Capital One Fraud Researchers May Also Have Done Some Fraud - <AUTHOR> http://www.bloombergview.com/articles/2015-01-23/capital-one-fraud-researchers-may-also-have-done-some-fraud <comment><USER3> I'm starting to agree with the editorial linked from the article [0] that laws against insider trading are pointless. People find ways to do it anyway, but because the laws exist, the general public thinks it's rare. It might be better for everyone to know what shark tank they're jumping into.

[0] [http://www.wsj.com/articles/SB100014240527023042799045795161...](http://www.wsj.com/articles/SB10001424052702304279904579516170211639290)

<comment><USER4> I wonder if it would be possible to create a parallel stock market where insider trading is permitted? People could then choose to trade shares (the same shares?) on the normal stock market, or the new free-for-all stock market.

<comment><USER5> People would just look at how the prices move on the 'free for all' market and then trade the real stock market using that information, thus insider trading on the real stock market would ensue.

You can't have it both ways, you either allow people to trade on private information (thus indirectly making the information public by moving the stock price) or you don't.

</comment></comment></comment><comment><USER6> This reminds me of a quote by Eric Schmidt : "One day we had a conversation where we figured we could just try and predict the stock market..." Eric Schmidt continues, "and then we decided it was illegal. So we stopped doing that."

They probably have thousands of employees who can access this information, I think it would be foolish to think that absolutely none of them does it for personal purposes.

<comment><USER7> So long as they used public information- why would it be illegal?

<comment><USER8> I once had an interesting discussion with a tech-savvy criminal attorney about whether security researchers could trade public equities using early indicators of compromise or private knowledge of 0-day (gained from outside the company, not under NDA). She thought about it a bit and said "The insider trading laws are so broad that if the US Attorney didn't like it they would make it illegal, and if you had talked to anybody about it they would go down for conspiracy."

My interactions with the criminal legal system as an expert witness since then have only reinforced my belief in Harry Silverglate's axiom that pretty much every US adult is merely an un-indicted Federal felon living their lives at the mercy of the thousands of AUSAs who could plunge them into a living hell.

<comment><USER9> And that is a problem, that we should solve.

</comment></comment></comment></comment><comment><USER10> Interesting, as the article notes - if Capital One had terms and conditions that said, "we can use sales data for unrelated purposes", they would be able to trade on that information themselves. I wonder who else has information that they're willing to use/sell to third parties... Facebook? Google? I wonder how predictive e.g. the ratios of likes of McDonald's/Starbucks/Chipotle pages are. Or clicks on display ads for Puma/Adidas shoes.

> Surely lots of Wall Street firms -- Chipotle is followed by 31 analysts -- > and asset managers are doing tons of research to try to estimate Chipotle's > sales. They're visiting branches and calling investor relations and talking > to pork suppliers and surveying consumers and generally getting paid a lot > of money to build a robust estimate of how many burritos Chipotle is > selling. One more piece of data -- one credit card company's charges at > Chipotle -- would be helpful, but come on, not that helpful.

Could we get this data any other way? How about putting cameras in front of a few flagship Chipotle stores and using CV to track the number of people going in/out? That's legal, AFAIK.

<comment><USER11> No one would do business with them if they had such terms.

<comment><USER12> The sat company, SkyBox, Google purchased mentions using sat images for predictive analytics that can be applied to investment decisions.

[http://www.skyboximaging.com/products#analytics](http://www.skyboximaging.com/products#analytics)

<comment><USER13> Following the logic in the article, you'd get the most efficient markets by making all financial transactions public and instantly accessible.

Then everyone would have the maximum possible amount of information, which would lead to maximally efficient pricing.

For some reason I can't quite put my finger on, I don't expect this to happen any time soon.

Which is one reason I remain skeptical that 'efficient pricing' has ever been a genuine goal.

<comment><USER9> On the other hand "making all financial transactions public and instantly accessible" is one of the best arguments I've heard for pushing people towards bitcoin/blockchain style accounting systems.

It would do all sorts of weird things to the theory of the firm forcing internal transactions to maintain information asymmetry.

</comment></comment></comment></comment></comment><comment><USER14> Kind of highlights the true value of data that users are giving away with every single, in this case, transaction.

I am not quite sure how one would go about an alternate method for assessing the actual value of user data, but it has always seemed rather obvious to me that it is hugely downplayed by all the self-interested parties and their defenders.

Would it, in this case maybe be the change in market cap pre and post sales figures? But even that, as pointed out, has some increases baked in based on alternative research to estimate performance. I guess you would need to find a very specific company that really does not lend itself to outside, tangential research and that keeps its performance measures and metrics under wraps really well between announcements. Anyone have any idea of an industry or company that fits such a profile?

Does anyone else realize we are really in and moving deeply into an era that is going to add significant opportunities for corruption and economic capture.

<comment><USER15> The problem with ascribing dollar values to data (a.k.a. facts) is that you can make up a million untestable hypotheses about how data could theoretically have worth. To give an extreme but illustrative example: let's say that by typing this comment to you, I raise the temperature in my router by a millionth of a degree, which alters the wind pattern in my room, which causes butterfly to flap its wings, which... you get the point.. causes a hurricane in some remote part of the world. Does this make the "expected value" of my comment negative billions of dollars?

You can back this argument out to less extreme versions and see that it's very difficult to economically value a fact. E.g. what if the traders named in this article had 100X the capital on the line for the same trade. Is the data now 100X more valuable because of the added economic value they derived from it? What if their trade netted them more than the change in market cap?

<comment><USER16> That's an interesting counterargument, but it defeats itself. Expected value is about averages.

</comment></comment></comment><comment><USER17> These guys should start their own credit card transaction aggregator (ala Mint), and gather user data that is expressly made available for market research. Make the analysis for privacy tradeoff more explicit and distribute profits.

<comment><USER18> Or, use the trading profits to subsidize the processing fees.

A credit card processor that charges 0% fee on transactions would have a huge advantage when pitching retailers.

