\- antibiotic resistance

\- resource inefficiency / nutritional availability and distribution

\- peak phosphorus (which may be deferred)

\- animal welfare

</comment><comment><USER9> you know that social experiment where they tell kids they have have either one cookie now or several cookies if they wait until later?

that's exactly the test going on right now and it's sorting out those that can give up the cookie now to shorten this, vs immediate gratification to give up a longer term benefit

the problem is, all it takes is a few who demand immediate gratification to drag us all through months and months more of this

btw planning on a vax is a fool's errand, there is growing research that a vax may not work/last and there will likely be mutations where a vax won't help, science may be a long term savior but not any time "soon"

only behavior changes can mitigate this but too late to solve massive inequality, health and discipline differences in american society, it's a perfect storm against a corrupted/corroded structure

<comment><USER10> There was a boy in this test. He always experienced grown-ups lying to him. So he thought: Better have that one cookie now because when that guy returns he might take it away.</comment></comment>


Ask HN: Is it worth to invest into Ethereum right now? - <AUTHOR> I'm thinking of investing into cryptocurrency, what are your thoughts? And where should I start? Is it straightforward to invest? <comment><USER2> In my opinion, Ethereum is unlikely to see major price gains in the near future, as it just went through a period of rapid price growth that can't be sustained.

As for whether you should invest in it, only you can make that determination. All I'd say is that, in my opinion, if one does invest, they should be aware of the volatility of cryptocurrency markets, and should not let short term price runs or price declines guide their decisions on when to sell or increase their holdings. I think it's better that one invest with a long-term plan in mind and try to stick to that plan as long as the fundamentals (i.e. not peripheral attributes like price) continue progressing as one had originally envisioned they would. Also, only invest what you're willing to lose.

</comment><comment><USER3> I bought BTC at $250, the it dropped to $80. It rose to $1000, I bought more BTC, then it dropped to $200. Then it rose to $3000 and I sold it all for a profit.

The bottom line is if you believe it in the long term and have the patience to accept any medium term losses, it is fine to put your foot in after a run up. Maybe invest 10% of what you're willing to lose now, which can be nice to get the trust of exchanges early, so when you can buy more your daily limit will be higher. It takes some days to open an account so you might also want to do it weeks before you want to buy. When it inevitably crashes you can buy more.

I recommend averaging in, say 10% a month over a year, you will get a range of low and high prices.

</comment><comment><USER4> I am a stock market speculator as well as long term investor, but I personally would not invest in any crypto currencies right now, because the market is very thin and I don't trust the exchanges- just look at the flash crash few days ago... maybe one day in the future we'll have a robust exchange with high enough volume, then I can try to speculate or even invest for the long run...

</comment><comment><USER5> No it's not. There are too many speculators who invested and are waiting for new people to invest so they can offload their bags.

</comment><comment><USER6> its not investing, its gambling. dont risk more than u are ok with losing

</comment><comment><USER7> I like Antshares, and all crytpo's are probably speculating rather than investing, too many variables and unknowns.

</comment><comment><USER8> Ethereum I believe did make the blockchain size larger then bitcoin but I still wouldn't invest in it.</comment>


Envify – Colorize browser tabs for dev/stage/production sites - <AUTHOR> https://addons.mozilla.org/en-US/firefox/addon/envify/ <comment><USER2> Very useful. I started building the same thing a few weeks ago for Chrome, only to realize it's actually impossible because Google doesn't allow dynamic themes.</comment>


Metacrap: The problems of metadata and how to solve them - <AUTHOR> https://people.well.com/user/doctorow/metacrap.htm <comment><USER2> It seems every few years I end up at a job/task where this essay is useful.

</comment><comment><USER3> In short: use unsupervised AIs and algorithms to generate metadata because humans suck at it.</comment>


Fukushima Reactor 1 melted down, 2 and 3 may have too - <AUTHOR> http://arstechnica.com/science/news/2011/05/fukushima-reactor-1-melted-down-2-and-3-may-have-too.ars <comment><USER2> Oh no, that isn't possible. There were so many pseudo-reactor-experts, explaining the safety of those types of reactor in detail. And now those darn fuel rods just melted without appreciating the "don't panic, it's all exaggerated" - wall of texts :[

<comment> DanI-S Potentially 3 meltdowns occurred, after a 'perfect storm' swamped badly-sited and antiquated reactors.

The end result: a few people with radiation burns, a local shortage of electricity, and a release of radiation that - while significant - doesn't come close to the radiation released by the thousands of atomic bomb tests performed in Nevada this last century. An area will be uninhabitable for a while.

Lessons learned: nuclear power is pretty darn safe, although you shouldn't build 50s-style reactors near the coast in a tsunami zone. If you do, don't live nearby. No surprises there.

<comment><USER3> I know what you were trying to say, but " _doesn't come close to the radiation released by the thousands of atomic bomb tests_ " isn't exactly the way to calm people about the amount of radiation leaked.

<comment><USER4> Is that even true?

A bomb might have 100 pounds of nuclear material, fairly efficiently exploded, releasing a lot of energy.

A burning, melting reactor might have 100s of TONS of fuel pellets, which can be aerosolized and distributed to the four corners.

