Severed fibre cables disrupted internet access in eastern Europe, Iran, Turkey - <AUTHOR> https://www.bbc.com/news/technology-50851420 <comment><USER2> In Vietnam, near every holiday or major event the internet magically slows to a crawl and the Govt run papers declare that sharks have attacked the undersea cables, it is almost comical how well timed the 'attacks' are...

[https://saigoneer.com/saigon- technology/11885-sharks,-anchor...](https://saigoneer.com/saigon- technology/11885-sharks,-anchors-red-tape-why-it-takes-forever-to-fix-vietnam- s-broken-internet-cables)

[https://tuoitrenews.vn/news/society/20190528/vietnams- intern...](https://tuoitrenews.vn/news/society/20190528/vietnams-internet- speed-slowed-by-cable-problem-off-da-nang/50125.html)

[https://tuoitrenews.vn/news/society/20171016/vietnam- grapple...](https://tuoitrenews.vn/news/society/20171016/vietnam-grapples- with-internet-cable-problems/42065.html)

[https://tuoitrenews.vn/news/city-diary/20170125/save- vietnam...](https://tuoitrenews.vn/news/city-diary/20170125/save- vietnam%E2%80%99s-internet-sharks/29467.html)

[https://www.independent.co.uk/life-style/gadgets-and- tech/ne...](https://www.independent.co.uk/life-style/gadgets-and- tech/news/sharks-are-eating-the-internet-in-vietnam-9962747.html)

<comment><USER3> Was reading the wikipedia page on undersea cables and ran across this gem -- some pirates tried to sell 100 tons of fiber cable they nabbed off the bottom of the ocean near Vietnam: [https://lirneasia.net/2007/06/vietnams-submarine- cable-lost-...](https://lirneasia.net/2007/06/vietnams-submarine-cable-lost- and-found/)

<comment><USER4> Salvaged copper is worth a lot and has a lot of uses for which it can be repurposed. Salvaged fiber...less so.

<comment><USER5> Are undersea fiber cables bundled with copper conductors to power the repeaters?

<comment><USER6> Yes, there is copper or aluminum for power. Most of the metal in a submarine fiber cable is steel.

See [https://en.wikipedia.org/wiki/Submarine_communications_cable](https://en.wikipedia.org/wiki/Submarine_communications_cable)

</comment></comment></comment></comment></comment><comment><USER7> In the mid 2000s I was in the Middle East and used the internet to connect back to the United States for conducting business. One day almost every site became unreachable (anything hosted in the states). It turned out that a naval vessel had dropped anchor and Murphy's Law put the anchor right on top of some undersea fiber cables. It was called a freak accident because statistically was so unlikely to happen.

It took a while to figure out what happened, and internet was out for a couple of days. Considering service was restored in 30 minutes in this case, we are getting a lot better at handling severed cables.

<comment><USER8> > Considering service was restored in 30 minutes in this case, we are getting > a lot better at handling severed cables.

30 minutes?

This is absolutely mind-boggling to me. 30 minutes -- and you can identify exactly where the cut was, deep in the water, access it, fix it _in the water_? To me that sounds like a 30-month job not a 30-second job.

Anyone here with insight into this fix-process: could you please shed light on how this is done and how it can be so fast?

<comment><USER9> It's about a 1-3 month repair job to acquire replacement cable, load it into a ship, and sail out to the break point.

However, service is restored sooner than that by rerouting service over a different fiber cable or undamaged set of fibers.

<comment><USER10> The cable is not fully replaced. They lift the cable up to a boat and repair it (replacing the damaged bit and joining it to the original) and lower it back down.

Here is an animation describing the process [https://m.youtube.com/watch?v=ZJblHOGXKo4](https://m.youtube.com/watch?v=ZJblHOGXKo4)

<comment><USER11> Amazing really that the optics at the repair site are still good enough to carry the bandwidth.

</comment></comment></comment></comment></comment><comment><USER12> many years ago, when i worked at google, we'd joke that every time fiber was 'cut' it was some rando government agency installing a tap. this was before internal traffic was encrypted.

of course, we were less than half joking.

<comment><USER13> Like the 'government agency' doesn't already posses the encryption keys or other methods to extract information from encrypted data.

<comment><USER14> That's super simplistic. Nobody magically 'has' anything. They need to do stuff (like this) to get anything.

<comment><USER15> Employ a 'reverse Snowden' and it's a done deal.

<comment><USER16> Large companies have plenty of safeguards against internal threats, especially when things like encryption keys are concerned.

<comment><USER15> They all do, and in most of them there are obvious errors in processes or rights assignments. It is pretty rare to come across a company that takes the threat from within serious. That's the whole reason Snowden could do what he did and if the NSA gets it wrong then there is a fair chance that your average corporation has faults as well.

</comment></comment></comment></comment></comment></comment><comment><USER17> > In a statement, the company blamed "multiple simultaneous fibre cuts", which > are very rare.

Corporate speak for "obvious sabotage"...

<comment><USER18> Could this vessel be the cause?

"Suspected Internet Cable Spy Ship Operating In Americas For Over A Month"

[https://www.forbes.com/sites/hisutton/2019/12/01/suspected-i...](https://www.forbes.com/sites/hisutton/2019/12/01/suspected- internet-cable-spy-ship-operating-in-americas/#6f5c0f6d32ae)

<comment><USER19> Between Bucharest and Iran ? Hard to believe .....

</comment></comment></comment><comment><USER20> Seems like SpaceX's Starlink will have no shortage of business.

It seems like a no-brainer to use space as a backbone haul for inter-continent traffic vs. physical cables.

It might be slightly faster, it'll probably be cheaper, you can scale the bandwidth by deploying more (very cheap) satellites.

Most of all, the traffic cannot be cut, spied on, you can spread access points in multiple locations (i.e. resiliency via distribution vs. single point of failure).

<comment><USER21> There's no way that wireless links will ever be _faster_ than backbone fiber - the whole notion makes very little sense. Starlink may be useful in other ways, of course.

<comment><USER22> _> There's no way that wireless links will ever be faster than backbone fiber - the whole notion makes very little sense._

Why? Wireless signals propagate faster linearly than fiber signals, no?

I don't have time to do napkin math, but if 2x orbital height + curvature path multiple < linear speed difference, wireless comes out ahead.

From memory, I think this held true for transoceanic distances.

<comment><USER23> So is the high latency reputation from satellite links just due to low end hardware on the satellite?

<comment><USER24> Traditional satellite internet providers used satellites in geosynchronous orbit (that whole "aiming your dish" thing). That's a 270ms hop up and another back.

Starlink is the other "not here yet" services are going to use low earth orbits for something like a 25-35ms latency to the satellite.

</comment></comment></comment></comment></comment><comment><USER25> I was going to ask "where is the USS Jimmy Carter", but it looks like they were overland fibers!

</comment><comment><USER26> It only took them 30 minutes to recover from multiple, simultaneous fiber cuts. That's amazing.

<comment><USER27> Almost as if they were being repaired right after they were cut.

<comment><USER28> Or almost as if the traffic were rerouted to other links as the article explains. That's the beauty of the IP.

</comment></comment></comment><comment><USER29> Weird coincidence that the Federal Reserve ACH network has an outage at the same time?

[https://www.cnbc.com/2019/12/19/federal-reserve-bank- glitch-...](https://www.cnbc.com/2019/12/19/federal-reserve-bank-glitch- delayed-bank-account-deposits.html)

<comment><USER30> Probably a weird coincidence?

My best guess:

a) The up and coming dictator Erdogan flexes his muscles for no particular reason. He has now probably demonstrated that he can cut two fibers at the same time using his all mighty turkish subs.

b) The Fed botches a software upgrade in the US

And this happens to happen at approximately the same time.

</comment></comment><comment><USER31> Was this a test? Who and why would be motivated to see the result of these actions?

<comment><USER32> Probably not, this just happens (at least for submarine cables) . My job was affected by this event in 2008 involving submarine cables [https://en.wikipedia.org/wiki/2008_submarine_cable_disruptio...](https://en.wikipedia.org/wiki/2008_submarine_cable_disruption)

and as the Wiki entry says

>According to Beckert, cable cuts happen "on average once every three days." He further noted that there are 25 large ships that do nothing but fix cable cuts and bends, and that such cuts are usually the result of cables rubbing against rocks on the sea floor.

