Call for a Better Web - <AUTHOR> http://callforabetterweb.org/

<comment><USER2> Sigh...where to start?

First, I applaud your passion for making the web a better place, and for being willing to put yourself out there and be open with your views.

That said, there's a number of problems with what you're saying and the proposed solution, but let me point out just a few:

1\. Normal people don't care. Seriously, my mom uses a handful of websites and doesn't really care about any of the problems you mention. If a solution were offered and it was more convenient, she might use it, but it's just not a big deal to her.

2\. Identity and data centralization seem to offer a lot of security risks and the philosophical problem of putting all that data into the hands of one company, or even just a few companies. Making an open, distributed standard sounds good, but in practice, I think a few companies (Google, Microsoft, Facebook, Amazon) would end up handling the gateway role for 95% of users, which puts you in an even more dangerous position.

3\. The big players have little incentive to lower barriers to entry, and you have a chicken/egg problem in trying to force them to 'adapt or die'. Also, see #1.

4\. If OpenID and OAuth aren't working (agree on the 1st, not sure on the 2nd), why not, and why would this be any different?

5\. I don't see _any_ way of implementing something like this over the next 50 years without either a) government mandate, or b) every internet giant getting involved. As I pointed out above, the internet giants are unlikely to do this, and the government getting more involved in the web is the last thing we need.

I think some of the problems you pointed out are legit, but I'm not sure that this kind of a system is really any better. It seems you'd be swapping one set of problems for another, and the new set of problems would seem to make the web extremely vulnerable to being controlled by a few large organizations, or the government. Over time, I see this kind of centralization and "perfect system" model resulting in stagnation and oppression.

<comment><USER3> "Sigh...where to start?"

I wish you wouldn't have started off with that. It's insulting and doesn't add to the discussion. Just because you see the author's conclusions as somewhat naive (which you've articulated) doesn't make it OK to belittle his effort. FWIW, Other than that snide start it's a thoughtful post.

<comment><USER2> Wow...I really didn't mean it this way at all, but now that you point it out, I can see what you mean.

What I meant was that I feel the same way about some of the issues he raised, and I think that there are lots of large-scale improvements that could be made on the web, but the scope of the problem makes it overwhelming to deal with.

The "where to start" piece in particular sounds bad, but I just meant that I wasn't sure how to articulate the problems I see with his solution. I get that it doesn't come off that way, especially now that I read it. Apologies to the author.

I didn't mean to belittle his effort in the least. It's a noble task to try and effect change in such a large domain because you believe in it.

<comment><AUTHOR> No need to apology, I did read that premise the way you explained it right now -- might have been naive now that I think about it. ;-)

</comment></comment></comment></comment><comment><USER4> Hiya. Mind if I make some suggestions on how you can write better in professional communications?

Lead with your strengths. Your first paragraph, which is the most important one you will write because it is the one that determines whether the rest of your piece gets read, is filled with self-inflicted strikes against you.

 _English is not my mother tongue and I'm not a great writer, so I am borrowing the words JFK used in_

There is a place for modesty and self-effacement. It is not during proposals.

The quote from JFK does not give me a reason to entrust you with money. That suggests cutting it. Ruthlessly eliminate any distraction from the goal.

 _First of all: I to say I have applied for Winter 2010 YC funding with this idea (still have to make a video). The problem is I don't think this is gonna get funded for two reasons: I have no team mates (YC tends to fund teams composed by 2-3 people) and I don't have any solid idea on how to make it profitable._

Here you are again telling me how you're not the right man for the job.

 _So since my desire for a better Web to live and work in is kinda huge I am writing this article hoping that maybe it's going to be an inspiration for someone else, or act as a catalyst. Or just to state the obvious. Whatever._

In addition to not being the right man for the job, you're diffident about even wanting to do the job. You are not projecting the image of a driven, with-it individual who is going to take a difficult technical, social, and marketing problem and solve it, making very rich rich men out of everyone associated with the project.

Look how differently your first paragraph reads from my reimagining of it:

The Internet as we know it is _broken_. Dozens of accounts per user -- broken! Web services that can't speak to each other -- broken! Our lives and friends scattered over a hundred web sites -- broken! Our identities owned by service providers -- broken!

We can fix the Internet. It will not be easy. Worthwhile things rarely are. The fix is a federated identity gateway, built out of technologies which are already accepted and in common use. The rest of this proposal will outline a sketch of what the federated identity gateway is, how it fixes the Internet, and why the first group who succeeds in building it will realize profits beyond the dreams of avarice.

Commentary: start with the problem, offer a solution, whet people's appetite for reading about the solution. Don't focus on yourself, most particularly not on your faults.

<comment><USER5> I felt an honesty and openness in the article which your rewrite (which I'd probably have stopped reading right around "dreams of avarice") lacks. The article isn't a plea for funding but an attempt to start a dialog about how to solve the perceived problem.

It's not all about money, and "making very rich rich men out of everyone associated with the project" is antithetical to the motivations conveyed by the piece.

</comment></comment><comment><USER6> I'd like to remind everyone of a rule related to this: please don't submit your YC application to HN. The reason is simply that if everyone did this, they'd drown out the ordinary content: if you divide the number of applications we get by the number of days between now and Oct 26, the result is many per day.

I left this one alive because it's arguably just over the line. It's really more of an essay that mentions they're applying for winter 2010. But I took the ref to YC out of the title.

<comment><USER2> Is that the only reason? If so, would it be possible to offer a public place to view apps that was separate from the main page? Judging by the popularity of the "review my startup" posts, I bet tons of people would be interested in reading them.

<comment><USER6> Honestly, I don't know. That problem was bad enough that I didn't think further about what other bad (or good) consequences there might be of letting people make applications public.

My gut tells me it would be a bad idea. I sure wouldn't have done it as a founder, and if only lame groups did this, there would be no upside, only downside. But I could be wrong; I haven't thought more about it than what I just wrote.

<comment><USER2> What if there was a high karma threshold for viewing the apps? Like 1000 or something.

<comment><USER7> I think 1k is too high. > 100 would probably be enough to get rid of trolls. It's not hard to get to that point, but you have to put in legitimate effort to do so.

</comment></comment></comment></comment></comment><comment><USER8> I am glad to see some more ambitious initiative coming from Italy. Italian culture is not really entrepreneurial (I've spent the past year in Como). That would explain the "one founder" issue you're having.

I like the questions you are raising. I have written about them before and have started playing with my own approach. It is a big project, but unlike yourself, I would not be concerned much about applying to YC with it. YC is not a research incubator but a business, and no matter how cool the people seem to be, they're after the money. Nothing bad, it's just capitalism. YC makes most of the money from the VCs, so they need you to have something that will sell (to VCs). It's a very smart business model that they're running.

If you are really passionate about these issues, you need to build a prototype or specification and throw it out on the web as an open source to get support. I see the possibility of a viable business model in the authentication scheme.

That said, I disagree with your approach to tackling the problems you listed. Your issues are valid, but not the most important. You have not identified the core problem. Consider this. You publish something on the web, the website goes bankrupt or decides to shut down. Your data goes down with it. Your article, your comment, your photo, blog post, this comment I'm writing. We've given all the power of data preservation to the web sites. The web is not preserving it self. If we see it at the _biggest library_ of all, just imagine this, every day a part of it gets burned down.

Making data independent of servers will solve most of the issues you raised. Your address book and contacts belong to servers and web apps, as you said, so you don't manage them. If you were to own the data yourself, and the webapps only managed and used your data, you would have a single point of authentication, single address book, single stream of your produced content.

Think of the desktop vs web app paradigm. We need a platform for applications on the web that will be based on user content. You own your data, but the webapp only uses it to add functionalities. You install a webapp onto your data just as on the desktop. You delete an application (or detach from your data). This would be a new paradigm of the web, where all the control is with the user, the user base is unique on the web without clustering, and applications are just that.

Emails are nothing else but user generated content. We tend to see it differently, but it is absolutely the same, the servers own it. I wrote recently an article about emails describing how much we don't have control over them:

<http://www.aleveo.com/ideas/decentralized-email>

You do not own your emails. The problem I want to stress is that, as long as someone else owns them, you don't. If no one owns them, you might claim full control. It is the benefit of decentralization.

If you take a route of making another central point of aggregation and data control, you have simply contributed the system you want to change. I would suggest you start thinking in the decentralized direction.

As you said, the web has issues, but you can't build on top of it if you want to change, you need to go lower.

We can take this further if interested dejan dot strbac at aleveo dot com, I will publish the whole thing on www.aleveo.com when I am done with the draft.

I wish you much success with the YC application, I couldn't agree more that such fundamental projects need to be supported rather than useless web bubbles.

</comment><comment><USER9> What the author is hinting toward need not be centralized entity that stores all your data, the way I read it his aims were quite the opposite.

He is right that we should be able to have this centralized data source, but it would likely be one source for our contacts that we want on our phone, one other source for our online connections of a certain type, and a separate source for our photos, etc. What is necessary is one point where we can find out where the user stores his different data, an shared understanding of what the different data is and how it is represented.

I also applaud you for recognizing that the way things work is less than ideal, and for making a noise about it, because the lack of that noise is what deters people that might have the same thought pop into their head from continuing the train of thought and acting on it.

To those who continue to point out that the author didn't make a great proposal, he wasn't trying to make one, in fact he explicitly said that he's only trying to make a noise, and although he wrote as though he was looking for financial support in his idea, I think his confusion between proposal and making a noise about it was a decision to show that he believes in his idea enough to take the responsibility for it if no one else will, which is a necessary show of belief, because these problems have existed for ages, and then things like openID came along acting like they're about to solve them, and then completely miss the point, so I'm sure he, like myself, believes that people need to hear a louder message to counter their belief that these existing efforts are doing something about the problem, they aren't. Yes, what you say is indeed a more ideal picture of the web, it will have it's downsides, so it probably won't feel the way you've see it in your dreams, but if your sole purpose was to make a noise about this issue, to point out that those responsible for the cutting edge of this area have been found wanting then you may rest assured that you have made your point.

