Help me grow my fishing blog - <AUTHOR>

In my spare time i run a fishing blog. started in june 2009 i now get:
    4,563
    Visits

    2,973
    Absolute Unique Visitors

    10,880
    Pageviews

    2.38
    Average Pageviews

    00:02:35
    Time on Site

    63.82%
    Bounce Rate

    59.50%
    New Visits

 the site makes between $20 and $30 month via google adsense ads. I'd like to make $200 to $300 per month for extra income... I've done everything i can think of to grow the site (and it still continues to grow month over month).   what low hanging fruit am i missing here?  Any help would be appreciated.  ps. the link to my fishing blog is in my profile. <comment><AUTHOR> i wound up buying darren rowse's ebook 31 days to a better blog - nothing new so far, but maybe something will gell. I'm gonna follow the 31 day plan and see how that works too.

</comment><comment><USER2> do you take your computer in the boat?

<comment><AUTHOR> what do you mean?</comment></comment>


EZDrugID – Campaign to Improve the Distinctiveness of Medication Packaging - <AUTHOR> http://ezdrugid.org/ <comment><AUTHOR> * Examples of "look alike" medication packaging

[http://ezdrugid.org/look-alikes.html](http://ezdrugid.org/look-alikes.html)

Scary stuff!</comment>


Ask HN: What is your morning reading list? - <AUTHOR>

Please give us your reading morning list in this format: - Hacker News (news.ycombinator.com) - etc. (etc.)<p>Thank you! <comment><USER2> BBC News

Hacker News

Winterhighland [http://www.winterhighland.info/](http://www.winterhighland.info/) (from ~October to ~May)

<comment><USER3> \- Arethuza, I actually like the Winterhighland site. Seeing people do things as skiing or sculpting relaxes me.

</comment></comment><comment><USER4> News (local Hungarian media mostly and/or BBC) and comic books (maybe it is funny but I love them!)

</comment><comment><USER5> Local news, Hacker News and checking RSS feed for any interesting news.

</comment><comment><USER6> reading local news. reading hackernews and reddit. looking tweets if I see any interesting links, I click and carry on reading it.

</comment><comment><USER3> \- ODesk (www.odesk.com)

\- Elance (www.elance.com)</comment>


Java on the Mac is malware - <AUTHOR> http://tech.kateva.org/2013/02/java-on-mac-is-malware.html

<comment><USER2> You're a fool if you think that is true. Java is one of the most secure technology and the problem is with Browsers and not the language. If you disable the Java plugin until the fix comes from Browsers you should be just fine.

</comment><comment><USER3> Why is Java linked to browsers at all?

All the Java security holes seen mostly are exploited through a browser plugin - but I've never, ever needed the browser plugin, I just need jdk/jre to run offline apps..

</comment><comment><USER4> "the implementation of Java on Mac reeks of hacks, bad design, and high risk" does not constitute malware.</comment>


So a product manager asks you to fix a bug… - <AUTHOR> https://medium.freecodecamp.com/youre-asked-to-make-a-fix-e156b802ad92#.y86cumyot <comment><USER2> Actually, our job isn't to create software that works.

Our job is to add value for the company.

Also, we should follow the chain of command. Product should never talk to individual coders, they should talk to managers. Every time Product Managers can ask for individual bug fixes for problems to coders, unless you don't have a manager, the organization is not functioning correctly.

<comment><USER3> That reinforces beurocracy. My experience is that kind of chain of command does slow down progress. I had many fruitful and actionable discussions with product. That might maybe be unique to my situation, but i have seen how others got slowed down due to lack of direct communication.

<comment><USER2> No, in a well functioning organization, you should always have something on your plate like a feature you're working on or a production fix.

Sure, product can come in and ask you about how long (roughly) it might take to get something done, or what would be involved.

But, at the end of the day, you're working on something right now, and that's what your team and product has agreed is the most important thing at the current moment.

Context switching costs time. And product is really good at coming in and convincing you that whatever you're currently doing is "not as important" as what they currently want done.

That way lies madness. Unless you can get agreement from your manager that what you're currently working on is in fact less important, continue on what you're currently working on. Unless of course you're currently on call, and expected to be interrupt driven.

Otherwise you're answering to like 4 people, each of which has a slightly different idea of what priorities should be.

<comment><USER3> The assumption of manager making the best decision on prioritization is faulty. Priorities change, manager is busy, manager is not the one working on a project so may not be in the position to make the best decisions. Product always dont come with the brightest ideas. Eng could come up with much better ideas, as it should, and should be in a position to drive that product end to end, when necessary.

<comment><USER3> What i am trying to say, sure people think what they ask for is most important thing to do, but eng has their own thoughts, and they can / and should be able to prioritize. You should not commit to your priorities months in advance. If you think something is not important, you push back. If it's important and you agree, you do it. If some new project comes in, you reprioritize your own stuff - it might just take a day or two to implement and could prove to be of big impact.

Manager will ask the eng what he think of the project, and then there will be discussions, meetings, requirements, formal processes, which will not only kill the mood, but also will slow down the projects significantly.

<comment><USER2> No, you are not interrupt driven.

You do not get to interrupt engineers, especially if engineering has prioritization meetings every two weeks.

Don't bother engineers to tell them what they have to do RIGHT AWAY. That's been determined already.

If product doesn't have visibility two weeks into the future, what good are they?

<comment><USER3> oh the meetings. I have seen engineers got stuck into them, because someone decided that it should get priority at the beginning of the quarter, and management wants to check the boxes on the spreadsheet tracking the OKR goals for their EOQ OKR rating.

Once something is decided, it's pretty sticky, when it really shouldn't be.

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> In the same way there are 10x engineers, there are 10x PMs. And for that matter, 0.1x PMs. My point is, YMMV. Good PMs carefully balance the various trade offs including respect for engineering time / schedule / quality while acting as a net multiplier for the org.</comment>


Ask HN: Should professional gamers be screened for performance enhancing drugs? - <AUTHOR> For example, stimulants, nootropics, anxiolytics, etc. My thought process came from thinking about the growth of regulation in the Olympics over many years. I'm curious to know what the community thinks about this, since professional gaming (or streaming) is becoming more and more popular by the day but is still relatively new as a "sport". <comment><USER2> No.

Also I do not think Olympic athletes should be tested. I once competed at a very high level in sports and the use of drugs is significantly higher then anyone would expect. The difference was that the poorer countries only had access to old school steroids (testosterone, dbol, tren etc) while the richer countries had access to things which at the time were impossible to detect (GH, IGF-1, Research Peptides).

The effects of steroids specifically are seen many years after use, so unless you are testing the lifetime of an athlete the test is meaningless anyway.

2 twins, one does steroids for 2 years, one does not. The steroid user comes off of drugs for another 2 years, and still has a major advantage over the non-using athlete.

<comment><USER3> Many people like to believe our choices are between letting the best drug infused athlete win, or the best drug free candidate win.

But based on your comment and other readings I think that is a false choice, and the real choice is between letting the best drug infused athlete win, or letting the best athlete who can hide their drug use win.

The difference between natty and enhanced body building is not drug use, but deception.

</comment></comment><comment><USER4> Physical sports are a completely different thing. Games simply don't require the same kind of physical effort and so physiological-enhancements probably won't help.

Other than stimulants to keep people awake for long periods of time, I doubt there are any drugs that would serve as an unfair advantage.

Being well rested and physically healthy would probably be the most effective strategy.

</comment><comment><USER5> Well if "professional gamers" want to be considered athletes, they should be subjected to the same amount of checks and restrictions that regular athletes are subjected to.

</comment><comment><USER6> But not all stimulants etc are used for performance enhancement, etc. There are many legitimate uses so like anything else, there would have to be exceptions to "the rule."

<comment><USER7> In meat sports, if someone has a legitimate use for a stimulant then they are barred from competition nevertheless.

In practice, this is better than someone getting the edge because of a medical condition.

<comment><USER8> > if someone has a legitimate use for a stimulant then they are barred from > competition nevertheless.

Not entirely true - you might have a "therapeutic use exemption" (TUE).

See [http://theconversation.com/athletes-need-performance- enhanci...](http://theconversation.com/athletes-need-performance-enhancing- drugs-to-treat-illness-13718) for a good discussion

</comment></comment></comment><comment><USER9> If it would be shown to give a clear significance in gaming, then I guess there should be screened for it. As it would indeed be offering an unfair advantage.

<comment><USER10> Right, in athletic sports, you're supposed to get by on training and skill. Drugs are seen as cheating. What sort of enhancements would be seen as cheating by gamers?

<comment><USER11> There's also markets for gaming gear that has lower latency and modified gaming gear like console controllers with extra buttons or scriptable buttons.

I think the gear would give more of an advantage over drugs since it would be more consistent.

<comment><USER12> Many professional tournaments have everyone playing on the exact same hardware for this reason. You bring your keyboard/mouse and everything else is identical between competitors.

</comment></comment></comment></comment><comment><USER13> Since esports are closer to cooking than an actual sport I'd imagine you wouldn't have much regulation.</comment>


Voice Phishing Scams Are Getting More Clever - <AUTHOR> https://krebsonsecurity.com/2018/10/voice-phishing-scams-are-getting-more-clever/ <comment><USER2> The problem here is the ability to spoof caller ID. This should not be possible. Regulations set up the phone system, regulations need to make this change. I don't care what excuse anyone has, don't care about your stupid PBX or any of that. Caller ID should be mandatory and reliable.

Having said that, always assume someone calling you is a fraud. If your "bank" calls you, tell them you'll call back and don't call a number they provide over the phone or in caller ID. If you can't find a reliable number to the bank, drive over there. The bottom line is that you can't trust anyone who calls you.

<comment><USER3> There is no way to fix the ability to spoof caller ID with the way SS7 is built. Not without breaking functionality to something like 85% of the installed base of PBX and phone switch equipment, most of which is anywhere from 10 to 45 years old. The legacy telco SS7 phone system needs to be burnt to the ground and rebuilt, but it never will be, because people have moved on to friend-opt-in based message platforms like whatsapp, signal, telegram, facebook messenger, and the domestic chinese equivalents (wechat etc).