<comment><USER5> AFAIK even the most efficient bombs only convert a very small (sub 1) percentage of the fissible material to energy. And (in the case of the over 500 airblasts) "aerosolize" all of the rest 100% and spread it throughout the troposphere, ensuring that the whole world gets its share.

While it's true that reactors contain far more radioactive material, they don't typically "aerosolize" much of it - Tchernobyl was pretty much a worst case scenario in that regard, and Fukushima thankfully was not.

</comment></comment></comment></comment></comment><comment><USER6> One of the issues that is obscured by the discussion of nuclear plant minutiae is the question "what level of trust should be placed in government?"

</comment><comment><USER7> Fairwinds: Fukushima Groundwater Contamination Worst in Nuclear History

"That (contaminated) water is seeping into the ground table, and there will be contamination on that site for a long time to come. It could also move inland. This is ground water, it doesn't have to move out into the ocean. It is clearly moving into the north"

<http://www.youtube.com/watch?v=9CAeixB19d4>

I don't believe that TEPCO is actively monitoring plutonium and uranium, which is heavy and more likely to seep into ground water than to be blown into the air. I hope that people in Tokyo do have some independent monitoring stations setup. Anybody know any links?

<comment><USER8> People will read the TEPCO report and they will process it in a variety of ways.

According to TEPCO (and GE documentation) the containment vessel did in fact contain the core material. Looking at the measurements reported, (both from TEPCO and other agencies) there isn't an indication of either groundwater or watertable contamination.

[update: The TEPCO folks early on said they _did_ see some groundwater contamination with Iodine. They also point out that the plant is 'downstream' of the water table with any nuclides most likely being carried to the ocean rather than to either of the rivers higher in the water table. The engineers will know more when they open things up and start cleaning them out.]

The 'news' is that cleanup will take longer because rather than pulling fuel pins out of the reactor and sending them off to be either re-processed or disposed, the core material at the bottom of the reactor will have to be removed piecemeal by what is probably custom equipment.

This was the same procedure used at TMI to remove material that had migrated to the bottom of the reactor after having melted.

I don't think anyone disputes that this was a tragic event and at seems nearly the worst possible accident (it could have been worse if all reactors were at full power) but it hasn't killed anyone yet, this incident is unlikely to be the principle cause of death for anyone in the forseeable future. And yet tens of thousands of people are dead because they couldn't flee the wall of water, so the tsunami _was_ a disaster, the damage to the nuclear plant _was not_.

When you see a head-on collision and the person in the car walks away because the airbags went off, we don't argue for banning driving because the car is destroyed, there is $50,000 worth of damage to the guardrail, and hundreds of people lost work because they were caught in the traffic jam. We say, "Isn't it amazing how safe cars are these days! That accident would have killed them even 10 years ago."

We have had a head-on collision between a late model nuclear reactor and an incredibly and extremely unlikely large magnitude double disaster and so far, the safety systems that were built into the reactors and upgraded over the years have kept everyone safe. Slowly, steadily, and with good engineering practices.

The results of that disaster are being addressed and will be cleaned up and repaired. I realize that someone walking away unhurt from what would have been a fatal collision might feel that it was a miracle, but it might just have been good engineering.

<comment><USER9> c'mon, these reactors of the basic design dating back to the Manhattan project need to give way. The primary goals of these designs were weapon related programs. Even molten salt reactor (supposedly coming in the happy future as Gen IV) was successfully prototyped in Oak Ridge 40+ years ago.

I'm completely for technological progress, including full speed nuclear. Yet, without hitting the current nuclear establishment hard in the nuts, they wouldn't let the progress happen, and will be continuing to build, if permitted, these old designs, or nothing will be built at all. The human race thus is kept hostage - either old and dangerous or nothing. There is no debate whether nuclear is safe or not. It is just a PR of the existing industry trying to sell old dusty designs and their minor tweaks wrapped as the necessary component of the technological progress of the human race. The real answer is - existing nuclear is dangerous, costly, and huge portion of its cost is socialized (as typical for any monopolized industry). The nuclear energy, if/when it is developed using even existing today state of human race technology (not 50 years old) can possibly be made safe and very effective.

Edit: among my best hopes for advanced nuclear and thermonuclear is that Musk will need a source of energy on Moon, Mars, etc... and there is no nuclear industry yet capable to reach beyond the Earth to limit the progress there

<comment><USER10> This is one aspect of this debate that I think hasn't been covered nearly enough. Nuclear opponents have successfully created an environment in which it is extremely difficult to construct new reactors, and then they are quick to decry failures of obsolete designs. The anti-nuke movement shares culpability in the Fukushima disaster precisely because they have done everything possible to ensure that we are stuck with older, far less safe designs.

If anything, Fukushima is an example of how little attention we should pay to the anti-nuclear movement, because an inevitable side effect of their cause is the prolonging of older reactor's lifespans, when much safer designs could be replacing them.

<comment><USER9> >If anything, Fukushima is an example of how little attention we should pay to the anti-nuclear movement, because an inevitable side effect of their cause is the prolonging of older reactor's lifespans, when much safer designs could be replacing them.

Unfortunately. if limitations are lifted or eased, we'd immediately get more of the same Fukushimas from the industry, and the anti-nuke movement is the only force keeping it from happening.

<comment><USER11> I think that both the industry and the anti-nuke forces are keeping nuclear from advancing.