I have also recognized this problem a long time ago and have been working for a little while in the area of social networking systems and this has indeed been part of my ideal picture as well, so hopefully it helps you sleep better at night knowing someone agrees with you and is working on it.

Cheers.

</comment><comment><USER10> _a system you would put your stuff on. You would then be able to authorize (think OAuth) people, websites, organizations and services to access subsets of your data._

A system for personal data... why does that sound familiar? I think it's the word personal...OH! I know! _Personal Computers_! Remember those silly things where you could own your data and run whatever the fuck you wanted and weren't a slave to random updates made on some remote server?

</comment><comment><USER11> Sorry, for some reason this post touched a nerve, and not even because I disagreed with a lot of what was said. Like ryanwaggoner said, props on putting this out there, its obvious you care a lot about the future of the internet and are genuinely trying to make it better.

My problem is with the attitude that the internet is 'broken' and that we should just redo it. That, and the suggestion that someone should give you money to play around with hypothetical e-utopias.

Anyway, my rebuttals:

1\. Hundreds...really? If you regularly use more than 100 accounts, that puts you in the top .1% of internet users. Normal people just let firefox remember their passwords and also probably spend more time outside.

2\. API's, facebook connect, openid. If I meet someone at a conference, I spend 30 seconds each adding them to twitter, linkedin and maybe facebook. Do I really need (or want) to automatically see their flickr feed?

3\. Again, the multiple modes of content consumption is perfect. I'll friend you on facebook if I care about you socially, I'll add you to my rss if your blog interests me, and I'll follow you on twitter if you're not terribly annoying. We all get to apply filters to everyone else.

4\. Totally agree, improved data portability would be great.

5\. "We should stop building new social networks, services and adding entropy to the system. We should stop trying to patch a model that has proven multiple times to be broken by design."

Umm, what?

I couldn't be more excited about the future of web apps and services. The internet is one of the only places where the free market is truly at work. Its glorious. Entropy is a problem, which is why we've seen recent efforts directed at reducing it, but at the end of the day the web, like any market, is about value creation and capture. You don't even mention capturing value, which is why pg, or anyone else, is not likely to fund you.

</comment><comment><USER12> I think you are conflating a call for action with an idea for a startup. To be more effective you should focus on one of these only.

As for your proposed solution, such services already exists, i.e. webfinger which Google may be supporting in the future.

So the challenge is really, how to enable widespread adoption for webfinger or something similar. If you have an ingenious idea how to support that, lets hear it. Because you are right, it would mean a lot of progress for the web.

</comment><comment><USER13> I think just about everyone here will agree that what you describe is more of an ideal web that we want. However, the problem is finding motivation for regular users to sacrifice, and if they wont then you need the big corporations to sacrifice to get there. How can we find motivation for either part?

I think this will be an extremely long process that is slowly happening on a minor scale, but that we will never see a fully open web - ever - just because of the lack of motivation from its central actors: users and providers.

Things like Wikipedia, OpenID/OAuth, FluidDB, more open API-s (although we don't own the data) are all pointers to the web maybe being more semi- transparent in the future. I mean, things are getting more open, but it will simply never be fully open, no matter how much us developers and geeks want it. If however someone like google or apple were to find a model were they could still earn their money while being transparent and open, then I would start believing.

The best way to facilitate this process is by doing your part by implementing your site/service in an open and transparent way. If you get successful people will take notice.

</comment><comment><USER14> Call me crazy, but I like the way things are. Having huge, centralized bodies with easy access to all of my information sounds awful. The government knows enough about me already, why would I trust I private corporation with _all_ of my data? What happens when they're hacked? How about when somebody decides to make millions illegally selling identities?

Facebook can keep my photos and status updates and pokes. Twitter can have all my 140-character sets of vapid bullshit. Those things don't matter. I don't want Globocorp having access to every bit of information about me.

<comment><USER12> This information should not need to reside on the net and be owned by a private corporation. One of the problems mentioned in the article is that every individual should own his/her data.

I think to adress the issues correctly all this info should be stored locally and/or on your phone.

<comment><AUTHOR> Yeah, that's more or less what I'd like it to work, but I think using phones or other devices that may get offline would be unworkable (at least in the present). You could, however, act as your own gateway just like you can do with OpenID right now

</comment></comment></comment><comment><USER15> What the author missed: the internet is by definition a _decentralized_ and aggressively _pluralized_ network, whereas what he's calling for is one single centralized system with a canonical API for every single person on the network and - here's the kicker - that every single person on the network agrees to adopt.

</comment><comment><USER16> This is right up my alley. I applaud you for writing this piece, and putting it out there as to what is wrong with the web, and what needs to happen. This issue is that the current web model is being regurgitated through all these sites that think they are doing something new and innovative, and are actually just repeating the same form that is proven to be arcaic, and does not work well anymore. We cannot expect a different outcome, by producing the same old actions. Its time to truly be innovative and come up with something different, more efficient, and that gives more power to the user. We often attempt to do this over the years, and then we revert back to the old format.

</comment><comment><USER17> A lot of this reads like the FOAF, DiSo and Semantic Web visions. None of those has got much traction in the market: my gut feeling is that there is a market in portable identity somewhere, but no-one's worked out what it is yet.

I'd be tempted to start with the mobile companies, though: they already know who I am, where I am and how to bill me. Feels like a natural place to add authentication and identity broking...

</comment><comment><USER18> Basically you're proposing a much more involved OpenID. I'm sorry, but beyond everything that was already pointed out, you also clearly don't know enough about the space that you want to "revolutionize".

Hint: what you propose isn't all that new, you're still suffering from the same chicken and egg problem.

</comment><comment><USER19> All you have to do is create a network under these guidelines. One system to do whatever you can in that awesome system that does a batch of particular things. Then you invite your friends and say, look, you can do all these awesome things just by being in my awesome system/network! They, understanding its awesomeness, will have to join. You offer them even more things that are progressively more awesome. And more people join. And more people surf under one unique sign-in.

One night you get home and feel happy, satisfied, knowing that your network of users has finally experienced the greatest possible, most efficient, most awesome system ever invented. And before you go to sleep, you pick up a phone and call your mom to tell her how happy you are.

</comment><comment><USER20> Good God, man, have you gone looney? You say the internet is broken because authentication is a pain? You say there should be just one social network? Try telling that to the people making boatloads of cash today.

The internet IS democracy. You can't tell it what it should and shouldn't do, or how it should or shouldn't be. It gets to decide that on its own.

The solution is kinda simple. Don't try to control the internet. It has never worked, and it will never work.

Instead, focus on making OpenID & OAuth easier to implement. Most sites don't _want_ to manage authentication & account creation. They would love to farm it out, but right now, it requires a lot of work to do so.

Instead, take a cue from Plaxo: focus on making a better Identity & Privacy control service. Fill it with simple APIs, and let other sites use it. Make it come complete with lifestream feeds & webhooks. Find a way to use Facebook mail without logging into Facebook.

>>You could have multiple profiles on multiple gateways so that you could have multiple identities if you needed them

Doesn't that defeat your entire stated purpose? Now we're back to 2009: multiple logins on multiple sites.

>>either support the construction of this model or to force the startups you found to embrace this model

Are you TRYING to break the internet? You can't force anything! The internet IS evolution. The internet IS democracy. The internet IS freedom. The internet IS bottom-up, not top-down.

This ain't gonna work.

Build something. If it really is better, people will flock to it. If not, they won't.

There is no force, only do.

<comment><AUTHOR> _You say the internet is broken because authentication is a pain? You say there should be just one social network?_

I didn't say the Internet is broken because authentication is a pain. I said the Web has been created to deal (and access) hypertexts. Nowadays the WWW is used for much more. People use it to shop, keep contacts with friends living far away, some use it to share their "lives" and the current state of art is far from being functional to the scope. To my personal point of view, it is broken by design when it comes to these scopes. And far from me trying to say there should be just a social network.

The gateway I idealize is not a giant bucket (or a silo) you'd fill with your stuff, that's exactly what I want to avoid. The "gateway" would just be a place you use to authenticate and authorize apps to access subsets of your data. Some of it (anagraphical data for the most part) would be stored on the gateway, and other stuff would be in much more appropiate places. Flickr, Twitter, Blogger, Facebook, et cetera. The model I idealize would be a common layer to build thing on, nothing more and nothing less.

</comment></comment><comment><USER21> One of the cool things about the first web was that it was so simple that you could essentially do _anything_ with it. It was originally meant to help people publish their research papers, and now here we are 20 years later doing all this stuff that the original authors never intended.

That's the good thing about it.

This guy's proposal is all about formalizing a bunch of things that we do on the web _today_. But there's no reason to assume that 20 years from now we'll be compiling lists of our friends online and authorizing random strangers to follow the 140-character random thoughts that pop into our head. Or shortening URLs or any of the thousands of other things we do online every day that the guys at CERN never expected us to do in 1990.

As such, the only thing this "new web" can possibly do is get stale. As a thought experiment, imagine we'd built it in 2004, and it was all about helping people create Blogs. Or we built it in 1999, so it could help you "optimize the internet" by installing spyware on your computer. Worse still, imagine the original creators put in a bunch of codified methodology to publish and critique research papers, thus making it better suited for the task it was originally intended. What exactly would we be doing with that extraneous functionality today?

So yeah, it's cool that we need a fresh start and all. Just make sure it's capable of expanding beyond the silly OpenID/oauth issues that bother us today.