<comment><USER4> I just want the major cellphone companies numbers to show up correctly and everything else can be ???. That does not require fixing all these other systems.

<comment><USER5> How exactly could they do that for calls originating outside their network? Most spammers are using VoIP, not cell phones on major US companies.

<comment><USER6> They could not fix it. However, it would be a big value-add to me if, say, the big 4 US carriers could add an out-of-band security check and block calls to their networks from numbers they control but which are spoofed.

I get way too many calls from area codes and prefixes I recognize. This would help me get some of that back.

<comment><USER7> There are legitimate use cases like Google Voice for sending caller ID that another carrier owns. Despite that, a basic authorized users list would be an easy fix, doubt that'll ever happen though. Look at the mess that LRN and CNAM data are, providers will nickel and dime for access to data that doesn't cost much to maintain...

<comment><USER4> Google Voice could A join the system or B have ??? as their caller ID either one would be useful. Again, they can say whatever number they want as long as I can opt out and block unknown numbers.

However, the current system is largely useless when you get spoofed calls from numbers you recognize.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> This is 100% _destroying_ the phone for younger generations ... my kids answer nothing, not even my own phone calls because they set their phones on do not disturb to curb the endless robo, scam, and cold calls.

If it wasn't for [https://hiya.com/](https://hiya.com/), I'd be at the end of my wits. Seems like the number of fake calls has ramped up exponentially in the last months. I finally just set it up completely block all telemarketing, spam, scam, fraud calls.

<comment><USER9> I suggest downloading a silent ring tone. I got one for a dollar. The silent ringtone is my default ringtone. I went into my contacts and changed the ringtone associated with them to be one that makes noise. I no longer am bothered by scam calls as a result.

<comment><USER10> > I went into my contacts and changed the ringtone associated with them to be > one that makes noise.

That gets the job done, but rather than modify each of your existing contacts (and each new one), consider just turning on Do No Disturb and setting your Do Not Disturb level to "Allow Calls From All Contacts" (or a particular Group or Favorites). These are iOS options but I assume there's an equivalent in Android.

<comment><USER11> On my particular Android phone (Pixel) this is not a great solution because setting Do Not Disturb alters the behavior of other things like Calendar reminders or email alerts. You could make DND not do that, but sometimes I _do_ want to mute other things. If you're using DND all the time, you essentially lose that feature on your phone.

The best solution I've found is to just go into the Google Dialer app and set the option to not ring on any call suspected to be spam. I still do get spam calls that haven't yet been reported, but it's down to only about 3-4 a month.

Not sure if Samsung phones / other android flavors have a similar feature or not.

<comment><USER12> A great improvement to that would be an option to silently reject all suspected spam calls and send them to the voicemail. This has been suggested many times on Google's product feedback and suggestion boards but for some reason they have not gotten around to doing it. The hard part of detecting spam calls is already there; all it should take is adding a couple of new check boxes.

<comment><USER13> There are apps like youmail and nomorerobo. I use youmail and it has the option to give a disconnected message when a scammer calls.

</comment></comment></comment></comment></comment></comment><comment><USER14> I'm personally somewhat nervous about what voice phishers will be able to accomplish with call ID once voice sample synthesis gets good enough and cheap enough, which is well on the way from what I can tell. Shades of that old Uplink game, call up a family member or friend and just get them to talk into the phone at all, not even give up personal information but literally just speak enough. Then the phisher can call up the target, spoof that number, and directly have the voice sound just like someone the target knows. The voice and the Call ID will both check out, and this should actually be a lower target then the kind of voice synthesis work currently being done because phone calls are highly compressed and tend to be not great quality anyway.

Once that hits general usage along with the kind of ML and social network graphs being done up couldn't that just plain be it for phone usage if companies can't come up with a proper cryptographically verified call scheme (which would require new phones, for everyone)? I mean, if a call coming in directly from a "trusted contact's number" that is literally in their voice becomes generally a scam too I think that'd have to be a real tipping point for the general population. I can't see any choice at that point but to disable all incoming calls period, and move my family over to something else as well. And that tech train is coming down the tracks pretty fast, there have to be at least some phone providers who can see that right? Heavily automatically run personalized ML powered social media and ad network profile fed phishing calls in a relative's voice, yeah that'll be really fun.

<comment><USER15> Simple workaround - you call me and leave voicemail, I call you back on the # I know and we talk.

</comment></comment><comment><USER16> I'll give you the flip side of the scammer's deterioration of trust in the phone... a few months back I got a phone call from what appeared to be my bank, and they were asking me about a fraudulent charge that I didn't recognize. Worried that this was the beginning of a scam, I delayed a bit on the phone while I logged in independently to my bank account... and lo, yes, indeed, there was a fraudulent charge to my account just as they described. It really was my bank calling me about fraudulent charges. But I was definitely close to hanging up on them, assuming it was a scam. It stinks on both sides.

<comment><USER17> It makes me laugh when my banks fraud department calls me and then asks me to verify myself to them by giving personal information before asking me questions. I usually laugh at them and tell them they they are the unverified party in this phone call, not me.

I always pull up the website and confirm before telling them anything.

<comment><USER18> > I usually laugh at them and tell them they they are the unverified party in > this phone call, not me.

This is one of the related reasons why I finally got my ducks in a row and switched away from Chase three years ago. Their potential-fraud-has-happened outreach department was, in my experience, terrible about this. It didn't help that their potential-fraud-detection department was similarly bad. ("You used your debit card at an AM/PM in Washington State!!!!" Yes, I know, it is about 900 feet from my house; I go there regularly.)

Point being, I got quite a few calls from their (real) fraud prevention department about (supposed) fraud. Each time, the rep who called me would get mad at me for not handing over the last four of my SSN and my complete address to the calling party. I pointed out, each time, that they were the ones who called me so I should be verifying them. "But, sir, WE are the bank and you could be anyone who just answered your phone."

The credit union I now use just presents a message with their name and a request to call back. "We may have detected a fraudulent purchase; please give us a call at the number on the back of your card and reference case number [digits]." Fortunately, their system is much better; I've only heard this message once.

<comment><USER19> _their potential-fraud-detection department was similarly bad. ( "You used your debit card at an AM/PM in Washington State!!!!" Yes, I know, it is about 900 feet from my house; I go there regularly.)_

A year ago I had an awful experience with this.

We were on vacation at Big Bend National Park, which is hours away from everything in southwest Texas. When trying to pay for breakfast, our card was denied. I tried to call the card company to tell them that it was OK, but couldn't get through - there was no cell service. Outside the restaurant was a pay phone (remember them?) that I was able to use to call their 800 number.

I learned then that they'd actually flagged my card as stolen, so I could no longer use it at all, and to get it turned back on I needed to receive the code they were sending by SMS and read it back to them. The thing was, we were in a dead cell area, we couldn't get the SMS. And Big Bend is mind-bogglingly huge - 1,252 of square miles of mostly desert (there's a whole mountain ranged entirely contained within the park). As far as I could tell, I didn't have enough gas to drive out of the park to get to cell service to achieve this (the park is so big that it's got its own gas station in the middle, and I'd intended to use this - but without my card, how can I?).

It seemed a perfect trap, there was no way we were going to be able to get out. What eventually saved us was that the hotel manager overheard me shouting at the card people, and came out to give me a map, with the places inside the park that can get SMS text highlighted. Using that I was able to fulfill their requirement.

They never were able to tell me why they flagged the card in the first place. They told me that they advise all card holders to warn them when they plan to go out of state. But I live in Texas, and I was in Texas when the charge triggered. They just shrugged that off.

<comment><USER20> As someone who travels in remote corners of deserts very frequently, I can say that you can never have too much water, fuel, or cash.

And when you're in a scrape, you can often barter with all three.

<comment><USER21> My wife and I (we are both Brits) were driving in the middle of nowhere in Washington state. We stopped at a garage to get petrol/gas and discovered that the credit card machines in the unmanned gas station only seemed to accepted credit cards issued in the US - IIRC the PIN equivalent was a US zip code. Our personal credit cards (UK cards) and cash (no teller) were thus useless. Luckily my wife had a corporate credit card issued in the US that we were able to use, on the principle that she could ask for forgiveness from her company when we got back.

<comment><USER22> For foreign credit cards oftentimes entering 00000 or 99999 for zip code works.

The other thing that sometimes works is entering the digit part of your postal code and padding it out with zeros. Ex: if your postal code was 1A2B3C you'd enter 12300.

</comment></comment></comment></comment></comment></comment></comment><comment><USER23> My bank's fraud department sent me a voicemail saying my card had been deactivated and I needed to call them at 1-800...

Yeah, fuck you. I'm not calling a fraud prevention number that was given to me over the phone and more to the point, what is wrong with you for asking your customers to trust people that called them on the phone.

I called the main switchboard for the bank and couldn't find the fraud number from there. They got an earful about that too. None of this is okay, including why they flagged my card (Not for buying a TV and a bluray player, no. For getting a $8 car wash on the way home...)

<comment><USER24> Yes! This happened to me too and is very alarming. It's training users to fall for phishing.

I'm not sure what a correction looks like though. Should they call customers and instruct them to find or verify a phone number and call back? Instruct them to log into their online account? That would be fine for you and me, but I'm thinking of the average cardholder.

<comment><USER25> Telling them to call the customer service number on their credit card seems pretty good?

<comment><USER26> I just got one of these that had me call a DIFFERENT number than the one that was on my credit card -- the whole time I was thinking it was probably a phishing thing as I was giving them all my info, but in the end it was to ask if I had really made a charge that I _had_ really made the day before (in a city I'm not normally in)... so I'm pretty sure it was legit. Probably?

</comment></comment></comment></comment><comment><USER27> I believe that phone companies are complicit in this criminal activity, as they seem to have virtually no interest in actually stopping it. I've already turned off calls on my phone because "why bother", and more and more people I know are doing the same thing. The phone companies probably make so much on streaming that they don't give a shit about the phone system. This is a really bad thing for crime, but might help accelerate the death of a decades-obsolete technology.