>According to Global Marine Systems, "Undersea cable damage is hardly rare—indeed, more than 50 repair operations were mounted in the Atlantic alone last year". While a cut in a cable crossing the Atlantic has "no significant effect" due to the many alternate cables, only a handful of Internet cables serve the Middle East. These disruptions are only noticeable because of the small number of cables

<comment><USER33> > such cuts are usually the result of cables rubbing against rocks on the sea > floor.

Huh. How much current is there down at the bottom of the ocean? I was imagining a mostly static environment.

<comment><USER32> Hmmm, now I'm curious but couldn't find a generic answer.

Here is a figure for the waters around Antarctica though:

[https://www.nationalgeographic.org/encyclopedia/ocean- convey...](https://www.nationalgeographic.org/encyclopedia/ocean-conveyor- belt/)

>An estimated 35 million to 45 million cubic meters (between 1.2 billion and 1.6 billion cubic feet) of water per second are continually moved from the ocean bottom to the surface.

That's over a huge area though and still no real idea of speed.

</comment></comment></comment></comment><comment><USER34> Is that is a terrible headline, or an association for what disappears when the internet is down?

<comment><USER35> Neither, I think. From the article

> The company told internet service providers to connect to its other servers > to "route around the problem".

I believe this means they changed their DNS settings and waited for it to propagate. This implies that the internet in general was accessible, but some larger companies that bought part of a fiber cable were inaccessible over that line.

<comment><USER36> Probably BGP rather than DNS?

<comment><USER35> I wouldn't know. Thanks!

</comment></comment></comment></comment><comment><USER32> Back in 2008 when some submarine cables were cut[1], it had us frantic at work as origin stations had no way to transmit documents to us in the affected countries so we couldn't do our jobs before the freight landed. Until it was rectified they were having to take the physical documents and fly them to a country that did still have a reliable connection and scan them there to transmit to us.

Then in 2010 [2] when the volcano in Iceland grounded flights throughout parts of Europe we were similarly like "argh, sorry customers!"

Cut a few cables and knock out the 31 GPS satellites and the world would grind to a halt. It's terrifying how dependent we are on technology for virtually ever facet of our lives. Then we rely so much on air travel for delivering persons and freight, modern society is so incredibly fragile.

[1] [https://en.wikipedia.org/wiki/2008_submarine_cable_disruptio...](https://en.wikipedia.org/wiki/2008_submarine_cable_disruption)

[https://en.wikipedia.org/wiki/Air_travel_disruption_after_th...](https://en.wikipedia.org/wiki/Air_travel_disruption_after_the_2010_Eyjafjallaj%C3%B6kull_eruption)

<comment><USER37> > modern society is so incredibly fragile

[http://energyskeptic.com/2016/when-trucks-stop-running-so- do...](http://energyskeptic.com/2016/when-trucks-stop-running-so-does- civilization/)

"When Trucks Stop Running, So Does Civilization"

and also

[http://energyskeptic.com/2015/power-transformers-that- take-u...](http://energyskeptic.com/2015/power-transformers-that-take-up- to-2-years-to-build/)

"Large power transformers are essential critical infrastructure to the electric grid, and are huge, weighing up to 820,000 pounds. If large power transformers are destroyed by a geomagnetic disturbance (GMD) electromagnetic pulse (EMP), cyber-attack, sabotage, severe weather, floods, or simply old age, parts or all of the electric grid could be down in a region for 6 months to 2 years. "

</comment></comment><comment><USER38> So that explains it, I thought I was going crazy when simple Google queries were taking 10 seconds or more to finish (I live in Bucharest)

</comment><comment><USER39> I'd love have a 1" slice of that cable on my desk for amuzement. Probably will be like a foot or more in diameter.

<comment><USER40> It's not as big as you think. It's about the size of a high-voltage power line approx 3' diameter.

<comment><USER39> 3 feet? or inches?

</comment></comment></comment><comment><USER41> In Northern Canada, it's Wolves apparently that 'attack' our cable: [https://www.cbc.ca/news/canada/north/northern-fibre-optic- no...](https://www.cbc.ca/news/canada/north/northern-fibre-optic-northwestel- threats-1.5222102)

"This is a picture of the Mackenzie Valley fibre optic cable. Since it was laid, it's been eaten at by wild animals, struck by lightning, and run over by construction workers."

</comment><comment><USER42> Was it just auto-fixed via BGP?

</comment><comment><USER30> The first HN thread I saw this morning (CET) about this was deleted, I think, but here's the second one:

[https://news.ycombinator.com/item?id=21832934](https://news.ycombinator.com/item?id=21832934)

</comment><comment><USER43> Virgin Media in London also has had it's fibre optic cables cut this morning.

[https://my.virginmedia.com/faults/service- status](https://my.virginmedia.com/faults/service-status)

</comment><comment><USER40> I used to work at a military base in San Diego that lost all internet connectivity after construction workers replacing a sewer line accidentally cut the OC-48 line

</comment><comment><USER44> Hmmm, I've also been experiencing downtime today to nixval and amazon (don't know which region exactly) hosted sites. IDK if it's a coincidence.

<comment><USER45> Auth0 is completely down for us too.. [http://status.auth0.com/](http://status.auth0.com/) again, probably not related but a weird morning with all these outages.

</comment></comment><comment><USER46> Yesterday I could not find a The Pirate Bay mirror site that works. Now I assume that is connected to this issue but the first RARBG mirror I tried worked so I wonder if this is just an anecdote or it gives some insight about the demography of these two sites.

</comment><comment><USER47> is it just accepted at this point that wiretapping is the cause, when this happens?

</comment><comment><USER48> When a cable is severed, and traffic is rerouted, who profits, how, and why?

The obvious loser is the severed cable owner.

</comment><comment><USER49> I wonder if this is why turkey post's tracking has been down for days.

</comment><comment><USER50> > _In a statement, the company blamed "multiple simultaneous fibre cuts", > which are very rare._

In cases where multiple cables are cut _simultaneously_ the simple answer was that it was probably done intentionally.

Reminds of 2015 in SF: _"At least 11 physical attacks on these cables have occurred in at least 10 Bay area cities"_

I don't know who these people are, but I bet they play dress up in a black mask and have convinced themselves that the ends will justify their means.

[https://fortune.com/2015/07/01/cutting-internet- cables/](https://fortune.com/2015/07/01/cutting-internet-cables/)

<comment><USER51> Multiple cuts, at multiple locations? or one location?

Or just one location where primary and backup systems went through the same pipe, system, whatever?

Telco land is full of redundancy that eventually converges into a single point of failure.</comment></comment>


Data Jujitsu: The Art of Turning Data into Product by DJ Patil - <AUTHOR> http://oreilly.com/data/radarreports/data-jujitsu.csp?cmp=tw-strata-books-data-products

<comment><USER2> DJ Patil will be giving a tech talk on Data Jujitsu at TellApart's office in Burlingame, CA on July 25 (Wed).

More details and RSVP at <http://bigdatatellatalk.eventbrite.com/>

Here's a write up of the event:

Data Jujitsu: The Art of Turning Data into Product

Join us for an evening of networking and an interactive talk with DJ Patil - Data Scientist in Residence at Greylock Partners and previously Head of Data Products at LinkedIn.

DJ will discuss his just published report focused on how an entirely new approach is required to build great data products. This includes new paradigms of design, web development, engineering, and testing. He will share the Data Jujitsu approach and the implications for all of us focused on Big Data.</comment>


Why browse the Web in Emacs? (2008) - <AUTHOR> http://sachachua.com/blog/2008/08/why-browse-the-web-in-emacs/ <comment><USER2> This covers many of the reasons I prefer web browsing without JS enabled: speed, less mem usage, safer. Before I started doing so, I thought that disabling JS would make the internet unusable, but a vast majority of pages display their content just fine without it. In addition, it is really easy to add domains to the JS whitelist in Chrome without the need to go into the options menu every time (less so in FF). AND, Chrome uses separate whitelists for normal and private browsing, and will clear the private browsing whitelist when you close the window! There are some periodic annoyances, but I wouldn't think of going back to default-enabled.

Browsing the web in Emacs is a bit too hardcore for me though :P

<comment> chestnut-tree _" I thought that disabling JS would make the internet unusable, but a vast majority of pages display their content just fine without it"_

I also browse the web with Javascript disabled (using Noscript), but have formed the opposite impression: more and more sites won't display their content (or display their content incorrectly) if Javascript is disabled. Most of the sites I'm looking at are not "web apps" or SPAs (single page apps), they are sites with text articles or links so they have no real reason to break without Javascript. (It's always annoying when you attempt to click a link only to find it won't work unless Javascript is enabled.)