</comment><comment><USER22> A little proofreading and peer review would have gone a long way.

We do, eventually, need different models of sharing identity and personal data on the web, but this is fairly incoherent.

<comment><AUTHOR> I can't really imagine a better peer review other than hacker news to be honest. However I wish I'd got a more replies when I tried to get skilled people to read this (expecially from the english mothertongue), but that didn't happen.

</comment></comment><comment><USER23> Two points:

1\. If we assume for a moment that the quoted JFK speech was actually written by JFK (and not by a speechwriter), you've actually proven you're better at penning inspiring words than JFK was. The sentiments in the JFK speech are rousing and inspiring enough that they overcame the wording at the time they were uttered to the world, but the phrasing itself is clumsy and distracting. "And the other things"? Seriously? I've never liked that speech, but I like the passion expressed in this call for a better Web, and it is not as marred as JFK's wording by a long shot.

2\. I think a far better idea than using gateway providers is coming up with a way to store the data locally (on your own computer) and authorize (or not) particular Websites to access particular parts of it. You have to develop a protocol that can be used by visited Websites to access the data when they are authorized to do so, anyway; why not make it a protocol that definitively keeps the stored data in your own hands? Either way, the real challenge will be getting the visited Websites to refrain from storing the data in violation of your wishes once they get the data, but if I got to keep the data in encrypted form on my own computer I'd be much more likely to want to get on board with the idea.

</comment><comment><USER24> Don't be so quick to dismiss OpenID and other open data initiatives just because they haven't solved the problem overnight. They are making slow but steady progress, which is all that you can really ask for with such ambitious goals, and all that it takes to achieve them, if you have a little patience.

When I first got my OpenID, this site was the only use I could find for it. Then I could use it on Stackoverflow. Then I could use it to comment on half the blogs in the world with Disqus. And now I can use it with Facebook (somehow.. I haven't got that working yet). This is a remarkable amount of progress for about one year.

The big players are not as averse to this as you make them out to be. Google in particular seems to be open to the idea of open data. They are also making Wave which I could see having a huge democratizing effect on the internet.

I started developing for the web a decade ago and back then, the only way to "share" data from another site was to scrape it, and that was considered hostile. Now everyone has feeds and APIs and the open standards are clearly catching on. I've seen enough to convince me that this trend will continue until the technorati are satisfied. It may take another ten years but that'll do.

</comment><comment><USER5> The main problem I see is that there is so little detail that I'm not sure what's being proposed. Many of the commenters here also seem to have varying ideas about what's being suggested. To have a chance, you need a clear vision, clearly articulated. The hard part will be finding a realistic roadmap to where you want to end up from where the Web is now, but that can come later.

As an example of the vagueness I'm talking about, you write "We would have some kind of gateway that would act as an identity provider (think OpenID) and a system you would put your stuff on." This doesn't say how this system is run, who owns it, who pays for it, or what the difference is from similar proposals that have already been tried.

The passion for making things better comes through loud and clear but the solution conveyed isn't much more specific than "let's make things better".

</comment><comment><USER25> This matches project. See <http://www.disnetwork.info>. I have the technical solution and nearly finished implementing it. I'm currently working on the protocol documentation, which means in depth review of it. Some key information to described the system are not published on the web site. It is just the outline and some detailed discussion of some aspects of it.

Development is unfortunately slow because I'm bootstrapping. Who would invest in a project equivalent to inventing the web ? If you know anyone, please let me know.

Note that this technology can't be owned and should become an open standard. But this is not incompatible with earning money from it. So I have a business model, but it is hard to predict if it can succeed.

</comment><comment><USER26> For this to work you would have to convince all (or at least a lot) of established players to do things differently than they do now. They will only do so if they see other major players doing it. It's a classical chicken and egg problem.

The technology is the easy part.

<comment><USER23> Until we have the technology, there's nothing to use to convince anyone to go along with the idea.

</comment></comment><comment><USER27> Let's play dress-up for a moment. I'll put on my investor's hat.

You are going to have problems with funding for two reasons (you mentioned one, and I'll disregard the no co-founders thing for a moment):

A) No clear path to monetization and

B) I can't see a reason for any site to go through the effort of adopting the technology you're suggesting, even if it was already written and easy to use. NIH syndrome is very big amongst companies for good reason - if they own all the technology front to back, then they can change it any way they see fit, and not have to worry about someone else's changes.

</comment><comment><USER28> What we need is a nice way for users to allow applications to their data in other applications. A common API and a common UX interaction element. Something like Facebook applications have ... you click a submit button, Facebook asks if you want to allow the application to do this or that, click "Allow" and BAM!

</comment><comment><USER29> > Do you think you can sign up for a Google or Facebook account with your own > OpenID?

Yes you can on facebook <http://www.allfacebook.com/2009/05/facebooks-openid- live/> Make some better research next time.

</comment><comment><USER30> No - the internet is not broken. The fact that we are communicating across it attests to that.

What needs to happen is for it to evolve to solve these problems. There are many projects aiming to do just that. We are getting there, but progress is slow.

</comment><comment><USER31> _We should act now. It should be done independently from the big Internet companies_

Here's where OP may have difficulties. He wants to make a major change that affects a lot of people. Better to dance _with_ the elephants than in spite of them. Just ask Loopt.

</comment><comment><USER32> I'm pretty sure this is what Chi.mp aims to do, but I haven't really explored their service beyond signing up over a year ago:

<http://chi.mp/>

</comment><comment><USER33> what about the moneyz. I believe that until the financial pipelines are laid out for this connected scenario, there will not be enough incentive for the big companies to cooperate over this "problem." So many referral fees, affiliate fees, and more to cut up. If data is what commands my 2-3x multiple, why would i give it away unless i know i can get a guaranteed 15%+ roi through giving it away.

Lastly, for problems 1-5 - FACEBOOK! No brainer that they will charge for FB connect soon.

</comment><comment><USER34> Sounds a lot like Vendor Relationship Management: <http://cyber.law.harvard.edu/projectvrm/Main_Page>

</comment><comment><USER35> My aborted (due to lack of time) attempt to do the same: <http://code.google.com/p/slash-social/w/list>.

</comment><comment><USER36> Why doesn't FB do most of this?

<http://blog.luckycal.com/?p=145>

</comment><comment><USER37> I do agree with your thoughts.. Infact I m working on such kind of web model.

</comment><comment><USER38> This sounds like Microsoft Passport's vision from years ago...

</comment><comment><USER39> We are attacking the messenger when we should be attacking the problem.

Forget the messenger for a moment, if he is good or not for funding, if he has writing problems, or if he is dumb or retard.

Lets focus on the problem please, can we provide solutions?

Even solutions on how to fix proposed solutions that don't work?

</comment><comment><USER40> clear and honest ideas! I feel there is a natural force that will push things _sorta_ in that direction. Re-factoring happens more and more.. Take gravatar.com, for instance. I agree with some of the other posters, however, that people put up with inefficiencies all over the place all the time. It may not be necessary to have an efficient space on the web. Jungle vs. well-oiled machine...</comment>


Geely Buys US Start-Up Terrafugia, Promises Flying Car by 2019 - <AUTHOR> http://www.scmp.com/business/companies/article/2120084/geely-buys-us-start-terrafugia-and-promises-flying-car-2019 <comment><USER2> If I had Geely money, I'd buy AeroMobil as well - [https://www.aeromobil.com](https://www.aeromobil.com), their flying car is fly.</comment>


Docker for Windows won't run if Razer Synapse driver management tool is running - <AUTHOR> https://twitter.com/Foone/status/1229641258370355200 <comment><USER3> Ha, stackoverflow is a great tool, but... the more answers I see on an area I'm experienced in, the more I realize how wrong they can be. Sure, the answer usually gets the job done, but everything else about it might not be right.

If I need to use stackoverflow, these days I make sure I do a few things:

\- read a number of answers, comments included. Just because an answer is accepted doesn't mean it's the best one

\- read API docs for anything I'm unfamiliar with, and make sure I understand how the solution works

\- never copy paste; instead use the general idea or concept to rewrite a solution in a safe, future proof manner

\- if an answer works but doesn't feel like the right solution, be prepared to do my own research to find a better approach

Hopefully this results in a better engineered product, but one of the main benefits is learning and expanding knowledge of APIs/techniques.

<comment><USER4> > read API docs for anything I'm unfamiliar with

One of the differences i've noticed between myself and some of the junior devs i've worked with. I would usually use the official docs as my first resource, and they would use stack overflow instead.

<comment><USER5> This is a hard lesson I had to learn as a junior developer.

I'm impatient and Stack overflow can often give me an easy solution. But just as often, it can't and I will spend 30 minutes unproductively trying things with little progress.

As I become a better developer I become more inclined to spend 30 minutes with the documentation instead.

<comment><USER6> Depends on how clear the documentation/usage is... and sometimes you accept that you have limited knowledge and understanding. Either way, it helps to understand what you are doing, and when in doubt look it up.

<comment><USER7> If the library documentation isn't clear then that's a clear sign that whoever created it doesn't take quality seriously and you shouldn't use it in the first place. Of course sometimes there's no alternative so you just have to deal with it.

</comment></comment></comment></comment></comment><comment><USER8> I am a somewhat active SO user and one thing I see other contributors repeating over and over is "stackoverflow is not a code writing service". Usually this comes up in the context of some kid posting their college assignment and asking people to solve it, but I think it should extend further.

Do not copy/paste code from stackoverflow. SO is not a code writing service. It is a problem solving/question answering service. Any code you see in the answers should be takes as reference only. If you don't understand what the code does, re-read the answer, check the documentation, understand and then write your own code. What happened here is such a stupidly trivial bug. If someone only took a second glance at this code it would be blindingly obvious what is going on here. I saw it as soon as I looked at the SO code sample and I don't even write C#. Do people at Docker even do code reviews?

