Retail stores use Bluetooth beacons to track customers - <AUTHOR> https://www.nytimes.com/interactive/2019/06/14/opinion/bluetooth-wireless-tracking-privacy.html <comment><USER4> It's worse. I have personal knowledge from a lot client work in this space.

There are companies offering some basic functions like "wayfinding" so the retailer or mall wants to give wayfinding to the user in their app. Sounds good, in fact it's cheap, and they will even handle the beacon deployment... hook up sdk to wireshark and find it sending lots of data, some of it comes to me (retailer api) but a metric ton of it is going back to the provider. Being able to see the installed solution in multiple retailers and seeing the app code you start to notice persistence between them... retailer and mall didn't even ask for this. They just wanted wayfinding.

<comment><USER5> Yes that's exactly how this gets implemented in practice.

I did quite a bit of client work here too, specifically around using already existing surveillance camera networks to build user profiles.

At the end of the day the goal is to optimize for the intersection of "what the user wants" and "what we want to sell." So, a low collection system will give bad recommendations and a really good recommendation system will have an immense amount about the user.

Now that I talk with people on the other side of this, it's clear that most don't really care as long as they are getting good suggestions. I had this conversation just a few weeks ago with a young lady and her take was: "It's kind of creepy, but if it gives me good suggestions, I don't really care."

<comment><USER6> > "It's kind of creepy, but if it gives me good suggestions, I don't really > care."

This is an Unpopular Opinion, but IMHO thats kind of a reasonable stance to take.

<comment><USER7> > _This is an Unpopular Opinion, but IMHO thats kind of a reasonable stance to > take._

I disagree. The recommendation is immediate and apparent to the end-user. The negative potential uses/consequences of all the other data collection are not.

It's funny, but when an unsuspecting person gets a home loan they can't possibly afford pushed on them by a shifty mortgage broker, people here cry bloody murder. But when people ignorantly consent to having their data harvested for the pleasure of better targeted advertising, the tech community happily says "but they asked for it!"

<comment><USER8> > But when people ignorantly consent to having their data harvested for the > pleasure of better targeted advertising, the tech community happily says > "but they asked for it!"

What? I feel like the only topic the tech community gets worked up about that nobody else cares about is digital privacy. There are always people on hacker news condemning a lack of privacy and targeted ads - I'd venture it's the majority of people on this site that feel that way.

</comment></comment></comment></comment></comment><comment><USER9> Maybe the existence of such toolkits is a Chesterton's Fence that says you can't make this work without something installed on the phone. But this would be possible without these trojans.

If the Bluetooth beacon configures itself as a master, and enters inquiry mode, phones that pass nearby will happily respond with their Bluetooth ID (see [https://www.bluetooth.org/docman/handlers/downloaddoc.ashx?d...](https://www.bluetooth.org/docman/handlers/downloaddoc.ashx?doc_id=457080), section 8.4).

You can also do the same with Wifi access points: Phones are constantly broadcasting their MAC address during active scanning for networks. The location from signal strength isn't as good (a Bluetooth beacon can pin you down near the Yoplait yogurt, a Wifi beacon and signal strength measurement just put you in dairy) but it's getting better (worse?). See: [https://www.crc.id.au/tracking-people-via-wifi-even-when- not...](https://www.crc.id.au/tracking-people-via-wifi-even-when-not- connected/)

I imagine it would not be perfect but would be acceptably easy to use these "anonymous" MAC addresses to connect you to a name and address on a debit card. If your MAC and 20 other people left the store Friday at 2PM, and you and 20 other people went through checkout, and then your MAC and checkout are seen with 20 different people next week it's pretty trivial to identify you.

The cynic in me, though, says that even a minor loss of fidelity in tracking data weighed against the minimal risk and cost of building the spyware makes it worth building both.

<comment><USER10> > _Maybe the existence of such toolkits is a Chesterton 's Fence that says you > can't make this work without something installed on the phone. But this > would be possible without these trojans._

Without these trojans the store would have on its hands a major networking infrastructure project. With these trojans, all they have to do is drop a few battery-powered beacons in their venue and store their IDs along with coordinates in a database.

<comment><USER9> "The store" that implements these is probably not a mom-and-pop. Places like Walmart succeed because of their ability to execute major logistics and networking projects.

If the beacons increased Wal-Mart's revenue by 1%, the "major networking infrastructure" project could be a $5 billion department, larger than Google's entire R&D operating expenses.

<comment><USER10> Sure, but the Beacon technology was designed for this cheaper type of use (dumb beacon, smart phone) from the get-go - people working on it probably may have wanted it to be useful not just for the biggest chains, but also smaller franchises and mom-and-pop stores (why limit your market prematurely?). In the alternate reality in which BLE beacons were never created, maybe Wal-Mart did its own major project to get the same results the hard way.

</comment></comment></comment></comment><comment><USER11> I setup Home Assistant with the Raspberry Pi Bluetooth module to detect when my fiance and I were home or away (to turn on/off lights, turn off WeMo switches to the curling iron that my fiance always forgets). After a few weeks of forgetting I had it running, I logged back into the Home Assistant dashboard to notice that it was tracking nearly all of my neighbors Android phones, iPhones, headphones, TVs - when they were home, when they were away. Entirely passively. Most devices had names that could very easily be linked back to the user - i.e. "Joe's iPhone".

Just to reiterate - this was _entirely passive_. I did nothing but enable the Bluetooth presence detection module in Home Assistant on my Raspberry Pi, and over time it built up a detailed log of when nearly all of my neighbors were home or away.

Luckily I was able to quickly turn off tracking of devices that weren't explicitly enabled.

What confuses me, is that I thought iPhones had randomized MAC addresses? In the Home Assistant known_devices.yaml file, you can give aliases to phones based on their MAC address. And my iPhone has never changed it's MAC address, because Home Assistant continues to track it with ease. Not entirely sure how that works.

<comment><USER12> iOS randomizes the MAC address when scanning for networks but provides its true name when it joins one.

</comment></comment><comment><USER13> Yep and I've been researching this for robotics. The new WiFi standard 802.11mc includes improved time-of-flight measurement of radio packets such that the device can be localized to within 1 meter reliably. Android 9 and the Pixel already support this, though WiFi APs supporting this are still in the early phases. Google WiFi supports it tho.

The good news is that this technology does not tell the AP where you are, only the device knows. However an app on your device could share this information with advertisers.

[https://www.crowdconnected.com/blog/testing-wifi-rtt-on- andr...](https://www.crowdconnected.com/blog/testing-wifi-rtt-on-android-p- for-indoor-positioning/)

</comment><comment><USER14> Apple's iBeacon location-aware shopping goes live today (2013)

[https://www.theverge.com/2013/12/6/5181302/apple-store- ibeac...](https://www.theverge.com/2013/12/6/5181302/apple-store-ibeacon- rollout)

Beacon Technology Arrives in 50 Target Stores (2015)

[https://corporate.target.com/article/2015/08/beacon- technolo...](https://corporate.target.com/article/2015/08/beacon-technology)

<comment><USER15> I was working with Target when they did this roll-out. As sinister as everyone here seems to make it sound, I can assure you at that time it was _not_. If you're familiar with the inception of corporate projects, this project was no exception to any of the stereotypical fumbles and foibles of any effort of this scale.

It began simply because Apple said "...iBEACON.." and everyone corporate wanted the new buzzword in their portfolio to let people know how hot/hip/tech they were (toys -r- us considered it for awhile) so they could pull the kids away from the internet and back into brick-and-mortar. How can we use these? What are they good for? No one really cared, they just wanted them in the store and we were there to sell them that (at a premium).

In 2015 - indoor location was bogus. Everyone in this forum seems confident that there are multiple ways you can determine location with Wifi (round trip packet time) or bluetooth (RSSI). A cacophony of radio in a catastrophically noisy environment does not work to provide reliable location information.

In fact - it was so bad, that there were a handful of other equally unrealistic solutions being pedaled by everyone from universities to light- bulb manufacturers. One such solution was to profile the accessible space of a building using a phone's compass, and then use the observations from a client device compass to identify how generated patterns correlated to the profile for the building.

The torrent of data you see pouring from your phone to the service via wireshark is real-time sensor data that is being used to feed a service side bayesian / markov-chain / monte carlo / kalman-particle filter / keyword soup monstrosity trying to generate some possible marginal confidence in a probable location. We found that this system was most effective in turning your phone into a pocket warmer, but sold like hot-cakes in a B2B setting wherein the intended end user had absolutely no voice.

Corporate wanted to buy it so they could sell advert-space (pop-up coupons) to affiliates. So we sold them something that worked barely well enough to provide a one-popup demo to potential interested parties. The affiliates bought the magic, corporate paid our company an arbitrarily large quantity of dollars for the service.

A deployment of thousands of coin-cell driven beacons per store, placed within reach of bored youths, maintained by an underpaid associate staff is of only questionable utility.

On a scale of things to worry about, ranging from nuclear holocaust to e. coli in your produce - this ranks a solid -3. In fact, in the 4 years since I've worked in this field I think the only advancement that has been made is that it's harder for third parties to sell because no one can do it well, so why not just do it in-house? It's cheaper and has the same garbage result.

If you think I'm wrong - go do it yourself. All these signals are easily grep- ed within any store (there's no way to make it proprietary), and you can create your own model and out-sell the proprietor. Surprise me. With an actual, viable client-oriented product (and assuming users actually want reliable indoor location) you'll make bundles selling it to the valley. Everyone is trying to do it (even cisco tried for awhile) - no one has.

Michael Kwet has read all the marketing copy, and rewritten it for popular consumption as a product. The insight/value provided by these systems is far more sparse than implied.

<comment><USER16> Such data is usually so noisy and incomplete that you cant get any actionable value from it.

The more complex a method is at tracking someone, the less reliable it is.