The rise of Javascript frameworks is only fuelling this trend of Javascript- dependent web sites. I've said this before, but Web developers pick the tools that make their lives easier (as you'd expect), but that doesn't always mean that users get the best experience.

<comment><USER3> > It's always annoying when you attempt to click a link only to find it won't > work unless Javascript is enabled.

Ah, the number of times I've asked colleagues to stop doing this! If you want a JS-powered link/button/whatever on a page, insert it using JS; then you're guaranteed that it will only show up for those who can use it.

Likewise, all togglable content should begin visible, and selectively-hidden by JS during page load; that way, it only gets hidden for those users capable of showing it again.

Also, although this is rarer, all work should be done in small, isolated event handlers. That way, when some unexpected situation arises (eg. the user is blocking your chosen spyware platform), that particular handler dies, but all of the rest keep working (eg. the button handlers, the slideshows, etc.).

<comment><USER4> The truth is almost nobody cares about js being disabled anymore. Even if today you think it's an overestimating (I don't think so anymore) over few more years it won't be even for you. Just 2 years ago it was like "What if a customer doesn't have js enabled? We don't want to loose him just over that! Let's support both versions.", today it is already more like "No js? Weird, lol. Well, it's his own problem anyway, no reason to spend time&money on that in 2014.".

When I for some reason was forced to use lynx, which I don't normally do, I was simply amazed by how smooth browsing is, it doesn't feel like the usual "internet" anymore, more like navigating your project via text editor on the local filesystem. But unfortunately as you go further than browsing ArchWiki it becomes almost unusable due to lack of static (in the sense "no js") sites support.

<comment><USER5> [http://stackoverflow.com/questions/764624/how-can-you-use- ja...](http://stackoverflow.com/questions/764624/how-can-you-use-javascript- in-terminal-for-w3m)

W3m-js is/was a thing. Also, w3m can apparently draw images inline via xterm, though I wasn't able to get this working in the ~10 minutes I tried on OSX Yosemite with X11 and xterm using the w3m from homebrew. UZBL is ok too, if you just want a minimalistic WebKit browser with vim key binds.

<comment><USER4> If you want vim-keybinds in your browser you can just use vimperator or pentadactyl, it's not the point here. Web without pictures/js on today's connection is almost as smooth as navigating your local file system, while "normal" browsing isn't, and you (well, _me_ ) don't even notice that before you eventually try that js-free browsing from lynx or something like that. That is, it _would be_ if not for the fact that js-free web is a "Red Book animal" already.

</comment></comment></comment></comment></comment></comment><comment><USER6> Does anyone remember Gopher:// ?

My experience was that content was a first-class-citizen of the gopher-net, because we didn't have "hyper media".

<comment><USER7> Wow, I had never heard of it, but that looks pretty cool. Gopherpedia is a complete interface to Wikipedia which I'll probably make use of.

Anyone else running Lynx? I don't use it for normal browsing (FF+NoScript like many others here) but I do fire it up for some of the purposes listed in the original article - works well with my workflow, no distractions, and of course it's really safe. Incidentally, it still fully supports Gopher.

On Mac OS, I highly recommend Lynxlet [http://habilis.net/lynxlet/](http://habilis.net/lynxlet/)

<comment><USER8> I used Lynx back in my glorious startup days (12-15 years ago :) it was a great tool to see what the various crawlers (which were Altavista, Lycos, Yahoo and Hotbot at the time) were actually "seeing" on the pages of my site. It helped solving issues with spacing, alt texts...

</comment></comment></comment><comment><USER9> > You're safe from browser exploits.

I'm skeptical of that. Of course no one is actually targetting whatever vulnerabilities there are, and getting rid of JS helps a lot. But is all the code sandboxed or anything?

<comment><USER10> Given that eww (the latest Emacs web browser) is written in elisp, it's safe from buffer overflows and such, which are the most common form of vulnerability in software written in C. The actual parsing code uses libxml, which isn't elisp, but is one of the most widely-deployed parsers around.

Obviously there's no such thing as perfect security, but I would guess it's way more difficult to exploit than your conventional browsers.

</comment></comment><comment><USER11> I use w3m from Emacs all the time. It is not my primary browser, but I do like it for reading documentation while hacking. It is ridiculously fast and uses very little memory when compared to Firefox.

It is very convenient for copying snippets of code and pasting them in whatever file you are editing (or a REPL), too.

The same, to a lesser degree, goes for Dillo. It is amazing how Dillo can have dozens of tabs open and never use more thant 50-100 MB of RAM... :)

<comment><USER12> Have you tried eww in Emacs 24.4? I already like it better than w3m.

<comment><USER13> It's better once you keep it from messing with your text background color. I think this does it:

        (defadvice shr-color-check (before unfuck compile activate)
          "Don't let stupid shr change background colors."
          (setq bg (face-background 'default)))

</comment></comment></comment><comment><USER14> I think what would be interesting is not in bringing the web to Emacs but rather Emacs to the web; a web browser that exposed everything right down to the rendering primitives in a decent (well, better than elisp or Javascript) language, allowing users to customize how they interact with the web in the way that Emacs users customize how they interact with text.

<comment><USER15> Firefox is already pretty heavily customisable through XUL and, of course, is open source so you can modify every aspect of it...

<comment><USER14> I guess XUL is the stumbling block for me there. And of course, the browser itself can be modified, for which yay! but really I'm looking for a small set of primitives exposed in a high-level language that can be combined to create web browsers specific to certain tasks; perhaps something like this could be retrofitted onto Firefox, in the way that Emacs was an macro-extension of an existing editor.

<comment><USER16> Vimperator for Firefox, then.

</comment></comment></comment></comment><comment><USER17> Customizing something and making it yours is a powerful thing. I think that ultimately that's the reason. One reason is that you make things uniquely fit you. But, I think in more cases than we are aware or want to admit, the emotional reasons are the real reasons. Sometimes its nice to have something you made, not something that was mass produced for everyone.

"Resource hogging" always seems like such a crazy reasoning. It's more aesthetic than practicalities. Is your memory really so scarce?

<comment><USER18> There's a line between "use" and "hogging"...

My computer is noticeably slower when Firefox is running. Quite often, Firefox will grab the audio device and not give it back, silencing all other programs. Sometimes the fan will just spin up and the computer will sound like a hoover until I quit it. Over time it just uses up more and more memory, rarely giving it back. It's not unusual to look at the task list and see Firefox taking up 400+MBytes, even though you're doing very little. (Right now, it's taking up 420MBytes. All I have open is the HN page with this text box I'm typing in.) I also think it does something rude with the GPU, too - when I'm not running Firefox, the auto-hide dock pops up perfectly smoothly. When Firefox is running, though, it stutters as it pops up.

The X11 version is terrible to use over a network too.

(I had a whole different set of complaints about Safari.)

</comment></comment><comment><USER19> I don't know if Emacs is so secure. Years ago I wrote a virus that would propagate between files in Emacs lisp.

<comment><USER10> Years ago, huh? Was it before Emacs added support for whitelisting file-local variables? These days you can't just place elisp in arbitrary files and have it get executed.

(Of course, propagating to other elisp files is both easy and completely orthogonal to Emacs, since you could do it in basically any language.)

<comment><USER19> The same problem happened with Microsoft Word, which, in my mind, is a product a lot like Emacs. Emacs is written in a special dialect of LISP, Word is written in a special dialect of Visual Basic. Both have a mind-boggling array of features, etc.

The difference was the Word viruses got a lot more fame because more people used Word.

</comment></comment></comment><comment><USER20>
       M-x eww http://www.lispworks.com/documentation/HyperSpec/Front/index_tx.htm

<comment><USER21> The example is well chosen because the Common Lisp Hyperspec is actually nicer to view in a text browser than in a graphical one ;)

</comment></comment><comment><USER22> All she had to talk about was scripting. It is super convenient to be coding in your language, have another window that is open beside your code that automatically does your searches on a certain website based on what you have open in the other window.

<comment><USER23> This is true! I've used keyboard macros with webpages and textareas to save myself lots of time. =)

</comment></comment><comment><USER24> A great reason not to do this, if you are building anything that will ever be touched by end users (or are building anything that is an application on the web browser) is this isolates you from how real users consume internet content.

</comment><comment><USER25> From the other comments, I feel more alone in this camp than I thought. I've taken the stance to not even consider a user, browsing sites I develop, with javascript off. It's such an integral part of the web by now, and without it, interactivity doesn't really exist.

Is it really so prevalent to browse without JS (I doubt the casual user would do that, since they're probably not even aware that JS exists)?