<comment><USER19> > A credit card processor that charges 0% fee on transactions would have a > huge advantage when pitching retailers.

So why, you may ask, do we have such high fees for credit card transactions? And believe me: they ARE high. No more than a hiccup when debit card fees were restricted to roughly $0.15/transaction but CREDIT card fees (which use the same systems) continue to be a substantial fraction (a few percentage points) of every purchase.

It's because no one is pitching retailers. The cards are sold to the consumer (who pays nothing). The retailer pays, but the contracts they are offered do not give them space to do much other than refuse to take a type of credit card (and give up a bug chunk of their business) or to accept them and pay the fees.

<comment><USER20> Huge barriers of entry. In order to make a card product that is really competitive to Visa & Mastercard, it's a chicken and egg problem - you need on board both a lot of merchants (to make the product useful to customers), a lot of customers (to make the extra effort viable to merchants), and a lot of money (measured in billions, not millions) to get it started - even major tech companies like Ebay/Paypal and Stripe are too small to afford this kind of effort on their own.

If you make the product really attractive to merchants, then you will have a problem getting customers. You will have to compete with the existing credit card products. Banks make a lot of money on those existing products and are highly motivated to ensure that the product you propose never, ever gets off the ground. History shows that they are both willing and able to (a) use this money to "buy" customers over with bonuses that you won't be able to match because you aren't charging the merchants so much; and (b) aggressively try to keep you out of all the infrastructure - there are many 'moats' that they control, including the large settlement systems, technical infrastructure installed at merchants (forget about using the same POS terminals to read your cards and Visa/MC, even if it's technically easy), etc.

There have been and are many attempts to make new alternative card products, but they aren't realistic to succeed. EU considers a wish for such a card system every couple years, but it turns out to be unfeasible even given the combined financial resources of the interested governments. Right now Russia has a strong motivation to support and subsidize such a system, but again, they don't want it _that_ much to warrant the huge expenses for the relatively low expectations of success.

</comment></comment></comment></comment><comment><USER21> I see a lot of comments about how they could have figured out this data by just counting customers outside some Chipotle restaurants. This misses a key point: using their massive database, they were able to sift through thousands and thousands of businesses and actually figure out that Chipotle was one to watch. Without that data, they wouldn't know where to put their customer watcher.

If they were a little savvier, they could have used their data from CapitalOne to decide which businesses to research and then create shill research, much like the FBI's "parallel construction" of evidence. I wonder whether that would have put them in the clear; when the SEC came knocking, they could have pulled out their research, saying "Look, we figured this out fair and square."

<comment><USER22> Wonder how closely footfall at high-street traders equates to their revenue - pretty close I'd imagine?

I'm thinking whether a firm running city centre CCTV could do this with some computer vision systems. Mobile phone operators and ISPs that serve businesses must have similarly closely correlated signals to hand too.

<comment><USER23> What exactly does your first sentence mean? Trying to parse it and do not understand what "footfall at high-street traders" means.

<comment><USER22> as mkehrt says.

>"Wonder how closely footfall at high-street traders equates to their revenue - pretty close I'd imagine?"

To put it another way: I was thinking that the number of people who go in to shops in the high-street might correlate well with the revenue for those same shops.

</comment></comment></comment></comment><comment><USER24> I genuinely think this is a grey area, and it's far from "insider" trading. Is it moral, I don't think so. Should Capital One sanction these employees, probably. But I think this is far from ilegal.

Huang and Huang had access to a db which is not open to everyone, granted, but they had to extrapolate the stock direction based on data from a subset (customers who buy Chipotle with a CC), of a subset (with a Capital One card)... and then compare that to analyst expectations, etc. but then, would it be insider trading if I stood outside a Chipotle polling customers who exited on the dollar amount spent? That is also proprietary information, and one I can use to trade stocks on. I'd like to know if they did any trades where the return went south. I know of sector investment funds which pretty much do this all day long, forecasting all sorts of industries, and it's not ilegal.

I'd like to know what others think.

<comment><USER25> Well, in the article the make clear that there is case law that this is illegal and considered "misappropriation" insider trading.[1]

Even if we decide it isn't insider trading, Capital One is on the hook for what it's employees do. Chipotle or whoever could sue CapOne for breach of contract, and CapOne could sue these guys for that. So even if we decide as a society it's not criminal, another group of guys doing the same thing somewhere else might not get to keep all that sweet dough they made purely on civil grounds. I don't know. It's interesting.

[1] [https://supreme.justia.com/cases/federal/us/521/642/case.htm...](https://supreme.justia.com/cases/federal/us/521/642/case.html)

<comment><USER26> > Well, in the article the make clear that there is case law that this is > illegal and considered "misappropriation" insider trading.

I'm not sure that is the exact same thing. These guys had to do some research.

Consider, for example, a large pork supplier. If they see orders from Chipotle trend up by (say) 30% over a quarter, are they free to buy call options on CMG? What if you're a feed supplier _to_ this pork supplier, and you know that Chipotle is their biggest customer, and see that this pork supplier's demand for feed has gone up by 30%; can _you_ then buy call options?

This is a gray area, and I'm not sure the line is really that clear cut.

<comment><USER27> >This is a gray area, and I'm not sure the line is really that clear cut.

Your examples are not novel issues, certainly there would be case law on point. I can not cite the case law, but I would tend to believe your examples fall within the classification of insider trading (i.e. trading based on a companies non-public information). I know for example as an attorney if I am working on a merger and I buy/sell stock or inform someone else who buys/sells the stock that would be insider trading.

Generally, think of the Martha Stewart allegations, she was informed by a friend/corporate officer that the FDA was rejecting the companies cancer drug. Based on that non-public information her brother sold the stock and then the FDA decision became public and the stock dropped. It is a stretch from your hypothetical, but the non-public information paradigm would seemingly still apply.