People fear too much of what can be done with the fancy ways of tracking while overlooking simpler ways that are much more effective.

</comment></comment></comment><comment><USER17> This is rage inducing. I went into this article thinking "ok as long as I don't have the Target or Ikea or whatever app installed on my phone, I'm fine." While that is a primary way, this needs to be outlawed:

> These companies take their beacon tracking code and bundle it into a toolkit > developers can use. The makers of many popular apps, such as those for news > or weather updates, insert these toolkits into their apps. They might be > paid by the beacon companies or receive other benefits...

Ban this, full stop, on both ends of this transaction. The Reveal Medias and the scummy app devs using their ~~SDKs~~ trojan horses. At the very least these apps need to be named and shamed, I find this fraudulent and extremely difficult for end users to police.

I have very minor hope that Apple at least will one day shine light on this or ban apps who are not transparent about the data they're sending and to whom, as it doesn't conflict with their business model and they seem to be moving there. For now I have to essentially disable bluetooth when I get out of my car.

<comment><USER18> This is how an app like Facebook can show you an ad on something you were talking about.

It would be naive to point the finger at Facebook listening to you, it would be more accurate to assume its EVERY OTHER app (including FB) gathering data about you and your surroundings - MAYBE ONE IS ACTUALLY LISTENING - <USER2> whether any individual app is or isn't, the data brokers have all the data as well as other people like you that have probably reacted to the same external stimulus and can be predicted to be thinking about a certain product around that point in time.

POOF - an ad about that thing you talked about, now on your Facebook feed.

Zuckerberg gets hauled in front of Congress, accurately says "what? no we don't do that", data brokers and software engineers laugh to the bank and let Zuckerberg get crucified for their sins.

<comment><USER17> Yes absolutely, everyone else is gathering this apparently and it has to just be assumed now. I hadn't thought about it with the "facebook is listening" stuff but this makes way more sense.

It's particularly frustrating given how hard I try to disassociate myself and my family from "data brokers" and then I read another thing like this.

<comment><USER19> I think people jump to "the app is listening" because it's the easiest concept to understand. Anyone with a technical background knows why that's extremely unlikely, but it still makes more sense to people as a narrative than the complex web of online trackers and analytics gathering that happens out of sight and contains vastly more information about individuals than could be gleaned by eavesdropping on ambient room noise.

</comment></comment></comment></comment><comment><USER20> This is really big in the WiFi space. Aruba, Cisco, etc all market services to public places like malls where you throw in a huge public wifi network, and regardless of whether you connect or not, they can see phones looking for known network and track traffic patterns.

Malls can then see which stores have highest foot traffic on what days, etc. It's actually one of the things that justifies the expense for huge, expensive free wifi deployments. And it is used to more accurately price locations around malls.

The other alternatives to getting the same kind of data is security camera analytics. Sometimes literally someone just watching footage and taking notes on who they see and what kind of demographics, etc. Which is problematic in it's own right.

<comment><USER13> Well they automate the security camera analytics now too. I just saw this one recently:

[https://www.sentinelcv.com/](https://www.sentinelcv.com/)

<comment><USER21> A lot of Verizon stores are owned by third-party companies. I had the chance to speak to one of the regional reps in a college class and he told me his company [1] does facial tracking of everyone who comes in the store. It also monitors employees and how many breaks they are taking/what they are doing (like hiding in the stock room).

[1][https://www.tccrocks.com/](https://www.tccrocks.com/)

</comment></comment></comment><comment><USER22> I think the biggest misconception here is the belief that Bluetooth LE beacons are tracking phones. The beacons themselves operate as transmit-only and don't receive any data and therefore don't perform any tracking themselves. The more correct way to look at this is that the apps are tracking a user's location, and the beacons are providing the app with information to determine the current location.

If the app's knowledge of your location provides some service and the user is opting-in, this shouldn't be a problem (just like I opt-in to provide Google Maps my location).

The keys here are (1) users should be aware that an app knows your location, and (2) User should have the ability to opt-in to providing my location to the app. The mobile operating systems should do a better job of making the user aware and making it very easy to opt in or out.

Maybe an ideal solution would be where (assuming the user opts-in) the OS automatically controls whether an app has the ability to use Bluetooth locationing when the GPS detects that I'm in a certain area. For example, the Target app is prevented from using Bluetooth tracking most of the time, but when my phone GPS sees that I'm in a Target store it automatically enables it while I'm there, and disables it when I leave.

</comment><comment><USER23> The cynical part of me thinks this is the real reason to get rid of the headphone jack -- to make it inconvenient to turn off bluetooth.

<comment><USER13> On the iPhone turning off Bluetooth using the control center doesn't even turn it of fully, precisely so that these location services (and other features) are still available.

[https://www.vice.com/en_us/article/evpz7a/turn-off-wi-fi- and...](https://www.vice.com/en_us/article/evpz7a/turn-off-wi-fi-and- bluetooth-apple-ios-11)

<comment><USER24> Indeed.

Sidenote, it behaves differently if you've enabled airplane mode (or at least so the UI would indicate). In airplane mode, it gives no message and the wifi/bt icon goes transparent. If you're not in airplane mode, the wifi/bt icon goes light gray and it says 'disconnecting <device type> devices until tomorrow' but the radio is still on as your article mentions.

Personally I miss the old behavior where it just turns it off, but I'm often in airplane mode so I get the old behavior anyway and great battery life :P

</comment></comment></comment><comment><USER25> Having done some proof of concept work for a couple of very large retailers using BLE/beacons I believe most of the scumminess isn't on the retailer side but the 3rd party API/framework.

The requests we were fielding was for better ability to find things in the store, floor maps for every store with wayfinding, and the ability to use the app to get more contextual info on demand.

For those not completely in the know on beacons: they are broadcast only and it is the apps running in the background on your phone that shuffle off the data on your phone. If you were running a device free of the offending apps, your privacy is fine on that front. The WiFi tracking is a different story though.

<comment><USER26> I'm a developer, but I've never touched mobile dev at all. Could you clarify what "running in the background" means here? I see it come up a lot and I'm never quite sure.

Specifically, if I have an app installed, but it's not open in any way (e.g. in iOS I double tap home and swipe up on the app's window to close it) can the app still run any code? Am I safe from these "background" vulnerabilities as long as I aggressively kill apps that I'm not actively using, or is simply having the app installed enough to let it run a certain amount of code on my device?

<comment><USER25> They can if given permission to. For certain apps in iOS it's usually an application asking for location permissions without a real good reason for it, that's why (in my opinion) it seems like weather apps are some of the worst offenders for this stuff, as it makes sense to give it location permissions. There are other permissions that can be abused as well, but location is the dead give away.

I can't speak to Android as it's been a long time, but iOS is pretty strict about what you can and can't do in the background. There are certain events that will "wake up" an app, even one that is killed. You're not necessarily safe if you have a bad app installed and kill it. I usually just recommend avoiding free apps that seem super heavy on ads. Because the ad framework is likely abusive, even if the developer didn't intend it.

<comment><USER26> Thanks. That's pretty unfortunate. I guess I'll just be event more aggressive about denying permissions requests and uninstalling any app I don't have a good reason to keep now.

</comment></comment></comment></comment><comment> move-on-by This is a bit off topic, but how could I do this at home? Seems like it could be a great addition to home security systems. Criminals know to cover their faces with all the cameras and they use stolen vehicles that can't be traced back to them. I bet they still have their phones with them. I'm not sure the police would take action on a device's MAC address- but it's still another data point. Perhaps there are hardware/usb sticks designed for this purpose?

<comment><USER27> I do wifi tracking for a living and no there is no off the shelve solution for consumers that I have ever seen. You can accomplish this with a raspberry pi, a wifi adapter that supports monitor mode, and tcpdump set to the right filters. However, I don't see why anyone ever would.

As others have mentioned many of the top wifi brands, Cisco, Aruba, and Meraki (now owned by Cisco) provide this kind of information to clients at their enterprise level.

The reason this doesn't exist for consumers for security at least is that in the use case you described it is hard to tell what MAC address belongs to each device. Even in a neighborhood, you will detect hundreds of macs a day due to mac spoofing that modern phones do.

<comment> move-on-by Built-in RaspberryPi WiFi can do monitor mode. Kali Linux even has a raspberry pi image. RaspberryPi also has built in Bluetooth that supports 4.1 and low energy. Since Bluetooth is a less powerful signal, is there anything I could do with that?

<comment><USER27> I haven't tried to track phones with bluetooth, it seems like it wouldn't be possible because phones aren't always announcing themsleves. A by product of battery limitations I would guess. The more common use is tracking powered tags for the purpose of asset tracking in say hospitals or similar.

I didn't know the onboard adapter supported monitor mode, that is ligitmately useful knownledge for me. Thanks, it should be simple to build your own sniffer to just plan around with. Carefull if you are in the EU though, not that it is removely possible to catch a silent sniffer.

</comment></comment></comment></comment><comment><USER28> To me, this isn't big news -- It's at the point where I turn wifi and Bluetooth off when I'm shopping.

Look at some of the filings by Kroger:

[https://fccid.io/PBR-SZG3APWC/Users- Manual/Manual-3994818](https://fccid.io/PBR-SZG3APWC/Users- Manual/Manual-3994818)

They are tracking down at the bay level for some items.

<comment><USER29> > I turn wifi and Bluetooth off

You believe that makes a difference?

<comment><USER30> It doesn't for Apple users. Location and other bluetooth features are still on after you turn it "off".

[https://www.zdnet.com/article/ios-11s-control-center-may- say...](https://www.zdnet.com/article/ios-11s-control-center-may-say- bluetooth-wi-fi-are-off-but-thats-just-not-true/)

<comment><USER31> That's the control center shit. I made a shortcut widget that actually shuts it off for this scenario.

