Ketogenic diet helps tame flu virus in mice - <AUTHOR> https://news.yale.edu/2019/11/15/ketogenic-diet-helps-tame-flu-virus <comment><USER2> PSA: keto appeared to cure my psychosis.

A while ago I experienced a traumatic event. Immediately I had sleep disruption and slowly I began to have textbook symptoms of psychosis. It was horrible and unpleasant. I went on keto and the symptoms went away. I stopped due to side effects and the symptoms came back. I went back on and the symptoms went away immediately. And on and off for a long time, with a perfect correlation between the two. The doctors who diagnosed me with psychosis don't care that keto does this. I told them that I have figured out how to cure my symptoms and they just give me a blank look. They prescribed me an antipsychotic which I have never had to take although I have come close to needing it a few times. I tell them there are other people who have written about similar experiences and they don't care. So I have to get the word out like this.

The psychosis is curbed within 24 hours of starting keto. Sleep disturbance persists for about five days. After five days it's as though nothing had been wrong at all.

I get a really bad rash after a couple of days of keto. This is a well known side effect of keto although it is uncommon. I've tried various things, the only one that worked was applying drysol prior to keto, preventing the rash- prone areas from sweating. This gives a clue about the rash, which is important because no studies have been done and its cause has not been determined. If I didn't get this rash I would happily stay on keto forever.

There's never been a study about ketosis and psychosis. There's one being done in Finland right now, although the sample size leaves much to be desired. I'm in contact with the primary researcher and the paper might be released as early as one *year from now.

<comment><USER3> Ketogenic diets have been used to control seizures in people suffering from epilepsy. It has reportedly been used for controlling migraines and possibly other neurological conditions.

Ketones being an alternative fuel for the brain, it can relieve neuronal starvation from cognitive hypoglycemia. Whether there's some other magical property of ketones at play, or it's simply that in some people glucose metabolism in the brain is broken, it's all speculation at this point.

Note that for epilepsy patients, the classic ketogenic diet isn't something that people can adhere to, being something that's normally done under medical supervision.

\---

Btw I tried the ketogenic diet for several months and I noticed cool effects like my face acne almost disappearing.

However the beneficial effects persisted after switching to a moderate carbs diet made of whole foods. The standard diet is a disaster for health, being very inflammatory and obesogenic, but you might want to also experiment with a whole foods diet, made primarily from fresh plants and animal products cooked at home.

You might discover the same benefits. And if you eat at maintenance, or with a caloric deficit, you'll naturally cycle in and out of ketosis daily anyway.

But if what you do is working for you and you feel great, then good for you, keep doing it.

<comment><USER4> Hi, interesting comment, do you know solid websites (or Books or places) about keto diet and diet in general ?

<comment><USER3> I recommend this one:

[https://examine.com/store/keto-guide/](https://examine.com/store/keto-guide/)

</comment></comment></comment></comment><comment><USER3> In mice.

Also unfortunately the study failed to control the protein. Control group had a diet made of 24% protein, keto group ate 10% protein.

Protein restriction has been shown to have profound immune modulatory effects.

Protein restriction is a massive confounder in such studies. Caloric deficit is often another. These often go hand in hand.

</comment><comment><USER5> My scientifically unverified pet theory:

Ketosis is the body's winter state. When no carbs are growing outside fat resources need to be used up and the brain needs to work well on a steady stream of ketones as it is more difficult to find food in winter. This immune system boost is also helpful during winter as there are less vitamine sources available. For some reason you also need less sleep.

When carbs are available in summer, the body tries to gather weight, and for this the carb addiction pattern is quite helpful. A high-carb diet is the summer state.

<comment><USER6> Didn't people evolve out of Africa near the equator?

<comment><USER5> Humans won't be the only creature that finds adaptation to seasonal food resources useful.

Anyway, this thought is probably difficult to study. We seem to be engineered to grab carbs when we see them though.

</comment></comment></comment><comment><USER7> Whoa. When I'm sick, that's when I most crave refined carbs. Could the virus be evolved to trigger that? Kind of in the same way colds are evolved to make me sneeze so I spread them?

<comment><USER8> The drive to maintain caloric balance is sufficient to account for that.

[https://besjournals.onlinelibrary.wiley.com/doi/full/10.1111...](https://besjournals.onlinelibrary.wiley.com/doi/full/10.1111/j.1365-2435.2010.01815.x)

> metabolic rate may rise as much as 55% when fighting severe infections

<comment><USER7> No, not in my case. I have very specific cravings.