Also, when I write answers in SO, I try (not 100% of the time, but I do try) to make my code generic, so it solves the problem the user is having, but does not include any specifics from the question. I suggest you all do the same.

P.S. I know that this rant of mine is rather idealistic. Nobody is going to stop copy/pasting code and these things will keep happening. But writing this was therapeutic.

</comment><comment><USER9> I think it would be a great addition for StackOverflow to have a sort of report button for dangerous code.

Take for example libcurl (thus, implementation in PHP, Ruby, Go, etc). There are sooo many posts with cURL example code where CURLOPT_SSL_VERIFYPEER is disabled. These are often answers with thousands of upvotes, that have been there for years.

Inexperienced developers copy/paste this code into production without understanding what it does.

<comment><USER10> You can report the errors in comments, and develop a habit of looking in the comments for reports of dangerous code.

<comment> crooked-v ...if you have 50 reputation.

<comment><USER10> You mean literally everyone who's been coding for more than 3 months. You need 5 upvotes on your questions to get that much.

<comment> crooked-v Unless you've never made any particular use of StackOverflow, stumble on an incorrect answer, realize you have no way to fix it, and then just leave because you don't feel like jumping through hoops just to make somebody else's day better.

<comment><USER11> If you've never made any particular use of StackOverflow, why would you expect them to care what you have to say about anything on the site?

It would probably take you as much effort to get 50 rep as it's taken you to post multiple sour grapes comments about how dare they have a threshold which excludes you, don't they know who you are??

<comment> crooked-v > If you've never made any particular use of StackOverflow

I would have made use of it... if I didn't have to post questions I have no interest in posting to farm enough reputation to actually do anything to fix the incorrect answers I occasionally stumble across in Google searches.

> It would probably take you as much effort to get 50 rep

Again, I have zero interest in posting questions just to farm reputation. Less than zero, actually, because of the mental overhead involved in doing so.

<comment><USER11> Do you understand that from the other side, you aren't a known skilled developer submitting valid corrections, you are indistinguishable from any other internet IP address submitting spam and/or low grade buggy misunderstandings?

One way they distinguish people who care about code from complete robo-junk is with a minimal effort barrier of community upvotes, which you refuse to engage with. They don't know you're special and important enough to skip the entrance requirements - how should they know? What the system sees is that you won't put effort in to get 50 karma. You want to skip their criteria because you say you are good enough - yet everyone including spambots would say they were good enough to skip the criteria.

If the filter was "verified members of the ACM/IEEE/IETF/whatever can bypass the 50 point requirements" would that be better? Or would proving your identity and membership details still be too high effort?

What test wouldn't be too high effort for you to bother, but would still be something that could be automated by stackoverflow and would cut out a huge mass of spam?

<comment><USER12> If it's trivial to reach 50 rep by asking questions, how does it prevent unskilled developers from submitting corrections?

<comment><USER11> Unskilled developers won't find it trivial. See the new question review queues for the kinds of questions submitted by people who can be bothered to sign up and try to participate for evidence towards this claim. e.g. right now there's one which isn't about programming it's about system administration, doesn't explain what they tried, and concludes with "it is not working" with no further details. This first-question is not likely to get upvoted. By being a minimum-competence filter it's not selecting in only the most skilled developers, it's selecting out huge swathes of people who don't want to do what stackoverflow wants its users to do.

People who submit terrible contributions will fall below 50 rep and lose the ability to do so.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment> _-___________-_ If you're going to copy-paste code from Stack Overflow and deploy it to millions of users' systems, I think you have some responsibility to understand what the code is doing.

I can totally see how this happened, and I would definitely not say that I would never make this mistake, especially under time pressure etc. But a careful programmer would a) desire to understand what the code did, and thus spend enough time reading it to spot the `GetType()`, and b) test that the "prevent more than one instance from running" behaviour worked properly, which would involve _both_ testing that you can't run two instances of the program, _and_ testing that if you change the assembly identifier, you can run two instances.

<comment><USER13> How many times have you run `npm install` or used literally any programming package management system without personally reading every line of code that you're installing?

<comment><USER14> Well, if you are going to be passing something as your own work, you better understand it well.

Also, you should look at least at the docs of the packages you install.. And since most SO answers are shorter that introductory section of most docs, this means reading and understanding entire answer.

<comment><USER13> >Also, you should look at least at the docs of the packages you install

Brb reading the docs for every micro-package installed as a dependency for what I just installed that provides functionality that could've been hand written in five minutes.

Gonna spend the next few months reading about a thousand package README's for this single package I installed and all its dependencies down the tree, be right back.

<comment><USER15> You say that like it's not a good thing to do? If you pull a library into your project, you're taking responsibility for that library, for better and worse.

<comment><USER13> I'm talking about how that's completely not feasible anymore because of how every project has dependencies upon dependencies upon dependencies because the general development attitude has shifted towards "import a single library that tells you if a number is odd, and another library to tell you if one is even"

<comment><USER16> Ultimately, if a bug in a library causes issue with your program, and your company loses $X, your superiors will not give a shit. You have the burden of responsibility for the program.

For common major libraries used worldwide in enterprise products, you are right in that there is an element of trust. They are made by people much faster/better/stronger than most of us. If all else fails, the sheer magnitude of people using it is a small insurance policy, as disastrous issues will probably be quickly apparent. That still doesn't absolve you of responsibility, but the overall risk is usually pretty low.

A segment of code on SO, or a weeny niche library? You only have your noggin to vouch for its stability and accuracy.

<comment><USER13> >They are made by people much faster/better/stronger than most of us.

lmfao no they're not

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> Every so often, someone will post that cheating in examinations is OK because the important thing is to get the answer from wherever. This shows why knowledge and understanding matter: that GetType() looks suspicious (the type of something rarely uniquely identifies it), even if you don't know much about the specific issue here.

</comment><comment><USER18> This has been fixed in 2018!!! Why is this here? [https://github.com/docker/for-win/issues/1723](https://github.com/docker/for- win/issues/1723)

<comment><USER19> The title should probably be changed but it's still an interesting twitter thread that has sparked interesting discussion here

</comment></comment><comment><USER20> > homework assignment for all programmers reading this thread: Think about how > you'd find this bug in your own programs. You copy/paste the code, it seems > to work, and you don't realize it's broken because you don't run either of > these programs which made the same mistake.

Wait... WHAT??

Who the hell copy pastes code into their program without first examining and understanding what each step is actually doing, how and why the pieces fit together as they do, and how it works as a whole to solve the problem?

<comment><USER21> Say hello to `pasteoverflow`: Paste code from Stackoverflow directly into your editor.

[https://marketplace.visualstudio.com/items?itemName=matsz.pa...](https://marketplace.visualstudio.com/items?itemName=matsz.pasteoverflow)

<comment><USER16> Can it go one meme-step further and automate our jobs away? ;)

<comment><USER22> Does this work ?

[https://github.com/drathier/stack-overflow- import](https://github.com/drathier/stack-overflow-import)

</comment></comment></comment></comment><comment><USER23> To any Microsoft/.NET devs reading this:

What do you think the chances are that you could make exact references to

      Assembly.GetExecutingAssembly().GetType().GUID

return a compile-time warning?

That could make this go away very quickly.

(For bonus points, add relevant telemetry to VS. :P)

<comment><USER24> A lot of the comments on this topic seem to be focusing on SO's nature or something like what you proposed about .NET itself.

When I first read the Twitter thread I was sort of dumbfounded that whoever did this originally didn't actually check it. That's not a SO or .NET problem that needs to be caught. It's a developer problem.

If someone is copying code into their project that they've never seen before, they should, at bare minimum, make sure it produces the expected result for the first instance they are using it. That developer should have checked to see that the GUID was actually the one from their assembly. Even if someone is copying some complex code that they aren't 100% sure how it operates, they can still test it to make sure it produces what they think it does.

The idea that someone working for Docker just copy, pasted, and then didn't check that it actually did what it was supposed to do is sort of mind-blowing to me. Not sure why no one else is talking about that. I've never used Docker before, but this doesn't instill confidence. It's one thing to have something like this in your end product - that's bad enough. It's another thing entirely when your company builds tools for other developers to use. That shit needs to be rock solid and this is one of those things that seriously worries me when I see it because it's about a lack of effort/testing and someone just blindly took code and didn't even bother to check it.

<comment><USER23> On the one hand, I completely agree.

I remember reading something about reasoning through a very simple (couple of divisions or something) math problem, where a deliberately (and later obviously) wrong working-out was initially defined, then corrected, to illustrate the importance of end-to-end understanding.

On the other hand,

a) Programming is equivalently complicated to "two-story-high whiteboard full of Greek letters and integration functions", but is never acknowledged by industry as such because of the associated responsibility nobody wants anything to do with

b) We live in a world where entire industries - ML-based AI - <USER2> _literally!!_ based on the idea of _not_ understanding the structure of the solution to the problem.

</comment></comment></comment><comment><USER25> I looked at the title, then briefly glanced over the discussion here, and guessed it correctly --- "same mutex name". I didn't guess they'd get to the same name _that_ way, however. I thought someone had copy-pasted example code from SO without changing a REPLACE_MUTEX_NAME or similar.

My preferred solution is simpler --- CreateMutex takes a mutex name of at most MAX_PATH characters. That's almost begging you to make it the path to the running executable.

        char name[MAX_PATH];
        GetModuleFileName(0, name, sizeof(name));

I know some of you may be thinking "but what if there are two copies of the application in different directories?" Yes, that would result in two instances, but how often is that a problem? If it is, then make it the binary name-only without the path

        pname = strrchr(name,'\\');

and then unless you name your application something very generic like test.exe, there can only be one. I guess the lesson here is to not overthink things --- I see that often in SO answers too.