</comment></comment></comment></comment><comment><USER32> Based on the title of the article I was expecting the stores to passively collect data based on the MAC address. I guess I was way wrong. I am a traffic engineer and we use passive BT MAC address scanners to sort out origin/destination and travel time. This is done by setting up multiple detectors around a study area. Each detector saves the time and MAC address of every device it detects. We later match the MAC addresses that have been detected at multiple locations and that gives us the travel time between them. The raw data is rather useless for any other purpose, to us at least, and is tossed after we are confident in the data results. If a store were to use something like this, they would have to tie my MAC address to me, which I doubt would be too hard.

I don't see anything wrong with passively tracking people in a store, mall, shopping center, etc., as long as it is used to inform the owners of movement patterns in the area. To use the information to push notifications and determine purchasing habits of people is over the line.

<comment><USER33> To me there is a difference between what you describe, where hardware deployed in stores collect detected bluetooth signatures, and what this article describes, which is YOUR OWN DEVICE reporting on your movements.

</comment></comment><comment><USER34> Android has a feature called "nearby device scanning" so even if you turn off bluetooth, apps can still do BLE. I suspect stuff like this, where many many apps can spy on you on behalf of others, is why Google made BT access a Location category. But it means your weather app that uses location to tell you where you are? It is selling your location via BT beacons to 3rd parties.

<comment><USER35> I really wish android differentiated between foreground and background location permissions.

<comment><USER36> Meet the newest Android Q (10) which is available as a beta. The permission levels are there for what you wish. It's impressive to see just how many apps were previously getting background location (and many other) permissions by default. Eye opening experience for someone that figured it wasn't _that_ bad.

<comment><USER37> > Meet the newest Android Q (10) which is available as a beta. The permission > levels are there for what you wish.

I would like to congratulate Google for such hard work. I mean, CyanogenMod 7 in 2010 could revoke any app permission at the user's will, but you know, computers are _difficult_

</comment></comment></comment></comment><comment><USER38> Nothing would make me want to buy yogurt less than an ad on my phone while I'm looking at yogurt. I would hope everyone would feel the same way, to disincentivize this.

<comment><USER39> The best way to protest surveillance capitalism is to make it ineffective. If you get a pushy or creepy ad, go out of your way to avoid that product or brand. Even if it is appealing to you. Even if it's a good deal. Send the strongest kind of signal against targeted ads: money.

<comment><USER10> I do whenever I can. For instance, for close to a decade now I maintain a blanket ban on Groupon for that one time they spammed me with retargeted ads a bit too hard (3+ same ugly pink ads simultaneously on a single webpage).

</comment></comment></comment><comment><USER40> Shouldn't there be a setting under Privacy to turn responding to beacons off?

I'd be interested in a list of popular apps or SDKs that use beacons -- so I could uninstall them pronto.

</comment><comment><USER41> This book [https://www.amazon.com/Aisles-Have-Eyes-Retailers- Shopping/d...](https://www.amazon.com/Aisles-Have-Eyes-Retailers- Shopping/dp/0300212194) goes into quite a bit of detail about various techniques retailers use to track customers.

</comment><comment><USER42> What exactly are retailers doing with this data, that they couldn't do before? If you go to a supermarket and pay by credit card, the supermarket is going to have a profile on what type of things you like to buy, even if you aren't a member of their loyalty program. They've been doing this since loyalty cards became popular in the 90s.

It seems somewhat benign, and not very useful, that they know I spent 45 seconds in front of the yogurt section, compared to the average at that time of 28 seconds. Maybe a friend I haven't spoken to for a long time started messaging me. Or maybe I was helping an elderly person get something from the top shelf.

The part about eending ads to your device is FUD, any app that starts doing that without my permission is getting uninstalled straight away.

<comment><USER43> We aren't privy to the back office deals they are brokering with our data across advertisers and what not.

</comment></comment><comment><USER44> In order for this to work the apps have to listen to bluetooth signals from the beacons (or register a hook for an OS level beacon listening service?). How do I prevent an app from listening to bluetooth? Is this gated by the iOS "access current location" permission, or the "bluetooth sharing" permission? The iOS docs I've found are unclear: [https://developer.apple.com/ibeacon/Getting-Started-with- iBe...](https://developer.apple.com/ibeacon/Getting-Started-with-iBeacon.pdf)

</comment><comment><USER45> So... turn off Bluetooth and Wifi when you go into a store? Put subtle lines on your face with makeup to confuse their facial recognition systems? What else do we need to do now to go out in public?

<comment><USER46> Physically dismantle every data broker's office and data center? Not sure what else would be effective.

<comment><USER47> Turn off your phone?

</comment></comment></comment><comment><USER48> I feel like I need a lot more clarification here, can anybody help out, whether on iOS or Android:

1) Some random third-party app has to be _running_ on your phone to detect beacons and send the data back... how viable/likely is this actually? It seems like this would only ever effectively detect a tiny percentage of users at best who just happen to have one of the apps open while walking around a store?

2) For an app to detect beacons, don't you have to give permission for the app to use Location Services? I've tried Googling it but can't seem to find a definite answer... I'd be surprised (and saddened) if Apple or Google are allowing apps to detect beacons without explicit location or Bluetooth permissions.

3) If the goal is to track as many users as possible... wouldn't it be far more efficient to look for Wi-Fi devices that are scanning, and identify them by their MAC address? I don't understand what Bluetooth beacons enable that Wi-Fi scanning doesn't.

4) The article lists companies that provide these third-party toolkits... but not a single name of an app that uses them, or what percentage of phones contain an app with them. Since this is the main accusation of the article... I don't understand why they wouldn't provide even a single instance of proof.

I've just seen a lot of very questionable reporting from the NYT in the past on tech/security/privacy, so I'd like to understand better how real this is or not.

<comment><USER49> > Some random third-party app has to be running on your phone to detect > beacons and send the data back

They don't have to be running. Here's my understanding (for iOS anyway):

1\. Apps have the ability to subscribe to bluetooth callbacks from the OS, which is constantly scanning for them (about once a second, from memory). It will be something like, "wake me up when you detect that beacon with UUID ABCD123 is in range". ABCD123 would be the standard ID of a marketing company's beacons - there could be millions of them.

2\. The beacon also have sub-IDs identifying the exact beacon being used. The marketing company will know which are where.

3\. Whenever the beacon is in range, the OS pings the app with the data, which decides what to do with it in the same manner as a background data refresh. This could be something useful, like waking up to let you know your suitcase is nearby - but it could also be silently uploading that data to a server.

4\. The software to do this is being bundled as a paid SDK in a great many seemingly-unrelated apps, such as weather apps.

5\. This behaviour is not counted as location services in the OS, and may or may not be disabled even when bluetooth is "off" on the phone

Corrections welcome but I believe that's roughly what's going on.

I'd greatly appreciate something like Little Snitch on the iPhone so I could see which apps are doing this and delete them with extreme prejudice. Back in reality, I'm glad this is getting attention - at the very least Apple should be providing a list of apps requesting BT access, and indeed any network access over time.

<comment><USER48> Thanks, this helps a lot.

I'm pretty shocked all this can go on in the background without permissions. With Apple adopting such a privacy-conscious stance, I really hope this gets their attention so beacon scanning requires explicit permission in the future (and separate from location services -- my weather app needs to know where I am, but _certainly_ doesn't need to scan for beacons).

This is honestly pretty egregious.

<comment><USER49> > This is honestly pretty egregious.

It certainly is. I knew about the mechanics of it but hadn't realised it was being so widely abused. I would like to see Apple come down on this swift and hard.

Third party paid SDKs! Those cunning bastards. AdTech really is the dregs.

</comment></comment></comment></comment><comment><USER50> On Android, this just had me 1\. Settings > Security 2\. Click on Location 3\. Enhance location precision 4\. Disable "Bluetooth Analysis" aka the use of BLE beacons

</comment><comment><USER51> The really simple answer? Give up your smartphone. It's eating your life anyway, crossing boundaries with your family / work. You're addicted to checking: your downtime is zero, your free space to think: negligible. Mindfulness: none. Mindlessness: maximum.

Just a thought.

<comment><USER52> How is this kind of "advice" anything but plain old-fashioned victim-blaming?

If ever an entire category of HN posts deserved an instant trip to -4 territory, these ever-present and singularly-unhelpful posts ("Just turn your phone off/leave it in airplane mode/leave it at home/give it up for Lent/sell it on Craigslist/go to Uttar Pradesh and join a Zen monastery") should more than qualify.

Letting scumbags dictate how you live your life -- or how you use your phone -- is never the optimal strategy. Don't turn off. Fight back.

<comment><USER51> I don't really see how my thought (note: more "thought", less "advice") qualifies for this ire, but, hey, maybe you too need to spend less time on social media being angry at people ;-)

Actually I think a considered and gentle re-looking at one's life is an entirely viable thing to do.

What's so nuts about leaving your smartphone at home, or giving it up completely? Try taking a step back in an attempt to take a cold look at how weird and unbalanced this whole smartphone addiction thing has become. A situation in which, what, 50%+ of any random group of people has head down looking at a screen? A situation in which a family goes out for a meal and spends the time with each member socialising with people in the virtual world but not with each other? A situation in which young girls are self-harming because they're spending 6 hours a day comparing themselves with others online? I live by the sea - a beautiful, wonderful part of the world - but the number of people who simply don't engage with the world they're moving through because of this little square of plastic in their pocket is astounding.

There's nothing blame-y about this - yes, the corporations need a slap at what they're doing with our data and our lives - but we've got individual agency, too.

</comment></comment></comment><comment><USER53> We need to articulate the changes we need from Apple & Google. Something along the lines of a) permission required for any app to use Bluetooth or BLE - preferably differentiating between whether the app is running in the foreground or background b) a way to turn off _both_ Bluetooth and BLE at the OS level. Then pressure needs to applied either through public opinion or through legislative efforts.