The only reason I'd care about displaying content without JS, is specifically for crawlers.

<comment><USER26> disclaimer: not a web dev, don't really have a dog in this race.

The reaction here strikes me quite a bit - talk about supporting an old web browser which has a small market share, and the reaction will often be that it's a waste of time. No-js users are a miniscule fraction of a typical site's audience, so why would those sites bother to support them any more than they would bother to support an old browser?

<comment><USER27> I believe there's a difference between not supporting an old, non-standard- compliant browser, where you must have the same functionalities but the platform is different, and not supporting users who have turned off javascript, because in this case the functionalities themselves are different. You almost have 2 different "products" in this case.

Also, angry users are always the most vocal. The huge majority that doesn't bother (or doesn't even know how to) turning off javascript will not complain on HN.

<comment><USER26> I guess - from my point of view it would be lumped under the wider group heading of 'how much should I worry about going to significant effort supporting stuff that few of my customers will care about?'

</comment></comment></comment></comment><comment><USER28> Just yesterday, I tried it the other way around with a terminal emulator in the browser using FireSSH [1]. However, I'm not sure whether it is particularily safe to have a SSH connection to localhost in Firefox. It also needs some key-rebinding to be of any use which I haven't done yet.

[1]: [http://firessh.net/](http://firessh.net/)

<comment><USER28> Yeah right, I have no idea why I deserve a downvote.

<comment><USER28> LOL, are you fucking kidding me…

One of the points of the blog post is that web browsing in Emacs allows you to integrate browser work and Emacs work, which for me is the most compelling one. But you can possibly achieve something similar by integrating Emacs into Firefox via SSH and using for example .js [1] for automatization work. That way you wouldn't have the disadvantage that you basically lose most formatting and layout which are actually quite helpful if you stay away from the loud and annoying websites. That's why I thought it was worth mentioning. I also use Tree Style Tabs and it could be helpful to keep work related websites and Emacs buffers organized in that way.

[1]: [https://github.com/defunkt/dotjs](https://github.com/defunkt/dotjs)

</comment></comment></comment><comment><USER29> It is a dream of mine to do exactly this, but even eww.el just wasn't any good to actually use. I can do everything else in Emacs, except that, but that's a pretty big something.

</comment><comment><USER30> elinks is quite useful on a raspberry pi

</comment><comment><USER31> No eww.el mention? It comes w/24.4

<comment><USER32> This article was written in 2008.`

</comment></comment><comment><USER33> Quick answer: because you are a masochist

</comment><comment><USER34> Is terrible, this idea.

<comment><USER35> Can you elaborate please?</comment></comment>


Total security in a PostgreSQL database - <AUTHOR> http://www.ibm.com/developerworks/opensource/library/os-postgresecurity/index.html?ca=drs-

<comment><USER2> I've only skimmed this, but it looks like a great post, covering an area of database security almost everyone overlooks. There is no reason your app needs to run with carte blanche access to every table in the database, especially when your app is primarily driven by reads.

I've been on pentest engagements where clients have survived rather horrible SQL injection vulnerabilities because the database handle the injection happened on had no meaningful privileges.

<comment><USER3> Also why stored procedures are often recommended since you can apply access controls around them.

</comment></comment><comment><USER4> A great article! It made me realize that I need to be much more careful in setting up restrictions for PostgreSQL users (i.e., client applications).</comment>


Retrieve info about artists/play mixes - <AUTHOR> https://github.com/nmock/artisan-ios

<comment><USER2> Looks awesome man, just starred and downloaded it. I absolutely love 8tracks, and listen to it all day at work, driving, in the gym, etc. Can't wait to fiddle around with it.

</comment><comment><AUTHOR> This is my first open source iOS app. Completed in about 8 hours. Would love to get your feedback. Looking forward to your contributions. Enjoy!

</comment><comment><USER3> Pretty sweet

</comment><comment><USER4> Legit.</comment>


Exploring DynamIQ and ARM's New CPUs: Cortex-A75, Cortex-A55 - <AUTHOR> http://www.anandtech.com/show/11441/dynamiq-and-arms-new-cpus-cortex-a75-a55 <comment><USER2> g-d those are some deceptive graphs! Take a look at the slide titled "Pushing the performance envelope". A 16% improvement (LMBench memcpy) is displayed so that it looks like a 164% improvement (size of bar increased from 50px to 132px)!

<comment><USER3> Might have to do with the pressure they're feeling from the unavoidable: RISC-V replacing ARM.

<comment><USER4> This is an obvious troll, but I'd like to point out that if risc-v where to become big, ARM could probably come up with one of the best implementations.

</comment></comment></comment><comment><USER5> Stupid question: if ARM keeps adding aggressively instructions and co- processors, how long before it becomes blotted and power hungry like the x86 architecture? Isn't its simplicity the strength of the ARM platform?

<comment><USER6> It's not like ARM randomly slaps features just for the fun of it. These features are carefully modeled and studied before released into the market.

<comment><USER7> Of course every design team wants to think it works this way. But the big/little mess (at the OS level), and the fact that Apple is beating them at their own game (like Qualcomm was, at the time) is a proof that it's not that simple.

<comment><USER6> An ARM CPU is not exactly a self contained system like an x86 CPU, it is very dependent on the rest of the SoC.

Qualcomm and Apple have their own tricks which work very well in their platform alone but they wouldn't be able to simply plug out their ARM implementation and sell it as a really optimized system without their own SoC.

<comment><USER8> The rest of the SoC plays a huge part, just like the architecture of a PC does. My personal mantra when thinking of how to get the most out of a CPU is "feed the beast" since idle time is the killer. In the most simplistic terms your L1 caches need to be big enough to hold the program you are running and the data it is using. You can hint to the CPU about what data you will need and get it to preload and branch prediction does a similar job for fetching instructions and avoiding branch misses.

I for one like to see big caches in SoCs, but the cost of putting it there needs to be balanced against the performance requirements of the product (no point having a bigger chip than you need). There is also the numbers game of 64 bit / number of cores / RAM etc which are easy to parse but difficult to understand. An irrelevant number of consumers care about IPC and time taken to wake a core or switch a workload between cores, so great innovations like big little are used as marketing numbers rather than to tune a SoC to its best performance. I would like to see 1 big, 2 little cores and more cache myself.

So what do Apple have? Lots of cores? No. If you build an 8 core SoC and can't keep those cores running then you have listened to marketing.

</comment></comment></comment></comment></comment><comment><USER9> I'd heard about them allowing heterogeneous clusters ahead of time and I was wondering how that would work. Private L2s should do it, you really need to design the L2 to match the profile of the supported CPU(s) but with L3 the latencies are higher and there's less need to be specialized.

</comment><comment><USER10> Nice write-up.

Also I was curious when consumers might see this in their products, last line in the article says late 2017/early 2018.

<comment><USER11> If current trends continue, Huawei (through their subsidiary HiSilicon) will be the first to launch a product with the new ARM IP.

The Cortex A72 was announced in April 2015, Huawei launched the Kirin 950 (4x Cortex A72 + 4x Cortex A53) in November 2015 as part of the Huawei Mate 8. The Cortex A73 was announced in May 2016, Huawei launched the Kirin 960 (4x Cortex A73 + 4x Cortex A53) in November 2016 as part of the Huawei Mate 9.

So yeah, my guess is on the Huawei Mate 10 with a Kirin 970 (4x Cortex A75 + 4x Cortex A55) in November this year. The market has become very iterative and predictable, and this ARM announcement confirms it. Don't actually give Huawei any money for this hardware though, their software update policies are horrible. The more interesting and useful implementations will come from Samsung, Qualcomm and maybe Nvidia in 2018.</comment></comment>


Forcing a subscription model resulted in 2500 1-star reviews in 2 weeks - <AUTHOR> Flexibits, the makers of Fantastical announced a new version and a subscription plan on January 29.
At the time of this change they had thousands of mostly 5-star reviews on the App store.
Two weeks later, they have over 2500 1-star reviews, many from existing paid customers who were forced into a slew of non-consensual changes. (https://apps.apple.com/us/app/fantastical-calendar-tasks/id718043190#see-all/reviews)
Their new version changed a few things:
* it now required everyone to have a flexibits account just to make the app work, with no additional functionality apart from un-breaking the app.
* while it allowed some extra features for previous paid users of the app, it still littered the UI with affordances which only work in the $40-year subscription version
* the upgrade happened automatically for everyone who had their app store set to autoupdate
* in a later update, flexibits (I think) removed the flexibits account creation requirement.
* flexibits wrote a blog post about how they need to switch to subscription model because they need money. (https://flexibits.com/blog/)
In their app update notes flexibits insists that version 3 has all version 2 features unlocked for customers who paid for v.2.
But, 1. there's no feature list comparison anywhere, and 2., there's no way to remove the UI pollution caused by listing locked-out features of the subscription-only app even for paid users of v.2 who were forced in the upgrade. A nag-free interface is a feature of the paid app which has been taken away.
This is a textbook example of how not to handle such a transition. It is so sad to see an otherwise brilliant team exercising such a tone-deaf execution and alienating their existing customer base.
It is even sadder that they continue to pretend that this is OK in the face of frustrated reviews and twitter responses from existing, paying customers. (https://twitter.com/flexibits/status/1225134145178931200). <comment><USER2> I really hate these dark patterns but it seems par for the course for this industry. At what point do people realize good relationships with long term customers matters more than the incremental dollar?