<comment><USER28> I don't think that example is insider trading. Insider trading is trading on material nonpublic information _that was obtained in violation of a duty of confidence_ (and for a benefit). Do Chipotle's suppliers have a duty of confidence regarding their order sizes? I suspect either it's explicit in the contract, or they don't.

<comment><USER29> Is that ("that was obtained in violation of a duty of confidence") true? I don't think it is. I'm pretty sure you can't trade on information you overhear in a bar, for example.

<comment><USER28> The SEC _might_ argue that bar patrons have such a duty of confidence - <USER2> have previously done so for roommates, and golfing partners. Or they might charge the person you overheard with violating the Reg FD selective disclosure rules. Or they might let you both away with it (IANAL). But yes, it absolutely is part of the law; [http://www.law.cornell.edu/cfr/text/17/240.10b5-2](http://www.law.cornell.edu/cfr/text/17/240.10b5-2) is the detailed version.

</comment></comment></comment></comment></comment></comment></comment><comment><USER30> It reminds me of how search engines know about things like shopping cart exploits right away because all of a sudden there are thousands and thousands of queries for a particular shopping cart software package being used on a web page.

Personally I agree with Matt that this is a not the usual kind of thing. Clearly Chipotle could anonymize their sales with dummy purchases but the actual numbers would still be there. Like a search engine, for the data stream (credit card charges) to work you are forced to put enough information in the transaction to identify it.

This is also something I see happening with IoT type technologies, when it becomes possible for someone to collect data on their own at thousands of locations for relatively small numbers of $, like the helicopters trying to estimate oil availability, you'll have data streams that can inform economic activity. Imagine something like a cellphone sized thing with a camera that just counts customers using OCV to note blobs at the counter, in a restaurant and texts a tally once an hour. Seems ridiculous but its quite possible to do, and much more cheaply than just repurposing disposed cell phones (although that works too).

</comment><comment><USER31> Wow. I'm actually quite impressed, in a 'that's impressively evil' kind of way.

Maybe anonymized CC trend data should be made public?

<comment><USER32> Criminal, yes. Immoral, probably. Evil? Of course not.

</comment></comment><comment><USER33> So I wonder how much insider trading occurs via government spooks analyzing surveillance data that we don't know about. I doubt the SEC would be able to make a public lawsuit about this .

</comment><comment><USER34> Just from reading the title I knew this would be a Matt Levine piece. Great, entertaining finance columnist.

<comment><USER35> I thought the same thing. He has very snarky titles. My favorite one is "Law Firm Accountants Were Bad at Accounting, Law."

</comment></comment><comment><USER36> Workaday co-CEO Dave Duffield said in some interview that he invests privately in the companies that buys Workaday cloud hr solution. If he can sees how many employees are added to a certain company that buys Workaday cloud product, he can use that an edge.

</comment><comment><USER37> This is a stretch of insider trading laws, which I assume is why they haven't been charged criminally (the SEC can only pursue civil sanctions). The data was in the possession of their employer, not of the publicly traded companies. They could probably be prosecuted under the CFAA for misusing a protected computer system, but I cannot imagine them being convicted criminally for insider trading here, or even losing at trial if they choose to fight the civil SEC case.

If I pay people to go count the number of customers in line at a representative sample of Chipotle restaurants during lunch every day, compare the results to the previous quarter where I was doing the same thing, and trade on that data, is that illegal? It's nonpublic information. Would my employees be prosecuted for this if they traded on it?

Prosecutors and the SEC attempt to stretch our laws every day. It doesn't mean that they are going to win these cases.

<comment><USER38> What if Chipotle signed an agreement with Visa and their credit card processor saying that their data wouldn't be provided to traders to trade their stock on?

What if Capital One signed an agreement with Visa saying that in exchange for issuing cards, they wouldn't provide the data to stock traders, and would keep it safe?

What if they didn't trade on it, just sold the info to Taco Bell?

Seems like a situations I want to avoid, if I'm Chipotle.

<comment><USER37> _> What if Chipotle signed an agreement with Visa and their credit card processor saying that their data wouldn't be provided to traders to trade their stock on?_

If they did, then obviously these two would be in violation. But I have seen no mention of such an agreement.

</comment></comment></comment><comment><USER39> The implications are bigger than for public companies' insider trading.

Think about the success of the Oatmeal's _Exploding Kittens_ card game on Kickstarter. Aside from the fact that KS's new payment processor Stripe is leeching an _astounding_ amount of money from this campaign (where most pledges have probably been made with cash-like debit cards being charged at the rate of credit cards), there are also implications of aggregation inside that cartel.

How many playing card printing companies out there are eager to handle that order? What if you knew ahead of time who they were going to use, based on that "bank account" info you have to give out when you sign up for a campaign on KS? Private companies leverage this info all the time, and it's much easier for them to get away with it.

</comment><comment><USER40> Have a look at 1010Data: [https://www.1010data.com/solutions/by- industry/financial-ser...](https://www.1010data.com/solutions/by- industry/financial-services/) and [https://www.1010data.com/partners/detail/data- providers](https://www.1010data.com/partners/detail/data-providers)

This stuff is already being done legally, with certain industries and within certain financial institutions. Just seems like these guys were just caught in an unfortunate legal snag - otherwise they just seem like good traders to me.

</comment><comment><USER41> The point is not whether somebody does a lot of research or not. The point is whether he/she had data available that is not available to the public. That is simply not fair.

Now, using helicopters to track oil tankers - as described in the article - seems to be a blurry line, but in theory anybody could do that and then use that information, it is available to everybody... In principle at least.

This data was entirely private, so I would agree with being not fair.

That said, I hope these guys do not have to go to jail, but are simply forced to pay their gains (or a portion of those) back, maybe as a fine.

</comment><comment><USER42> This is probably going on right now in lots of other companies that have access to such data. We only hear about the ones that get caught. Seems like they didn't try too hard to cover their tracks. Just think about all the companies that have access to credit card data and all the people that are connected to those companies who could either be selling the data to others or trading on it themselves. Best thing to do to prevent this unfair advantage is releasing publicly available CC spend data.