<comment><USER54> App level bluetooth permissioning is actually planned as a part of iOS 13

[https://www.apple.com/ios/ios-13-preview/features/](https://www.apple.com/ios/ios-13-preview/features/)

</comment></comment><comment><USER33> I actually implemented a nearly identical system for my senior design project, except we targeted the smart home ecosystem. Basic use cases would be automatically turning on/off lights or having a music stream/temperature preference/... follow you as you move throughout your house and enter/leave rooms. All implemented by an app on your phone detecting strategically placed beacons.

<comment><USER55> Haha I did a very similar thing for mine - it was using these to replace clock in systems for hourly workers, no more need to clock in or out, the app would auto detect when you entered/left the building

</comment></comment><comment><USER56> This isn't new. I wrote this blog about beacons back in 2015 for the NoSQL vendor Aerospike; there aren't just audio (high frequency) beacons. There are also RF and other spectrum beacons:

[https://www.aerospike.com/blog/silverpush-unifies-people- dev...](https://www.aerospike.com/blog/silverpush-unifies-people-devices- data/)

</comment><comment><USER57> The other day I had to send a video to a friend. Too big for email and fb messenger wouldn't let him download it once received, so I ended up trying airdrop and got a list of names of everybody's iPhone or iPad around me.

Apparently we are all telling anyone around us who cares to listen who we are.

</comment><comment><USER58> Is there a way to determine which apps have the SDKs from Reveal or other companies?

<comment><USER59> Yes. My company (MixRank) downloads and analyzes mobile apps. Among other things, we determine what SDKs, APIs, etc, an app uses. We have 20k SDKs identified and track all of their installs/uninstalls.

</comment></comment><comment><USER60> I didn't know it was a secret? Figured it was pretty common knowledge back when iBeacons and similar were announced and when major retailers like Target even made press releases about it

[https://techcrunch.com/2017/09/20/target-rolls-out- bluetooth...](https://techcrunch.com/2017/09/20/target-rolls-out-bluetooth- beacon-technology-in-stores-to-power-new-indoor-maps-in-its-app/)

Kind of funny that Apple pushing privacy basically helped create this kind of tracking to begin with.

Edit: NYT article mentions other apps selling data to retailers. I think it's time apps start asking permission to use BTLE. No reason a weather app needs that kind of access.

<comment><USER61> Apple? Maybe it's the big stores and advertisers want to know everything about everybody that are to blame?

<comment><USER60> Yes Apple. They rolled out iBeacons and created a whole toolkit on ios that enabled tracking - at least a lot easier than it would have been.

<comment><USER61> Thanks, this makes sense, though beacon technology is not exclusive to them

</comment></comment></comment></comment><comment><USER62> So when can we start using this stuff to get indoor navigation or navigation inside tunnels to work properly? If we are being tracked we should get some benefit from it as well.

</comment><comment><USER63> am I understanding this mechanism right?

1\. Set up a bluetooth beacon in the diary aisle that broadcasts as a connectable (nor not?) device with an "SSID" (or the bluetooth equivelant) that is a known GUID

2\. apps on your phone can scan for available bluetooth devices, and see the presence of the GUID, which is enough for them to know you are in the dairy aisle of Store 1234.

if that's right, does this mean disabling bluetooth, or restricting a device's access to scan for devices, will preclude this?

<comment><USER64> Basically it means those loyalty apps stores put out? Are you sure you know what that app is doing...?

You are right that disabling bluetooth or being aware of what apps your phone has is what is required.

<comment><USER23> You don't need the Target app to be tracked by Target, since the tracking beacon code can be in any number of unrelated apps (weather, news, games, etc.)

</comment></comment></comment><comment><USER65> Hopefully not a dumb question...

Are there any apps / options that allow for only connecting / responding to a previously connected unless overridden?

</comment><comment><USER66> AFAIU, on iOS disabling location access will stop apps from accessing beacons entirely, and apps have to prompt to establish this permission.

</comment><comment><USER67> You can set similar tracking yourself with rpi, hass.io and presence detection module that can register and track MACs on Bluetooth and wifi

</comment><comment><USER68> What I don't get is:

1\. Pretend it's the 1900s.

Walk into a general store, shopkeeper sees you looking at ammo for 20 minutes and then leave without buying anything. Next time you walk in, he recognizes you and says he'll give you a discount on ammo if you buy in bulk.

This is totally cool, not a violation of privacy, and both parties benefit. win/win

2\. Use a computer to do the same exact thing automatically

Rage, pitchforks and proverbial molotov cocktails and people going on privacy diatribes.

What's the difference?

<comment><USER69> You're on HN and "What's the difference" is really your question? 1\. Friendly private human interaction shared by two people. 2\. Data is collected, sent, analyzed, sold, shared, distributed, stolen, and abused in order to maximize profit across expansive markets at the expense of any respect for the user's privacy. The user is tracked, distracted, and tricked into obeying algorithmic market forces of massive and opaque breadth. Every piece of data ever accrued is collected and stored in order to create an invasive profile of a user's movements, decisions, actions, and relationships, so that predictive programming can be implemented in attempts to guess the state of the user's mind prior to the user coming to these conclusions, or at least to convince the user that this is what the user wants. The end goal is technology that effectively usurps the user's free will, so that the user is completely reliant upon it for basic decision-making. The goal is to destroy free will. A society in which every individual action is known by governments and corporations is not a healthy society. It is an electronic prison.

<comment><USER68> This just seems like such absurd hyperbole I can't tell if you are serious or not. "technology that effectively usurps the user's free will" "electronic prison"

I don't believe any of this. Nobody can usurp my free will no matter how much data they have on me. Heck, even if I _told_ them every last piece of private information I knew about me, I doubt they could increase my spending even 1% more than I currently am with all the coupons and targeted advertising and subliminal marketing in the world.

<comment><USER69> I'm glad that you feel you are immune to these advances. That doesn't change the corporate agenda though. They want you to buy their stuff. You, me, everyone. They pay loads of money to teams of people dedicated to utilizing the latest technologies to bend your will to their desire, with whatever tricks their minds may conjure. They work in concert with others doing the same. It's "just business".

We have a global population that is addicted to their phones. A great deal of their worldview is shaped on a daily basis by a small illuminated screen that fits in the palm of the hand, full of deception and manipulation, which goes well beyond grocery shopping. The phone is an ideal espionage tool since, for most people, it is turned on and broadcasting constantly, and always at its user's side. I mentioned "electronic prison", scaling out from this, in the sense that law-abiding citizens are under constant surveillance, similar to inmates in a prison. We have the ability to move around of course, but we can hardly do so without being watched, which does not equate to actual freedom. The human experience is being overrun by addictive technology that manipulates our will through mechanisms that are totally unknown by the average user. It may seem like hyperbole because its full effects have not yet been understood. It's not like this is the end: this is just where we are today. The intrusion into our lives will only escalate.

</comment></comment></comment></comment><comment><USER70> Honestly, part of this doesn't bother me that much. It doesn't bother me for a store to know where I'm standing while I'm in their store.

What _does_ bother me is the part where they can get lots of other data and use it to build a profile of me that spans far beyond their store. The fact that this Pulsate company encourages devs to include my email address, for example, seems _really_ invasive, and probably would be illegal under the GDPR?

</comment><comment><USER71> How do they actually make money?

Merchandising isn't rocket science. I wonder if there is real roi?

</comment><comment><USER72> Not if I keep Bluetooth turned off, which I usually do. Admittedly this is easy for me since my phone still has a headphone jack.

<comment><USER73> You may have been misinformed about the effectiveness of keeping Bluetooth "turned off".

<comment><USER72> I also keep Location History and Bluetooth scanning off, just because I want less Google in my life. Apparently those are important too.

[0] [https://qz.com/1169760/phone-data/](https://qz.com/1169760/phone-data/)

</comment></comment></comment><comment><USER74> mass background tracking is becoming the defacto leading industry

</comment><comment><USER75> >Location marketing aims to understand "online-offline attribution." If a Starbucks coffee ad is sent to your email, for example, marketers want to know if you actually went there and bought a coffee. The only way to know is to monitor your online and offline habits at all times.

Make no mistake: the purpose of marketing is to maximize information asymmetry. The natural end point is totalitarian: they know everything about you, and you know nothing at all, blindly obeying.

<comment><USER76> That is not the purpose of all marketing. That might be the purpose of this kind of tracking, but I don't think telling people the product you created to serve their need is inherently evil.

At its best, marketing is a way to let people know the goods and services you have that can make their lives better.

This is marketing at its worst.

I really enjoy this explanation of why targeted advertising is such a horrible thing:

[https://zgp.org/targeted-advertising-considered- harmful/](https://zgp.org/targeted-advertising-considered-harmful/)

<comment><USER10> > _This is marketing at its worst._

This is marketing at its real. As practiced.

> _I don 't think telling people the product you created to serve their need > is inherently evil._

Of course it isn't evil, but this is not what marketing is doing - <USER3> claiming so amounts to a motte-and-bailey defense of an industry that's rotten to the core and quite openly malicious towards their fellow human beings.

<comment><USER76> I am not defending these practices at all, I am just saying the idea of marketing is not inherently evil.

I also think you are being unfair if you say there are zero companies that do marketing right.

<comment><USER77> "I am just saying the idea of marketing is not inherently evil."

And probably most of us, including me, would agree. The problem is when the market is saturated with goods compared to buyers so that more aggressive methods - read: lies and subtle psychological tactics - are used to convince those buyers they need this or that product when they actually don't. Which becomes even more evil when the product is something potentially harmful such as unneeded food, medicines, anything that will be soon thrown away creating more pollution, etc. The problem isn't marketing by itself, but the total disregard for moral issues that can and will make it harmful once overproduction and saturated markets get us to a point where lying is the only way to keep businesses alive.