<comment><AUTHOR> I don't think it's a zero sum game. Just from the top of my mind, how about

\- offer bug updates for v.2 existing customers with no additional feature development

\- offer a paid upgrade with lower subscription for existing customers

\- offer more affordable iphone-only or ipad-only subscriptions (currently it's $40/year for a suite of iphone, desktop, ipad apps)

\- offer an _ad-free_ v.3 upgrade locked to v.2 features to existing customers

\- offer a v.3 upgrade requiring existing customer to make an informed choice vs. forcing it as an upgrade replacing their their current, paid for app with another one nagging them for subscription.

I spent 1 minute on these options, as an amateur in the field, and they all sound like viable possibilities for increasing revenue while retaining respectful trusting relationship with existing paying customers.

</comment></comment><comment><USER3> The Mac mindset is to overpay for perceived top quality hardware and keep it a long time, consistent with purchased software (even at a premium price). Subscription model is ill-suited to the Mac crowd.</comment>


MD5 is dead - <AUTHOR> http://www.win.tue.nl/hashclash/SoftIntCodeSign/ <comment><USER2> I think hashing your sequence twice with different salt suffixes will make it much stronger, if not unbreakable for the next decade. Or am I missing something?

So, for input sequence t a better hash can be computed as

      md5(md5(t + salt1) + salt2)

Once computers get more powerful just add one more step with saltN, and so on.

Upd: length of t can be included in calculation as well.

</comment><comment><USER3> Well this is all good in theory, except that it requires the attacker to modify both the good file and the bad file to make them have the same MD5.

This is a more interesting attack vector for things like attacking digital signatures than untrusted binaries.

<comment><USER4> If you can create matching hash pairs at will, the interesting attack in binaries is to distribute one that acquires a trusted reputation under the shared hash, then at a later date replace it with the problem one.

Not too bad of a risk if diverse hashes are often used and people promptly move away from any hashes that demonstrate collisions; could be a nasty surprise if the collision is privately discovered and sprung at an inopportune moment, or people keep trusting an older hash after collisions start appearing in the wild.

</comment></comment><comment><USER5> Sha-1 it is, then. I wonder how long it will take the bittorrent protocol to switch.

<comment><USER6> sha-1 will eventually be compromised most likely

probably better to use sha-1 and md5 together, that way even if both are broken, it is very unlikely that an evil person will be able to create a fakefile that has the same sha-1 AND md5 hash as the realfile

<comment><USER7> Just use SHA-2.</comment></comment></comment>


RISC-V Foundation - <AUTHOR> https://riscv.org/ <comment><USER2> 100+ points and no comments? That's a first.

If anyone is wondering, this is the foundation behind the RISC-V architecture that is supposed to make a dent in the proprietary ISA world of x86 and ARM.

Why? Because this ISA is licensed using a BSD like license which means anyone can use the ISA without paying _anything_. There have been previous projects like OpenRISC which failed but they're hoping the company backing behind this will make it to the consumer and not remain on paper[1].

So what does this mean for you? Cheaper hardware (hopefully).

Whenever any company licenses a core from ARM to make modifications they pay out of they nose _and_ sign a slew of NDAs. This is another reason why ALL of raspberry pi isn't open. You can't see the CPU internals even though Broadwell is open to it.

Now this ISA, has a bunch of minimal base specs which they _must_ follow as to maintain basic compatibility and then they can add their own extensions as needed. You can see them here[2] - scroll down to the PDF and then the third page - preface.

So what the people excited for the project are hoping for, is to get everyone to use the ISA, because there is very little reason not to, other than developer inertia and because almost all of existing code is for x86 or ARM.

Now this won't bring about the software like open-sourcedness to hardware, because every company isn't to eager to share their specific architecture with you. But some companies which want to, can.

Hopefully this is bring auditable hardware, make everyone focused on specific compiler architecture (like llvm and GCC) and make hardware, especially the cheap microcontrollers even cheaper because they don't need a license or fear getting sued by ARM or Intel(talking about the shady manufactures who break NDAs and go ahead and manufacture micro-controllers without license). So expect microcontroller prices to drop to the ground on eBay.

This architecture, isn't just meant for microcontrollers, don't get me wrong! It is specifically _meant_ to be extensible even for super computers (even 128-bit architecture)! That would require a _huge_ company with large army of engineers involved in CPU engineering. So a startup like approach isn't possible. But keep your hope alive!

When? Soon™

[1]:[https://riscv.org/membership/?action=viewlistings](https://riscv.org/membership/?action=viewlistings) \- Note how Intel and ARM are absent while almost every other semiconductor manufacturer is present.

[2]:[https://riscv.org/specifications/](https://riscv.org/specifications/) \- embedded PDF on this page

<comment><USER3> Ok, so the ISA is open. What about the rest of the design of the CPU?

<comment><USER4> There are some interesting open CPU designs at the high level, but it is basically impossible to fab a state of the art chip with _truly_ open designs. From the standard cells down, you are unlikely to be allowed to know anything.

Bunnie Huang touched on this, and other themes, at the 6th workshop (though sadly the audio was not captured directly from the microphone, so it's crummy PA sound from the perspective of the camera): [https://www.youtube.com/watch?v=zXwy65d_tu8](https://www.youtube.com/watch?v=zXwy65d_tu8)

That said, if you mean the high level/functional design of the chip, then there are quite a few open ones. Chris Celio is working on a (seemingly quite excellent) superscalar out of order RISC-V called BooM. There's a reference in-order core called Rocket, which is attacked to a lot of "uncore" infrastructure which is reused by BooM and a couple other chips. They also have an introductory educational RISC-V core called Sodor.

There's Z-scale which is a deeply-embedded-sized in-order core. Clifford Wolf, in addition to developing a formal verification framework for RISC-V cores, has a small RISC-V core called PicoRV32.

SiFive's FE310 is open to the extent permitted by the agreements they've had to make to fab the chips, which includes RTL for the core itself and a couple other things. FE310 being the model they shipped in their Arduino-compatible HiFive1 boards.

</comment></comment></comment><comment><USER5> Hey, I was thinking recently about porting something to RISC-V. After short research looks like there is qemu fork[0] that could be a good start if I don't want to spend money (probably horribly slow, but better than nothing). Unfortunately I couldn't find any Linux distro to run on it. Would be grateful for any advice.

[0] [https://github.com/riscv/riscv-qemu](https://github.com/riscv/riscv-qemu)

<comment><USER2> There's a fedora port to RISC-V, you should be able to find it pretty easily.

There was also a GSoC project I think last year which ran a linux distro on the FPGA of a parallela board. I guess this will require purchasing something. But if you are up for purchasing something, get the Nexys 4 DDR, which is what Fedora project recommends and you can use open sources RISC-V designs like SiFive[1]

[1]:[https://news.ycombinator.com/item?id=14283272](https://news.ycombinator.com/item?id=14283272)

<comment><USER6> The Nexys 4 only has 16-bit wide RAM, the Parallella has 32-bit wide RAM.

</comment></comment></comment><comment><USER7> How long until I can buy an Adruino or Raspberry Pi sort of development board that has a chip implementing the RISC-V ISA?

Is anything like that available today? Anything planned?

<comment><USER8> The Arduino Cinque board was just announced and has a RISC-V chip along with an ESP32 and STM32: [http://hackaday.com/2017/05/20/arduino-cinque-the-risc-v- esp...](http://hackaday.com/2017/05/20/arduino-cinque-the-risc-v-esp32-wifi- bluetooth-arduino/)

</comment></comment><comment><USER9> I've been wondering how RISC-V compares to Donald Knuth's MMIX ISA. Surely MMIX is also freely available, probably Public Domain or something?