</comment><comment><USER26> And that just for some colored LEDs and such. I don't understand why you need Windows-only software for that.

Doesn't a hardware maker want to make it as simple as possible to use their hardware from any OS?

I used to use a Razer mouse when it had a switch on the mouse itself to toggle between different speed settings.

But I changed away from them when that switch disappeared in later iterations of their mice and instead depended on software that didn't work in Linux.

<comment><USER27> The new version of DeathAdder[1] reintroduced DPI adjustment buttons, and the LED settings persist even when set with the open-source Linux drivers.

[1]: [https://www.razer.com/gaming-mice/razer-deathadder- elite](https://www.razer.com/gaming-mice/razer-deathadder-elite)

</comment></comment><comment><USER28> Docker for Windows has had a fundamental Dns[1] bug since April of last year, I've been forced to run v188.8.131.52 for months now to ensure yum repos resolve inside AmazonLinux containers. Truly a second class platform. [1]: [https://github.com/docker/for-win/issues/3810](https://github.com/docker/for- win/issues/3810)

<comment><USER29> >Docker for Windows has had a fundamental Dns[1] bug since April of last year, I've been forced...

>Truly a second class platform.

Now maybe some Windows users will see how Linux users have felt for over 2 decades.

</comment></comment><comment><USER30> Some tangential analysis of Synapse over here: [https://twitter.com/davkean/status/1144498663122558977](https://twitter.com/davkean/status/1144498663122558977).

<comment><USER31> Mouse./keyboard customisation software seems universally bad / lowest-bidder style. Logitech's mouse button configuration tool for example weights over 400MB. Literally for a tool which requires a few dropdowns.

<comment><USER23> Oooh. What does it have in it?

A home-made .NET-to-Java transpiler that requires custom builds of the CLR and JVM?

The 300MB of random data at the end of the Windows XP install CD?

An encrypted archive containing the set of folders comprising the entire source code history (the top level of which has an alarming number of entries named like "revert_v5_bug [Final] - ACTUAL CURRENT") (because some developer has OCD about backups)?

<comment><USER32> Given the state of Modern Software Development, It's most probably Electron.

</comment></comment></comment></comment><comment><USER33> So with tools like Sonarqube we get static code analysis on our code base which shows code duplication within itself. I wonder if there is some way to look for duplication from stack overflow? Not sure that is feasible, since no one is going to want to post all of their proprietary code to some API, but wonder if there is some system for local indexing SO that would also for local duplication detection.

<comment><USER11> StackExchange data dumps are (at least, were[1]) freely downloadable: [https://meta.stackexchange.com/questions/2677/database- schem...](https://meta.stackexchange.com/questions/2677/database-schema- documentation-for-the-public-data-dump-and-sede)

[1] not sure what happens since they "illegally" retrospectively relicensed all the content a few months ago.

<comment><USER33> Yeah I thought they had something like that. Might be interesting to play with. I meant more of a question as to if anyone had actually done something like that with it. Basically a Turn It In kind of tool that universities use for plagiarism detection, but for code.

</comment></comment></comment><comment><USER34> Always interesting to see code from StackOverflow in a commercial product, as always this is most likely also a licensing issue.

</comment><comment><USER35> When I need to ensure only one copy to run I never used GUID, I always used some combination of project name + my name + current date + customer name/business. This way is unique and with a personal touch. Also you can make it as long as you want up to MAX_PATH, not the short style that GUID does it.

<comment><USER36> Sounds like a natural primary key.

</comment></comment><comment><USER37> For me overwatch wouln't start if razer synapse was installed.

</comment><comment><USER38> This is exactly the reason I can never understand how it is impossible for the community in SO to override the accepted answer. The argument goes that the accepted answer is the one that satisfies the asker's needs so it is always the one that gets placed higher up. But in practice things aren't so cut and dry.

\- The asker can misunderstand the response.

\- The asker can accept a response that for the general public's interpretation of the question is incorrect. It doesn't matter what the asker thought the question means to them if beyond their control their answer becomes the first result on Google years later for a problem that might not be exactly the same.

\- Technologies change and new libraries or language features can be added since the question was asked. I've counted several times where people bunch up below the accepted answer to say this is true, and 90% of the time it's the better answer for my use case.

\- The question is similar to another that is far more popular and happens to share the same SEO keywords but is completely unrelated, so another answer with 1,000 upvotes in comparison to the original answer's 100 is added. People have no choice but to put comments saying "this is the wrong answer if you're doing X, use the other one," because the comment section of the accepted answer is the highest up they can be seen. But the average user might not listen or see the smaller comment text and use the wrong answer, just because it was the accepted one.

This is because a _single person_ 's decision on what "correct" means is valued more highly than the correctness of the more important answer which thousands more people actually support, and is more critical to support because of unintended search indexing.

Sometimes SO questions become used for a purpose completely unrelated to the original questions and answers because of search engines. There should be some kind of acknowledgement of this instead of being unable to protect clueless people from themselves.

This isn't to support editorialization of old answers in general, it's a problem of unintended consequences out of anyone's control because of what gets indexed as the first search result on Google. Nobody can change what's there if nobody but the original authors can edit the answer and they happen to not do so for whatever reason, so we'd be stuck being misled forever. And as we've seen people will copy and paste anything in the code box and not even read the description and caveats if there's a fat green checkmark next to it like a Pavlonian reflex. I'm guilty of this myself.

<comment><USER39> You can still write your own answer and comment on the wrong answer.

Users who are callous enough to ignore such comments get what their lack of due diligence deserves.

</comment></comment><comment><USER40> Razer Synapse has been responsible for a variety of odd problems. Just myself I've had it mess with Bluetooth connectivity and screen autorotation.

</comment><comment><USER41> The worst part is that they solved it in the "edge" branch (the one you need to use docker on WSL2)... because they switched to Electron

</comment><comment><USER42> Razer went from making great hardware and drivers to making terrible drivers that require you to sign in to a Razer account and constantly run Razer software. I was a Razer die-hard for years, but with their transition from a hardware company to a cloud-based user-data-mining company I avoid them. If you want good hardware with good drivers I highly recommend SteelSeries.

<comment><USER43> Steelseries drivers are phoning home more and more now...

However - you can configure the mouse, then uninstall the drivers and the settings persist.

So I continue to use steelseries.

</comment></comment><comment><USER44> The author claims that this is the result of copy pasting from Stack Overflow but it could be due to auto-complete as well. GetType and GUID both start with 'G' after all. Since the snippet is so small the similarity of the rest of it could just be a coincidence.

</comment><comment><USER45> What am I looking for in the screenshot ?

<comment> _-___________-_ You would sadly have to find your way through the Twitter "thread" to fully understand.

Someone at Docker and someone at Razer both copy-pasted the same faulty code from Stack Overflow for preventing multiple instances of their program running at once. Unfortunately the code took the assembly identifier and called GetType() on it which returns the same value for all programs.

The Stack Overflow answer was later fixed but since the programmers no doubt both felt they'd "solved" the problem, they didn't see the fixed answer.

<comment><USER46> Which I suppose is an argument that pulling in eleventy thousand oneliners from npm is better than copying oneliners using the editor: At least you can run a batch upgrade without spending real brain cycles.

I'm sure someone has written a thingy to upgrade npm dependencies, rerun tests, and bisect to tell you about the breaking upgrade if anything reaks.

Left-pad, come back, all is forgiven.

</comment></comment></comment><comment><USER47> A somewhat tounge-in-cheek comment: but I wonder if there could be a git/IDE extension to track cut-and-paste code like this (especially from stackoverflow) so that when things are corrected or flagged as broken at the source, that change is propagated to your use of it.

</comment><comment><USER48> It also has an hard time string if another Hyper-V VM is running.

</comment><comment><USER49> On a related note I've found docker for windows so buggy at times.

<comment><USER50> i feel like it's better than docker for macos, but that's not a really high bar to clear tbf.

<comment><USER8> I have been using Docker on OS X for a while, haven't had any major issues, but maybe my experience is atypical.

</comment></comment></comment><comment><USER51> Glad to see no one here ever has bugs in their code!</comment>


Google in talks to buy Whatsapp for $1 billion: Report - <AUTHOR> http://androidos.in/2013/04/google-in-talks-to-buy-whatsapp-for-1-billion-report/

<comment><USER2> My wild guess is that "Whatsapp" is the anonymous entrepreneur's co Marissa Mayer would have to pay twice than anyone else in today's NYTimes article.

<https://news.ycombinator.com/item?id=5509275>

</comment><comment><USER3> Presumably so they can shut it down?

<comment><USER4> They'd transfer the users over to Gtalk/Babel, but that's a good thing. They need to unify all their message platforms.

<comment><USER3> How is google buying apps and forcing the users to use a google bastardised service a good thing?</comment></comment></comment>


Google trends: Facebook - <AUTHOR> http://www.google.com/trends/?q=facebook

<comment><USER2> Even better [http://www.google.com/trends/?q=facebook,+google&ctab=0&...](http://www.google.com/trends/?q=facebook,+google&ctab=0&geo=all&date=all&sort=0)

<comment><USER3> Why? This makes perfect sense. Who Google's Google?