When people like the founder of Greenpeace are _pro_ nuclear, the only people anti-nuclear are radically anti-nuclear. They do not give a damn about old versus new tech.

The nuclear industry just wants to save money by pushing the old tech.

Together they create the false dichotomy of either old or nothing.

I wish we had an anti-nuclear movement which distinguished between old and dangerous and what we could have with new tech. Even if they were against both, if they were at least much more against the old an dangerous, that would be great.

But the current ani-nuclear forces are not that rational.

<comment><USER12> To support your point, can you link to some information about the new tech? I'd be interested in a layman's comparison to the old tech.

<comment><USER9> you can Google on your own and there are a lot of different designs in different states, from pure concepts to successfully prototyped. My point is the absence of any significant technological development by the entrenched and monopolized industry (and intentional preventing of others through regulatory machinery - i.e one can't disrupt the industry short of producing the fusion reactor in the garage).

From practical point of view, the most developed, i.e. it was successfully prototyped 40 years ago (<http://en.wikipedia.org/wiki/Molten- Salt_Reactor_Experiment>), is Molten Salt Reactor :

<http://en.wikipedia.org/wiki/Molten_salt_reactor>

nice quote from the article: " Since it uses raw fuel, basically just a mixture of chemicals, current reactor vendors do not want to develop it. They derive their long-term profits from sales of fabricated fuel assemblies." :)

The principal difference of this type of reactor is that all the stuff (fuel, fission products, etc) aren't piled and accumulated in the reactor core. Instead, it is flows in, burns, flows out, filtered/reprocessed, flows in ...

General scare tactic utilised by the industry to preserve status-quo is expressed nicely here:

<http://en.wikipedia.org/wiki/Generation_IV_reactor>

"As one director of a U.S. research laboratory put it, "fabrication, construction, operation, and maintenance of new reactors will face a steep learning curve: advanced technologies will have a heightened risk of accidents and mistakes. The technology may be proven, but people are not"

Basically - if you force us to make something new, it will be even more risky and we've warned you.

Another quote from there : "Nuclear engineer David Lochbaum has explained that almost all serious nuclear accidents have occurred with what was at the time the most recent technology. " .

Complete BS - nor Chernobyl, nor Fukushima have nothing to do with their technology being most recent as 1.their technology hasn't been most recent 2.it has to do with morons - Chernobyl, and unplanned for high tsunami - Fukushima and if i remember TMI was also not about new technology.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> We can all point fingers and accuse people of being too conservative in their fear or not, but I think we can all agree that this is an unfortunate setback in terms of public perception of nuclear energy.

I hate seeing coal ads that more or less state that it's safer than nuclear energy.

<comment><USER14> _we can all agree that this is an unfortunate setback in terms of public perception of nuclear energy_

I - for one - disagree quite strongly with that.

I think that it's very unfortunate that somehow Nuclear power has picked up a lot of support from people who think opposition to it is unscientific.

I think that if you look even moderately closely at it you'll find that the risk modelling associated with nuclear power closely resembles the risk modelling that Feynman tore to shreds when done on the space shuttle after the Challenger disaster.

For example, people will tell you that this disaster was so bad because of the combination of earthquake and tsunami knocked out the support infrastructure. They'll even give you odds on each individual problem occurring.

But they don't look at the system as a whole: If an earthquake and tsunami did occur, it was almost certain that support infrastructure would be knocked out. In actual fact they were very, very lucky that no aftershock produced another significant tsunami in the area.

The stupidity of those assumptions is obvious in retrospect, but nuclear fans are papering over it by saying it is a one-off problem, and associating anti- nuclear people with smelly, uneducated hippies from the 1970s.

Well.. it's NOT a one off problem, and the risks aren't as low as they make out. Take seismic risks in the US. Quoting the report of _Safety/Risk Assessment Panel for Generic Issue 19_ (ie "IMPLICATIONS OF UPDATED PROBABILISTIC SEISMIC HAZARD ESTIMATES IN CENTRAL AND EASTERN UNITED STATES ON EXISTING PLANTS"):

 _Updates to seismic data and models indicate that estimates of the seismic hazard, at some operating nuclear power plant sites in the Central and Eastern United States, have increased_

 _Using available seismic hazard and plant seismic fragility information, the Safety/Risk Assessment found that the increase in coredamage frequency for about one-fourth of the currently operating plants is large enough to warrant continued evaluation under the Generic Issues Program_

[http://msnbcmedia.msn.com/i/msnbc/Sections/NEWS/quake%20nrc%...](http://msnbcmedia.msn.com/i/msnbc/Sections/NEWS/quake%20nrc%20risk%20estimates.pdf)

So.. those risk assessments done when the plants were approved? They were wrong, and in 1/4 of plants in the _Central and Eastern US_ core damage would occur during a seismic event within their design tolerances.

Still calling this an unfortunate setback?

 _I hate seeing coal ads that more or less state that it's safer than nuclear energy_

I hate seeing coal ads, but nuclear isn't the answer. (Oh, and don't believe the whole "no renewables can produce baseload" lie, either. Do some reading on solar-powered pump-hydro, geothermal and tidal power)

<comment><USER13> Um, I'm not making any excuses for this accident, and yet nuclear power is still measurably safer than coal...

<comment><USER14> Oh yeah, that argument.

Yeah, its true that if you are involved in the coal industry you are much more likely to die than if you are involved in the nuclear industry.