<comment><USER28> > I've already turned off calls on my phone

How do you do that on an Android phone?

<comment><USER27> My phone is a Galaxy S5 with Android 6, but it's here:

Settings > Call > Call Rejection > Auto reject mode

Set it to "All incoming calls".

</comment></comment></comment><comment><USER29> How come in 2018 we can't get a reliable CallerID. Surely this is something that could be simply regulated.

Perhaps there should be a few types of CallerID - verified, physical and nominated. Eg a company calls you with a verified ID (like TLS), a local number from a single line is physically authenticated and anything else is just a best guess. That way we can filter more reliably.

<comment><USER2> No options. Make it mandatory and make it unable to be faked.

<comment><USER30> It wouldn't really need to be mandatory, just something that cell providers and reputable businesses provided. Then phone companies could start rejecting anything that didn't provide it.

<comment><USER31> But how does the telco in the last node know the caller id is accurate? They can only tell that the data is coming in that direction but it could have been routed multiple times before (if phones work like the internet protocol). The only telco who can ensure that must be the one who initiated the call (exactly like IP spoofing).

</comment></comment></comment></comment><comment><USER32> I'm at the point where I don't answer the phone unless I know the number calling me or I'm expecting a call.

<comment><USER33> Yeah, even my friends don't call me (they use Whatsapp/SMS), so why should some random marketeer have the privilege of actually talking to me on the phone?

</comment></comment><comment><USER34> The issue, as I understand it, is that the SS7 telephone network is completely insecure assuming that you have the ability to connect to it. Shady gateway providers will allow you the privilege, and once you're in, you can do just about anything.

There is precious little within SS7 to prevent or respond to spoofing. It's a major nightmare for telephone companies.

<comment><USER35> How did spoofing work vis-a-vis those with 1-800 inbound lines? I was under the (mis?)impression that those users were protected against spoofing because they were (are?) billed by inbound call duration.

> It's a major nightmare for telephone companies.

Disagree. It's a bug for the telcos, and a major nightmare for the rest of us.

<comment><USER36> Having spent a bit of time working on projects that touch the phone network, I think it is a 'major nightmare' in the Lovecraftian sense--I for one am forever changed by what I saw.

As for billing, it is usually based on the destination number, and your originating telco, unless I am misunderstanding your question.

<comment><USER37> Does this imply I should answer the 1-800 calls and keep them on the line as long as possible? :D

<comment><USER38> If you suspect a scammer called you, always keep them on the line as long as possible. Feed into the scam and act as gullible as possible, give them fake cc numbers, etc.

<comment><USER7> Best to extract as much iinfo as possible, business name, callback numbers, email addresses, etc. The more info, the easier it is for the FCC to bring enforcement action against fraudulent callers.

</comment></comment></comment></comment></comment></comment><comment> King-Aaron Can anyone offer any insight into the latest series of odd phone calls I've been noticing, where you get either a private number or an out-of-state number call you, and then sit in silence until you utter a word in which it hangs up at that moment?

I've experienced a few so far over the previous months. I've even experimented by not saying anything for an extended time - up to about 30 seconds of silence (and then it usually hangs up itself). But the next time it happens, if you say 'hi' within a few seconds, it immediately hangs up afterwards. Like its waiting for a verbal prompt.

The apathetic part of me thinks 'maybe its a robocall thats bugging out', but then the pessimistic part of me wonders 'are they trying to sample my voice'.

<comment><USER39> One reason for calls that get instantly disconnected is that when these systems will call up, say, 10 people at a time, 8 won't answer, so there's no reason to tie up 10 operators waiting for someone to answer. So they don't connect you to an operator until you actually pick up the phone/interact. But if they miscalculated and 4 people answered, they don't have enough operators and they just hang up.

<comment> King-Aaron Interesting, I wasn't aware this could be the case.

</comment></comment></comment><comment><USER40> We (Nomorobo) have a bunch of recordings of this type of scam. They're scary.

[https://nomorobo.com/lookup/844-386-9815](https://nomorobo.com/lookup/844-386-9815)

<comment><USER41> Love your service! I've been using it for a few years now I think and it's really helped. Thanks!

<comment><USER40> Thanks! I really appreciate the support. These voice spam calls have gotten out of control.

</comment></comment></comment><comment><USER42> Who are the people manning the phones for the scam? Does it really pay better than a real job? I mean if you have the skills to scam like this you have skills that are valuable to legit business as well, no?

I knew a few criminally-minded people back in high school and my early 20's (I don't associate with them anymore.) The thing that always stuck me about the "criminal mind" is that they were ready and willing to work hard, as hard or often more as a real job, to try to make money. I asked one guy once about it and he basically said that it was the idea of getting over on society, or "the Man", or something. "Getting away with it."

This same guy also refused to open a saving account, but he would buy CD's (certificate of deposit) with ~3 month terms, and pay down the payments, because _it felt like having twice as much money_. To him it felt like he got to spend the money (that he used to secure the CD) twice: once with the money the bank loans him, and then again when he pays off the CD and they give him his original money back.

Now, this is insane. He's just giving the bank some money.

I asked him about this because it's so crazy, and he said "I can pay bills", meaning that he can psychologically deal with the idea of having to hustle to pay the ongoing payments on the CD, but (for whatever reason) he can't just give some of his money to the bank and not touch it. He literally can't feel right about savings. So he does this weird thing that basically inverts the whole idea of banking. He even knows it's crazy but it's a working equilibrium for him.

Anyhow, I wrote all that in the present tense but this was years ago and I lost touch with the guy.

I am astonished that the scammer-telemarketers who can sit there and carefully run these scam-scripts on marks don't just go get legit jobs. I wonder what economic context they are in? Or are they just, uh, morally corrupt, or something? The mystery of the criminal mind.

<comment><USER43> Reply All decided to try to get to the bottom of a specific "tech support" scam, which might shed some light.

[https://www.gimletmedia.com/reply-all/102-long-distance- part...](https://www.gimletmedia.com/reply-all/102-long-distance-parts-1-2)

</comment></comment><comment><USER44> Number one advice I give my family: never give out any information (no matter how inconsequential it seems) to a person purporting to be from a company calling you. Hang up and call the company yourself using a trusted number (e.g., the number on the back of a credit card).

<comment><USER45> Banks should really just stop calling customers and taking them through security. If there's something urgent, the protocol should be that they call you, give you a ticket number, and tell you to call them back on the bank's standard number for customer service. Anything else just conditions people to expect incoming calls with security questions which will always result in scammers finding a way through.

<comment><USER46> This can _also_ be scammed due to the timeout "feature" in telephone systems. Ie, the scammer calls, tells you to call the number on your card. You believe they hung up, but they are still on the line. When you pick up your phone again, you're still contected, and they're playing a dial tone.

[https://www.geekrant.org/2016/05/08/phone-scam- part-1/](https://www.geekrant.org/2016/05/08/phone-scam-part-1/)

<comment><USER47> How many people still use landline phones? I don't know anyone.

</comment></comment></comment></comment><comment><USER48> More and more, my plan seems wiser.

I'll generally get a phone call like this, and hang up and re-initiate a request myself starting from the phone number listed on my card.

<comment><USER49> This. I'm also happy to phone a direct number that they give me (e.g. subdepartment), as long as I can find the telephone number listed on their public web site.

The sticky ones are things that seem to somehow be tied into people at the actual company scamming - my parents recently got a scam Openreach call within a few hours after calling to complain that their telephone had been disconnected a week earlier than promised. They had knowledge of the complaint call, but did the standard scam walkthrough of looking at event viewer and asked for the router ip address.

See also the conveyancing scams whilst buying houses where phishers impersonate the exact solicitors email format and know exactly when the monetary transfer is supposed to take place in order to get you to pay a different bank account.

<comment><USER50> Do we need a certificate authority for phone numbers now?

<comment><USER30> That would actually be a very good idea to cut down on number spoofing.

<comment><USER50> Yeah I figured as such. You could pass a hash to a certificate via caller ID

</comment></comment></comment></comment></comment><comment><USER51> If I were able, I would disable incoming telephone calls entirely (consider that a feature request, Apple). The phone system today is fundamentally untrustworthy because of caller ID spoofing, and the phone companies involved are culpable for not addressing this problem.

A new ID system using PKI could eliminate the spoofing problem completely. Yes, I'm sure it would require a huge coordinated effort. Given spam calls will exceed 50% of all calls next year [1], this should be seen as an existential crisis for phone companies.

[1]: [https://finance.yahoo.com/news/spam-robocalls-will-soon- acco...](https://finance.yahoo.com/news/spam-robocalls-will-soon-account- almost-50-calls-183157916.html)

<comment><USER52> Public-key identity verification wouldn't even require substantial upgrades to anything except the phone hardware itself - when making the call, just convey the signature upon connection via a dialup-modem-like encoding, and the receiver may at their discretion neglect to connect their audio hardware to the line until after verifying that data.

(Could even use some kind of PoW as another option, for calls where the receiver is unlikely to have received your public key yet.)

</comment></comment><comment><USER53> The latest scam I've experienced is when I last sold my car through craigslist recently. I would get voice calls, they person says hello, starts asking about my car and the call would cut off.

Then I would get a text saying, "sorry, bad signal or it's loud where they are" At that point, a chat bot takes over asking questions about the car and talking about how they really want to buy it but need to make sure that it has no accident and that I should get a car verification report and if it has a clean history they will buy it. A link is then sent to me via text.

What I haven't figured out is if they are going to steal the CC info if entered in the link or give me some bogus report that costs $5 to acquire and charge me $100 for it.

<comment><USER54> Usually, the scammer is getting an affiliate commission whenever you complete the verification report.

You see this a lot with job listings and rentals where the scammer will link to a background check as a condition of hiring/renting.

</comment></comment><comment><USER55> The amount of spam calls is fucking insane, the fcc needs to seriously crack down. Start fining telecom companies a buck a call and I think the problem would go away. Hell make it 5 dollars for every call after the first ten thousand, I receive at least 5-10 day. If it is an obviously spoofed number make it 50 dollars. The telecoms have the capability to deal with it, they simply have no incentive to bother.