</comment><comment><USER10> I'm hoping for the success of RISC-V, an open ISA would solve many binary compatibility issues and free chip makers to compete on the merits of their microarchitecture and not their ISA lock in ( cough cough Intel).

That being said, I doubt it's going to happen. Chip makers have a strong incentive to have a proprietary USA that they can use for lock in a la x86.

<comment><USER11> There are only a handful of high end chip manufacturers left. The lock in you describe only really applies to Intel (and not that strongly either, they have been known to manufacture non-x86/x64 chips in the past). Manufacturers like TSMC are effectively a fab-for-hire, you're unlikely to see them turning down sales just to specialise in a single ISA.

[https://en.m.wikipedia.org/wiki/TSMC](https://en.m.wikipedia.org/wiki/TSMC)

<comment><USER10> I meant fabless companies and ODMs, why on earth would a foundry refuse business?

</comment></comment></comment><comment><USER12> I think cheaper hardware is one possibility, but more importantly it's decentralized design, manufacturing, and auditing. It unencumbers it from one or a few companies, and governments. And it has the potential to increase trust.

With Intel ME/AMT, I think we're witnessing the limitations of the existing models.</comment>


Let's make them pay for using our personal data - <AUTHOR> http://amortizedcost.net/make-them-pay-for-personal-data/ <comment><USER2> Pretty sure the mechanics as detailed in the article are factually wrong. Google does not sell personal data. It collects all the personal data it can and then stockpiles it, where it becomes an asset that the company can use to build products and charge rent (largely from advertisers, but also from consumers). Selling an extremely valuable proprietary asset to competitors would be a really dumb move - the money in today's economy is in owning monopoly assets and charging rent for them.

The actual mechanism behind the behavior the author observed is that the user went to Google, searched for a product, and then _visited the product 's website_. The product's website contains a tracking beacon that associates a unique cookie for the user with the visit. The website's owner can then choose to run ads on Facebook or Twitter that are shown only to people who previously visited the website. This program is well-known among Facebook advertisers (it's apparently quite profitable to them), but Facebook understandably doesn't publicize it much to the general public.

Agree that it'd be cool if the person involved could actually control who and where it went to and was compensated for the use of it, but that'd likely require a fundamental change in how the web works.

<comment><USER3> Google does sell personal data, a little at a time. If I make an ad that targets young dog owners in Seattle, then when someone clicks that ad I know Google thinks they're a young dog owner in Seattle. Google sold me data about that person.

<comment><USER4> Not that I'm saying we shouldn't be careful with our personal data, but:

There's some serious mental gymnastics going from "young dog owners in Seattle" to selling somebody a dossier with their location, search & browsing history (all of which you can turn off).

<comment><USER5> What? You can't turn off any of that. It's recorded whether you see it or not.

<comment><USER6> Presumably when you "turn off" various Google features that data is no longer used for ad targeting. For Google to do otherwise would invite a scandal. (I wouldn't expect all copies of the data and its backups to be deleted immediately since that would be a lot of work for the tape robots.)

Check out [https://www.google.com/ads/preferences/](https://www.google.com/ads/preferences/) and [https://myaccount.google.com/activitycontrols](https://myaccount.google.com/activitycontrols)

</comment></comment></comment></comment></comment><comment><USER7> Arguably, they already do. They pay us in services such as communications software, social software, search, etc.

Also, this is very common in some countries/industries. In the U.K. if you want to buy insurance or open a bank account etc, you'll often use a comparison website, and they will likely give you an incentive (such as free cinema tickets) for choosing a service through them. This is paid for directly by the affiliate revenue. Cashback sites also exist that do this through affiliates. Credit cards do this with air miles, cashback and other rewards too.

<comment><AUTHOR> I bet for 90% of users of Facebook(or Google) it is not clear how actually Facebook makes money

<comment><USER8> Facebook sells your attention. Look at your news feed, every second post is an ad.

<comment> munk-a Your attention and your productivity. They are a leech on modern society.

</comment></comment></comment></comment><comment><USER9> I know this is a really unpopular opinion, but what I don't get is why all this fuss over personal data? So what if facebook records what sites you've been to? If I visit starbucks, When I go to order my latte, the owners/baristas remember my name and face and maybe even what drink I ordered - you certainly don't mind that, right?

People aren't normally sensitive to these things: for example Govt on average takes 1/3 of people's incomes (thousand, tens of thousands of dollars) without the slightest hint of complaint. But when a company records where you've been online (with 0$ cost to you) it's all the sudden a disaster?

i genuinely struggle to understand this. if someone could explain it, that would be interesting.

<comment><USER10> I'll give it a shot. Yeah, so you don't give a crap about being tracked everywhere, having your every inclination, desire, thought, intention, or deed recorded. You're fine with them knowing everything about you, about your family, friends, associates, acquaintances, and all their doings and preferences too. But then one day you wake up and you realize that your entire existence is being mined to corral you into corridor of sameness, conformity, and malaise. You don't think anything edgy or dangerous, don't do anything remotely controversial or embarrassing. They mostly track you to monetize your sameness, your complete and utter lack of originality, your total lack of value to them except as cattle to be fed a diet of carrots and sticks; ads and special offers. You don't mind the digital eyes stalking you everywhere from the shadows. You don't mind having your complete existence watched over for-- for now, seemingly innocuous if slightly annoying cajoling to buy more crap.

But you live a charmed life without imagination. Without dangerous ideas. Who wouldn't hurt a soul. To you, your life couldn't possibly matter. To you, you're one of the herd. You like it. Blending right in.

Enjoy your charmed life that complete and utter indifference to the digital dystopia being erected around you, beyond your control. You probably won't do anything edgy or interesting, because you're caught in that loop that they love you to be in. Inured and desensitized, caught in a self-reinforcing loop made by the background of your mind, constructed by your subconscious that knows that you're being watched--all the time.

For your sakes I hope you never stumble on a crime, disagree with prevailing political opinions, or speak up against the powers that be. Or that you look like someone who might. Or are close to someone who might. Better steer clear of sex toys, risky behavior and embarrassing maladies, live your bland existence under the watchful eye of the overlords who seem harmless, if only a little greedy.

Don't live your life any way that makes you unique and don't make yourself a target! Don't bother to use your imagination! Keep your lips off that whistle! And make sure to vote, or not, because who the fuck cares how society treats its citizens, amirite?

And don't bother looking back to the expectation of privacy that just a generation ago, was some kind of normal. To see the governments and power structures that wielded tyranny over people and engaged in genocide, to the documents and bills of rights that were put in place to restrict that tyranny, and how thoroughly founders understood that people just have a right to be free. But lattes!

<comment><USER9> I think what your saying is that facebook makes it easier for the government to come after you, if you blow a whistle. But, if the gov came after you, i think they'd be able to get you if they really wanted you.

And basically, that FB monitoring reduces our willingness to share who we really are (at least the edgy non-conformist stuff)

For sex toys and other non-conformist stuff, signout of facebook and use Google in-cognito mode. You don't want that stuff on Facebook anyways.

<comment><USER10> No, what I am saying is that we have totally normalized criminal stalking in the digital age. If you think incognito mode is going to save you, I suggest you dig deeper. And turn off your location history and high-accuracy mode! And WiFi! Seriously, you should basically assume your cellphone is a surveillance device, because it is.

</comment></comment></comment></comment><comment><USER11> I've been thinking instead of paying individuals, gov't should levy a tax on PII that is stored. A $/person identified/fingerprinted would be interesting.

This would allow ethical companies like Firefox and Signal to operate at much lower margins than Chrome and Messenger.

<comment><USER12> I like this. One worry I have with paying individuals is that it becomes predatory for poorer people. If you struggle come back-to-school season, it might be tempting to let companies vacuum up your data for a quick buck.

Sundar Pichai touched on this recently, criticizing Apple for making privacy a "luxury good" (of course, Google doesn't give you privacy at any price). We should make companies value our privacy in the first place, not commoditize it.

<comment><USER13> > Sundar Pichai touched on this recently, criticizing Apple for making privacy > a "luxury good" (of course, Google doesn't give you privacy at any price).

Heh, yes, clever spin on his part: it's expensive primarily _because_ the default is actors (like Google) working so hard against it.

</comment></comment></comment><comment><USER14> This is not a new movement, and Tim Berners-Lee's SOLID is good but not the first attempt to address this.

The first I heard of something like this was in the Berkman Identity Group, which grew into the Identity Commons. At the time the movement was called Vendor-Relationship-Management (VRM), an inversion of the CRM practice where customers controlled the information and could be incentivized in various ways (discounts, paid, etc.) to share that information for agreed upon durations.