</comment></comment><comment><USER4> Link requires registration.</comment>


Siri meets Eliza - <AUTHOR> http://jordanmechner.com/blog/2011/10/siri/ <comment><USER2> Although Eliza was coded for a less powerful machine, the most powerful mainframe in existence in 1964 was the CDC6600, which was able to put out about 1 MFLOPS. The iPhone 4S is apparently capable of 138 MFLOPS. ( [http://www.phonearena.com/news/Apple-iPhone-4S-benchmark- tes...](http://www.phonearena.com/news/Apple-iPhone-4S-benchmark- tests_id23140) )

We've managed to put the equivalent of hundreds of room-sized mainframes from Eliza's time into something that can fit in your pocket but, in the last 47 years, A.I. has advanced so little that Siri is using the same bag of tricks as Eliza. All that distinguishes Siri from Eliza is some licensed speech recognition software, a nice collection of pre-programmed geeky easter-eggs, and the fact that Siri is plugged into a collection of apps and search engines that allow it to perform a few basic, but useful tasks beyond simply fooling around. However, those tasks do not really require, or make use of, A.I. at all. Google's voice interface for Android makes no pretensions towards sentience, but is capable of everything Siri is. Google just hasn't wrapped their voice interface software up in a cute anthropomorphized Eliza wrapper or taken the app integration as far yet. That, and perhaps a little interface work, is pretty much it.

It is simply astounding that, in spite of Siri having access to such vastly superior resources, Eliza still comes across as the smart one!

<comment><USER3> Well, that's not really fair, because Siri isn't designed to try to have a conversation -- it's designed to just get a few things done easily via voice commands.

The state of the art in chatting is probably something more like Cleverbot, which is way, way better at having a conversation than Eliza.

(It occurs to me that hooking Siri up to cleverbot would be pretty awesome...)

</comment></comment><comment><USER4> The best part of that page is comment #4 (quoting)...

Reminds me of conferencing calling two Dunkin' Donuts together and listening silently as hilarity ensued:

"Hello, Dunkin Donuts."

"Yes, this is Dunkin Donuts."

"Yes, this is Dunkin Donuts."

"Yes."

"Hello?"

"How can I help you?"

"This is Dunkin Donuts."

"Yes, it is!"

"Hello?"

It was the last time my friends' parents let us use their fancy new (1983) Merlin phone unsupervised.

<comment><USER5> There's an amusing prank where you call two Chinese restaurants: <http://www.youtube.com/watch?v=Iz9ra9FqNKQ>

(I think they pulled this prank on a late night show as well, I can't find the video though.)

<comment><USER6> Related call where 2 sex line workers are let loose on each other: <http://www.youtube.com/watch?v=OoyDQ327mm8>

</comment></comment></comment><comment><USER7> Not exactly surprising results, but pretty entertaining.

Eliza had fewer non-sequiter's, generally kept up the conversation better. Eliza pretty clearly wins the discussion. But Siri demonstrated beyond a doubt that she is a woman of action by searching the web, finding businesses, and calling people. By virtue of actions speaking louder than words, I declare Siri the winner of the shouting match.

<comment><USER8> Siri: We must do something. This is something. Therefore, we must do it.

</comment></comment><comment><USER9> This conversation is like listening to some executive's over-caffeinated assistant trying to help her boss's overly Xanax'd therapist. Not sure what the take-away here is other than Eliza is such a lazy program. It just falls back onto open-ended questions when confused and doesn't really do anything productive at all.

<comment><USER10> Eliza is actually an AI-building platform. The "doctor" program was like a Hello World, it didn't really show what the platform was capable of. <https://secure.wikimedia.org/wikipedia/en/wiki/ELIZA>

</comment></comment><comment><USER11> It's entertaining, but the thing that struck me most after reading that "conversation" is how far we still have to go in AI.

That can also be taken as good news, ie there is still a lot to be done/discovered in this interesting and very difficult field.

<comment><AUTHOR> I did a report during my undergrad (2005) on AI chatterbots and compared various bots; they all had huge distances to go before approaching any kind of real conversation. During my masters (2009) I studied computational linguistics and found that the gap was even wider than I'd previously thought. Even generating a natural sounding 2 sentence exchange is very difficult, let alone a lengthy conversation, and as far as anything approaching genuine understanding and insight? We don't even know where to begin yet.

<comment><USER12> Yeah, but then again, it takes the human brain about 15-20 years before you can have a somewhat reasonable conversation with its owner, and that's dedicated hardware custom-built for that purpose.

<comment><USER13> I guess you don't interact much with kids. 3 year olds will give great conversation and sometimes very interesting insights.

</comment></comment></comment></comment><comment><USER14> Based on the following:

SIRI >> Sorry, I can't provide maps and directions in Canada.

ELIZA >> Have you tried?

I would say that Eliza is smarter than Siri.

</comment><comment><USER8> A great hack and easily the funniest thing I've ever read on HN [damning with faint praise unintentional].

Parry v Siri would might be Youtube worthy.

<comment><USER15> I was just going to suggest a match with Parry myself! Parry was seriously better than Eliza and had a more natural tone. I'd love to see someone try this. I'd try it, but I don't have an iPhone 4s and don't have a running Parry engine.

</comment></comment><comment><USER16> The Singularity is not near. :)

</comment><comment><USER17> This was very similar to an exercise we had in a class I took a decade or so ago "Theory and Practice of Non-Linear and Interactive Narrative" (<http://web.mit.edu/21w765j/www/Home.html>)

Also, I think they took 'yow' out of emacs at some point (or at least the actual Zippy the Pinhead quotes - the command is still there), but the "psychoanalyze-pinhead" command (which pipes random quotes from that comic into Eliza) is _really_ trippy.

</comment><comment><USER18> "I lunge for the phone, stopping the experiment."

That's been my exercise (gym membership expired 3 years ago) as I try different Android voice recognition apps. Add random people you no longer remember on your Facebook account which is automatically put in my phone contacts. It should be a sport.

</comment><comment><USER19> I'm just bummed that he stopped the experiment before Mr Jose Fuentes got involved.

</comment><comment><USER20> My Hobby: Proxying conversations with my cow-orkers to Eliza.

Try it, great stress relief. I've only done this once, and they did realize what was going on. Will try to dig up the chatlog, but I doubt I can find it.

Appy polly loggies to the xkcd guy. ;)

</comment><comment><USER21> Anyone tried a Turing test on Siri yet? She'd fail the first time she tried to call someone or do a web search, but if you could head her off before she can try to do anything but answer it might be quite convincing.

</comment><comment><USER22> <http://www.youtube.com/watch?v=WnzlbyTZsQY>

AI vs. AI. Two chatbots talking to each other</comment>


Ask HN: Why is liquidation preference acceptable and prevalent? - <AUTHOR> It seems commonly accepted that all VC investment comes with (at least) a 1x liquidation preference.  Is there logic as to why this is commonly accepted and prevalent?  Clearly investors always want the best possible deal for themselves, but why/how did this become the standard deal term?  On the surface, it seems wrong that employees get "worse" equity, i.e. common equity, than the investors and founders.<p>Why shouldn't investors and founders share the same equity as other employees? Investors can presumably adjust their valuation model accordingly. <comment><USER2> The most common argument for VC 1x liquidation preference is to avoid the situation where the VC looses while the founder gets rich. Say the VC puts in 5M, gets 20% equity. The founder sells for 5M, gets 4M, big success for the founder, total failure for the VC.

Now the counter argument would be that whether its a 0x or a 1x it's a loss for the VC, as they're in the game of getting a 100x. And the founder's 'win' is only a win relative to the general population, they also lost as they could have made so much more if things went right.

So 1x liquidation is mostly to prevent a founder from trying to game the system. But I can totally see how it could feel unfair if there wasn't any ill behavior founder-side.

The issue of employee stock [options] vs founder stock is a somewhat separate issue.

<comment><AUTHOR> Thanks.

It would seem like a 0x liquidation preference would provide protection in this scenario. i.e. VC is guaranteed to get his original investment back, but not a multiple of it.

"Say the VC puts in 5M, gets 20% equity. The founder sells for 5M"

VC could just get the 5M back in this case.

<comment><USER2> This is exactly what 1x non-participating liquidation preference is. The 1x is 1x of the invested amount, not a profit multiplier. [https://vcexperts.com/buzz_articles/185](https://vcexperts.com/buzz_articles/185)

</comment></comment></comment><comment><USER3> To answer your question: I don't know. But I imagine if it became common not to have, valuations would be adjusted accordingly to price in the risk.

Which makes me wonder, if a company raises $1mil (1 million shares, $1/share) @ $9mil pre-money, that means the investors get 10% or, say, 1mil/10mil shares. But is it really fair to extrapolate that 10% ownership for $1mil means the whole thing is worth $10mil, given the significantly different provisions (ratcheted anti-dilution, pro rata/drag along rights, information rights, liquidation preference) their shares tend to have over common?

Maybe the SV convention of treating all shares as equal when talking about valuations should be examined more closely.

</comment><comment><USER4> > It seems commonly accepted that all VC investment comes with (at least) a 1x > liquidation preference. Is there logic as to why this is commonly accepted > and prevalent?

Liquidation preference in effect makes VC investment a hybrid between standard equity investment and a loan (it has an almost-guaranteed repayment feature, like a loan, but trades interest for potential upside.) Its better for the other stockholders (and for the success of the company) than VCs holding debt instruments, and its better for the VCs than common stock.

> On the surface, it seems wrong that employees get "worse" equity, i.e. > common equity, than the investors and founders.

As long as the features of the type of equity they are receiving are taking into account when employees decide to accept an equity + salary compensation offer, I don't see the problem. Liquidation preference is a guarantee against losing money. The employees' guarantee against losing value for the time invested is the salary + benefits part of the salary + benefits + equity pay deal.

<comment><AUTHOR> That's an interesting way of framing it. A 1x liquidation preference is like buying a loan at 0.50 on the dollar.

A 0x liquidation preference (insurance that you'll get your original investment back) would be more "bond-like" to me.

Good point that the employee can similarly adjust his/her price on the compensation offer. Unfortunately, I think a lot of employees in SV dont understand the dynamics at hand here.