I've had a conversation with my cell carrier where I asked to block Texas and Florida, every area code in those states. Apparently that is not possible.

</comment><comment><USER56> What do I have to do to get my iPhone to only allow calls from my contact list, without using DND 24x7. Something has to happen for this setting to come out. Will it take enough spam calls to a CEO of a major company to come out with it?

<comment><USER57> I like this but it will only help a little and temporarily. I've received calls from _my own_ number. Given the amount of data out there in social media and seeing friends of friends, the scammers will be able to call you from a number that is in your contact list. The phone system needs a new layer but one that is optional. If a call comes from via the old layer, your phone warns you that this call may be fraud.

</comment></comment><comment> jor-el I am interested to understand how does these attacks work. The article states, after the victim disclosed the CC number there were ATM transactions performed using it.

How are scammers able to generate a physical card in first place to perform ATM transaction? Is it something similar to card skimming with cards having magnetic stripe? Can this attack be performed with cards using chips?

Also I often come across a fraudulent transaction being performed even if only credit card number is disclosed, while cvv and expiry date are not. As per my understanding all 3 info is needed to perform a transaction.

Do anyone have some resource where these attacks are discussed in detail and how they are carried out.

<comment><USER58> Yes, some countries still use the magnetic stripe for authentication, or allow fall-back onto it if the chip "fails".

</comment></comment><comment><USER59> We all make mistakes, so I'm hesitant to ever say they should have known better. But...

> Even technology experts are getting taken in by some of the more recent > schemes (or very nearly).

Rule number one about phone scams, which I've seen repeated numerously so "technology experts" should know this ... _always_ verify and call the number back. I was under the impression that was common knowledge?

The scams iterated in this article, no matter how complex, would all have been prevented by that simple and pervasive rule.

> "People I've talked to about this say there's no way they'd fall for that, > but when someone from a trustworthy number calls, says they're from your > small town bank, and sounds incredibly professional, you'd fall for it, > too," Haughey said.

When someone from a trustworthy number calls, says they're from your small town bank, and sounds incredibly professional, you follow the exact same rule. Hang up. Verify the number. Call back.

Again, even the best of us make mistakes, so I'm not trying to be critical of the victims here. I'm just surprised is all.

<comment><USER60> > _always_ verify and call the number back

Fine in principle, but banks do call, and often have no direct dial, as a matter of policy, for whoever you're speaking to.

So it becomes verify the number, call back, and spend 30+ minutes in a queuing system before some lowly call centre worker on another continent incorrectly tells you they can't connect you to the xyz department.

It used to work before call centres and all the small banks became just branding on the front of one of the big 4. You were even allowed the phone number of the local branch! That's the UK market btw.

<comment><USER61> Yeah. I worked in banking during the crash. Upper mgmt literally told us to pretend we were XXX small bank (on a list of banks) if someone called and asked about it. Even though we were just large bank 1-4 that bought them.

</comment></comment></comment><comment><USER62> Most robo-callers feel like Phishing scams. I've been contemplating giving up my cellphone and just using a Calyx mobile data ([https://www.calyxinstitute.org](https://www.calyxinstitute.org)) and use Signal, email and Mumble only. Anyone else do something like this successfully?

<comment><USER63> I did it for 6 years when I lived in Germany. I had a data only sim card and a google voice US phone number.

Verdict: It's not doable if you want it to work 100%. And in the US I would say it's not doable at all because Android/dumbphone users are still using SMS instead of a messenger app like Whatsapp, so you have no way of communicating with them at all.

The biggest problem for me was online services that want to verify your account via your phone number. They don't understand not having a phone number. And about 20% of the time, they block VOIP phone numbers for verification purposes, so your google voice number won't work there either. Literally no way to move forward there other than ask a friend to let you borrow their number or use your burner phone or something.

You also can't sign up for Whatsapp without a phone number, but luckily it does work with google voice.

Google voice also doesnt let you set it up so your device gets incoming calls unless you forward them to a real phone number. So you can only make calls with it, not receive. Maybe some other VOIP solutions are better at this. The google voice app on iOS is pretty shitty.

Now that I'm back in the US, I had to get a phone number because messenger app adoption is very very low. iOS users are fine because iMessage is awesome, but for people on Android, there's just nothing. They still use SMS. Maybe you can get around this with VOIP, but I didn't want to hassle with it.

<comment><USER62> Thanks!

I'm not concerned about Whatsapp, and I figured I use Twilio for text messages. Out of service phones can still call emergency services, 911. My main concern is being "that guy" who everyone has to make exceptions for when contacting.

</comment></comment></comment><comment><USER64> I've had an Asterisk box for about 10 years now, mostly to deal with the tide of junk calls, and it has worked nicely. I first just blacklisted numbers (and sometimes whole prefixes), but now I use a CAPTCHA that handles the robocallers beautifully. Calls from known numbers get to ring through without the CAPTCHA.

Still, I've been paying too much for that crusty old landline, and finally got motivated to do something about it. I just ported it out last month, and the new VoIP service I'm using costs _less per month than what AT &T was charging just for Caller ID._ Even funnier, they offer telemarketer blocking like I've set up, at no extra charge.

Farewell and f*ck you very much, AT&T. You didn't even lift a finger to insure that the Caller ID I paid for was accurate.

<comment><USER65> Could you please point to guides / docs / references for setting this up?

Might make some good HN submissions ;-)

<comment><USER64> Here's a good starting point:

[http://nerdvittles.com/?p=75](http://nerdvittles.com/?p=75)

Of course, with Asterisk, you can get downright crazy if you wish.

<comment><USER65> A bit more a "getting started" guide than this, actually.

Hardware, configuration, concepts.

</comment></comment></comment></comment><comment><USER66> I haven't even had a debit card issued for my core bank account, and there is very little chance I ever would at this point. There just isn't a good reason to put my money at risk when I can use a variety of credit cards instead, and just pay them off every month. On the rare occasion I need cash, I can do a cash advance (with an associated charge....really useful motivation to avoid needing cash more than once or twice a year).

Unrelated, but I'm pretty sure I know what credit union they're talking about. Super nice place that is focused on the tech workers in the Portland area, and I've always had good experiences with them.

</comment><comment><USER67> We deal with this on a semi-monthly basis at the hospital I work at. We'll here from one department ("Hi, this is the Emergency Dept, all our phones are busy with a robocaller") then it will roll across other departments for about 20-30 minutes. The best our telecom team has come up with is to take the numbers, give to the FBI, and ¯\\_(ツ)_/¯. Last time, they had spoofed the number of FedEx so we couldn't even report that.

Most are very noticeable for being in Chinese and tying up multiple lines at a time. That's not really great though, like in the example, when it's all the phones in the ED.

</comment><comment><USER68> >That made Sasser pause. Wouldn't an actual representative from Wells Fargo's fraud division already have access to his current PIN?

No, nobody has access to your PIN, if you forget it you need a new card.

<comment><USER43> > if you forget it you need a new card

That's not true- you can reset you PIN if you go to a physical Wells Fargo location, I've done it.

<comment><USER69> Reseting a PIN is different from having access to the old PIN number. Obviously some system in the bank has to verify that the PIN you enter at an ATM matches the one you selected but resetting is a separate operation that does not require the original number.

</comment></comment></comment><comment><USER70> This highlights what I see as the biggest security weakness with banking and online services -- identity verification is only one-sided. Protocols like passwords , pins, biometrics, secret questions only authenticate the customer and not the service provider. moreover, no one is talking about this huge weakness. For there to be trust, both sides need to be trusted.

For apps, this could be a one-time code validated in the app. As a fall back there could be a unique shared "service pin" that gets rotated.

</comment><comment><USER71> Well, I think these scammers will always try to steal our money by using hundreds of methods and tricks. Almost everyday I could read dozens of complaints and reports filed at social media and also sites like [http://whycall.me](http://whycall.me) about phone scams. We need to keep informing our family about these scams. They are never getting tired of trying.

</comment><comment><USER46> One of the issues is that the scams adapt themselves to current "best practices" (use known information to reassure you, tell you not to divulge other pieces of information) - whereas the legitimate institutions use poor practices.

When I call my bank, they ask for verification by giving an account number, credit card and expiry details (!)

</comment><comment><USER72> Good news, everyone, the industry is moving towards SIP! Bad news is that it's just as bad. There's no improvements in security because that would break backwards compatibility.

Also, there's no one who wants to pay extra for security, and the telecoms industry have the virtue of laser-like focus on money.

</comment><comment><USER73> The sad thing is that I am old enough to remember when a call from the bank meant that the director of my local branch office or however someone I knew personally was on the phone, usually to ask to go to their offices because something needed my presence/signature.

<comment><USER20> I remember that, too. I was a huge deal if a bank called you.

Now, when I go into a Chase or Citibank or whatever branch with a question, all the "banker" guy does is call the same 800 number I would have called, and wait on the same 40 minute hold as I would have. They don't even have special in-house IVR anymore.

Meanwhile, I drink all their free coffee.

</comment></comment><comment><USER74> Why has Apple/Android not added the ability to reject (or at least send directly to voice mail) all calls outside of contacts, and make this the default setting?

Seems like this would solve almost all of these problems.

</comment><comment><USER75> It's a hard problem to solve since being able to set your own outbound caller ID number is so critical for the phone business. \- Call Forwarding \- Picking which trunking provider to send a call out -etc

</comment><comment><USER76> When receiving a call from your bank's contact centre, always thank them, hang up and call the number on the back of your card.

This should be the standard advice from banks to their customers.

</comment><comment><USER77> This is why I don't answer the phone unless it's a contact. Everyone else can leave a message.

<comment><USER78> Did you read the article? The Many people have their bank or credit union in the contacts. This won't help if they're spoofing a bank number.

> Cabel Sasser is founder of a Mac and iOS software company called Panic Inc. > Sasser said he almost got scammed recently after receiving a call that > appeared to be the same number as the one displayed on the back of his Wells > Fargo ATM card.