</comment></comment></comment></comment></comment><comment><USER78> yet another reason to just shop online or at mom-and-pop shops

<comment><USER79> You know tracking customers is a hell of a lot easier online. Mom-and-pop shops are probably the only way to go to avoid being targeted now.

<comment><USER80> > Mom-and-pop shops are probably the only way to go to avoid being targeted > now.

Yeah, and pay cash before they get rid of it and make us all pay for everything with wechat bucks or whatever.

</comment></comment></comment><comment><USER81> A provocative thought experiment: are you more annoyed by retailers recommending a product you just purchased from them, or a retailer recommending a product you probably will need soon? In a world blanketed by advertising, I would rather see relevant advertisements than be bombarded by garbage. Maybe I will get a deal, maybe I will discover something I like, maybe I will ignore it... but the spray-and-pray untargeted advertising that tries to advertise arthritis medication to me as a 31-year-old man is guaranteed only to annoy.

<comment><USER82> > Maybe I will get a deal, maybe I will discover something I like

This is what the ad industry exploiting the fear of missing out [1] looks like when they tout the virtues of "relevant ads". You might draw a comparison with casino marketing to gambling addicts, alcohol to alcoholics, etc -- it's rather slimy.

[1] [https://en.wikipedia.org/wiki/Fear_of_missing_out](https://en.wikipedia.org/wiki/Fear_of_missing_out)</comment></comment>


CLiki: The Common Lisp Wiki - <AUTHOR> http://www.cliki.net/index <comment><USER2> CLiki is usually pretty outdated and incomplete. These are probably the best resources for a new CL programmer (in no particular order)

<http://common-lisp.net/>

<http://www.gigamonkeys.com/book/>

[http://www.lispworks.com/documentation/HyperSpec/Front/index...](http://www.lispworks.com/documentation/HyperSpec/Front/index.htm)

<http://www.quicklisp.org/beta/>

and #lisp on irc.freenode.net

<comment><USER3> Those are all good resources. On top of that, Xach just posted[1] the number of times that libraries have been recently downloaded from quicklisp. I have been having fun checking out the most downloaded libraries.

I prefer common-lisp.net for finding a project's webpage and mailing list, but cliki has a useful section that lists projects by category.

[1] [http://blog.quicklisp.org/2011/02/project-download- stats.htm...](http://blog.quicklisp.org/2011/02/project-download-stats.html)

</comment></comment><comment><USER4> Making some enemies: Google "common lisp" and you will find that link in the first page of results. In a general programming languages forum this could be maybe ok. But having this in the first page of HN (known for having some familiarity with CL) strikes as something superficial to me.</comment>


Ask HN: C# DocGen like Javadoc? - <AUTHOR> There's an internal team at my job that's trying to get people to use a framework they built. The problem is there's no documentation; this despite the code being well commented in what appears to be a structured fashion. An example looks like this:<p>/// <summary><p>/// Waits for the Page's DOM to fully.....<p>/// </summary><p>/// <param name="classInstance">The PageObject instance to be populated.</param><p>does anyone recognize this format and, even better, a tool used to turn this into usable HTML documentation? <comment><USER2> Those comments auto-build an XML output; it's a built-in feature of the C# compiler. [1]

There are a number of XSLT stylesheets and more complicated tools around, many from relatively ancient times in the .NET world, to generate prettier documentation from those comments. NDoc [2] is ancient but still presumably works. I last used SandCastle, whose website proclaims it shutdown and forwards to fork SHFB [3], and some of whose guts inspired DocFX [4].

As another comment points out it appears that DocFX is the latest toolset Microsoft themselves are using (it's one of a couple of build tools for the new mostly all open source docs.microsoft.com site).

[1] [https://docs.microsoft.com/en- us/dotnet/csharp/programming-g...](https://docs.microsoft.com/en- us/dotnet/csharp/programming-guide/xmldoc/xml-documentation-comments)

[2] [http://ndoc.sourceforge.net/](http://ndoc.sourceforge.net/)

[3] [http://github.com/EWSoftware/SHFB](http://github.com/EWSoftware/SHFB)

[4] [https://dotnet.github.io/docfx/](https://dotnet.github.io/docfx/)

<comment><USER3> +1 for Sandcastle (SHFB). I used it a couple of years ago and felt that it was pretty easy to use and that the documentation came out nicely.

</comment></comment><comment><USER4> This is a Visual Studio feature. [https://docs.microsoft.com/en- us/dotnet/csharp/programming-g...](https://docs.microsoft.com/en- us/dotnet/csharp/programming-guide/xmldoc/recommended-tags-for-documentation- comments)

</comment><comment><USER5> [https://dotnet.github.io/docfx/](https://dotnet.github.io/docfx/)

I believe this is used to generate some of the official Microsoft documentation.

We use it on our team -- it's pretty basic, but allows Markdown formatted content and ingests the triple slash comments.

The biggest downside is that it is extremely slow.

<comment><AUTHOR> This was the solution I went with. As you mentioned, It is incredibly slow.

</comment></comment><comment><USER6> Looks like maybe:

[http://www.stack.nl/~dimitri/doxygen/manual/xmlcmds.html](http://www.stack.nl/~dimitri/doxygen/manual/xmlcmds.html)

</comment><comment><USER7> In Visual Studio, if you're distributing it via NuGet package you can send the xml doc along with the code and consume it via Intellisense (as you type it), similar to what happens when you use the .NET framework itself.

Right click the project, "Properties", "Build", enable "XML documentation file". When creating the NuGet package make sure the xml is in the same folder as the dll.

</comment><comment><USER8> That looks a lot like the format for auto-generated method comments from VS.net ~2013 or so.</comment>


What Impossible Meant to Feynman - <AUTHOR> http://nautil.us/issue/68/context/what-impossible-meant-to-feynman <comment><USER2> How fortune the author was to have had these interactions with him. Feynman was my greatest hero as an undergrad physics student (largely because of "Surely...", and the Feynman Lectures) and I was heartbroken when he died before I could meet him.

Among other things, he showed again and again how much economy and power was gained by attacking problems from different angles, and by building up and applying physical intuition, rather than relying solely on brute-force calculation. More importantly, he showed how much fun you could have solving hard problems, simply by _playing_ \-- lessons that I was able to apply well outside of physics.

</comment><comment><USER3> After the description of quasicrystals in the submitted piece, I found this paragraph on the author's wikipedia page [1] quite interesting:

> Peter J. Lu and Steinhardt discovered a quasicrystalline Islamic tiling on > the Darb-e Imam Shrine (1453 A.D.) in Isfahan, Iran constructed from girih > tiles. [2] In 2007, they revealed a conceptual breakthrough that enabled > early artists to create increasingly complex periodic girih patterns over a > period of centuries, culminating in a nearly perfect quasi-crystalline > Penrose pattern five centuries before their discovery in the West.

[1] [https://en.wikipedia.org/wiki/Paul_Steinhardt#Other_contribu...](https://en.wikipedia.org/wiki/Paul_Steinhardt#Other_contributions_to_the_field)

[2] [http://science.sciencemag.org/content/315/5815/1106](http://science.sciencemag.org/content/315/5815/1106)

<comment><USER4> not long ago there was an article about Leibniz inspiration through geomancy. Which was also used for ages by humans, albeit not in a mathematical rigor setting.

That led me to some rant, I think most of the core of mathematics is absolutely natural to the layman of any place in space and time. Simplicity and regularity is quite obvious to any body, but the education systems blurs that off mathematics. Only advanced research can reconnect the two sadly.

</comment></comment><comment><USER5> What a beautiful text. It just made my day. I think, for most of scientists, these previously thought impossible outcomes is as, if not more, rewarding as aligned with theory outcomes. Certainly this is one of the reasons that encourage me to continue in science. Curiosity of course, but also the feeling that impossibility is only temporary.

</comment><comment><USER6> Feynman was still doing Physics X when I was a student there, about 8 years after the time the author is describing.

One of my regrets is not taking advantage of that. It had been described as a weekly session where you could go talk to Feynman if you wanted help with physics, and since I was doing OK in freshman and then sophomore physics I didn't need help. I didn't realize at the time that you could do more than just ask about whatever was currently being covered in Physics 1 or Physics 2.

</comment><comment><USER7> "The groups of atoms in crystals repeat at regular intervals, just like the five known patterns."

What is "five known patterns" a reference to? I found [1] but I don't see five of anything here.

[1]: [https://en.wikipedia.org/wiki/Crystal_structure](https://en.wikipedia.org/wiki/Crystal_structure)

<comment><USER8> The Platonic Solids: [https://en.wikipedia.org/wiki/Platonic_solid](https://en.wikipedia.org/wiki/Platonic_solid)

<comment><USER9> Quasicrystals are based on the symmetry system of the icosahedron/dodecahedron, in which it it is impossible to periodically tile space.

"Proper" crystal structures are periodic, and are not necessarily related to any Platonic solid. See [https://en.wikipedia.org/wiki/Crystal_system](https://en.wikipedia.org/wiki/Crystal_system) (but I'm not quite sure where the 5 comes from in TFA).

</comment></comment></comment><comment><USER10> Feynman was a brilliant man and quite the character. If you haven't read "Surely you're joking Mr. Feynman" I highly recommend you give it a read.

"The title derives from a woman's response at Princeton University when, after she asked the newly arrived Feynman if he wanted cream or lemon in his tea, he absentmindedly requested both." [https://en.wikipedia.org/wiki/Surely_You%27re_Joking,_Mr._Fe...](https://en.wikipedia.org/wiki/Surely_You%27re_Joking,_Mr._Feynman)!

<comment><USER11> I liked that book and highly recommend it, but... by the end I got the impression that Feynmann was intentionally _manufacturing_ interesting anecdotes in his life, not just randomly having all these interesting crazy coincidences happen to him.

<comment><USER12> Of course he was manufacturing them. He explicitly talks about the art of having an adventure in the book.