[https://www.idcommons.org/working-groups/vendor- relationship...](https://www.idcommons.org/working-groups/vendor-relationship- management/)

This movement was one of the drivers for the link contract work done as part of the Extensible Data Interchange (XDI) OASIS technical committee.

I don't know if this is the first instance of this kind of movement, but it was the first I heard of it.

Doc Searls reports another recent development: VRM is alive and well, under a new acronym that plays on B2B, Me2B. Source: [http://blogs.harvard.edu/vrm/](http://blogs.harvard.edu/vrm/)

</comment><comment><USER15> I used to support this point on view, but after the Facebook VPN scandal [0][1] I think using this approach will do more harm than good. It's a good way to make sure only poor people lose their privacy, since those that can afford it will use other platforms that charge a fee in exchange for a private experience (say no ads, or better privacy defaults).

Arguably, this is already happening with Apple, positioning themselves as privacy-aware, but charging a huge markup for it.

[0]: Facebook has been paying teens $20 a month for access to all of their personal data [https://www.vox.com/the-goods/2019/1/30/18203803/facebook- re...](https://www.vox.com/the-goods/2019/1/30/18203803/facebook-research-vpn- minors-data-access-apple)

[1]: Discussion on Hacker News [https://news.ycombinator.com/item?id=19031055](https://news.ycombinator.com/item?id=19031055)

</comment><comment><USER16> Why would they pay you for your data? How much is it worth?

If you click on 0 ads per year, you generate $0 for Facebook and therefore your data is worth $0.

For a personally targeted (using your data) ad click on FB, you're looking at ~$3.25. For a web targeted ad click on a niche website, you're probably looking $0.50-$2.50.

In other words, your "data" is worth $0.75-$2.75 per click of revenue

FB spends 17% of revenue on direct costs and another 18% on marketing. Let's ignore R&D improvements and assume 35% of costs to serve that revenue.

Profit per click for FB = $0.49-$1.79 per click.

Please consider that these clicks must have real intent behind them. In other words, there should be at least 10% chance you'd actually buy that product.

In other words, your data is not worth that much money.

...

On the flip side, FB should offer a paid ad-free version of their services but who honestly would pay $10/mo for FB + Instagram etc.?

<comment><USER17> > On the flip side, FB should offer a paid ad-free version of their services > but who honestly would pay $10/mo for FB + Instagram etc.?

IIRC they don't make anywhere near $10/user/month. If you gave me the option to pay, say, $25/year for ad-free, tracking-free, and it was implemented in some way that I could _trust_ , then I might be willing to participate with FB again. I'm hoping, actually, that someone will come along with exactly this business model so that we can have social networking for friends and family without the dark patterns. Needs to get everyone on board, of course, which is the hard part.

<comment><USER18> There's an adverse selection issue. Let's say you make $10/month/user from ads, and offer the option to pay $10/month to not have ads. Users with less money are less likely to take you up on that, and are also less valuable as an advertising audience, so you start bringing in much less per month per ads- only user.

Advertising effectively allows a company to charge richer users more, which you lose when you switch to a flat fee.

<comment><USER17> That is an angle I had not considered, thanks!

It seems like a chicken & egg problem, in some ways. A business that was built more traditionally than a unicorn could still make good money at $10/user/month, certainly it's possible to build Facebook-level social networking without employing nearly as many developers as they do. But without the network effect, the value is not there. I don't want to pay to be by myself.

Maybe it could work as a SaaS, selling distinct social FB-style closed social networks to families, with a future option to interconnect those.

Probably someone has already tried this and failed. I'm not an idea guy, just a coder ;-)

<comment><USER19> I think app.net ([https://en.wikipedia.org/wiki/App.net](https://en.wikipedia.org/wiki/App.net)) tried that approach and failed to get traction.

I view it kind of like Craigslist. If I put something there for free tons of people are interested. If I charge even a dollar the interest drops by a magnitude.

</comment></comment></comment></comment></comment><comment><USER20> I think I looked that up like 4 years ago and found a few platforms where you could resell your data - thing is it wasn't worth much, like you could make 4 bucks a month with regular smartphone usage. Even if the data we generate is profitable it's only so when aggregated (e.g. across thousands / millions of users) so the value of a given person's data is heavily diluted. Then again maybe it isn't worth that much because the price is being set by the people collecting the data and not by the users - if there is a paradigm shift in which people become aware that they're basically working for free, maybe the value would increase ?

(I used to work in a company that was basically harvesting some users' GPS data (via a SDK / without their explicit consent) and using it to make consumer studies for retail companies so it made me think)

</comment><comment><USER21> This page sends your data to:

\- Google

\- Disqus

\- Facebook

Maybe the author should practice what they preach.

</comment><comment> munk-a I strongly disagree in trying to actually cost out the usage of our personal data. I think the right to privacy should be protected and that the extreme compromise of your personal thoughts is abhorrent. A market around this data would just lead to a normalization of this behavior into the socially acceptable realm. Similar to how we don't allow people to sell themselves into slavery we should prevent people from selling off their personal history.

</comment><comment><USER22> > Do you remember when you were looking for good pair of hiking boots on > Google and almost imminently you start seeing promoted posts about nice > shoes discounts on Facebook and Twitter.

I don't _think_ this happens?

> Basically what happens is that Google without your (explicit) confirmation > collects all history of you search requests and sell it to another company.

This definitely does not happen. Google doesn't sell search history to anyone else. It may be the case that Google itself remarkets things to you. But I don't think so, since how would they get paid in that transaction? Through affiliate links? Doubtful.

Instead, I think what actually happens is that people make a search, they click a link, and target of that link (be it Amazon or some other store) associates their profile with interest in a particular product, then remarkets to that profile on Facebook.

</comment><comment><USER23> worth noting that this is why Andrew Yang is justifying a tax-funded Universal Basic Income proposal in the US: if corporate research makes money of citizen's data, then citizens should be compensated accordingly.

</comment><comment><USER24> Why not sell our data and for that money buy non - free services? In that sense we can at least control what to give and services will compete not only for a good service but also for a good price.

</comment><comment><USER25> That sounds like what Brave Rewards does... [https://brave.com/brave- rewards/](https://brave.com/brave-rewards/)

</comment><comment><USER26> Be careful, as you legitimize a practice that has been very secretive and dishonest in tech, and in many cases should be considered criminal.

I suggest that we're tremendously outclassed in understanding how this all works, and how to find angles or "evil" in it.

Also, it could be somewhat similar to what we get with class-action settlements that are just a minor cost of doing business to let the wrongdoer off the hook, while paying some middleperson to facilitate that.

</comment><comment><USER27> I'd rather be given the option to just straight up pay for a service with assurance that my personal data isn't being used. That is what I would like to "make them" do.

<comment><USER28> I read a statistic that claimed Facebook would only need a single payment of like $4 from it's users to operate at the same margins without selling their data. Seems like presenting users with the option of paying $10 for premium privacy could end up make companies more money. I don't use FB, but I'd sure use Google products more often if the option were available. Maybe we're edge- case users, but I surely don't feel like one. That said it's confusing the options don't exist, because from a purely capitalist perspective, the only perspective these companies have, the option seems to make sense.

<comment><USER18> _> Facebook would only need a single payment of like $4 from it's users to operate at the same margins without selling their data_

Facebook makes about $100/year from American users. [1] Something like $4 once can't be right.

(Facebook also doesn't sell your data. They allow people to target ads against your data.)

[1] 2018 Q3 data, but the right range: [https://digiday.com/marketing/facebooks-making-money-per- use...](https://digiday.com/marketing/facebooks-making-money-per-user-north- america-ever/)

</comment></comment></comment><comment><USER29> Could we just not let anyone use our personal data? I don't need, neither do I want to lease my personal data to google or facebook. I very much want that they don't use my personal data.

Note that I use neither google searcj nor facebook, but both google and facebook do collect my personal data, for example from my use of whatsapp, my Android phone and the google play store, etc. That really has to stop.

<comment><USER30> >Note that I use neither google searcj nor facebook, but both google and facebook do collect my personal data, for example from my use of whatsapp, my Android phone and the google play store, etc.

That's a non-sequitur... Whatsapp _is_ Facebook. The Google Play Store _is_ Google. You are using Facebook and Google 's services. Whether you're using Google search or "Facebook" (the product not the company) is irrelevant.