Yes, day-to-day pollution from a coal plant (especially old ones) is much worse than day-to-day operation of a nuclear plant (which is why they need to be replaced).

But there is zero chance that an accident in a coal plant will affect more than (say) 1000 people, and yet there is at least a 1/12,000 chance [1] that it will affect 100,000+ with a nuclear station.

[1] The first commercial nuclear power station was commissioned in 1954. There are ~25,000 days since then, and there have been 2 INES Level 7 accidents: [http://en.wikipedia.org/wiki/International_Nuclear_Event_Sca...](http://en.wikipedia.org/wiki/International_Nuclear_Event_Scale#Level_7:_Major_accident)

<comment><USER8> _But there is zero chance that an accident in a coal plant will affect more than (say) 1000 people, and yet there is at least a 1/12,000 chance [1] that it will affect 100,000+ with a nuclear station._

Heh, the flip side is that _there is a 100% chance_ that the pollution created by the coal plant over its lifetime will kill thousands of people. But to your point, that is an argument based on facts, not emotion. And emotionally the people living near the coal plant, while dying due to the effects of its pollution will not have been frightened that one day it might have an accident that would cause them to evacuate for a few months.

<comment><USER14> I actually replied to a similar object further down.

Obviously I agree that coal is a disaster. At the same time I don't think that replacing coal with nuclear power is acceptable.

However, since this thread is pretty much dead (except for us two!) I'll say this:

I'm not as anti-nuclear power as I might appear here. For example, I'll happily say that the panic associated with a nuclear leak is usually unjustified. I'll even go so far as to say that nuclear power might have a place in the future of power generation.

What I don't like is the uninformed cheerleading by many technophiles of nuclear power.

There _are_ real risks associated with nuclear power, and they _are_ grossly understated by those in the industry, which then gets parroted mindlessly by many. There are plenty of examples on this thread of blind acceptance of "facts" put forward by the nuclear industry (disclaimer - I'm not accusing you of this). A trivial amount of research is enough to raise pretty significant questions on them.

The trend towards blind acceptance of those claims, and the whole "nuclear is cool" thing is what I try & push back strongly against.</comment></comment></comment></comment></comment></comment>


Ask HN: Review My Startup, Yog (like Anchorman...kinda) - <AUTHOR>

Hi Everyone,
I've seen how helpful answers to "Ask HN" requests have been in the past, and now that I've released the first version of the social running app I've been working on, I figured I would make my first  post to HN to ask for some feedback from you all.
Yog (www.getyog.com) as it's called, allows users from around the world  to run together virtually, in real-time.
In short, my intention is to channel peer pressure to  increase the frequency and level at which people exercise. I am focused on synchronous running to start and then once I've mastered the social mechanics behind running, I'll expand Yog to other sports.
While there are a slew of run-tracking tools on the market that do a great job of digitally transcribing physical exertion, my ambition for Yog is to create new exercise experiences (think virtual races, in-run challenges, communication, etc.).
I released the first version of Yog in mid-November and I've been excited by its traction to-date. In just over 8 weeks, users in 73 countries have scheduled 3,100 runs.
With an MVP complete, I am now thinking about building out the social infrastructure (i.e. in-app communication, user profiles, points/badging, etc.) to really deliver on the frequency and performance focus I mentioned above.
Whether or not you run, I'd love to hear what you all think. Our website (http://getyog.com/) has some more information and the app is free if you want to play around with it: https://itunes.apple.com/us/app/yog/id533514312?ls=1&mt=8.
Thanks. -Peter <comment><USER2> Effing clever - love it.

<http://www.getyog.com/>

One suggestion: Make "yog" more meaningful w/ a better tagline. "Run with friends" isn't very descriptive, exciting, or memorable. Is there a way you can use rhyming or alliteration in there to make it stick more?

Yog - Jog wars!

Hell, I quit. Never mind. You do that. I clearly am no good haha

<comment><AUTHOR> Thanks for the thought, Scott.

Regardless of the specific verbiage, you're right - our messaging needs work. To you, what is the most compelling value of Yog? That's ultimately what I want our tagline to deliver on.

<comment><USER2> The race/war aspect - that I don't give in/up before my friend does.

<comment><AUTHOR> Got it. Thanks, Scott.

</comment></comment></comment></comment><comment><USER3> Sounds pretty awesome. I've used Runkeeper, but this realtime social aspect is really cool. Getting into their app marketplace would probably make for a nice spike in usage.

<comment><AUTHOR> Thanks. I feel strongly that people should be able to take their health data wherever they like, so integrating with other services makes great sense.

</comment></comment><comment><USER4> Great Idea, and the execution looks fine too. Will use it for sure!

May I ask how did you get to be featured on TNW, Mashable, etc.?

<comment><AUTHOR> Thanks! If you have any thoughts or would just like to talke more about the app in general, shoot me an email. I'm Peter at getyog.com.

RE press, I was diligent about finding writers who had written about similar things in the past and reaching out to them individually to keep them updated on our progress. When it was time to launch, I had a handful of people I had established relationships with over the months leading up.

<comment><USER4> Thank you for your reply Peter. This information is priceless. In ~6 months we will release something and we're starting to think how to make it to these sites. So again, thanks!