If you are an early employee, it's also not possible to know if the company will accept a 2x liquidation pref investor in the future.

</comment></comment><comment><USER5> It's downside protection. It's basically saying they get paid before the founders but after loan holders. I'm simplifying, since multiple and/or participating liquidation preference does alter the math, but roughly speaking that's it.

On common stock though, I don't think that'll fly. There are a number of ways where founders with board control can screw a minority shareholder. For eg. they can issue 10x the current outstanding shares to their family, or appoint their friends to the board, or sell the company, or sell the company. It's only in extreme cases that VC's will expose themselves like that. I believe facebook's first institutional round was for common stock and no board seat.

</comment><comment><USER6> To the extent that startups are swinging for the fences, everyone should be well aligned (0.5% isn't much unless the total is pretty huge), since you're trying to optimise for the extreme outcome, rather than "average", having such a clause could let you benefit in other dimensions that help you towards your goal.

I'm speaking in generalities since I'm not sure about specifics, but as an example an investor might be willing to accept a smaller (i.e. less controlling) stake with liquidation preferences for the same price, which leaves you more equity to sell to others.

</comment><comment><USER7> What else are you going to do when you are at round X, when the original investment could be considered a lost cause? You could sell the assets into a new venture. I've seen that done. Then the original investors take the asset sale revenue, lick their wounds, and move on.

Or, if new investors give a new investor a liquidation preference, they could ride along with an outside chance of seeing some upside. In that light, an investor with a liquidation preference is preferable to an asset sale.

</comment><comment><USER8> From a preference standpoint, I had assumed that founders were in the same boat as employees most of the time (especially first-time founders), just that they have a lot more stock.

If investors put in $10M and the company sells for $9M, doesn't it all go to the investors?

If founders get the same preference as investors, it wouldn't be true. I just didn't think they normally did.

<comment><USER3> Your understanding is correct, founder shares are typically just common, the same as employees get, whereas a lot of early-stage capital partners (investors) get a different class of stock with a preference attached.

OTOH founders typically have much larger interests in the companies they own, leading to much higher control, which is _for all intents and purposes_ a different class of stock, even though the rights of say, an employee, are nominally the same. Control is everything.

Also, P.S. most employees get options, not shares, which can be exercised into common shares, but are a little different with regard to tax and the fact that they must be "purchased" or exercised.

</comment></comment><comment><USER9> Here's the argument I've heard: Let's say you found a company. A VC invests $1M for 20% of the company, for a $5M post-money valuation. Then you immediately sell the company for $3M (less than $5M). You make $2.4M. The VC essentially loses $400k. The 1x liquidation preference protects them from losing that $400k.

<comment><USER10> It's also worth pointing out that >1x liquidation preferences make a similar type of sense: if the VC invests $1MM for a post-money valuation of $5MM, and is handed the $1MM back two days later while the owner pockets $2MM, that's not really respectful of their time. It would probably be okay to limit the liquidation preferences at 1x and rely on professionalism, but higher multiples aren't an outrageous ask most of the time (the investor and the founder(s) should have similar outlooks for the future of the company) and it's a pretty easy thing to put in during negotiation.</comment></comment>


Ntirokey is shipping - <AUTHOR> https://shop.nitrokey.com/shop <comment><USER2> Does anyone have experience with these in their current or prior (CyptoStick) form? It seems to good to be true given the cost of other HSMs.

<comment><AUTHOR> I don't know anything about server-side HSMs.

However, smart cards have existed since forever in the enterprise. You can buy FIPS 201-2 Level 3 compliant smart cards by the truckload at ~$10/card, generate a keypair onboard, put the public key in Active Directory, and have a pretty solid guarantee that the private key will never leak. Distribute one to every employee and use them instead of (or in addition to) passwords for Windows logon. The per-device cost is very low, but the big vendors (Gemalto, etc) want you to call their salespeople to discuss how many hundreds of thousands of dollars the Windows integration and card programming software is going to cost.

Most of these are JavaCards preloaded with a proprietary applet, then locked so you can't change the applets. The vendor then sells a driver that communicates with the applet and provides a PKCS#11 interface to the OS, so the card can be used for i.e. webmail client certificate login, PAM modules, domain authentication, SSH, VPN, etc. You can also just buy unlocked JavaCards and write your own applets for them. This is how most smart card products (national IDs, school IDs, large corporate deployments, U.S. DOD CACs, etc) come into existence - buy JavaCards by the shipping container, load your applet, run through an ID printer, distribute. There are a few places that will sell in low volumes with the default key set so you can use tools like GlobalPlatformPro to load open-source applets. Otherwise you can pay a coule grand for an SDK. There are a few open-source applets that (allegedly) provide a PKCS#11 interface on Linux and OSX through OpenSC. The JavaCards I bought were too old for most of them, unfortunately, but I'm buying some newer ones.

Old corporate hardware used to have smart card readers integrated everywhere - in monitors, in the keyboard, in the sides of ThinkPads. Nowadays the card + reader thing is a little dated and people would rather carry a USB token. So you can buy (bulk, white label) JavaCard chips with an integrated reader in USB form factor. Interface protocols are the same, and the same applets can run on both.

YubiKey wrote its own proprietary PKCS#11 applet and drivers. They also forked an existing OpenPGP applet (competing standard) which you can download from Github and (theoretically) run on a white-label JavaCard yourself.

So did Nitrokey. The only thing that's new about these developments is that the personalization tools and drivers are free, and the tokens are available in quantity 1. There are actually a few dozen different corporate, enterprise- sales-only YubiKey/NitroKey-like devices already, and have been for years. NitroKey is actually on the expensive side - their ~$50 model has a bit less functionality than YubiKey's. See also Feitian ePass2003, Gemalto IDBridge K50, etc.

<comment><USER2> First off, thanks for taking the time to reply. This is very helpful.

I have some more questions about these smart cards (e.g. it sounds like unique public/private key pairs would be generated on each card which might not help with the master key style scenario HSMs are good for). I'm going to be looking into this for sure.

One more thing. I'm assuming FIPS 201-2 Level 3 cards have not been hacked (there were several smartcard hacks a few year ago e.g. [http://www.securitytube.net/video/945](http://www.securitytube.net/video/945)

<comment><AUTHOR> You're almost certainly not going to get direct memory access or read keys off storage media like you might with a general-purpose computer. Attempts to physically get inside the chip to do so will destroy the keys. You have to communicate with the software running onboard.

But the software running onboard is, well, just software. It's common for applets to want a PIN before performing signing or decryption operations, and to lock out further attempts after N bad PIN entries. Yubikeys were vulnerable for a while to a logical flaw in the applet that let you trick it into signing without the PIN. Presumably applets can have buffer overflows and logical flaws just like everyone else; it's not inconceivable that you could get remote code execution inside the smart card by talking to it the right way. If implemented correctly, you still shouldn't be able to get the key this way, but you can use it. Also, while there exist readers with onboard PIN keypads, most people type their pins into desktop software that you could phish or keystroke log with remote code execution on the client PC, then have remote use of the card as long as it's connected to a compromised machine.

There's also generally a layer (or two) of administrative PIN/PUK codes so organizational administrators can reset forgotten user PINs. This is sort of a problem for the military when people in remote postings lock themselves out of their computers are there are no sufficiently privileged IT guys around. Some organizations can do this remotely, which is (probably) cryptographically secure but vulnerable to social engineering if you can steal a card and convince remote support to give you a PIN reset code. There's also another code that's necessary to replace applets. All of these are presumably vulnerable to being left at their factory defaults, being leaked by a careless administrator, etc. and not easy to rotate if compromised.

HID iClass (smart card-ish proximity physical access control) credentials are supposed to be impossible to clone without a cryptographic key, for example, except the same key is embedded in every HID reader. You can rip one off a wall, JTAG it, get the key, and sign arbitrary cards for any building that hasn't bothered to generate a facility-specific key (and almost no one has).

In a stored value card application, you probably can't get inside the card and flip a bit to give yourself $1,000,000. But there's a much better chance you can figure out the protocol spoken by vending machines and impersonate one. Security through obscurity is common here, and if cryptography is used the private keys in the vending machines may well be sitting in RAM in Windows XP on a subway platform, or crypto primitives may have been chosen incorrectly, or keys may be available by social-engineering the manufacturer.

Smart cards aren't a panacea. As some CIO-focused trade press mentions, most real-world breaches don't involve stealing authentication credentials. Having super-secret SSH keys doesn't help you if I can get a shell through PHP. But it is a hell of a lot easier for an attacker to get your SSH private key from ~/.ssh/id_rsa than from your smart card - at worst the smart card would let him _use_ it.

BTW, you _can_ generate the keypair on a computer (preferably an air-gapped one) and load it onto a smart card. This would let you have backups. But most applications are for authentication; there is no need to have a backup because administrators can simply associate a new card with the account. Server-side HSMs have different properties.'