<comment><USER77> Might as well put your social security and pin number in your phone too. Bank phone numbers in your contacts are a huge vulnerability. Just Google them when needed... or you know, look at the card.

</comment></comment></comment><comment><USER79> I dont think i even heard about such issue in EU.

</comment><comment><USER80> Easy solution don't answer phone calls from those not in your contacts.

<comment><USER78> Huh? The caller ID was spoofed. Read the article.

> Cabel Sasser is founder of a Mac and iOS software company called Panic Inc. > Sasser said he almost got scammed recently after receiving a call that > appeared to be the same number as the one displayed on the back of his Wells > Fargo ATM card.

<comment><USER80> It didn't say.. wife, friend, mom, joe, etc.. you know people you entered into your contacts.

Personally If someone needs to get a hold of me outside of my contacts email or text me and I'll get back to you accordingly.</comment></comment></comment>


Openstreetmap, a global map for worldwide insight - <AUTHOR> https://blog.mapbox.com/openstreetmap-a-global-map-for-worldwide-insight-4e041cbf1ec1 <comment><USER2> Let me plug OpenLayers, which uses OSM and is way harder to use than google maps but once you stop hating on it you realize it can do a bunch of things that google maps really can't and is more versatile in numerous ways - ymmv as always. ([https://openlayers.org/en/latest/examples/](https://openlayers.org/en/latest/examples/)).

I've found it more useful for specific applications that I build because it's far more customizable. The map truly feels like it's part of the app and not just some mapbox or leaflet thing sitting on top of gmaps. Again, these aren't hard facts, just stylistic preferences on my part.

The ES6 is not really a dealbreaker if you're using something more traditional. I just make my own "map.js" that exposes the interfaces I need, then I transpile it and include it like anything else.

I know that sounded really complicated, but my package.json is 10 lines, that's it.

This way you can use it in a much more conventional classical way without jumping the whole project over to ES6 syntax.

<comment><USER3> How can I generate raster tiles myself for a specific region, so I don't have to use planet.osm?

I can find regions on geofabrik.

<comment><USER4> Most production raster tile systems use osm2pgsql + Mapnik. These are not easy to install. You may need to generate two or three sets of raster tiles for different pixel densities. The total number of tiles will explode past around zoom level 15. [https://switch2osm.org](https://switch2osm.org) is a good intro.

The newer way to do raster tiles is to actually generate vector tiles first, and then do the rasterization dynamically. Mapnik can do this, renderers like MapboxGL can be run in headless mode to do this as well.

Yes, I wish this was easier too.

<comment><USER5> In addition, modern browsers can display vector tiles directly. Mobile and apps have a somewhat harder time with this. [https://www.maptiler.com/](https://www.maptiler.com/) has a good introduction for this wrt Open Street Map.

<comment><USER3> Aren't those vector tiles a little heavy, since they're likely json?

Of course I can guess a lot of data can be removed and simplified, but still, PNG seem lighter...

<comment><USER6> It depends on the application, but I don't think they're necessarily larger in size. I believe the format is quite compressed (Mapbox Vector Tile/MVT, which I believe is a variant of protocol buffers).

Many vector tile encoders have wide flexibility in geometry simplification/removal depending on zoom layer and this helps big time with tile size. I find them to be quite nice in lower bandwidth situations because you can overzoom them and still have them look good: if you zoom in and the tiles for the next zoom level haven't loaded, the vector geometry is still able to look decent, rather than pixellated like a raster tile.

<comment><USER7> You're mixing up the formats slightly: MVT is sqlite with a particular schema; OSM raw data is PBF with a particular schema.

<comment><USER6> Isn't mbtiles sqlite?

<comment><USER8> [https://docs.mapbox.com/vector- tiles/specification/](https://docs.mapbox.com/vector-tiles/specification/)

<comment><USER7> Yep, versus [https://docs.mapbox.com/help/glossary/mbtiles/](https://docs.mapbox.com/help/glossary/mbtiles/) \-- I had them backwards. My confusion might have been because of the name similarities (mbtiles vs mvt), which took me 3 tries to even just type correctly.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> The conference this is advertising is rather buried in this long article. It's tomorrow, online and free, and the talks sound interesting and varied. Schedule below:

[https://2020.stateofthemap.org/](https://2020.stateofthemap.org/)

<comment><USER10> Thanks - lol, hopefully this comment doesn't get buried as well. mapbox, ESRI, Geotab, and Grab will have "sponsor booths" as well. See [https://2020.stateofthemap.org/#sponsors](https://2020.stateofthemap.org/#sponsors)

</comment></comment><comment><USER11> A confusion that I had at first before going further into the Openstreetmap ecosystem: OSM is not a ready to use app and some alternative to Google Maps the app, it's a lower level database on which front-ends renderings with a tileset can be built to serve different usages. If you go to openstreetmap.org you will not see much, but click on "Edit" and zoom in close and you'll get a better idea of the data layer.

Edit: to further clarify the stack, Mapbox is a collection of tools for creating maps from OSM data.

<comment><USER12> A really cool frontend for OSM is [https://mapscii.me](https://mapscii.me). You can try it out via:

        $ telnet mapscii.me

(Use arrow keys to move, and a/z to zoom in/zoom out)

I was totally blown away when I first connected to it.

<comment><USER13> In awe! You can also use the mouse to navigate around like on a gui map.

</comment></comment></comment><comment><USER14> For anyone looking to migrate to an OpenStreetMap-backed map and location data provider, [https://switch2osm.org](https://switch2osm.org) has a good overview of how, why, and who is offering services.

I'm partial to my own (in bio), of course, but I would be happy to answer questions for anyone looking to switch.

Respond or email me (also in bio).

<comment><USER15> Why is it hard to setup our own tile "provider" ?

<comment><USER4> Because user expectations are high for interactive web maps - zooming and panning should retrieve new data near-instantly.

OpenStreetMap is an unwieldy but not "big" dataset - it fits easily on a consumer grade SSD. You need to index the dataset so that retrieving a specific slice is extremely fast - doing point in polygon tests, clipping operations on source geometries that have tens of thousands of vertices, etc should not happen at query time. This inevitably means pre-rendering as much as possible.

In addition, this needs to work for every intermediate tile level when zooming out - each parent tile covers 4 child tiles, so you need some strategy for decimating the amount of data so that the tile sizes don't increase exponentially as you zoom out. This is beyond a pure computer programming problem and becomes a visual design problem as well - features such as roads or transit layers should form a sensible hierarchy with less important features removed.

I've been working on this class of problems for a couple years now and have a related presentation day 2 of the conference mentioned in TFA - details in bio if you'd like to talk more

<comment><USER5> > OpenStreetMap is an unwieldy but not "big" dataset

Do note that while not BigData big, it _is_ large. Your PostgreSQL database (postgis) on your macbook won't be able to import `planet.pbf` in any reasonable time (think: weeks). Your digital-ocean VPS won't have enough diskspace to process a weekly planet.pbf and the free or cheap tier of your RDS won't be able to handle planet.pbf either.

[http://download.geofabrik.de/](http://download.geofabrik.de/) (also one of the StateOfTheMap conference sponsors) is a good place to find "chopped up" downloads to avoid that: just get only your country, a province or even just one city. On my developer env I always run everything through with `luxembourg.pbf`. or `iceland.pbf`.Luxembourg-latest does still contain nearly 2.5 million datapoints: `osm2geojson luxembourg-latest.osm | wc -l #=> 2417784`

<comment><USER4> You are describing a problem inherent to using PostgreSQL, not OpenStreetMap itself. My presentation is specifically about my solution to this, which can easily import planet.pbf in 7-8 hours on a laptop with SSD, and can cut extracts for cities and countries like you describe based on minutely data:

[https://2020.stateofthemap.org/sessions/JDNTHK/](https://2020.stateofthemap.org/sessions/JDNTHK/)

[https://github.com/protomaps/OSMExpress](https://github.com/protomaps/OSMExpress)

<comment><USER5> Indeed, a lot is due to PostGIS. I'm using mimirsbrunn[1] a lot, lately, with Elasticsearch as storage; especially because it is fast. It does lack a processor that listens to changesets and imports those, though; so I still need to run a nightly rebuild of the entire database.

Thanks for pointing me to your StateOfTheMap session. I'll "attend" it for sure.

[1] [https://github.com/CanalTP/mimirsbrunn](https://github.com/CanalTP/mimirsbrunn)

</comment></comment></comment></comment></comment></comment><comment><USER16> Just wondering if I could get some suggestions from the community

I've been asked, preliminarily, by the lab I work for to produce an application that will overlay daily/weekly water quality measurements on a map. I've got no idea where to start as I've never done anything GIS - but I do like keeping things open source. Would this be something to integrate with OSM?

The problem seems simple and generic enough that I'd expect it can be done with zero programming. I just need to find the right place to feed in a table of coordinates and measurements

I know the problem spec is a bit vague, but what's a good place to start?

And if I do need to write an app, is there any way I could stick Clojure/JVM?

<comment><USER5> For more complex GIS-data exploration, visualisation and research, I'd suggest QGIS. [https://www.qgis.org/](https://www.qgis.org/)

It is not the most userfriendly (aimed at GIS professionals) but it does have a large, open and friendly community around it, making lots of tutorials, manuals, introductionary material and so on.

Edit: especially your type of "problem" is what qgis is good at: you have a CSV, maybe a postGIS database, some old scans of maps maybe; a government provided shapefile of the waterways and so on. And with qgis you can all project them over Google/OSM/Bing/Mapbox maps, mix, mash, filter, extract and so on. It is a desktop software, so publishing your result would probably mean "make some PDFs" or "render a set of PNGs" or so.

<comment><USER17> I'm a complete novice when it comes to maps, GIS, and all that. (Though I like to consider myself technically literate in general.) I had no problem getting started with QGIS for that stuff. It is fiddly, of course, but the software was clear and well documented enough.