</comment></comment></comment><comment><USER5> What an awesome idea. Whatever social functions you incorporate just make sure you keep it fitness-focused!

<comment><AUTHOR> Thanks! The goal is to support a community of people actually exercising together, beyond talking about it before and after the fact.

</comment></comment><comment><USER6> How do you know the other person is running and not riding a bike :)?

<comment><AUTHOR> There's an upper bound on how fast you can be travelling before being ejected from a run :)

</comment></comment><comment><USER7> Great idea Peter! Are you open to or looking for any help?

<comment><AUTHOR> Thanks, Sara! Yep - send me an email; I'm peter at getyog.com.

</comment></comment><comment><USER8> Smart idea. Good job. Race war ftw!

<comment><AUTHOR> Thanks!

</comment></comment><comment><USER9> Great APP! So much potential!

</comment><comment><USER10> I love this idea</comment>


Modern Android programming - <AUTHOR> http://www.vartmp.com/blog/2016/06/11 <comment><USER2> Cool thanks</comment>


Startup Sales For Founders - <AUTHOR> http://blog.statuspage.io/startup-sales-part-1-tool-up <comment><USER2> I haven't played with segment before, does anyone else have any experience with it? However, I am a huge believer in using one library/system to track events and use one system to ingest them.

One quick note, I've found that it's helpful to build a simple wrapper in my own system for the call to the external library - this means that I have just one place to go if I change who I use to send events to.

I do think this oversimplifies lead scoring a bit, that's an area for a whole blog post to or two - and this seems like a good starting point. This is just to say that being too quick to settle on a lead scoring method can cause a lot of incorrect assumptions later.</comment>


Ask HN: What are your favorite audiobooks? - <AUTHOR>

I'm generally interested and also have a bunch of audible credits to burn before closing my account.<p>Open to suggestions from any genre. <comment><USER2> Game of Thrones (Narrated by Roy Dotrice) would be a great choice IMO.

<comment><AUTHOR> The entire series?

<comment><USER2> Yes, the entire series is a joy to listen to. As a lifetime theater actor Roy Dotrice not just reads the book, but really brings it to life.

You could also check The Wheel of Time by Robert Jordan. It is also a good series and has two fine voice actors. Though IMO, not on par with Dotrice.

Please tell what you've bought, I have some credits of my own that lay around :)</comment></comment></comment>


Arduino RFID Security Access - <AUTHOR> http://appdelegateinc.com/blog/2010/10/04/arduino-rfid-security-access/ <comment><USER2> A setup like this is written up in detail in the book 'RFID toys' by Amal Graafstra. Using this same rfid reader, maybe even an Arduino, or maybe it was one of the other projects in the book that used an Arduino. The disadvantage of this setup is that you need power at the door, unless you want to replace the batteries on your door every couple of weeks. I still want to make something like this but for a hidden door - I've got an rfid chip implanted in my hand and I want to be able to unlock a hidden cabinet by waving my hand in front of it :)

<comment><USER3> Under what circumstances did you decide to get an RFID chip implanted in your hand? I'm genuinely curious.

<comment><USER2> Just for the experimentation really, to get some first-hand (pun not intended) experience with it. ('it' being both rfid and implanting stuff). Body hacking for hacking's sake, if you will.

It was quite anti-climactic, really. Turns out there aren't really any good applications for it, except for the 'fun' things like the 'hidden vault' I mentioned. It's quite an undertaking though to make something like that production quality. For example you need a way to unlock the vault even when there's no power. It would probably require some hidden mechanical mechanism that is actuated by a certain series of events. Like most experiments, I mostly lost direct interest after the proof of concept worked. Still if I ever have a proper workshop and a few weeks, or if I ever build a new house for myself, it would be nice...

<comment><USER4> I found much the same thing with mine. I had mine implanted because a friend owned a piercing shop and offered to do it for free.

Since then I haven't had much practical use for it except for the odd POC project.

The friend that did mine though uses his with a pass code for the front lock on his apartment. I've also considered something for my laptop to automatically unlock it when my wrist is in range.

<comment><USER2> Yeah the unlocking thing I got to work, I used it for a while to log onto my machine at work. Wasn't as much of an improvement as I thought it would be. The book I mentioned has a project on how to build an rfid reader into a keyboard, maybe it works better, not convinced though.

Where do you have yours? Is it more in the webbing between your index finger and thumb, or further up your hand? Mine is between the index and thumb but I did some manual labor a couple of weeks ago and I started to feel it. Does yours ever bother you?

<comment><USER4> I have seen that book before and was either going to grab it or did and it's sitting in my pile of unread books back in Canada.

I have mine in the back of my wrist about an inch up my arm from where my wrist bends back. It is out of the way of everything. I rarely remember it is there until I go to scratch my wrist.

Of course the downside is that I have to twist my wrist around in a slightly awkward fashion to get it to register.

</comment></comment></comment></comment></comment></comment><comment><USER5> It's much easier to debug and get it to work using a software serial library like newsoftserial, as (in the article) you cannot use the serial port at the same time as the usb serial (it is handy to have a serial session to the device for debug printouts and the like).

<http://arduiniana.org/libraries/newsoftserial/>

<comment><USER6> You can still get debug serial working if you set it to 2400 baud.

<comment><USER5> Interesting, the rfid card I've worked with (I did a similar thing) only worked at 9600 baud I think.