<comment><USER13> There's definitely an art to setting yourself up for suprising and interesting adventures in your life.

</comment></comment></comment></comment><comment><USER14> I read "Surely you're joking Mr. Feynman" during my high school days. In that book he mentions multiple times about Pasadena (where CalTech is located). I moved to US 3 years back and right now live in Los Feliz (close to Pasadena, Los Angeles). First thing which I did after moved to LA, was visiting CalTech. He made such a huge impact on my life.

</comment><comment><USER15> Great read. What would be a good introduction to Feyman's writings for physics noobs such as myself?

<comment><USER16> Surely You're Joking Mr. Feynman and it's sequel for fun. The Feynman Lectures if you're interested in Physics. There are also some very interesting and fun lectures on Youtube.

<comment><USER17> Another good starting point might be "Six easy pieces"

</comment></comment></comment><comment><USER18> [http://www.feynmanlectures.caltech.edu/I_01.html](http://www.feynmanlectures.caltech.edu/I_01.html)

The first of the referenced Feynman lectures. It's quite the fun read for an introductory physics text.

<comment><USER4> his writing/speech style is lovely, so down to earth, it's a pleasure

</comment></comment><comment><USER19> A really good read. Apart from the books that he has penned, I really like the videos ( available on youtube) in which Feynman explains the "why" behind many common sightings.

Just a sidenote: Coincidentally flying to Caltech today for a week of training. Wish he was still alive.

</comment><comment><USER20> Oh just how fantastic!

Such great detail, I felt like a fly on the wall. Thank you for this.

</comment><comment><USER21> from the article:

'''

I also learned that "impossible," when used by Feynman, did not necessarily mean "unachievable" or "ridiculous." Sometimes it meant, "Wow! Here is something amazing that contradicts what we would normally expect to be true. This is worth understanding!"

'''

<comment><USER22> But, a pretty good read none the less.

</comment></comment><comment><USER23> > _Feynman thought a moment and, much to our surprise, replied "Yes!" So every > week for the next two years, my roommate and I joined dozens of other lucky > students for a riveting and unforgettable afternoon with_ Dick* Feynman.

I don't know if that's meant to be a typo or an intentional name-calling ? Can somebody confirm ?

<comment><USER24> Back before Nixon, Dick was a perfectly allowable shortening of a first name for [edit: mostly] white American men called Richard. Dick Feynman, Dick van Dyke, Dick Sargent, even Dick Cheney. Only since the 70s / 80s has it become a perjorative among younger generations, perhaps because of the Liar in Chief.

<comment><USER25> only white?

<comment><USER26> I think this is a fair question. I think it was predominantly white men. Never heard of a black man named Richard being called Dick. I think they usually use Rick instead.

Richard ~= Rick == Dick

<comment><USER27> One exception was black comedian, author, and activist Dick Gregory.

<comment><USER28> [https://en.wikipedia.org/wiki/Dick_Allen](https://en.wikipedia.org/wiki/Dick_Allen)</comment></comment></comment></comment></comment></comment>


Ask HN: How do you choose the next place you want to work? - <AUTHOR>

3 months ago I left my previous position as a systems engineer/sysadmin at a BigCo tech company. I wanted some time off to relax and work on some personal projects. Now I'm thinking about getting back into the game, perhaps another startup but I'm not really sure what kind of product I want to work on for the next 4-5 years.<p>When it comes time to move on to something new, how do you guys choose where you want to work? Do you look to the BigCo for stability? A startup for an adrenalin rush and payout? Or just whoever will hire you? <comment><USER2> I find it's best to think in terms of 1-3 years when evaluating a startup and you have to be OK with that kind of turnover. But the most important thing is who you're working with in a startup. The adrenaline rush wears off quickly if you hate the people you're spending all your time with and you'll be around them all the time in a startup.

</comment><comment><USER3> Go with wherever you "feel" is right. In the end, we all die.

<comment><USER4> This. You have to think about the end result -- will you feel like you've done enough? What matters most to you?</comment></comment>


As HN: how to serve subdomain content in a subfolder? - <AUTHOR> At work we have the following situation: - we have several web applications hosted on various servers and end result is that they end up like this application1.root.com/page1 - this is bad for our SEO value/domain authority as Google will register the content of application1 to belong to a different domain domain than root.com - Ideally we would like to put it into a subfolder like this root.com/application1/page1
Cloudflare has a "Using Resolve Override in Page Rules" feature (https://support.cloudflare.com/hc/en-us/articles/206190798-Using-Resolve-Override-in-Page-Rules) that allows for it but its only available through the pricy enterprise solution.
Do you know of any other service that allows for this? <comment><USER2> You can configure your webserver on root.com to act as a reverse proxy for the folders application1, etc.

If you use Apache you have mod_proxy ([https://httpd.apache.org/docs/current/mod/mod_proxy.html](https://httpd.apache.org/docs/current/mod/mod_proxy.html)), just be carefull with the configuration and not end being an open proxy.</comment>


KKR's Internet Brands plans to buy WebMD in a $2.8B deal - <AUTHOR> http://www.latimes.com/business/la-fi-web-md-sale-20170724-htmlstory.html <comment><USER2> "All Western nations, with the exception of New Zealand and the United States, have historically (since the 1940s for Australasia, North America, and Europe) banned direct advertising of pharmaceuticals to consumers." \- wiki

Would be interesting to see what happens in this space with all the changes to healthcare. Pharmaceuticals spend a ton on marketing, but if legislation changes that... would kill a lot of revenue for tech and media companies.</comment>


Williams-Sonoma accuses Amazon of copying West Elm furniture - <AUTHOR> https://www.seattletimes.com/business/williams-sonoma-accuses-amazon-of-copying-west-elm-furniture/ <comment><USER2> Recently I went shopping for a new, nice, couch.

After having visited all the local medium and high the retailers, my choice was which slight variation of preferred leather couch style did I want.

All the furniture companies turn out very similar models. If you pay close attention you can spot when one retailer releases a new design, a 6-8 month delay, and then the "inspired copies" being released by other furniture brands.</comment>


Oracle finally targets Java non-payers six years after plucking Sun - <AUTHOR> http://www.theregister.co.uk/2016/12/16/oracle_targets_java_users_non_compliance/?mt=1481919461669 <comment><USER2> For anyone on Windows willing to switch to OpenJDK, there are builds from

\- Azul: [http://www.azul.com/downloads/zulu/](http://www.azul.com/downloads/zulu/)

\- RedHat: [https://developers.redhat.com/products/openjdk/overview/](https://developers.redhat.com/products/openjdk/overview/)

\- JetBrains: [https://bintray.com/jetbrains/intellij- jdk](https://bintray.com/jetbrains/intellij-jdk)

<comment><USER3> Apparently people keep forgetting who pays the majority of OpenJDK developers.

<comment><USER2> Or people simply want to avoid installing the proprietary software that is bundled with Oracle JDK. With the added benefit of running the same JDK on your dev machine and on your servers.

<comment><USER3> Which leads to the interesting situation that not all Java GUI applications run properly in GNU/Linux with OpenJDK, forcing companies like JetBrains to bundle their own fork for those not willing to install Oracle JVM or another third party vendor.

Because actually OpenJDK isn't 100% 1:1 to the closed source versions.

<comment><USER2> Font rendering is ugly on linux with both Oracle JDK and unpatched OpenJDK, or at least that was the case last time I tried to solve this issue manually.

</comment></comment></comment></comment></comment><comment><USER4> One thing Oracle doesn't seem to understand is that the whole "milk it till it's dry" strategy won't last forever.

Everything they touch is a catastrophe.

Oracle database? Bloated, absurdly expensive, and blown away by PostgreSQL. If you really want bulletproof reliability and absurd throughput then DB2 on a mainframe is a better choice.

Virtualbox? Bloated, slow, and much more buggy than VMware's offerings.

ERP software? Companies could save tons of money using a custom solution and even if you are so massive you need something like Oracle's ESP SAP's offering is infinitely better (and cheaper).

Java? Don't even get me started on Java...

<comment><USER5> Don't forget MySQL.

It's not that Oracle ruins properties, the same could be said of Microsoft over the years, but that they _tastelessly_ ruin them.

Bundling the Ask Toolbar with Java is absolutely insulting. Not even Adobe stoops that low.

<comment><USER6> Hudson too...

</comment></comment></comment><comment><USER7> How real is this and what impact, if any, would this have on server apps that run on a JVM? There's _tons_ of them, many of which bundle a copy of the JVM in the app itself. The latter is the suggested deployment model in containers (i.e. bundle all your dependencies).

Also, would using OpenJDK remove any " _Get your ass sued by Oracle_ " risk or just defer it to a later date?

<comment><USER8> It seems like all the features that require a license are those that require launching the Oracle JVM with `-XX:+UnlockCommercialFeatures`. If you're not running with this flag enabled you should be fine. Note that those features are not in OpenJDK to begin with.

</comment></comment><comment><USER9> I wrote a small post on the JRockit part of this approx 5 years ago if anybody is interested: [http://www.spyfoos.com/blog/2011/07/28/oracle-java-7-and- com...](http://www.spyfoos.com/blog/2011/07/28/oracle-java-7-and-commercial- features/)

</comment><comment><USER10> They are slowly strangling every single golden goose they got from Sun.

</comment><comment><USER11> One interesting alternative to Java SE would be an OpenJDK JVM bundled with one or more of the superior alternatives to Java the language.

Such a package with Scala might make major inroads into the enterprise over time, with virtually no risk. Clojure is also a widely respected JVM language.

</comment><comment><USER12> Richard Stallman was right about Java all along.

<comment><USER13> But something something something Aspergers something picking feet something

<comment><USER14> What evidence can you present that Richard Stallman has Aspergers?

<comment> norea-armozel I think he means in jest that people have constantly talked about Stallman's quirks that are honestly gross but shouldn't take away from what he says regarding technology.