<comment><USER43> > Best thing to do to prevent this unfair advantage is releasing publicly > available CC spend data.

Who releases it? Every credit card company? At what frequency?

What if one of the nightly bulk loads into the transaction data warehouse fails with an integrity error, alerts the DWH team, is picked up by a junior person because of a staffing anomaly, who forces it through, and then the next day's data release is off by a couple of million, but the automated trading bots and manual trading desks don't know this, so they trade on this new signal...

....I'm sure you see where I'm going with that.

</comment></comment><comment><USER44> I've always felt this would be a really interesting job to have. The ability to look at a CC company's data and be able to generalize market trends. There are so many questions I'd want to ask about socioeconomic status and impact on debt, fraud, specific types of purchases, etc. It'll never happen, but someone should give a big data firm unfettered access to answer some interesting societal and behavioral questions.

</comment><comment><USER45> > That's amazing! These two like customer-support guys...

> You sometimes see insider-trading cases where someone makes like a thousand- > percent return...

Am I the only one bothered by the author's writing? Am I getting old? Conversational is ok, I guess (though, Bloomberg?). But these "like"s? They're not 'like customer-support guys', they _are_ customer-support guys (or else they _are_ analysts).

Bah-humbug.

</comment><comment><USER46> I think they were primarily a victim of their massive success. If they had only made $500,000 instead of $2.8 million, they might still be going along fine.

How did they get caught? Did the SEC see this account has 1,800% return on investment over 3 years and investigate who owned it? Or did Capital One discover some odd queries on their production database and report them to the SEC?

<comment><USER47> I think generally it's the large unhedged options position that makes 10x after an earnings surprise that gets noticed. To your point, yes I think in this case pigs got slaughtered.

</comment></comment><comment><USER48> Couldn't this kind of thing be easily solved by having companies release sales data more frequently? It seems like the only reason this is profitable is because earnings are released quarterly, so there's opportunity for the stocks to become wildly mis-priced over those months.

What would the downside be for releasing earnings data daily, or even weekly or monthly?

<comment><USER49> lol

</comment></comment><comment><USER50> Big question. If they setup a hedge fund and bought the data from the card issuer, and did the exact same thing. Would it be legal? Don't they use private satellites to take pictures of mall parking lots and crop fields to estimate holiday sales and crop yields? Hows is this different. Its data that public doesn't have access to.

<comment><USER51> You're describing a world in which said data is available on the market, which is already a drastically different world than the one we live in. I would be surprised if they can legally sell that data - surely credit cards come with a privacy clause?

<comment><USER50> All the banks sell their data. Its aggregated but thats all you need. You don't care if a specific person went to Chipotle, you're looking for trends.

[http://www.businessinsider.com/credit-cards-sell-purchase- da...](http://www.businessinsider.com/credit-cards-sell-purchase-data-to- advertisers-2013-4)

<comment><USER52> I think this data is delayed. I don't care if there were 1.000.000 chipotle customers in Virginia two quarters ago.

</comment></comment></comment></comment><comment><USER53> How did these guys get caught?

<comment><USER54> Not sure about the US but this is more or less what happens in Japan:

Brokerages are obligated to flag and report suspicious orders or trades to the [equivalent of] SEC.

If necessary, the SEC then asks the brokerage for more information and investigates it.

The definitions of "suspicious" can be somewhat arbitrary, but those >1000% returns would definitely be considered suspicious. Two people at the same workplace getting abnormally high returns would also be considered a red flag.

</comment></comment><comment><USER55> for better or for worse, the establishment of decentralized prediction markets will essentially make insider trading laws moot. Who cares if you can't bet on the original market when you have another unregulated market where you can bet on the veracity of the first?

[http://www.augur.net/#what-we-do](http://www.augur.net/#what-we-do)

[http://www.truthcoin.info/](http://www.truthcoin.info/)

<comment><USER56> Why would anyone who does not have access to insider information participate in an unregulated market when you have easy access to a regulated one?

</comment></comment><comment><USER57> metafraud, interesting concept</comment>


Genetic Algorithms: Evolving Human Faces - <AUTHOR> http://lbrandy.com/blog/2009/04/genetic-algorithms-evolving-human-faces/

<comment><USER2> This is _not_ a genetic algorithm; this is a steady-state-ish (MU, LAMBDA) evolution strategies algorithm. Genetic algorithms imply crossover, not simply mutation.

People have gotta stop referring to population-based methods of stochastic search as "genetic algorithms".

<comment><AUTHOR> Our algorithm is also not a "face detector". It's a feature-based machine- learned image classifier that was trained on faces and non-faces. However, when speaking to those presumably without a background in machine learning, I think "face detector" conveys more information.

Also, the title "Steady-state-ish (MU, LAMBDA) evolution strategies algorithm, and/or population-based stochastic search: Evolving Human Faces" is too long.

<comment><USER2> Also, this doesn't seem to be an apt analogy; I'm no expert on machine learning (certainly) but it seems to me that "face detector" is simply a catchy abstraction that does not necessarily contradict the underlying technicalities of your production.

My issue with your titling "Genetic Algorithms" is that it is not simply a more convenient, abstract way of expressing what you did: it is in fact a contradiction of terms with the underlying technical details of what you did.</comment></comment></comment>


Show HN: Toolkit for Mobile App Makers - <AUTHOR> http://www.vuzers.com <comment><AUTHOR> Hi Hackers! Here's my project's explanation:

As a Mobile App Product Manager, I spend a lots of time on time-consuming management tasks in order to launch and manage my apps on the App Store and Google Play: designing screenshots, monitoring reviews, collecting feedback etc.

So for my own mobile apps I was looking for an all-in-one solution with a set of tools that would execute those tasks quickly. What I found were various separate tools.

So with a friend, we decided to build a toolkit that includes an in-app satisfaction meter and a feedback survey builder.