</comment></comment></comment><comment><USER7> I got really excited about this, so I immediately went to my local Radio Shack and picked this up. Sadly, my hopes of reading my work ID, passport, and store purchases were dashed when I saw the reader only works with the EM4100 family of RFIDs. I'm not sure what that means other than it won't ready anything I've stuck next to it other than the two supplied RFID tags.</comment>


Getting Back to Smalltalk - <AUTHOR> http://railsrx.com/2011/12/29/getting-back-to-smalltalk/ <comment><USER2> "The first element of an array is index 1, not index 0. Which, honestly, makes more sense."

No, it really doesn't. This is a constant headache in Lua too. See Dijkstra's comments on the subject here: [http://www.cs.utexas.edu/users/EWD/transcriptions/EWD08xx/EW...](http://www.cs.utexas.edu/users/EWD/transcriptions/EWD08xx/EWD831.html)

<comment><USER3> I'm struggling to find Dijkstra's argument sufficiently compelling to conclude that zero is the 'most natural number'. It's a conclusion based on _his_ aesthetics (plus an anecdotal story).

The natural numbers are generally considered to start at 1. Therefore, to people in general, such a system makes more sense.

<comment><USER4> Agreed. The fact that arrays were simple memory-offsets making zero-index easier for low-level programming doesn't make it easier for humans who historically prefer 1-indexing.

Zero is not a "natural" number, in fact many societies / civilizations never even understood or used zero in arithmetic [1].

[1] <http://en.wikipedia.org/wiki/Roman_numerals>

<comment><USER5> > in fact many societies / civilizations never even understood or used zero in > arithmetic

Yeah, but those societies were uniformly terrible at math.

<comment><USER6> There are Roman bridges still standing, and Roman roads still in use.

</comment></comment></comment></comment></comment><comment><USER7> There are some excellent screencasts for pharo here:

<http://www.pharocasts.com>

Smalltalk is a small language (think C), so you can learn the whole language set in a few days.

The live objects concept might warp your brain a little bit. I've heard lisp does the same, so if you're from a lisp background, you might not find it shocking.

The Pharo environment (IDE) can make all the modern IDEs (Eclipse, Visual Studio) look like babies in diapers.

There is built in versionsing, DVCS, refactoring tool, unit testing framework, The most powerful debugger etc....

You will not regret trying out Smalltalk (maybe you will when you have to go back to C++) :).

<comment><USER8> In general I agree, except for the IDE part. Every single IDE I haven ever used have better editor that Smalltalk IDE.

Not being able to use your own editor, whichever it is, and being forced to use something that is basically equivalent to plain old browser textarea is a showstopper for calling Smalltalk environments pleasant.

Maybe Gnu Smalltalk is a cure to that, since it doesn't have live image and you can use whichever editor you like, but that kinda defeats most of the benefits of Smalltalk.

<comment><USER7> True. I've had trouble with that as well when starting up. But later on I found I'm not writing methods that are larger than 10 lines (longest being 20 lines) in Smalltalk, which makes it tolerable. Still no ideal.

I hear that SqueakVM has a package called nvi that can emulate Vi keybindings as well as emacs keybindings.

<comment><USER9> Squeak and Pharo used to have a really great (for some value of "great", anyway) Vim emulator you could use in place of the default editor, but the hacks to enable it ran so deep that it doesn't run well anymore. The good news is that Pharo's GUI is increasingly clean and less crufty, which ought to make reintroducing a similar package feasible for the first time in years, if anyone were up to it.

<comment><USER10> It should be possible to simply embed or shell out the editing to an external program… I think this'd be the ideal solution.

</comment></comment></comment></comment></comment><comment><USER11> If you want to get introduced to Smalltalk and happens to have a Windows machine, check out Dolphin Smalltalk <http://www.object-arts.com/>.

Many years back, I tried Squeak a couple of times and it didn't click. Dolphin Smalltalk did that for me (and I then went back to Squeak due to other reasons). It has a well-designed, compact class library and a decent UI. I'm not sure if it has been updated to keep up with Windows, but it's a great start.

</comment><comment><USER12> I also enjoy hacking in the Pharo environment. That said, I have been doing most of my work lately using Clojure with combinations of: repl, Emacs, slime, and IntelliJ. I find working with Lisp or Smalltalk yields similar benefits of supporting very quick code experiments and development.

The important thing is having an environment that supports your eventual deployment requirements and also supports short term fast development requirements.

</comment><comment><USER13> Do i really need to use the ide to 'get' smalltalk? I'm pretty happy with my tools, and would only use ST for the paradigm shift anyway. I don't want to leave my text editor. It has become a part of me, and i can't imagine life without it.

<comment><USER14> Just to play devil's advocate to some of the other comments, there is GNU Smalltalk:

<http://smalltalk.gnu.org/>

It's tagline is "The Smalltalk for those who can type".

However it doesn't look very lively, and you'd be pretty lonely. I don't know any projects using GNU ST. Squeak, and now Pharo, are really the only implementations with momentum right now.

And as far as the typing thing... I am a die-hard Emacs user, and I still enjoy Pharo. This is because programming in Smalltalk is not so much about writing and editing code as it is working with objects. And, frankly, Smalltalk's way of working with objects (and remember: classes and their methods are just objects) is much more powerful than the average editor's way of working with source code.