</comment></comment><comment><USER31> [https://solid.inrupt.com/](https://solid.inrupt.com/)

Tim Berners Lee is already working on something similar

</comment><comment><USER32> Start by figuring out how much YOUR data is worth - that's the hardest part of all this. Individuals will need to create scarcity like the big ad networks do today, otherwise a market flooded with copies of personal data will have very little value. [https://app.fastgarden.io/assessment](https://app.fastgarden.io/assessment)

</comment><comment><USER33> I have said this for the longest time ECHO, GOOGLE HOME etc... DNA tests, Ancestry et al. should pay the users and not the other way around.

</comment><comment><USER34> The initial concern of "the service would have to be paid for" is insurmountable to this generation.

If the average Grandma and High School kid had to pay per query to Google in return for ad free search ( Google did have this product with CSE) what miniscule percentage of users would pay?

The Brave Attention Token tackles this problem in a logical manner

</comment><comment><USER35> If anyone is interested in some long-form writing, Vi Hart posted a very well- reasoned article about the same subject (and much more besides) a few weeks ago: [https://theartofresearch.org/ai-ubi-and- data/](https://theartofresearch.org/ai-ubi-and-data/)

</comment><comment><USER36> In theory I agree, but the somewhat depressing realization is that _your_ data is not especially valuable in and of itself. The marginal value of your data with respect to 10,000,000 other people's data is almost (but not quite) nothing. The value is in the whole.

It might work well if significantly large groups of people got together and collectively sold their data - say 100,000 or more. That would be kind of cool - "hey we are 100,000 people with X demographics and are willing to share Y data for Z dollars.

Doing it on an individual basis may be a symbolic victory, but that would likely be it. "Personal" data has a huge asymmetry in value. There is some Danny Kahneman in here somewhere - I bet people would value their own data 10x what they value a random person's at.

In my opinion people would on average refuse to sell their data individually because what it is actually worth would almost certainly be lower (probably much lower) than they'd imagine, and that sounds like it would make people sad not happy.

</comment><comment><USER37> The thing is, without those companies your data is absolutely worthless, users are not holding any cards. To own your data,put it in RSS format and let competitors bid to license them from you.

(Also author doesnt seem to know how google,fb work)

</comment><comment><USER38> "GoGoDuck". Clearly a user.

<comment><AUTHOR> fixed

</comment></comment><comment><USER39> Disclaimer: this post is very subjective and all facts mentioned here are purely my assumption So they're beliefs not facts

</comment><comment><USER40> Good points, I will trade money for privacy myself if there is an option, but the product quality has to be good.

</comment><comment><USER8> usertesting.com pays you for your data. And earn.com pays you for your data

</comment><comment><USER41> And let's make them charge us for sending emails with attachments.

</comment><comment><USER42> Under the spirit of capitalism, if privacy is such a popular product that so many consumers want, then why not make it available for them to purchase?

For Google users example, free-tier will allow each user account 5 searches per month that will not be tracked and recorded, so essentially users will have an option to specify right before the moment of each search to indicate whether this specific search is going to be "cognito" or "invisible" (perhaps by just ticking a checkbox).

Higher tiers offering greater amounts of private searches per month will simply cost more to purchase shall those consumers desire. Ran out of private searches? Top it up just like prepaid phone credit! This way those users who are extremely privacy conscious will have a solution to protect their own privacy while Google has invented a new revenue stream and can even increase profits from their valuable services.

The next generation Capitalism 2.0 will now enjoy privacy becoming a new cash cow industry overnight. The question then will be how much are people willing to pay for an unlimited account?

<comment><USER18> _> For Google users example, free-tier will allow each user account 5 searches per month that will not be tracked and recorded_

You can already open an incognito / private browsing window if you want to search without it contributing to your profile. On the other hand, modern search works better because it _can_ build that sort of profile.

(Disclosure: I work for Google, on ads. Commenting only as myself.)

<comment><USER43> > On the other hand, modern search works better because it can build that sort > of profile.

Google has become too incompetent to even take the query (all of it, without ignoring half of it) into account. I don't know what Google search has become better for because it sure isn't finding things.

</comment></comment></comment><comment><USER44> Although the idea sounds nice, I think it's impractical. Large companies don't care about you, they care about profit...</comment>


Giant magnetic fields in the universe - <AUTHOR> http://exactlyscience.com/archives/11632.html <comment><USER2> Blogspam of

[http://www.mpifr-bonn.mpg.de/pressreleases/2017/4](http://www.mpifr- bonn.mpg.de/pressreleases/2017/4)

with research team credits and contacts removed.</comment>


Ask HN: Teach me to write 3rd party java script please? - <AUTHOR> Could someone please help me understand everything I would want to know in order to create third-party JS widget, like twitter embeds or facebook ads, in the shortest amount of time?
I am okay getting 80% of the value in 20% of the time, for now, and would love to know of any guides, pitfalls, and best practices for writing such widgets.
Basically, I will consume anything you're willing to throw my way so I could get from 0 to 1 asap. Appreciate it! <comment><USER2> There is no magic in these widgets. People have to add certain snippets, mostly a JavaScript file from some CDN and some basic HTML tags where these widgets shall appear, and everything else is done by the JavaScript.

In former days, people used iframes, this was even easier because the iframe could basically show any website with its own styling, scripting, etc.

If you want to get hands dirty, then skip any framework, learn modern ECMAscript, vanilla Dom and try out to modify a well known element in the target page from your script.

<comment><AUTHOR> From what I understand the scripts usually find an anchor in the page, then load some iframe/html content and update the anchor with new data. That in itself doesn't seem too bad, but ... it can't be that easy. I mean, each one of those widgets usually is 100s lines of code. I feel like I am missing something very important.</comment></comment>


Fortnite keeps stealing dances – and no one knows if it's illegal - <AUTHOR> https://www.theverge.com/2018/12/20/18149869/fortnite-dance-emote-lawsuit-milly-rock-floss-carlton <comment><USER2> I find disturbing the idea that a human body movement could be copyrighted.

"I own taking 13 steps, looking to the right and shrugging. If you do this in any film I want a royalty!"

<comment><USER3> It is not the movement that itself that is protected but the public performance. You can dance any dance you want but you can't charge people to see it if someone else opens the copyright. You also can't make a little animation of a dance that someone else created and sell it to millions of people without givinge creator royalties.

<comment><USER4> I completely disagree, as long as you aren't selling the original content people are free to make their own versions. This happens constantly with music and other media. Some of the most popular songs are covers of others work and not a cent of royalties is paid.

For example the Simpsons has copied scene by scene dozens of famous movies and made billions doing so.

Backpack kid didn't even "create" the dance, it's just a cheap litigious money grab.

<comment><USER3> This is not how copyright law works. You cannot reuse other people's copyrighted performance unless your work counts as a parody and the standards for parody are well documented. For example, Weird Al Yankovich needs to get permission for most of his parody songs because most of them don't actually qualify as parody under the law. Some do, but not all. Musical covers are generally done with permission from the rights holder. [https://www.legalzoom.com/articles/posting-cover-songs-on- yo...](https://www.legalzoom.com/articles/posting-cover-songs-on-youtube-what- you-need-to-know)

Also, the question as to whether any of the songs in question meets with the minimal creativity threshold to qualify for a copyright is a different question as to whether choreography can be copyrighted. The later is definitely the case, but the former is an open question that will answered in these court cases.

</comment></comment></comment></comment><comment><USER5> > According to Ferguson's complaint, Epic is copying videos frame-by-frame to > create the dances, a case of straightforward copying. "Epic creates emotes > by copying and coding dances and movements directly from popular videos, > movies, and television shows without consent," alleges the complaint. "Epic > does so by coding still frames of the source material. For example, upon and > information and belief, Epic coded the 'Ride the Pony' emote, frame-by- > frame, from the 'Gangnam Style' dance made famous by the Korean entertainer, > Psy. The Ride the Pony emote and Psy's dance are identical in every > respect."

Does anyone know if this is the process Epic actually uses when coding the emotes?

</comment><comment><USER6> I think it's important to note that all 3 of the major cases about this (Backpack Boy, 2 Milly, Alfonso) all are represented by the same law firm.

</comment><comment><USER7> Epic has been putting these cheesy dances in their games since the time of Unreal. I wonder if those dances were also "stolen" (as much as a dance can be).

<comment><USER2> The idea that dance could be owned and "stolen" is farcical. Culture is not a commodity.

</comment></comment><comment><USER8> Intellectual property is a racket. I don't see how it will ever get better too. Acquiring a valuable piece of IP is like finding a golden ticket.</comment>