</comment></comment></comment><comment> m-app The last time I looked for an alternative for Google/Apple Maps some months ago, I couldn't really find a decent OSM (or even Mapbox)-based app for iOS. Any recommendations from anyone?

I really like the web-based Openroute Service [1] that was shared here recently, but AFAIK this doesn't have an app version.

[1]: [https://maps.openrouteservice.org/directions](https://maps.openrouteservice.org/directions)

<comment> globular-toast Maps.me or Osmand. The latter is more powerful and not just a "Google maps replacement".

<comment><USER18> I found OSMand to be terribly slow on my old phone and maps.me sort of OK-ish in performance. My phone is quite old. Searching locations in both of them is not perfect. One sometimes needs to know how to search for things and treat the UI carefully, patiently waiting till it has finished showing results.

<comment> globular-toast Searching locations (geocoding) is never perfect. Google seems to be the best at it, though. Probably because they've put significant effort into doing that specifically and they simply have access to more data than any other organisation. OSM isn't about geocoding, it's about building a geographic database of the world. Geocoding is just one application and not one that seen a great deal of attention, relatively speaking. Personally I often use Google maps for geocoding if I have to but most of the time I already know where I'm going on the map so have no need for it.

</comment></comment></comment></comment><comment><USER19> I tried making an app that would leverage OSM late last year and was disappointed at the amount of false or stale information in there.

I went into the experience thinking it was the wikipedia of maps. But it's not, wikipedia has much better content control than this.

My theory is that it's too easy for random people to enter data into OSM. It should require some sort of validation of the contributor.

And each contribution should have a discussion, just like wikipedia talk pages. I know that sounds like a lot of talk pages but I believe some of those contributions require community discussion to improve.

<comment><USER18> It sounds like a good plan, however, there is the question of how you want to validate the map information.

Someone adds a street. What do you want to do to validate it? Is there some international OSM team, which goes to all the locations and checks, whether there is really a street? With Wikipedia articles it is simpler, because you can check sources mostly online or you have experts on subjects world-wide, not bound by location mostly.

A map of the world seems like sooo much work to keep updated, while many Wikipedia articles can stay as they are, if they are OK now, because they treat historical topics for example, or mathematical things. There are new developments in those areas as well, but no one will take a wrong road when driving, because the Wikipedia article was not updated. Or at least it is not likely to happen. By introducing additional barriers, the update frequency on OSM might be even lower. I wonder how many contributors there are for OSM maps. I have personally never updated a map there and have been too lazy to read up on how to do that.

One would have to find a clever way to validate map information, which does not inhibit participation.

<comment><USER20> The answer is crowd sourcing. Everything one person creates or modifies needs to be voted on by multiple people. After x votes and y percent in favour of the change it's visible to everyone. The x and y numbers could change depending on the user's reputation etc.

Think of it like the stack overflow "tasks" you are asked to do all the time: review this question, do this, do that ...

<comment><USER21> Because of the OSM data model, changes can't be really held in "unaccepted" state. One would run into editing conflicts[1].

On Wikipedia withholding edits until review works in some language versions [2], but because Wikipedia pages are "atoms" that stand on their own, they have it easier.

[1] [https://learnosm.org/en/josm/josm-conflict- resolution/](https://learnosm.org/en/josm/josm-conflict-resolution/)

[2] [https://en.wikipedia.org/wiki/Wikipedia:Flagged_revisions/Si...](https://en.wikipedia.org/wiki/Wikipedia:Flagged_revisions/Sighted_versions)

</comment></comment></comment></comment><comment><USER22> OSM is a really cool idea, and a fantastic dataset! For people curious about what it's like to use OSM in a huge company, a couple engineers from facebook were recently on a podcast discussing it: [https://softwareengineeringdaily.com/2020/04/17/facebook- ope...](https://softwareengineeringdaily.com/2020/04/17/facebook- openstreetmap-engineering-with-saurav-mapatra-and-jacob-wasserman/)

Some interesting tidbits: FB are hyper-conscious of "graffiti-edits" that can sometimes sneak into OSM, so they built a system to self-host the OSM data, which periodically and _selectively_ merges chunks of data from upstream, using fancy algorithms to flag "suspicious" edits upstream.

</comment><comment><USER23> I would highly recommend to use [http://maptiler.com/maps](http://maptiler.com/maps), they provide easy way, how you can customize your own map. You can also host it on their cloud. Really neat.

</comment><comment><USER13> Anyone able to suggest a free approach to pull up GPS coordinates based on an address search for an OSM/leaflet.js based app?

<comment><USER5> Are you looking for something self-hosted? Because there are tons (and tons) of SAAS "geocoding" services around already.

If self-hosting, have a look at this [https://wiki.openstreetmap.org/wiki/Search_engines](https://wiki.openstreetmap.org/wiki/Search_engines) overview.

I'm biased (I help with the development and build my latest project on top of it), but I love mimirsbrunn [https://github.com/CanalTP/mimirsbrunn](https://github.com/CanalTP/mimirsbrunn). Mostly because it is _fast_ , small and relatively easy to deploy (courtesy to Rust). It uses an old (2.x) elasticsearch as backend, so that is a major downside.

</comment></comment><comment><USER24> And this is my attempt at ranking the big french cities by pedestrian area : [https://villes.plus/piétonnes](https://villes.plus/piétonnes)

</comment><comment><USER25> This is a little tangential, but does anyone have a strong recommendation for a good ios osm based app? Strong cycling capabilities are extra appreciated.

</comment><comment><USER26> OSM is also one of the few remaining websites on the internet that allows bring-your-own OpenID 2.0 login! I put together a tiny personal OID server (plug: [https://gitlab.com/rendaw/oidle](https://gitlab.com/rendaw/oidle)) and OSM was one of the only public places I could test it...

</comment><comment><USER27> The last three or four backpacking trips I've gone on, I found the OSM data wasn't completely accurate or complete. In each case I went in and fixed it based on other data sources like Strava Heatmap, primary source maps or firsthand GPS traces.

OSM is good, but it's not magic. For critical uses, check a second data source!

<comment><USER5> But that goes for any map.

Maps are, by definition, outdated. They will have mistakes. They will have abstractions of our messy world that go awry at some point.

OSM is in some areas by far the most accurate and up-to-date source (which is als othe reason why for several areas, both Bing maps and Apple maps use OSM as source). In others it is not.

I often give talks about OSM and always use this: "Google, for example, wants to make profit, their maps are just another canvas to put ads on. This is not bad. But it does mean, that in places (I pull open a map of Tjad where Google maps show large areas of Nothing; Tjad, is a lot of nothing -sand, really- but it is obvious Google has no interest in making that map anything good) where there is no money to be made, Google won't drive around with streetview cars, they won't buy datasets to merge, and they won't spend effort improving or validating the maps there."

</comment></comment><comment><USER28> If I develop an app that uses openstreetmap do I need to pay a subscription to be able to download the map tilesets etc?

<comment><USER29> OSM is a dataset. That's free and open. There are different tile servers ([https://wiki.openstreetmap.org/wiki/Tile_servers](https://wiki.openstreetmap.org/wiki/Tile_servers)) but they each have a different policy ([https://operations.osmfoundation.org/policies/tiles/](https://operations.osmfoundation.org/policies/tiles/))

In a nutshell: you can't just use them in production for your app. Development shouldn't be a problem.

What you're talking about is precisely the commercial service that Mapbox offers. OSM (+ some extra stuff).

Alternatively, you're free to spin up your own tile server. That way you don't pay anyone else (but you pay your server).

</comment></comment><comment><USER30> I have contributed heavily to google maps but have recently tried to do same in OSM. However, that proves to be very difficult

<comment><USER31> I am quite curious what was the main blocker.

</comment></comment><comment><USER32> I've actually been creating a monetization strategy for my online website that lets users purchase map skins in the game.

</comment><comment><USER33> One feature that has impressed me is that maps are exportable as SVG. This does comes in handy once in a while...

</comment><comment><USER34> as long as they show part of my country as part of another country, i'm not touching it with a stick

<comment><USER35> Go and edit it!

<comment><USER8> Users that repeatedly edit contested boundaries are blocked from editing. So that doesn't help with the objection.

</comment></comment></comment><comment><USER36> You really believes this holds any competition against Google maps?

<comment><USER31> Car navigation? Locating shops? Generally no, and overtaking Google Maps is hard in this fields.

Hiking, cycling - Google Maps is not usable, at least in places that I visited, while OSM was great.

Doing anything interesting with data, like making own map, making map-based decorations (I made some laser-cut maps), research involving geodata, data analysis and anything more interesting - it requires access to data.

OpenStreetMap is allowing to do things completely out of scope of Google Maps, so in many cases it is not even competing.

But if you are individual driving car and you are not trying to eliminate Google from your life? Then Google Maps app is often superior.</comment></comment>


Apple doesn't use the letter O in its serial numbers - <AUTHOR> Any 0 you see is a zero, not an O. <comment><USER2> It was common practice once upon a time to _never_ put either an 'O' or an 'I' in serial numbers. Back in the 60s-80s, it was also a common practice to put a slash through a zero to signify that it was truly a zero.

</comment><comment><USER3> And the reason for posting this?</comment>


Understanding the "improved" in VIM - Super User Blog - <AUTHOR> http://blog.superuser.com/2012/03/06/understanding-the-improved-in-vim/ <comment><USER2> I don't see the point in copying this answer whole into a blog post. It does not help to understand the "improved" in vim, as Jim Dennis' answer says he does not try to.

A blog post that quoted from Jim's answer and gave pointers to further information about vim's extensions would have begun to justify the title.

For reference value - HN post linking to Jim's answer: <http://news.ycombinator.com/item?id=2911930>

</comment><comment><USER3> A blog post consisting only of a copied stackoverflow answer. How exciting... NOT.