<comment><USER5> His "quirks" are what harms his message. The same could be said for his long- time collaborator ESR who has some quirks that are beyond eating shit from his feet.

You want a spokesperson for something they better be worthy of respect. That's their primary function. It's not being a sage of truth.

People listen to those they respect, and his behaviour at times is so out of line that he spends more time destroying his credibility than communicating.

<comment><USER15> People sometimes are just thick, focusing on "quirks" instead of the content.

I get that people might disagree with his views, but why would they think he's not worthy of respect?

<comment><USER16> People don't like his views so they look to his quirks as proof that he is crazy and not merely misguided. Thus they can dismiss his followers as crazy too instead of having to own up to the fact that many of their colleagues worthy of respect believe in a world view fundamentally different from them.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> Why is this business model legal? I mean, suppose I give you a candy, wait for you to eat it then ask for payement aguing that it's obvious I'm not giving it for free. I'm sure there are forgotten laws protecting against such a business

<comment><USER18> Was Oracle present at the Trump building some days ago?

</comment></comment><comment><USER15> The one thing that truly matters is how they determine if your use is "embedded" or not. And they left the answer out of the FAQ:

[http://www.oracle.com/technetwork/articles/javase/faqs- jsp-1...](http://www.oracle.com/technetwork/articles/javase/faqs- jsp-136696.html)

> _Frequently Asked Questions_

> _Is Java still free?_

> _The current version of Java - Java SE 8 - is free and available for > redistribution for general purpose computing. Java SE continues to be > available under the Oracle Binary Code License (BCL) free of charge. JRE use > for embedded devices and other computing environments may require a license > fee from Oracle. Read more about embedded use of Java SE or contact your > local Oracle sales representative to obtain a license._

Also, this link has more info on specific features that cost money, aside from the embedded vs general purpose issue:

[http://www.oracle.com/technetwork/java/javase/terms/products...](http://www.oracle.com/technetwork/java/javase/terms/products/index.html)

</comment><comment><USER19> When exactly do I need to pay for Java? When I develop with JDK? When I download java from [https://java.com](https://java.com) and install with default settings? When I download the installer from [https://java.com](https://java.com) and distribute it alongside with my java programs?

<comment><USER20> I assume you have this question at this moment because of [http://www.theregister.co.uk/2016/12/16/oracle_targets_java_...](http://www.theregister.co.uk/2016/12/16/oracle_targets_java_users_non_compliance/) ? Good question...

</comment></comment><comment><USER21> And this is why Oracle will lie at the side of SCO in the Bay Area graveyard.

</comment><comment><USER22> Are there still any reasons why one should choose Java instead of .Net for new developments?

<comment><USER23> There are many, many more good libraries for Java in Maven Central than for .NET in Nuget. OS independence, if not quite platform independence, has informed much of those libraries' development.

Maven, love it or hate it, can do a staggering number of things, some of them very useful.

JAX-RS servers and clients are more robust IME on Java. (Just try to find a capable path+querystring builder for .NET.)

JDBC is still the gold standard for database connectivity.

<comment><USER24> Maven, where your build script is actually declarative XML that might or might not run. Maven, which spends a minute contacting random servers all over the world only to tell you there is a closing tag missing.

I still have a repository where _Surefire_ (hah) refuses to run any tests. Impossible to debug. No, that pile won't be missed.

<comment><USER3> I will rather take Maven a full day over a few seconds with Gradle.

<comment><USER25> Since Gradle 3, Kotlin is the preferred language for writing build scripts and addins, rather than just Apache Groovy. If you use Kotlin instead of Java for your Android coding, you can use the same language for writing your build scripts as you do for your system code.

</comment></comment></comment></comment></comment><comment><USER26> I wonder how it looks to courts that Oracle, thus far, has strategically singled out Google?

If Oracle does not show a concerted effort to protect their copyright from all who are "infringing", does that help delegitimize their case against Google?

</comment><comment><USER27> There is _so_ much negativity around Java that I wonder why anyone starting on their journey to becoming a programmer would want to learn it or work with it.

<comment><USER28> _" There are only two kinds of languages: the ones people complain about and the ones nobody uses"_

\-- Bjarne Stroustrup [1], Creator of C++

[1] [http://www.stroustrup.com/bs_faq.html#really-say- that](http://www.stroustrup.com/bs_faq.html#really-say-that)

<comment><USER28> On a more serious note, Java's "reputation" is because:

\- It was kind of the Golang of the 90s, where each class had a clear and limited purpose -- but it also meant you had to chain three or five classes together to get anything useful done [1]. For this and other reasons, like the longtime lack of type inference, earned it a reputation for verbosity.

\- Most people don't have a clue how to design software, so they turned to outside resources for ideas. The 1994 book 'Design Patterns: Elements of Reusable Object-Oriented Software' [2] introduced a lot of useful models on how to translate mental models into object-oriented code. Some systems sprawled too much to where their implementations started to look like this model gone horribly wrong, while some developers merely ingested these ideas as a dogma and went on to produce code that was needlessly complex and poorly thought-out.

\- At some point a bunch of licensed code originating from a venture of IBM was dumped into the JDK, hence the awful, miserable mess that was datetime and calendaring [3] before Joda-Time's Stephen Colebourne brought sanity to it with Java 8.

\- Applets were punching above their weight, but the tech was poorly implemented, and, as history proved with it and other plugins like Flash, woefully insecure. Vulnerabilities in Java Applets, and early public confusion about Javascript vs. Java perpetuated the stereotype that Java itself was broken, insecure, or both.

\- Consultancies are big business, and companies like IBM, Oracle, and SAP would happily sell shops on big application servers with monitoring and control panels and genuinely useful stuff, but also tons of cruft and bugs. These players emerged from the J2EE spec, which defined useful APIs but intentionally left the implementation unspecified, to cultivate a thriving community of alternative implementations. Predictably, this didn't go as hoped.

\- People are obsessed with customizing their software, so vendor-delivered products were built with externalized configurations. Some people took this way too far, resulting in the familiar nightmare [4] where you had to configure mounds upon mounds of XML or .properties files to get an application running. It didn't help that this was actually the _better_ way of getting it done in Java, with the Spring Framework, which was way more palatable to work with than the alternatives coming out of the J2EE spec.

\- Rails shook the world at the end of 2005 and showed that the obsession with configuration was dumb [5]. Scrambling, both Spring and EJB received rewrites, so now Java devs @hardcoded things directly into the source code with @annotations (that are by the way "not code!", as if that distinction was at all relevant) and pretended they were enlightened.

\- Sun had a vision for Java that they were never truly able to execute. In the process, they delivered a pretty solid language, eventually backed by a fantastic VM [6], that became popular because it was simple and scaled down well to okay and decent programmers -- not requiring a fleet of expensive rockstars. Oracle smelled money and bought it up, and despite additional innovation still being delivered by its staff, created wariness and distrust in the Java community by its corporate attitude.

[1] [http://stackoverflow.com/questions/4716503/](http://stackoverflow.com/questions/4716503/) [2] [https://en.wikipedia.org/wiki/Design_Patterns](https://en.wikipedia.org/wiki/Design_Patterns) [3] [https://java.net/nonav/projects/jsr-310/lists/dev/archive/20...](https://java.net/nonav/projects/jsr-310/lists/dev/archive/2007-07/message/171) [4] [http://thedailywtf.com/articles/Soft_Coding](http://thedailywtf.com/articles/Soft_Coding) [5] [https://news.ycombinator.com/item?id=12761705](https://news.ycombinator.com/item?id=12761705) [6] [https://news.ycombinator.com/item?id=12160439](https://news.ycombinator.com/item?id=12160439)

</comment></comment></comment><comment><USER29> Great news for Golang. Time to switch if you have not.

<comment><USER30> Go doesn't share any kind of similarity in purpose, methodology or audience with Java.

Or maybe you were being sarcastic?

<comment><USER31> It fits the generic GC performant network server designed for large teams in mind. A large segment in Java land.

<comment><USER32> I would say that Go is designed for _small_ teams. Minimal compiler safety and generally weak code reuse (outside of code generation, which...no) under the guise of "just microservice all the things."

It is an okay analogue to Java 1.4. But the state of the art is significantly further along, and OpenJDK+Kotlin (or Scala, if you're adventurous) is a significantly more well-considered alternative that fits much better into a Java workflow (not that those Java workflows are in danger in the first place, given that _they don 't use any version of Java that is outside the license_).

</comment></comment></comment></comment><comment><USER33> I am not sure I understand this: if I develop an application and distribute it using the installer that embeds the JVM, then I owe Oracle??

</comment><comment><USER18> Alphabet will swallow Oracle to save it's Android.

Nice sci-fi scenario.

</comment><comment><USER34> Sounds like good news for C++ developers?

I'm assuming C#/.net carries the same risk, and C/C++ does not.

<comment><USER35> .NET is under MIT license ([https://github.com/Microsoft/dotnet/blob/master/LICENSE](https://github.com/Microsoft/dotnet/blob/master/LICENSE)) and there's also a patent promise ([https://msdn.microsoft.com/en- us/openspecifications/dn646766](https://msdn.microsoft.com/en- us/openspecifications/dn646766)). There isn't an "enterprise .NET" version for sale. There are enterprise versions of Visual Studio, servers, etc., but nothing you could feasibly be "accidentally" using, and nothing that you have to use to do .NET dev.

What specific risk(s) are you thinking about?

Disclaimer: Microsoft employee, Nazgûl

<comment><USER36> Could change but I think Bill Gates originally tried making money selling a version of BASIC. Never made much money[1]. Since then Microsoft doesn't try to make money on dev tools. The dev tool business is there to support Microsoft's internal needs and to promote the Windows Platform.