Then we heard of Launchkit. Launchkit was a fantastic suite of useful tools for mobile app creators made by a brilliant team: Brenden Mulligan and Taylor Hughes. And, as often with a great team and a great product, the inevitable happened. They have been acquired by Google and Launchkit has been discontinued. However, the team open-sourced the code.

After reviewing their tools it made sense for us to take Launchkit's code over and add it to our existing tools.

The toolkit features 6 tools: a preview builder to generate App Store and Google Play screenshots, a landing page builder to create a website to promote your app, a review tracker to monitor all your reviews, a satisfaction meter to measure your user satisfaction, a feedback survey builder to collect in-app feedback, a power user tracker to identify your most loyal users.

TOOLS USED

We used Python, Nodejs for back end, Angular for the front, Swift and Java for SDKs.

BETA

The Beta will be released on the 1st of March. At that point we will start to invite users that signed up for early access based on the order in the queue.

In the meantime we look forward to feedback / questions

Thanks! Sylvain</comment>


The Parley Letter - <AUTHOR> http://david.heinemeierhansson.com/2012/the-parley-letter.html <comment><USER2> 1970: " _Another part of the necessary art of calling bullshit is to take down good ideas when they become inflated beyond what they can bear. Organizing your instructions in a clear way is a reasonable idea that I support. But there's just not enough there there to dress it up in function calls, machine optimization, and all the other -- here's that word again! -- wankery that passes for muster in the compilers orthodoxy._ "

1980: " _Another part of the necessary art of calling bullshit is to take down good ideas when they become inflated beyond what they can bear. Separating your code in functions that address single concerns is a reasonable idea that I support. But there's just not enough there there to dress it up in models, controllers, views, and all the other -- here's that word again! -- wankery that passes for muster in the MVC orthodoxy._ "

2010: (and this one's verbatim) " _Another part of the necessary art of calling bullshit is to take down good ideas when they become inflated beyond what they can bear. Using URLs instead of IDs in your json responses is a reasonable idea that I support. But there's just not enough there there to dress it up in HATEOAS, HAL, custom mime types, and all the other -- here's that word again! -- wankery that passes for muster in the hypermedia orthodoxy._ "

I never could understand this attitude of overt antagonism towards people who care about architecture. If you aren't partial to such discussions yourself, at least show some respect for the people who, through years of wankerous discussion and debate, came up with and subsequently refined the pattern that propelled you to fame (or in the case of us mortals, at least gave us the tools to make our programming life a little easier). Now, I understand this particular guy is deeply invested in the MVC architecture. But that doesn't mean history stops here. REST (despite a long but somewhat underground history) and hypermedia are still in their infancy as an architecture. Many, many problems still remain unsolved and the process of debate meant to distill the good from the bad necessarily looks to outsiders as "wankery". Still, show some respect. The next person of Heinemeier's caliber will likely make their fame by bringing REST to the masses.

<comment><USER3> Not every new architectural idea is a good one. Lots fell by the wayside over the years. See J2EE or Naked Objects (I actually kinda liked that one). Bad ideas fail faster when criticism is brought forward which opens the floor to new, better ideas.

<comment><USER2> Constructive criticism, yes absolutely. Labelling things as wankery and reiterating that you don't see the point aren't. All they're showing is that you're missing the point.

<comment><USER3> Let me translate it for you, then. Wankery: Complexity brought on by the love of an abstract idea without meaningful practical benefit.

By definition I don't see the point in architectural exploits that can be labelled wankery.

<comment><USER2> I know, you've repeated that several times. "Without meaningful practical benefit" is what I'm referring to when I say you keep stating that you're missing the point. Just because you happen to not see the meaningful practical benefit doesn't mean there isn't one.

<comment><USER4> That is one of the most common young nerd mistakes. "If I don't see the value in something, the people doing it must be idiots!" Rather than, say, "... I must not understand something here."

I made it a ton as a youth. I had to have about a thousand, "Oh, now I see what they're talking about" moments before I learned to keep my mouth shut long enough to actually learn something.

<comment><USER5> Agreed, but there has to be _some_ filter. You can't just say, "I don't see the value in crystal healing, I must not understand something here." Sometimes, you do understand enough.

<comment><USER4> Well, it depends on how you do it. My original reaction was, "duh, idiocy." But once I paid more attention, I learned a lot about the emotional motivations behind it, the placebo effect, and why western medicine is so unsatisfying to people.

That's helpful, in that you can convince anybody by saying: "Although I have no evidence, I'm sure that crystal healing is bullshit and I'm waaaay smarter than you." All they read from that is contempt and arrogance; that approach to skepticism is basically bullying.

I think a better approach is the one taken by my doctor. When people come in with concerns about vaccines, she first listens to their fears about kids and patiently explains why those particular fears might sound reasonable, but in this case are unwarranted. It's not really about the facts; it's about the hand-holding. For her, the interaction isn't about _being right_ , but about _persuading_ people.

So I agree, but for very high values of "understand enough". It's not enough for me to know that they're wrong; I want to understand why they're wrong sufficiently to have empathy for their situation.

<comment><USER5> So how do you know DHH doesn't meet that threshold? (I don't think it's clear either way, but still "most common young nerd mistakes" is pretty dismissive.)

<comment><USER4> He might, but he certainly hasn't demonstrated otherwise. In particular, he's not saying, "I see where the REST crowd is going, but their crucial mistake is X." That, combined with DHH's well-earned reputation for arrogance, makes me think he's just doing his usual.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> I agree wholeheartedly with with dhh's stated philosophy on the fact that code talks, bullshit walks and writing "future proof" code is a terrible idea (one that virtually every journeyman developer stupidly clings to for a while at some point in their career). But at the same time I'm not a Ruby fan, in large part due to the monkey patching ability he holds so dear.

Given the same philosophical outlook but perhaps less inherent trust in developers (including myself!) to always do the Right Thing, I've come to really appreciate Go as a no-bullshit language that does allow you to hang yourself (eg. the unsafe package, ability to ignore error returns via '_' variables, etc) but it at least makes you tie the rope to the ceiling before you can use it, so you have time to think about whether or not you really want to use it.