<comment><USER3> The developers at ObjectFusion (<http://www.objectfusion.fr/>) appear to do much of their development in GNU Smalltalk. That's: Iliad web framework, Odyssey CMS, and possibly the upcoming Smalltalk Hub (the equivalent of GitHub, and an anticipated replacement for SqueakSource).

<comment><USER9> Unless I'm badly mistaken, SmalltalkHub is now developed on, and for, Pharo, not GNU Smalltalk. I have no insight into the reason for that change, however.

(I'm basing this on the code for SmalltalkHub, which at least used to be available on SmalltalkHub, and which had Pharoisms in the code base. It's entirely possible they simply moved those pieces over to GNU Smalltalk, though.)</comment></comment></comment></comment>


The Tech Talent Shortage is very real - <AUTHOR> https://medium.com/@extrasaltorg/the-tech-talent-shortage-is-very-real-d59513913da3 <comment><USER2> I'm guessing this is a response to this Techcrunch article: [https://news.ycombinator.com/item?id=10561198](https://news.ycombinator.com/item?id=10561198)</comment>


NIH halts clinical trial of hydroxychloroquine - <AUTHOR> https://www.nih.gov/news-events/news-releases/nih-halts-clinical-trial-hydroxychloroquine <comment><USER2> As expected, hydroxychlorquine shows no benefit when it's started in patients who're either hospitalized or in the emergency room with Covid symptoms. Like tamiflu, hydroxychloroquine is most effective within the first few days symptoms start to show.</comment>


What's your story? Why start Balsamiq? - <AUTHOR> http://www.balsamiq.com/blog/?p=79

<comment><USER2> This is an excellent perspective from a single founder (with child, no less) that will be helpful for bootstrappers.

On top of all that, the product seems pretty cool.

<comment><AUTHOR> Along with the fact that he managed to make it work even though he's not in a startup hub. balsamiq is a dream startup!

<comment><USER3> If you don't need investors or cofounders/employees, there is no advantage to a startup hub. You could live anywhere with an Internet connection and a (VoIP) phone. In fact in such a situation it makes sense to live in an area with lower cost of living, as Balsamiq's founder is doing.

<comment><USER4> it's easy to slip out of startup mode when nobody around you is doing it. peer pressure & constant exposure help a lot.

you certainly can do it, and the perks you mentioned are spot on, but i've always found it harder to stay motivated when not around startuppy people.

<comment><USER3> Cofounders exert a lot of peer pressure. I'd be surprised if being in physical proximity to other startuppy friends generally matters much, considering we do some of that interaction online (HN/Facebook/email/etc.) anyway.

</comment></comment></comment></comment></comment><comment><USER5> An inspiring story. I want to know how that guy managed to actually see his laptop screen whilst coding on the beach in the sun.

<comment><USER3> One trick is to completely turn off the backlight (can be done on MBPs), and treat the display as a reflective screen. It isn't perfect: looks almost as washed out as with max brightness on the backlight, but without the battery drain.

Definitely an inspiring story with Balsamiq, though I do also see it as competition to Dabbleboard, so -ahem- you know where my loyalties lie.

</comment></comment><comment><USER6> Everytime I hear this guy's story, I get more impressed. He was actually one of the guys I had in mind when I wrote my post on why its a good time to be in a startup. Talk about capital efficiency!

<http://news.ycombinator.com/item?id=332527>

</comment><comment><USER7> I am a very happy user of Balsamiq. I was able to deliver 20+ rough wireframes in about 6 hours using its interface. It would've taken significantly longer in OmniGraffle and we've been able to use them cross platform b/c of AIR.

A++ would do business with again.

<comment><USER8> Is OmniGraffle like Balsamiq? I though they're apps attacking different problems..

<comment><USER7> At an early stage of requirements gathering they're complementary for wireframes. Revisions/UI specs will be fleshed out in Omnigraffle for greater precision later, but that's after we've iterated with client in Balsamiq, which is what it makes so easy.

</comment></comment></comment><comment><USER9> I think readwriteweb.com is looking for these stories...

[http://www.readwriteweb.com/archives/web_20_gritty_entrepren...](http://www.readwriteweb.com/archives/web_20_gritty_entrepreneur.php)

</comment><comment><USER10> This from Atlassian on Balsamiq: <http://blogs.atlassian.com/news/2008/10/quit_your_job_a.html></comment>


Ask HN: Develop a site 'Has anyone developed (idea here) yet?' - <AUTHOR>

Wondering if the creative minds on HN could come up with a site where a user could put in an idea and be directed to a site/app/plugin that's already been developed for the idea or able to submit it for creation. <comment><USER2> I like the idea!! But did anyone develop it yet? :)</comment>


How to be productive when you are depressed - <AUTHOR> https://www.moodcheckin.com/blog/being-productive-while-depressed <comment><USER2> "This isn't the time to bring out your "I Hate Myself and Want to Die" 90s grunge playlist."

Dang it.

In all seriousness, this is very true. Little things make a difference.</comment>


Hofmeister Kink - <AUTHOR> https://en.wikipedia.org/wiki/Hofmeister_kink <comment> J-dawg I'm not exactly sure why, but I absolutely love this type of post.

Actually I do know why, it's because I get the warm feeling of knowing I get to be a smartass and point out Hofmeister Kinks to other people all over the place.