<comment><USER4> Doesn't even provide extra information or analysis of the answer.</comment></comment>


Heidegger, the homesick philosopher - <AUTHOR> https://www.newstatesman.com/world/europe/2019/09/heidegger-homesick-philosopher <comment><USER2> > The book was a refutation of the distinction between mind and body, and all > the fallacies that follow. "I think, therefore I am" was, in Heidegger's > reckoning, a "naive supposition", an anthropocentric conceit that went all > the way back to Plato. Humans cannot be imagined either outside or prior to > the world into which they are "thrown" – a bed of land, language, tradition, > history and more. Heidegger believed that only once this embeddedness, this > "Being-there" (Dasein) in the world, is recognised can it be restored to its > fullest, most authentic form, and the "forgetfulness of Being", "the > homelessness of man" and "the Fallenness of the world" overcome.

I actually don't see that "cogito ergo sum" and Heidegger's "thrown-ness" are so contradictory. Descarte wanted to find a claim irrefutable by logic on which to found his subsequent thought. And he did. The fact he went on from there to separate mind and body in a way that Heidegger's thrownn-ness doesn't require doesn't mean the ideas aren't compatible.

The problem with Descarte's thought is not the first but second therefore: I think therefore I am therefore my mind is separate from my body.

<comment><USER3> No, Heidegger explicitly attempts to refute and attack Descartes's supposition "cogito ergo sum" (the first therefore). And one can read all of Heidegger's early philosophy as an attempt to undo the errors started by Descartes: Heidegger faults Descartes with stymieing all of modern philosophy with a false first presupposition.

Heidegger's fault with Descartes lies in the very first two words: "I think." Heidegger does not believe that the "I" (Dasein/Being) is the thing that thinks (directly at least). In Descartes' world, humans are "res cogitans" ("thinking machines"): the "I" is that which thinks. For Descartes, there is some _thing_ that is doing the thinking. In Heidegger's world, there is not some mysterious being that thinks, but rather the "I" is the experiencing/thinking itself (the "thrown-openness"). This is why Heidegger always uses verbs/gerunds to describe Being.

For Heidegger, the simple statement "I think" cannot possibly be true because there is no "I" behind the thinking. For Heidegger, the analog basic first- claim would instead simply be: "there is thinking" (the "ego"/"I" as we think about it is the "thinking" itself for Heidegger).

<comment><USER4> I agree. That is why Heidegger says that dasein, which roughly speaking means human being, is being-in-the-world, rather than a metaphysical substance outside the world that posits ideas about the material world.

The people who think Heidegger's philosophy is compatible with the Dartesian ego are reinterpreting his concepts to fit their own ways of thinking.

</comment></comment></comment><comment><USER5> _Once discredited by his association with Nazism, Martin Heidegger is enjoying a posthumous revival. So what is it about his ideas that resonate with so many?_

It seems like the situation is exactly the opposite. Heidegger was considered a leading throughout the 20th century and it is only in the last few years that the intensity of his NAZI affiliations has become evident (as well as the degree to which he mix philosophy and politics), leaving his philosophy much more suspect.

<comment><USER6> It hasn't been just the last few years. Heidegger's Nazism became an issue already in the 1960s, when other intellectuals like Paul Celan struggled to reconcile his philosophical insights with his actions during the Hitler regime.

<comment><USER7> Marcuse was corresponding with him about it in 1947.

[https://www.marcuse.org/herbert/pubs/40spubs/47MarcuseHeideg...](https://www.marcuse.org/herbert/pubs/40spubs/47MarcuseHeidegger.htm)

<comment><USER8> Heidegger's response looks rather weak to me, but note that Marcuse also didn't get his point about the treatment of East Germans by 'one of the Allies':

Not too long ago, I saw an exhibition on the 'Wolfskinder'[1], and what happened there looked pretty genocidal to me (though of course it wasn't the same as the meticulously planned 'Endlösung').

[1] [https://en.wikipedia.org/wiki/Wolf_children](https://en.wikipedia.org/wiki/Wolf_children)

</comment></comment></comment></comment><comment><USER9> Heidegger perpetrated nonsense like "Das Nichts selbst nichtet" (The Nothing itself nihilates) [1], which positivists and empiricists rightly disdained. Obviously I am firmly in the analytic camp. If you like a bit of mysticism in your philosophy the later Wittgenstein is your man, especially his thoughts on language games, intersubjectivity and forms of life. A far more incisive set of philosophical tools for understanding notions of community and place than Heidegger's Blut und Boden bluster. IMHO of course!

[1] [https://maverickphilosopher.typepad.com/maverick_philosopher...](https://maverickphilosopher.typepad.com/maverick_philosopher/2015/03/heidegger- nothing-and-the-analytic-continental-schism.html)

<comment><USER10> > _Obviously I am firmly in the analytic camp_

Obviously. But it's not the only camp, nor it's some settled question. It's just the most popular in anglosaxon countries...

</comment></comment><comment><USER11> Does Heidegger has had an added value on the world? He is very known which does not say anything about if he is a bullshit artist or a real truth seeker.

Could anybody explain one of it's new ideas? Did he just improved existing ideas?

I believe he is a bullshit artist but I would love to be refuted.

</comment><comment><USER12> Even though Heidegger was a nazi, he had a close relationship with Hannah Arendt, who was a Jewish political philosopher. Weird to conceive of holding nazi ideology in your head whilst dating Arendt.

<comment><USER13> Slightly tangential, but Hannah Arendt, in addition to being a political philosopher, wrote a fairly thought-provoking tome called 'The Origins of Totalitarianism'. Worth a read if one is interested in such things.

[https://en.wikipedia.org/wiki/The_Origins_of_Totalitarianism](https://en.wikipedia.org/wiki/The_Origins_of_Totalitarianism)

I'm not completely well-versed in Heidegger, but is it possible that he did not hold his Nazi beliefs so close to his heart that true love (corny, I know) could not usurp those feelings? I would not suggest that a man such as Heidegger would not be forthcoming in his beliefs, but I do think it's possible that him (and others throughout history) adopted political beliefs partially out of convenience. Sometimes, it's difficult to tell the lengths to which someone holds their convictions.

<comment><USER12> Yeah I've read about half of origins of totalitarianism. Really unique book. One interesting thing I read is how she shows that colonialism from the dominating powers was quite often rooted in capitalist goals. And so she shows how underpinning totalitarianism and powers spreading over other countries was the result of greed by those in power. Makes sense, but I never think of how capitalism could lead to that.

</comment></comment></comment><comment><USER10> > _And yet, Heidegger still stands as one of the commanding figures of 20th- > century philosophy. His heirs include Arendt and Emmanuel Levinas, Jean-Paul > Sartre, Simone De Beauvoir and Jacques Derrida. His denial of mind-body > dualism – his belief that we are rooted beings, inextricable from time and > place – continues to influence fields as diverse as architecture, ecology > and art history. Readers are left to discern whether the essence of his > ideas leads inexorably to fascistic thinking or whether, in that aged > refrain, the life can be separated from the work, so that we are free to > forage as we please._

There's a third option, that didn't seem to pass through the writer's mind: that what they call "fascistic thinking" is a constellation of things, many of which were invoked in the past without negative consequences, and most would still find totally find, were they not today tarnished by association with a mass murdering regime...

The fascists also pushed major welfare reforms for example, and nobody today (hopefully) considers welfare something fascist in the bad sense...

The same can be said for all kinds of philosophical ideas (including of Heidegger). Just because they were themselves adopted by Nazis doesn't mean adopting them brings upon a Nazi regime, antisemitism, or mass murder...

</comment><comment><USER14> For more on Heidegger and any other philosopher, I highly recommend the podcast "Philosophize This", it's helped me understand philosophy better than anything else.

</comment><comment><USER15> >>>At the time of writing, "Martin Heidegger" is one of only 174 English Wikipedia pages –out of a total 29 million – officially flagged as "incomprehensible" by the site.

If nobody can understand him, he's not worth caring about.

<comment><USER16> If you want to get a handle on Heidegger, I recommend working through Being and Time while listening to Prof Hubert Dreyfus's UC Berkeley lecture series, 'Philosophy 185 - Heidegger'. I heard them on ITunes U long ago, but they are also available on archive.org [0].

Dreyfus wrote a critique of AI, "What Computers Can't Do" in the 70s, and talks a bit about a Heideggerian approach to AI in his lectures which may be of interest to a few people here.

[0] [https://archive.org/details/Philosophy_185_Fall_2007_UC_Berk...](https://archive.org/details/Philosophy_185_Fall_2007_UC_Berkeley)</comment></comment>


Ask HN: What do you do with your Raspberry Pi? - <AUTHOR> Hey all,<p>I recently got a Raspberry Pi as a gift. For those of you that have one, I'm curious what you've done with it. I'm contemplating a media server but I'm open to more interesting ideas. <comment><USER2> We use it as sort of a 'programmable, smart serial port'. Because RS-232 serial ports are rare these days on laptops and even desktops, its easier to use the RPi as a bridge between PC applications and electronics/hardware devices which use RS-232. The PC application connects to the RPi using a direct TCP/IP cable. Its a bit more complicated than that, but that's the general idea.

</comment><comment><USER3> A file server with open wifi placed somewhere in an urban downtown setting. See what people share.

</comment><comment><USER4> I'm about to set them up for the company I'm working for as cheap remote servers. Each of them will have an API for me to connect to from the main server. Cool use case, and fun. Total Rpi used will be about 20-ish.

</comment><comment><USER5> I setup OpenELEC on one Pi. It connects to a network server with my media files on it. Portable entertainment system for any TV I hook it to. I have another that I am trying to figure out what to do with.

</comment><comment><USER6> My mom had a stroke recently and is paralyzed on the right side. I'm using the Raspberry Pi to make her an exercise machine to keep her from muscle atrophy.

<comment><USER7> Sounds interesting! Would love some more details.

<comment><USER6> I got an old Craftman garage motor. It has the torque I'm looking for. I got a LifeGear rowing machine on Craigslist for $50. I like this one because the seat and track is used for the leg exercise, moving the leg back and forth. The extra arm and pullies I use for the arm exercise, using her good arm to move the other arm. That way, both arms are getting exercise. The base is built out of 3 in. PVC pipes. Since she's only 115 pounds, it's more than enough to hold her weight. And PVC are super easy to work with. Using a Raspberry Pi and a Gertboard to control the motor, I can set how far back and forth to move the leg assembly. My next step is to hook the Raspberry Pi to an iPod and let my mom control the speed and duration of the exercise.