</comment><comment><USER7> He keeps writing "Parsley" instead of "Parely". For other non-native english speakers (like me), here's the defintion:

Parley:

Parley (/ˈpɑrli/) is a discussion or conference, especially one between enemies over terms of a truce or other matters. For example, in Julius Caesar (a tragedy by William Shakespeare), the respective followers and armies of Brutus and Antony are ready for a truce. The root of the word parley is parler, which is the French verb "to speak"

Parsely:

Garden parsley is a bright green, hairless, biennial, herbaceous plant in temperate climates, or an annual herb in subtropical and tropical areas.

<comment><USER8> My guess is that iOS autocorrect strikes again. :)

<comment><USER9> Autocorrect is a bad idea. The kind of spelling error that iOS corrects (At least as far as I know.) is a _syntactic_ error. Whereas the kind of error that autocorrect introduces is a _semantic_ error. A semantic error is much worse than a syntactic one. At worst, a syntactic error leaves your meaning ambiguous. At worst, a semantic error leaves your meaning incorrect or inverted.

Usually you can read past a syntactic error, but a semantic error could change the tone or meaning of your entire message.

<comment> T-hawk Well, it's a question of total value, weighted by frequency. If the autocorrection gets ten syntactic errors fixed for every one semantic error it introduces, it's probably a net gain for the writer.

<comment><USER9> One abnormally bad semantic error can be worth a thousand syntactic errors.

<comment><USER10> Have a little care, then. You have to be careful anyway with a touch keyboard. Autocorrect makes me faster, by correcting most errors without making me stop, and that's all I ask of it. I can't recall a time it's stung me in a major way; I can't count the number of times it helps me every day.

</comment></comment></comment></comment></comment></comment><comment><USER11> I guess we need a new entry in <http://rubydramas.com>

<comment><USER12> You know, this strikes me as very sane and cogent essay into maintainability and rails. Where does the drama come form?

<comment><USER11> To DHH credit, he always has fair points in his opinions, but the way he expresses these points is never diplomatic. For example, he couldn't resist making some blanket statements about java world and rspec.

I am not sure about how intentional that is, but it surely is dramatical in 'flame war eliciting' sense of word.

<comment><USER12> The JAva point I felt was truly fair here. Servlets were good, but then it became the huge EJB which was bad. His rspec opinion - as expressed here that is - was "I dont like the DSL". Those seem fine really.

<comment><USER13> Just as a pointer I would recommend to get up to date with latest JEE specs and standards before making judgement What I see is most people base their opinion on EJB2 from past and they keep ranting about that. Also java ecosystem doesn't start and end with JEE

<comment><USER14> Come on! They scrapped almost everything because it sucked and everyone knew it. Judging EJBs as a pile of shit is quite deserving. I mean this as a programmer who wrote Java code for a living.

OTOH, the servlet API is nice.

</comment></comment></comment></comment></comment></comment><comment><USER15> Some related posts that probably spawned this article. You can find DHH's response in the comments: [http://gammons.github.com/architecture/2012/12/22/where- the-...](http://gammons.github.com/architecture/2012/12/22/where-the-logic- hides/)

This talk (31 min, grab some coffee) also gives a better context. <http://confreaks.com/videos/1125-gogaruco2012-mega-rails>

<comment><USER16> My understanding is that this article was in response to various questions that were asked of him on the Ruby Rogues Parley list (all guests are on the list, and others can pay to be on the list). Of course, recent topics he covered like hypermedia were colored by those recent discussions.

</comment></comment><comment><USER17> I think some clarity is in order.

 _While Java certainly isn't a pinnacle of language design, it took quite a few years of devolution to go from something relatively simple like servlets to the steaming pile of shit that is J2EE_

I believe he means to say EJB here, and not J2EE, because Servlets are a part of J2EE.

<comment><USER3> J2EE's sins include far more than just EJB. See [http://en.wikipedia.org/wiki/Java_Platform,_Enterprise_Editi...](http://en.wikipedia.org/wiki/Java_Platform,_Enterprise_Edition). Servlets got just started running with a bad crowd, even though deep down it was a good kid.

<comment><USER18> Personally I wouldn't let servlets off that easily. One of the basic design choices they made was one request handling function per class (the service method, delegating to doGet/doPost/etc for http requests). As a result, most applications actually needed another framework on top of servlets to do routing based on request URL and mapping on to some model of server side components, like MVC. See for example struts, spring, webwork and a host of other java frameworks that were around at the time Rails appeared on the scene. At the time, Rails' routes file and having classes grouping related controller methods together was a clear demonstration of what the servlet API had got wrong.

Heck, the architects even designed it as a completely generic request/response framework with http as just one possible protocol. When http is your 99.9% use case, that just smacks of over-engineering.

<comment><USER4> I certainly don't want to be one to defend Java from criticisms of overengineering. But on this point, I can't blame them much.

The Servlet spec was finalized more than 15 years ago, when CGI scripts were the mainstream server-side tech and browsers were circa version 3. The domain "google.com" wasn't registered until 3 months later. I think Servlets were reasonably well done for the time. The web was obviously dominant, but FTP was still widely used, and it certainly wasn't clear that newer protocols wouldn't be important as well. Rails didn't turn up until 8 years later.

One could certainly blame the java folks for _stopping_ there, but there wasn't a lot of advantage to be gained from redoing the foundations in a way that forced everybody to rework all of their existing servlet code. And as you say, the community was making solid progress on their own, so it's probably better that Sun didn't interfere.