And for anyone else thinking "that would make an awesome band name"... it seems a duo from Adelaide with 66 likes on Facebook have beaten you to it.

<comment><USER2> Several years ago there was an Ask HN post inquiring what it is called when you want that fuzzy feeling of knowing more random mostly useless trivia than others. Some obscure knowledge was left there.

If you like random car stuff: apparently the fuel gauge on most cars points to the side of the car with the fuel fill, when it is at half full of course. And on cars with the muffler on only one side it is I believe the opposite side from the filler opening.

Edit: there was also a thread many many years ago where it was agreed to not post links to just a random Wikipedia article and instead to something that provided a bit more context as to why the thing is interesting. But I guess a couple of years after that it was abandoned.

<comment><USER3> Knowing how to find out which side the fuel cap is is very much not mostly useless if you hire regularly; it saves considerable time and effort knowing you can just look at the gauge as you pull into the fuel station.

<comment><USER4> It's actually useful even if you just don't drive much and only fill up every month or two. My brain has filler-cap-side down as "readily available information, do not store" so I don't bother remembering it. Gotta save those neurons for something I can't just look up at a glance when I need it!

<comment><USER5> I also don't fill up too often and unintentionally memorized this after owning the car for a few months.

At first I'd have to look at the little arrow on the fuel pump symbol, but early on, I made the joke to myself that the fuel port is "'pon the left hand side" (like that song "Pass the Dutchie").

Now to this day, when I pull into the gas station and momentarily think "what side is it again?" I immediately remember "'pon the left hand side".

It's kind of ridiculous but it amuses me.

</comment></comment></comment></comment></comment><comment><USER6> Now you people will be seeing this everywhere.

I've noticed that Infiniti goes out of their way to not have a Hofmeister Kink on their "BMW 3 Series killer" the G35/Q50. The Q50 has an especially pronounced Not Hofmeister Kink.

<comment><USER7> I'm confused. Looking at pictures of the Infiniti q50 [0], it definitely has the kink, as I understand it. In fact, an even more "assertive" version, to my eyes.

[0]:[https://www.infinitiusa.com/content/dam/Infiniti/US/vehicles...](https://www.infinitiusa.com/content/dam/Infiniti/US/vehicles/Q50/2019/overview/2019-infiniti-q50-sedan- forward-emergency-braking.jpg.ximg.l_6_h.smart.jpg)

<comment><USER6> The Q50 has an inverted Hofmeister Kink: instead of having the window sill flow upwards like a wave, it has an abrupt angle that decays flat, like a shark fin.

</comment></comment></comment><comment><USER8> One of those quirky HN posts. :)

I didn't understand what was meant at first. It's the part at the bottom of the back window that changes angle toward the front.

The link in the article to C-pillar was also interesting: "As an example, rescue teams employ pillar nomenclature to facilitate communication when cutting wrecked vehicles, as when using the jaws of life." (wondering if anyone can confirm)

</comment><comment><USER9> Along the same lines as "Bangle Butt" on later BMWs.

I suppose you know you've made it as a designer when there is a phrase with your name in it.

</comment><comment><USER10> > the Hofmeister kink is said by BMW to suggest that all BMW models have rear- > wheel drive

And yet the 2 series active tourer also has it :)

<comment><USER11> I think that meaning was probably pretty tenuous when it was introduced and more or less gone today.

I drive a FWD Ford Focus ST, which also has one.</comment></comment>


Mental hashing for paper address books (with Python) - <AUTHOR> http://lists.canonical.org/pipermail/kragen-hacks/2010-October/000517.html

<comment><USER2> One problem I see with the evaluation is he uses a generic English corpus. The real application is names though, which probably have different statistical properties. Shouldn't be too hard to find a list of real names somewhere on the web.

edit: here for example <http://names.mongabay.com/most_common_surnames.htm>

<comment><AUTHOR> Thanks for the link. Hash function "First and fourth letter" wins for english surnames:

<https://gist.github.com/bd9fabf91a5501b215c5>

(I copied the names table from your link and applied the original program to it)

<comment><USER3> There's a tradeoff between speed of lookup and ability to find things when you only partially recall the name. For those situations (the "tip-of-the-tongue" phenomenon), I'd pick either the first and final letters as the easiest to recall, or the first and second letters. The fourth letter won't be easy to retrieve unless you recall the name exactly.

</comment></comment></comment><comment><USER4> Did anyone notice the mailing list? It's one dedicated to the author. Interesting alternative for a blog.

<comment><USER5> There are some real gems on the list, too:

"Smalltalk Performance and Moore's Law" [http://lists.canonical.org/pipermail/kragen- tol/2007-March/0...](http://lists.canonical.org/pipermail/kragen- tol/2007-March/000850.html)

"OCaml vs. SBCL, and various other interpreters" [http://lists.canonical.org/pipermail/kragen- tol/2007-March/0...](http://lists.canonical.org/pipermail/kragen- tol/2007-March/000852.html)

"what affects programming language adoption?" [http://lists.canonical.org/pipermail/kragen- tol/2006-Novembe...](http://lists.canonical.org/pipermail/kragen- tol/2006-November/000834.html)

(kragen is also kragen here)

<comment><USER6> Thank you! I'm glad you enjoyed them.</comment></comment></comment>