</comment></comment></comment><comment><USER8> Set it up to boot into a web page on startup and refresh every ten minute.

In theory, I'll have useful information on the webpage. Right now I have a picture of a cat.

</comment><comment><USER9> Besides maker projects I see that the R-Pi is many times used as a media center with XBMC.

<comment><AUTHOR> Yeah, that was my initial idea but the current naked state of the Pi has me hunting for nice cases.

</comment></comment><comment><USER10> ([http://crushbeercrushcode.org/2013/03/developing-the- rogue-p...](http://crushbeercrushcode.org/2013/03/developing-the-rogue-pi/))

</comment><comment><USER11> A friend and I share one that's hosted at his house, we use it as a mumble server, and plan possibly to host other shared services.

</comment><comment><USER12> in the process of making a better-than-stock security system for the land rover defender.</comment>


Atom netbook chip propels Intel to top of market - <AUTHOR> http://www.thestandard.com/news/2009/04/01/atom-netbook-chip-propels-intel-top-market

<comment><USER2> Apple not in the netbook market? But what about MacBook Air? So what if it's five to seven times the price of a netbook from another vendor? It's got insanely great, lickable design!!!</comment>


Time of origin for the international borders - <AUTHOR> https://moverdb.com/world-border-age/ <comment><AUTHOR> the original discussion (quite verbose) could be viewed here,

      https://www.reddit.com/r/MapPorn/comments/7ndxz9/i_tried_to_find_the_date_of_origin_for_every/ds134a9/</comment>


Ask HN: Have you moved beyond Java 8 in production? - <AUTHOR> Have you moved to Java 9 , 10 or 11 in production ? Yes / No ?  How big is your source code ? Is it a legacy code ? Does it have automated tests ? How much time did it take for this activity ? <comment><USER2> No. Still stuck to Java 8. We still didn't decide what to do. Probably move straight to Java 11

</comment><comment><USER3> Not yet. We have to check the stability of the build with Java 11.</comment>


Too Many Passwords and No Way to Remember Them. Until Now. - <AUTHOR> https://www.nytimes.com/2013/06/06/technology/personaltech/too-many-passwords-and-no-way-to-remember-them-until-now.html?pagewanted=1&_r=0&smid=tw-nytimesbusiness&partner=socialflow <comment><USER2> Is this a sponsored ad for Dashlane?</comment>


SOCKMAP – TCP splicing of the future - <AUTHOR> https://blog.cloudflare.com/sockmap-tcp-splicing-of-the-future/ <comment><USER2> Articles like this are my very most favorite kind. The scientific approach combined with the never ending quest for more efficient and higher performance from software!

I love everything about it!

<3

</comment><comment><USER3> Thomas Graf, a Cilium founder, made some comments on Twitter around this:

[https://twitter.com/majek04/status/1097485987054346240](https://twitter.com/majek04/status/1097485987054346240)

<comment><USER4> For those that don't want to jump to the twitter feed, we should be expecting a follow-up as there should be a push addressing the data loss and allowing changes to attempt speed enhancements without data loss.

Good, wholesome, internet collaboration right here.....

</comment></comment><comment><USER5> How is backpressure handled in the SOCKMAP solution? The description sounds like it just attaches all incoming buffers to the outgoing part of the socket irrespective of the number of already buffered data. That could be bad, if it means the memory usage is unbounded.

The other solutions definitely all would block if the send buffer is full.

Apart from that question it was interesting to learn that io_submit actually works on sockets too. I definitely need to read more about this one.

<comment><USER6> There are couple of interesting question:

\- backpressure

\- what if both userspace and SOCKMAP are doing read() on a socket?

\- can one use SOCKMAP to splice only a selected amount of data, and pick up the rest with read()

\- What are the parser/verdict program semantics. What can they do.

\- what is the SK_MSG abstraction, and how to benefit from it.

and more... some of this is discussed:

[http://vger.kernel.org/lpc_net2018_talks/ktls_bpf_paper.pdf](http://vger.kernel.org/lpc_net2018_talks/ktls_bpf_paper.pdf)

On io_submit, we wrote about it here:

[https://blog.cloudflare.com/io_submit-the-epoll- alternative-...](https://blog.cloudflare.com/io_submit-the-epoll-alternative- youve-never-heard-about/)

TLDR: it allows for batching, and with IOCB_CMD_POLL can be used as epoll alternative.

<comment><USER5> Thanks for all the articles! I read the one about io_submit in the meantime. I actually hoped it would be as async as the API suggests, so it seems a bit disappointing for my use-case. Do you know if when I would schedule multiple writes via io_submit, whether it would block until all sockets have written something, or only until at least one has written something?

I guess the fact that one has to guess and try how those APIs behave makes me most nervous and would make me prevent from using those. An async IO system should be very well-behaved, and not block at arbitrary points.

</comment></comment></comment><comment><USER7> Feels like we're heading to a future where half of userspace will recompile itself as BPF and upload itself into kernel space to be executed there

<comment><USER8> Jokes aside, I wonder how much time will pass until people start writing kernel drivers in BPF

<comment><USER9> XDP is sort of that for the network subsystem. (Though it doesn't allow you to implement drivers, "just" protocols.) Next step could be filesystem stuff, then libvirt drivers, etc.

But BPF is no that versatile, but at least it has a stable ABI.

</comment></comment></comment><comment><USER10> Any reason this article completely skipped over the userspace tools like DPDK and Netmap (there are many others). Considering cloudflare uses a customer version of nginx using the dpdk stack?

<comment><USER6> Apples and oranges. Most important problem with DPDK and Netmap is that they require a dedicated network card. We don't have a network card to spare for each of our applications. Read on more:

[https://blog.cloudflare.com/kernel- bypass/](https://blog.cloudflare.com/kernel-bypass/)

[https://blog.cloudflare.com/single-rx-queue-kernel-bypass- wi...](https://blog.cloudflare.com/single-rx-queue-kernel-bypass-with-netmap/)

Also using dpdk and netmap kills usual tooling (from basics like tcpdump). We very much like iptables, xdp, conntrack, syn cookies and other technologies deeply embedded into linux kernel. Doing DDoS once on linux kernel is hard enough. We don't want to redo the logic for each of the possible kernel bypasses technologies:

[https://blog.cloudflare.com/why-we-use-the-linux-kernels- tcp...](https://blog.cloudflare.com/why-we-use-the-linux-kernels-tcp-stack/)

[https://blog.cloudflare.com/syn-packet-handling-in-the- wild/](https://blog.cloudflare.com/syn-packet-handling-in-the-wild/)

</comment></comment><comment><USER11> This article had me all excited until they got to the benchmarks. Hopefully this is just some design deficiencies and not something terrible like running a BPF bytecode is just plain slower than a couple of context switches.

<comment><USER6> I really really wanted to prove SOCKMAP rocks. Oh, well. Not just yet. In one of the linked videos the SOCKMAP authors say they didn't optimize part of the code. So there definitely is plenty of room.

I don't see any fundamental reason why SOCKMAP wouldn't be fastest. It's just a matter of putting an effort into it.

For example, we noticed the poor splice(2) performance is due to a spinlock. We need to figure out just why this happens, but it doesn't seem like a major problem. Probably just a trivial regression.

<comment><USER11> I really appreciate the effort you put into doing the benchmarks. Reading the first half of your article I was excited but also slightly dreading that I'd have to go to the trouble to create and run the benchmarks to see if it was worth the effort.

</comment></comment></comment><comment><USER12> > The naive TCP echo server would look like:

        while data:
            data = read(sd, 4096)
            write(sd, data)

Not if that's the write syscall, since it can return with fewer bytes than requested having been written. The full C code detects this case and crashes, which looks totally wrong.

The Python-ish example should, at the very least, use sendall. But even that is potentially suboptimal.

</comment><comment><USER13> I'm surprised that for something this simple there isn't an easy to use approach through netmap and friends.

<comment><USER6> We specifically want to splice userspace TCP sockets. The unix way. I'm also not a fan of custom TCP/IP stacks.

[https://blog.cloudflare.com/why-we-use-the-linux-kernels- tcp...](https://blog.cloudflare.com/why-we-use-the-linux-kernels-tcp-stack/)

<comment><USER13> I see the opinion, but the kernel developer in me thinks that perhaps it would be better for everyone if the answer to such narrow, performance focused use cases was not "let's develop an exotic kernel interface that doesn't really work" but rather "go buy hardware or do it in userland".</comment></comment></comment>


Looking to hire an intern - <AUTHOR>

Hey,
I am looking for some reasonably "young" _and_ talented programmer guy to hire.
First project is pretty simple and could be fun to work with — there are some chances to face with scalability issues, funny tricks, non-mainstream technologies.
I am an experienced developer, so I would like to start building own team designated to create interesting application.
Scope of technologies to be experienced (or not): Ruby, Merb, Javascript, Erlang, AMQP, Io, Lisp, ...
If interested, please drop me an email at firstname.lastname@example.com
Thanks. <comment><USER2> Can the intern work remotely? If not, where are you located? Does the programmer have to be "young" and a guy?

IMO, the best place to find an intern like you're describing is the Computer Science department at your local University. I cold called a well-respected CS professor and ended up with the best programmer I had ever hired. She started full-time three months later.

<comment><AUTHOR> As for now I am considering only remote interns, since I am traveling a lot this year. He or she should be "young" in terms of creativity/brains/etc.

I don't have any _local_ university :) But anyway that's a good idea.

</comment></comment><comment><USER3> Not sure where you're located and whether hiring laws apply to internships at startups, but you should consider posting the qualifications you'd like in the ideal candidate and see who shows up -- regardless of age and gender. Who knows, you might be surprised!

<comment><AUTHOR> The only qualification I really need is being smart person and have some preliminary experience withanything funny like Ruby, or Lisp, or Io, whatever :) Gender and age are not THAT important (see comment above)</comment></comment>