<comment><USER18> Oh, yeah - absolutely. The servlet API was very much of its time, and for several years it seemed to be a good solution. I think it's only in retrospect that it became more clear that there were key challenges that everyone faced in building a web application that the servlet API, and J2EE more broadly, didn't solve. For me that was the thing Rails demonstrated: a full stack solution for building web applications that actually tackled the real problems (like routing requests from URLs to controller methods). And I think the major changes to J2EE since have been in large part a reaction to Rails showing what problems a web framework should actually try to solve.</comment></comment></comment></comment></comment>


GSM Network Characterization Using Software Defined Radios - <AUTHOR> http://blog.nikseetharaman.com/gsm-network-characterization-using-software-defined-radio/

<comment><USER2> It would be incredibly socially valuable to be able to independently triangulate the location of cell phone towers and then observe if new mobile towers came online. i.e. Stingray detection.

<comment><USER3> Could you already make an app like pressurenet to do this for towers?

<comment><USER4> There are several public GSM/Cell databases[1], the largest of which are probably OpenCellID[2] and the Mozilla Location Service[3]. Their coordinate points are estimations from user observations, so the accuracy may leave something to be desired. Perhaps it could be combined with the OpenStreetMap database which has data for observable cell towers in places where contributors have added them. There are also a couple Android applications[4][5] that claim to detect IMSI-catchers, but I'm not sure what data they use or how publicly available their findings are. Either way, we are living in a golden age of sousveillance and great opportunity to use collaborative technological systems to increase transparency.

[1][https://en.wikipedia.org/wiki/Cell_ID](https://en.wikipedia.org/wiki/Cell_ID) [2][http://opencellid.org/](http://opencellid.org/) [3][https://location.services.mozilla.com/downloads](https://location.services.mozilla.com/downloads) [4][https://secupwn.github.io/Android-IMSI-Catcher- Detector/](https://secupwn.github.io/Android-IMSI-Catcher-Detector/) [5][https://opensource.srlabs.de/projects/snoopsnitch](https://opensource.srlabs.de/projects/snoopsnitch)

</comment></comment></comment><comment><USER5> I'm kinda amazed at how easy it apparently is to intercept even the encrypted GSM traffic. All you need is a Software Defined Radio, available in a USB stick for $20, and a half-dozen open-source packages? I might have to mess with that sometime.

<comment><USER6> I think SDR is really amazing technology. I got one of the RTL sticks I think about 2 years ago, for no money ($20 ? or less). Within about a day I was receiving FM radio using GNU Radio on my laptop, and wishing I had a better aerial. Now I have a small discone antenna ($100) and I'm still playing with receiving all sorts of radio broadcasts off and on. So yes you should definitely try it.

This was an intro I wrote back when I started: [https://rwmj.wordpress.com/2012/12/05/real-cheap-software- de...](https://rwmj.wordpress.com/2012/12/05/real-cheap-software-defined- radios-part-3/)

<comment><AUTHOR> Yeah, it's awesome stuff. Listening to the HAM guys on the local repeaters occasionally makes for some entertainment.</comment></comment></comment>


Ask HN: Who is looking for jobs? (NYC edition) - <AUTHOR>

A complement to the "Who is hiring?" thread: Anyone on HN looking for jobs? NYC edition. Post here with your skill set and what you are looking for and hopefully fellow HNers will help you out!<p>Fyi, GoodCrush is hiring (email email@example.com) <comment><USER2> Are you one of those rare people who has a deep passion for both technology and art? Are you excited by the thought of revolutionizing the highly inefficient art world and helping artists sell their works?

We are a NYC, pre-product, but seed-funded startup that has placed at least as high as finalist in 3 business plan competitions. We are looking for extremely passionate and intelligent (yet humble) people interested in being part of our founding team.

Positions: Interaction/visual designers and front-end people with experience in FB app development, LAMP, Zend Framework, JQuery. Contact me directly at email@example.com and include links to something you've created. Thanks!

</comment><comment><USER3> Yodle is hiring: <http://www.yodle.com/careers>

We use Java, Spring, Hibernate... and Rhino

</comment><comment><USER4> Vimeo is hiring: <http://vimeo.com/jobs></comment>


Itty-Bitty Satellites Could Carry Your Experiments to Space - <AUTHOR> http://www.wired.com/2015/10/thumbsat/ <comment><AUTHOR> I think private accessibility to space is key to driving public interest in space exploration. It used to be that only very large corporations and government bodies had access to space. Advanced technology and out-of-the-box thinking is making it possible for even hobbyists to be involved. It is very exciting.</comment>


Ask HN: How do I count people with computer vision? - <AUTHOR>

I'd like to build an app to count the number of customers in a store through a phone's camera. How would I go about doing this? <comment><USER2> "in a store through a phone's camera."

If it was _for_ the store then you'd do one or more stationary mounts of something better and more purpose-built than a camera phone. Or something even simpler like counting bodies in and out at the door with the door dinger thing.

So I assume it's for surveilling the store surreptitiously, right?

I suppose it's an interesting problem for the machine vision people. But how do you deal with people down the aisles that you can't see? How do you avoid looking like you're collecting upskirts or kiddie porn? How do you avoid just plain getting your face punched in?

Is there a way to count cell phone signals, from your own phone or from special equipment? There were stories a year or so ago about some mall that was going to track individual phones through the mall, to discern shopping patterns and such. I imagine it's not impossible to create something that you could use surreptitiously (again, I'm assuming).

</comment><comment><USER3> Well, you probably don't mean you can set up a stationary camera as if so then you could just install some sensor at the door or a foot pad.

But if you could mount a phone...

Maybe some technique where you take a baseline photo with the store empty and then compare that to ones with people in it. You'd have to account for natural changes in light and ignore that in the algorithm. Shadows and bags would be difficult. Then count the number of changed pixels from baseline, the average number of pixels representing a person, and some sort of edge detection for added checking.

Or, a mechanical turk worker would solve this in a few seconds for probably a penny.

</comment><comment><USER4> Assuming your phone/camera is mounted in a stationary position, you could track all the moving objects _fairly_ easily with background subtraction. I say "fairly" because you'd likely have to incorporate motion, color and texture detection to disambiguate between different people. A count of the moving blobs would give you a rough number of the people in a store. It would be an instantaneous count, so you'd probably have to take a moving average of the time series of the number of people detected to get a reasonably accurate value. Non-trivial, but doable.