[1] Bunch of companies tried selling compilers with 'drink your milk shake' licensing terms in the 80's. Developer resistance, Microsoft and Borland killed them off.</comment></comment></comment>


Utrecht shootings: Hunt for gunman after attack on tram - <AUTHOR> https://www.bbc.com/news/world-europe-47611811 <comment><AUTHOR> Also [https://www.bbc.com/news/world- europe-47615231](https://www.bbc.com/news/world-europe-47615231)

[https://edition.cnn.com/europe/live-news/utrecht-tram- shooti...](https://edition.cnn.com/europe/live-news/utrecht-tram-shooting- live-updates-intl/index.html)

\- There are 3 persons dead, 3 persons heavily injured and more injured people

\- Police are looking for a 37-year-old Turkish man named as Gokmen Tanis

\- The mayor of Utrecht says they see it as a terrorist attack and think more things could happen

\- Everybody needs to stay inside</comment>


Show HN:Snappshot - Showcase your apps - <AUTHOR> http://www.justinjudd.org/snappshot

<comment><AUTHOR> Also check out the github page - <https://github.com/JustinJudd/snappshot></comment>


A pithy starter kit with router and internationalization in Vue - <AUTHOR> https://github.com/WeiChiaChang/vue-boilerplate <comment><USER2> Learning vue right now, thank you for the resource !</comment>


Java to Objective C tool - <AUTHOR> http://j2objc.org

<comment><USER2> Interesting approach! However, as stated on the website, doesn't that lack of a UI port make it a pretty half-baked approach.

I understand of course that the way UI is coded in iOS is very different from Android.

I can see this is a far better approach than Cordova & PhoneGap in that I can just port the logic across from my Android app. I have always hated the Cordova approach and found it nothing better than a glorified hack.

Even so, while this approach should save dev time considerably for startups like ours won't it also complicate the dev cycle in terms of writing device independent logic?

Another question. Is it a two way tool? Will it convert my Objective C code to Java?

Also, your GitHub README is incomplete. Would like to see some proper examples.

<comment><USER3> Docs & INSTALL are in there. Should have written a better README though. Just tried it on some old android app code and it crashed.</comment></comment>


Etcd v0.1.2 with a new dashboard - <AUTHOR> http://coreos.com/blog/etcd-v0.1.2-new-dashboard-and-bugfixes/

<comment><USER2> Etcd and CoreOS look really great, but I'm still missing a fundamental question. If I've got a set of CoreOS instances running on EC2 with auto scaling on, how does a new instance add itself to the cluster when it starts up? How does it know which other servers to associate itself to, and how do these server know to trust it?

<comment><USER3> > How does it know which other servers to associate itself to

Right now we have a service, called coordination (c10n), which helps boot strap an example cluster on ec2. The basic idea is that in order to get things going you need to know the IP of at least one other machine and c10n holds on to this information. The root for this bootstrap is a unique token you put in the AWS user data.

You either need an external service like c10n with a shared token or a stable hostname that you setup yourself that can distribute the initial seed of information. An external service makes for an easier experience.

> and how do these server know to trust it?

As we get further along we will be adding a API/dashboard to help with boot strapping on etcd and approving/denying new machines as followers. That is part of why we added client certs to etcd from the very beginning.

Re: autoscaling: Our focus at the moment is getting the core services, like etcd, working properly so that we can correctly build higher order concepts like horizontal auto scaling. More to come. Thanks for the questions.

<comment><USER4> Similarly, my fundamental question is how you would implement master election for applications running within a docker container using etcd. Or is master election only for etcd itself and not a capability it provides?

Also, all the examples just store simple key/value pairs. What are your best practices for actual config files? Do you store e.g. key=/etc/nginx/nginx.conf value=<contents of that file>? Does that imply all machines will have the same config? Or do you have the machine name in the key space? Or is etcd not actually for this kind of configs? If not, for which kind then?

<comment><USER3> > how you would implement master election for applications running within a > docker container using etcd.

You build master election on top of the test and set functionality of etcd which gives you a cluster wide locking mechanism. The plan is to provide a simplified master election REST api as a module, just like the dashboard in this release is a module.

But, nothing is stopping a regular etcd client from building master election on top of the current API.

Something I would like to add to etcdctl is a config file generator which reads from the keys of etcd and fills in fields. You could add the entire file but it is more reasonable to simply add the metadata that is dynamic into etcd and ship a template around. Another example of this is this chef integration: [https://github.com/coderanger/etcd-chef](https://github.com/coderanger/etcd- chef)

For some applications, like load balancers, you may want to have the process itself interacting with an etcd cluster. e.g. this HTTP load balancer prototype: [https://github.com/calavera/active- proxy](https://github.com/calavera/active-proxy)

<comment><USER5> > You build master election on top of the test and set functionality of etcd > which gives you a cluster wide locking mechanism... But, nothing is stopping > a regular etcd client from building master election on top of the current > API.

Could you give some pointers on how to implement master election on top of test-and-set? What is the algorithm? I've tried searching for it, but I've likely missed correct keywords.

<comment><USER5> I've got reply here: [https://github.com/coreos/etcd/issues/225](https://github.com/coreos/etcd/issues/225)

</comment></comment></comment></comment></comment></comment><comment><USER6> Hm. Looks kinda cool - the TTL option for keys could be a very useful tool.

One question/problem: I can't find any kind of permissions/separation/ACLs for it. Yes, you can do authentication, but w/o even basic POSIX style owner/group/world type permissions, this essentially becomes single-user, with all apps/programs/etc trusted and able to break everyone else.

Or am I missing something?

<comment><USER3> We are adding ACLs with POSIX style permissions. You can see the doc on the 0.2 branch: [https://github.com/coreos/etcd/blob/0.2/Documentation/etcd-f...](https://github.com/coreos/etcd/blob/0.2/Documentation/etcd- file-system.md#acl)</comment></comment>


Google Now failed me - <AUTHOR> https://jeena.net/google-now-failed-me

<comment><USER2> Unsurprising:

> Because it is my work phone and doesn't relate to me as a private person too > much I thought I could try Google Now which is advertised as a help in life > without the need of you adding data manually.

The whole premise of Google Now is that it is a help in life "without the need of you adding data manually" _because_ it leverages information from your Google Account which, presumably, _does_ relate to your "life as a private person" quite deeply.

If your whole basis for trying it out in a particular context is that that context is _isolated_ from most of your life, yeah, its not going to work.

It's like choosing to try out a Ferrari in the middle of the Sahara desert because its isolated from paved roads.

</comment><comment><USER3> My experience is similar: Started off as a light and resistant Google user, learned about Now, decided to go all-in, so that _The Google_ could know so much about me it would tell me and show me useful things.

At first, maybe it did. Over time results have seemed to become random and uninteresting, as others have suggested.

"Google Now == Great Big Meh" in my book.

Does Google suffer from "shiny" disorder? Do they come up with cool ideas, jump on, do cool stuff, only to get distracted when things get challenging? That would explain Now and a great many other things.

</comment><comment><USER2> I use Now and I _do_ heavily use my Google Account (logged in Google searches, Chrome with Chrome sync tied to my account across multiple devices, Gmail, etc.) -- and Now does quite a lot for me. Updates to blogs I visit regularly get shown on Now. I get reminders based on flight itineraries that are in my Gmail (e.g., when my wife is travelling and forwards me her itinerary) without taking any action to make it happen, including notifications of flight delays. It provides travel times to places I frequently travel. It suggests pages I might be interested in based on previous browsing happens -- which seemed wierd at first, but I found some interesting things that way that I might have otherwise not run into.

</comment><comment><USER4> I haven't exactly found much of a use case for it - I juggle iOS and Android and as far as I'm concerned iOS cribbed the most useful bits (upcoming appointments and predicted commute times).

Being more of a music guy than a sports fan, too much of what I'm actually interested in is just not hooked into Google. If Now could aggregate band/comedian tours stopping in town, album releases, local symphonic events, I'd use it every day. I wish it could alert me when a new Netflix series I'm into is premiering. I'm surprised that none of the big players have aquired Songkick, which is what I use for these kinds of events, or something similar.

</comment><comment><USER5> When I first saw 'Now' suggest "You need to leave now to make it for $your calendar event" I thought it was super cool and it was one of the reasons I got Android.

But nowdays I don't use it. The clever reminder is too random to be relied upon (I guess it has trouble recognizing addresses which include company or building name) and rest of the cards are either wrong or irrelevant.

To make things worse Nexus5+KitKat desperately pushes 'Now': left unremovable homescreen = Now, top unremovable search bar = Now, bottom unremovable swipe = Now. Now! Now! (I've had to remove Google launcher just to get rid of it).

</comment><comment><USER6> Besides being stupid, the main problem with Google Now and other "predictive" assistants is that they have no understanding of intent/context.

Google Now would often display travel time to locations and other irrelevant information based on my recent searches. Even though the information was irrelevant. It had no idea WHY I searched for a restaurant in Bordeaux, for example. Sigh. Pointless indeed.

</comment><comment><USER7> That is an interesting perspective. For me, I find Google Now rather convenient. I don't have to look up the weather in my current location. I don't have to dig through my emails to find which flight I am on. It brings up the traffic-adjusted time to get home right when I finish up work.

None of these are things I couldn't live without; most just save a click or two. But I find them useful.

</comment><comment><USER8> Now helps me with traffic.

If I was into any of the big American sports I think it would be cool. Alas, my interest is in Formula 1 and Rugby Union, neither of which have any coverage in Now.

Also, because I tend to not watch either of these sports live, I suspect that Now would just spoilerize my interests anyway.

</comment><comment><USER9> Works very well for me. Shows me my flights & flights of relatives and status of their flights. Shows me meeting reminders and traffic to there. Also, tracks packages that come through on email along with hotel bookings.

On nexus 5 and primary phone for all emails.

</comment><comment><USER10> Google now will occasionally alert me to heavy traffic on the way home. That's about it.</comment>