(I am not a security expert, just taken an interest in this recently.)</comment></comment></comment></comment>


Three-word addressing scheme adopted in Mongolia and Ivory Coast - <AUTHOR> https://www.washingtonpost.com/news/volokh-conspiracy/wp/2016/12/14/three-word-addressing-scheme-adopted-in-mongolia-and-ivory-coast/ <comment><USER2> Someone has actually adopted this lunatic scheme?! The whirring sound you can hear is Genghis Khan spinning in his grave (located at Codpiece-Aardvaark- Nipple)

[https://stiobhart.net/2016-01-15-stupidest-idea- ever](https://stiobhart.net/2016-01-15-stupidest-idea-ever)

For a universal location system that actually makes sense, check out: [http://www.openpostcode.org](http://www.openpostcode.org) (implementation on that site shows only Ireland, but the concept is valid globally)</comment>


Eugene Goostman becomes first computer to pass Turing Test - <AUTHOR> http://www.independent.co.uk/life-style/gadgets-and-tech/computer-becomes-first-to-pass-turing-test-in-artificial-intelligence-milestone-but-academics-warn-of-dangerous-future-9508370.html

<comment><USER2> It's very, very poor. Extensive discussions already here on HN:

[https://news.ycombinator.com/item?id=7864644](https://news.ycombinator.com/item?id=7864644)

[https://news.ycombinator.com/item?id=7864521](https://news.ycombinator.com/item?id=7864521)

</comment><comment><USER3> It's an interesting claim. Basically the AI's success is because it covers its shortcomings by claiming to be 1) young (plausibility for not knowing commonly known things), and 2) speaking in a non-native language he's not fluent in (cover for not communicating well).

This leads to the question: where do you draw the line? Could a computer pass the Turing Test if its "parents" claimed it's their baby mashing on the keyboard, and the computer just outputs random characters?</comment>


Eat out a lot? Try one of these Secret Menus - <AUTHOR> http://www.couponsherpa.com/ask-coupon-sherpa/secret-restaurant-menus-revealed/ <comment><USER2> Man not to be a downer but there is literally nothing even remotely healthy on any of these suggestions. Not even the typically healthy Chipotle is spared.

It's easy as developers working late or odd hours to fall into the trap of unhealthy eating habits. But don't do it - if anything our hard working hours requires really smart food choices.

</comment><comment><USER3> I saw this when the article was originally posted in March, but was fun/interesting to review. The Rodeo burger is pretty decent (it used to be a 'limited time' special menu item). Also, my favorite all-time secret item which didn't make the cut: the "Poor Man's Big Mac" -- order a double cheeseburger without ketchup/mustard, add special sauce and shredded lettuce.. cost =~ $1.30

</comment><comment><USER4> I noticed that several of these items are actually on the normal menu in my region. The first one that actually stood out for me was the Peanut Buster Parfait, it's actually one of the most popular items at the Dairy Queens in my area. I then went back and looked at the rest of the items and realized that several of them are a normal part of the menus around here.</comment>


Engadget Android 4.0 (Ice Cream Sandwich) review - <AUTHOR> http://www.engadget.com/2011/12/01/android-4-0-ice-cream-sandwich-review/?m=false

<comment><USER2> I'm using a crippled DroidX with Motoblur variant (ex. can't hide blockbuster app, limited homescreens, etc) and I've found a solution for waiting for the table scraps to filter down from Android releases: Go Launcher X (no root needed)

With home screen replacement apps you can more or less configure whatever you want on your mobile and strip out the stuff you don't want: [http://www.addictivetips.com/mobile/10-awesome-go- launcher-e...](http://www.addictivetips.com/mobile/10-awesome-go-launcher-ex- themes-android/)

<comment><USER3> Or.... you can go (and later support) Cyanogenmod

[http://wiki.cyanogenmod.com/wiki/Motorola_Droid_X:_Full_Upda...](http://wiki.cyanogenmod.com/wiki/Motorola_Droid_X:_Full_Update_Guide)

<comment><USER4> I have a Galaxy S2, and it's a great phone, but why should I have to do that?

I can't get rid of bloat-ware or even stop it from running without rooting my phone and voiding my warranty. I don't have root access to a device I own, which seems bizarre if you think of it as a mobile computer.

Imagine the uproar if all Windows PCs now came with un-stoppable and uninstallable bloatware, and without admin/root privileges.

<comment><USER5> "imagine the uproar if all windows computers came with..."

That's the thing though - all android phones don't come like that. If you wanted an unlocked and clean phone you could have bought one. You made the choice to get a locked down phone filled with crappy carrier apps, in exchange for a lower price. if people had the choice to get a windows PC for $50 in exchange for some preinstalled apps and no admin access, you'd better believe they would. The reason carrier subsidized phones are more popular is that most people dont care. If you care, don't buy a phone you don't like.

<comment><USER6> _if people had the choice to get a windows PC for $50 in exchange for some preinstalled apps and no admin access, you'd better believe they would._

They did try and it didn't work. Why? because PCs are abundant and the companies that wanted to do subsidized PCs couldn't get the economics to work. The smart ones realized that PCs were getting cheaper anyway so just wait a little bit. Others realized they could put it on credit and still come out ahead. Only the ones really bad with money/poor credit went the subsidized route (pay us now, and then pay us $40/mo indefinitely).

Phones are slightly different. The service doesn't get much cheaper whether you buy up front or subsidized. And unlike PCs, the price of phones hasn't dropped, the features just got better. And do to wireless restrictions of competition the price of plans hasn't dropped either.

For example, I just renewed my plan. I could pay $600 and buy my own phone. The carrier was going to knock $10/mo off my calling plan. Either way I was going to be locked in for the next 2 years. So I could shell out $600 and save $240 or I could only spend $100. I looked at the PAYG plans but due to my volume of calls it would cost more than the calling plan.

People aren't as naive as you think. They know they are going into this deal at a severe disadvantage so they might as well make the most of it.

</comment></comment></comment></comment></comment><comment><USER7> The default fonts in Ice Cream Sandwich seem much too small to me.</comment>


FBI looking into City of Atlanta computer issues - <AUTHOR> https://www.wsbtv.com/news/local/atlanta/fbi-looking-into-citywide-computer-issues-in-atlanta/720045695 <comment><AUTHOR> Channel 2 Action News obtained an internal memo from the Atlanta Police Department saying that the city network had been hacked.

"The city network has been compromised. If you have not already, please unplug your Ethernet cable from your desktop in an effort to prevent possible corruption, but the damage may already have been done. Unfortunately, this may affect payroll. Please let everyone know that this problem is being aggressively addressed," the memo said.</comment>


How To Facebook Comments on Blogs - <AUTHOR> http://www.yodspica.co.uk/2012/01/ultimate-guide-to-implementing-facebook.html#.TyR-JfTQnvY.hackernews <comment><USER2> Congratulations for the awesome tutorial. Really helpful.</comment>


Field Linguist's Toolbox - <AUTHOR> https://software.sil.org/toolbox/ <comment><USER2> For many people, Toolbox has long since been replaced by SIL's Fieldworks Language Explorer (FLEx). Toolbox allows you to get inconsistent representations of lexemes; FLEx effectively prevents that. OTOH, if you're doing s.t. other than the usual sort of dictionary, Toolbox might be a good choice.

Disclaimer: I helped develop the morphology and phonology model in FLEx, and an earlier version of one of the two morphological parsers in FLEx (Hermit Crab), so I'm not an unbiased observer.

</comment><comment><USER3> There's a really cool pipeline for shepherding Toolbox-cataloged utterances and definitions into Delphin-project symbolic grammars to basically auto generate morphological models & do TDD on symbolic grammars. Took a class from Emily Bender where we built a grammar of Chintang with this system, and were able to do simple machine translation via an intermediary language to other grammars built in the class for e.g. Nuuchahnulth and other small languages. Its a really cool system for machine understanding of languages that never would have enough tagged text for a machine learning system.

<comment><USER4> When you say "basically auto generate morphological models" how automatic is the process exactly? I've been asked to help write a stemmer for Berber (which I do not speak) for use on [https://tatoeba.org](https://tatoeba.org) and I'm wondering whether this Toolbox and/or Delphin ( [http://www.delph- in.net](http://www.delph-in.net) right?) would be useful for that.

<comment><USER2> For morphology (esp. languages with complicated morphologies, like Berber), the tool that most computational linguists reach for is finite state transducers, particularly those that are built for use in morphology and phonology. An early one of these was the Xerox xfst/ lexc program, which has since been re-implemented in open source form as Foma ([https://fomafst.github.io/](https://fomafst.github.io/)). The book on xfst/lexc, [https://www.press.uchicago.edu/ucp/books/book/distributed/F/...](https://www.press.uchicago.edu/ucp/books/book/distributed/F/bo3613750.html), is probably still the best place to go for a tutorial. Other FST programs that have been used for morphology and phonology include the Stuttgart FST (sfst, [https://www.ims.uni- stuttgart.de/forschung/ressourcen/werkze...](https://www.ims.uni- stuttgart.de/forschung/ressourcen/werkzeuge/sfst/)) and the Helsinki HFST ([http://hfst.github.io/](http://hfst.github.io/)). HFST allows the use of weights, which can be useful for spell correction.

I've built built morph parsers with all of these except HFST, although that's next on my list.

I'm not familiar with Delphin, but a quick glance at their website implies that it's for syntax, not so much for morphology. They mention a Japanese grammar implemented in Delphin, but it uses a separate tool for morphology.

In answer to your other question, the last time I looked, machine learning of morph parsers (or stemmers, which are like morph parsers that throw away the affixal information) is reasonably good for "fusional" morphologies, which most modern IndoEuropean languages have. I don't think the state-of-the-art ML would work well for Berber, because of its much more complex morphology.

<comment><USER3> The Delph-in system has a morphological model based on position classes. Morphology items are treated similarly to syntax items, in that they can hold constraints on & apply features to what they attach.

<comment><USER2> Interesting, I hadn't seen that. Does it handle phonologically-conditioned allomorphy or inflection classes? Stem allomorphy conditioned by phonology or position in the paradigm (like the stem allomorphs of the Spanish verbs 'tener', 'crecer' etc.)?

</comment></comment></comment></comment></comment><comment><USER5> Several aspects of this seem rather outdated from a software perspective (NB: I'm not commenting on potential utility for language work). It's Windows, only emulated for Mac/Linux, has several other hints that it's really old (who touts DBMS like it's the 90s, even if that's what's behind something) and crucially it's not open source.</comment>