<comment><USER5> This only works when people are separate enough so they have an individual silhouette. If doing length of line tracking however, it becomes much more tedious, with edge detection necessary and such. Also, if using a 360 camera, this becomes more complex, as a person in the middle blob shape would be completely different from a person at the edge. I am aware you can use a filter, but it cuts out some area sometimes.

This is a surprisingly hard problem that I've explored before. Feel free to email me about it!

</comment></comment><comment><USER6> I thought this was finally a joke on HN

Q: How do I count people with computer vision?

A: 1 2 Fizz 4 Buzz Fizz 7 8 Fizz Buzz 11 Fizz 13 14 FizzBuzz 16 17 Fizz ...

</comment><comment><USER7> I think some sort of Camera to radio detection system, chances are every person carries a phone and then synchronize them to count matching parameters (if the image is moving radio field will change)</comment>


World's climate about to enter 'uncharted territory' as it passes 1C of warming - <AUTHOR> http://www.theguardian.com/environment/2015/nov/09/worlds-climate-about-to-enter-uncharted-territory-as-it-passes-1c-of-warming <comment><USER2> [https://en.wikipedia.org/wiki/Geologic_temperature_record](https://en.wikipedia.org/wiki/Geologic_temperature_record)

"uncharted"</comment>


The time has come to end the era of Codehaus - <AUTHOR> http://www.codehaus.org/

<comment><USER2> Sniff. This brings back memories of when I put to bed [http://opensymphony.com](http://opensymphony.com) and [http://openqa.org](http://openqa.org). In the era of GitHub these kinds of organizations seem so odd, but at the time they were critical to some really important projects. Nothing is forever I suppose!

</comment><comment><USER3> They should archive up all the repos/artifacts and put up some torrents. Or make a codehaus-zombie org on github and export all the SVN repos over to it.

> Will all be migrated to Github - SVN repos will be migrated to Git and > transferred into the "codehaus" Github account. This is a readonly account. > Inactive projects may be migrated ahead of the shutdown.

tl;dr they are.

</comment><comment><USER4> A tip of the hat to CodeHaus for doing this transition the right way: Carefully preservation of the projects' assets and plenty of notice to the contributors.</comment>


I made a game to play at the doctor's office. Friends convinced me to release it - <AUTHOR> I'm a lurker of hacker news.
About a year ago I started needing to go to the doctor's office on a regular basis. The doctor's office makes me pretty nervous and I needed something to take my mind off of the whole thing. I created a very simple/fun game that I didn't feel guilty putting down when my name was called.
It's called Two Birds One Stone.
It started as a crap-sprite, no menu, no objective mobile game. Friends and family saw me playing it and asked how they could get it. I shared the apk with them (Android) so they could sideload it. Some of them couldn't put it down and told me I should release it to the public. Several months of slow development later, I was confident enough to release it.
I want to share it with you.
Gameplay video: https://www.youtube.com/watch?v=KzRqYFug-W8 Play store link: https://play.google.com/store/apps/details?id=com.MutuGames.TwoBirdsOneStoneFree <comment><USER2> Games that you make just for fun are always the best. Thanks for sharing. I'll check it out for sure!</comment>


Common fails in a remote software team (and how to fix them) - ben-clubhouse https://clubhouse.io/blog/common-fails-in-a-remote-software-team-and-how-to/ <comment><AUTHOR> Great article. I do have one question for the void:

Am I the only remote worker who has zero interest in traveling to meet colleagues in a specific location? I already have a fulfilling personal life, I don't need to meet up with colleagues in-person in order to stave off isolation or function effectively on the team.</comment>


WooMe Privacy Violation - <AUTHOR>

I joined WooMe briefly this past May to see how the site worked and I uploaded a picture as it requires the user to do so.  I had forgotten that I had joined, until I googled myself to realize that my full name, picture and age comes up as user of WooMe.  However, once I became aware of that fact,  I immediately deactivated my account with the hopes of eliminating the problem, it has now been three months, and all my information still comes up via a simple Google search.
After made numerous attempts at contacting your company since last June at both email@example.com and at 3832 Hemmingway, Irvine, CA 92606, and even contacted the CEO, Stephen Stokols  and no one has responded nor rectify the problem.
Due to the nature of my profession, people often Google me. And it is quite embarrassing to me that this information should come up, and this is something which potentially can affect my personal relationship.
The more I read about WooMe, the more I realize how shady they are.
It is distressing and I will be forced to take legal action soon. <comment><USER2> [http://techcrunch.com/2011/02/02/woome- techcrunch40-finalist...](http://techcrunch.com/2011/02/02/woome- techcrunch40-finalist-20-million-in-funding-and-one-huge-scam/)

<http://news.ycombinator.com/item?id=2169904></comment>


Best Buy: That Laptop Isn't "Open," It's Just "Optimized" - <AUTHOR> http://consumerist.com/2009/09/best-buy-that-laptop-isnt-open-its-just-optimized.html

<comment><USER2> First, laptops (and other computers) now come with a buttload of crapware pre- installed, because that's where the manufacturers are making their margins now. A good "optimization" for new computers is not at all a bad thing: remove the b.s. pre-installed software, create the recovery disks, make sure all updates are pre-installed. We do this, too.

Second, if you really don't trust a place enough to do this for you without doing something sneaky, then you really shouldn't be shopping there. It's not hard for them to open it up and re-shrink it, after all.

Third, if you're super paranoid about this kind of thing, order direct from the manufacturer. Dell, especially, is really good at this.

This is a tempest in a teapot. And, I don't even like Best Buy / Geek Squad, so have no ulterior motive defending them.</comment>


Your Guide to the GDPR - <AUTHOR> https://spectrum.ieee.org/telecom/internet/your-guide-to-the-gdpr <comment><USER2> While a great read, this does take effect in just over three weeks.

The time for this was a year ago.</comment>