</comment></comment></comment><comment><USER9> They don't seem to provide the tables with the data just graphs. There is a lot more variance with keto group than the other groups. However its still better than the carb group, but not that much better than high fat group/ Also they only used ~20 mice and didn't make the groups the same for example they have 5 in carb group. I wish studies would do better job of providing tables so you can look at data.

</comment><comment><USER10> One more positive from Keto apart from the health and longevity benefits (studied in mice)

</comment><comment><USER11> In mice.

<comment><USER12> I love this account:

[https://twitter.com/justsaysinmice/status/119661435015448576...](https://twitter.com/justsaysinmice/status/1196614350154485760)

<comment><USER13> Seems like it's already been IN MICE'd. [https://twitter.com/justsaysinmice/status/119582327375131852...](https://twitter.com/justsaysinmice/status/1195823273751318529)

</comment></comment></comment><comment><USER14> I'm curious how long it takes for the inflammasome effect to set in. Can you start going keto when you get the sniffles and shorten the duration of illness?

<comment><USER15> There's definitely research out there showing that you heal faster when fasting - whether that is inflammatory reduction related or not, I'm not sure.

</comment></comment><comment><USER16> I'm sure all the mice reading this must be happy.

</comment><comment><USER17> Chicken soup anyone?

<comment><USER18> Only if you use cauliflower noodles.

</comment></comment><comment><USER19> Wow, revolutionary. It's not like its been known for years already that sugar acts as an effective immune suppressant.

It's always funny to see how school medicine tracks the state of the art by 20 years into the past and then another 40 before it hits the actual doctors and their patients (for the latter part, ongoing re-education requirements might help as to avoid people like my grandma who still thinks after being 30 years out of practice that what she learned after the second world war in her studies is the state of the art of medicine).

For the first part, I have no answer. Something is utterly broken with the way school medicine "innovates".

I would love to be able to write this while drinking my extra large soda and next to it a piece of chocolate cake. Yeah, cancer here I come.

<comment><USER3> > _It 's not like its been known for years already that sugar acts as an > effective immune suppressant._

Interesting, any references?

AFAIK that's not true, no, sugar does not act as an immune suppressant, what acts as an immune suppressant is whatever inhibits autophagy and that's primarily protein, or calories in general. High levels of the IGF-1 hormone is also associated with higher risk of cancer and all cause mortality, it's just a weak association, but note IGF-1 seems to also be stimulated by a protein.

This isn't to say that we should restrict protein. In truth we need a lot of protein to remain healthy and these associations have confounders, in truth vilifying any single macro nutrient is just stupid and unsupported by existing evidence.

It's not the sugar in the soda or in the chocolate cake that's going to get you, but the overall _caloric surplus_ ... since after a soda and a chocolate cake you'll still feel hungry. Everything breaks loose on a chronic caloric surplus. And interestingly any study that doesn't control the calories or the protein is flawed, as these are massive confounders.

> " _Something is utterly broken with the way school medicine "innovates"._"

The problem is that nutrition is a hard science, because obviously you can't dissect people or lock them in cages and feed them crap for the rest of their lives to see how they react :-)

That said the anti-establishment propaganda coming from the low carb camp is increasingly worrying. I've even seen prominent LCHF supporters being or affiliating with anti-vaxxers as well.

<comment><USER20> My understanding is that both carbohydrates and protein inhibit autophagy through different pathways.</comment></comment></comment>


Brein / Mininova settlement reached; lawsuit ended at Mininova blog - <AUTHOR> http://blog.mininova.org/articles/2010/12/10/brein-mininova-settlement-reached-lawsuit-ended/ <comment><AUTHOR> Says Mininova paid a monetary settlement to Brien. Wonder how much that was -- Didn't think Mininova was making much in terms of $ from their ad signage.</comment>


Programmers should stop calling themselves engineers (2015) - <AUTHOR> https://www.theatlantic.com/technology/archive/2015/11/programmers-should-not-call-themselves-engineers/414271/ <comment><USER3> And in a slightly oblique way, when I was studying at engineering school (University it is called in Australia) the joke among the students was that at Uni we had two hours to get four questions half right(exams), but once we were engineers we would have as long as it takes to not make a mistake.

The lecturers that had actually worked in real industry for any period of time had another line, "Most of what you do as engineers could be done by many people, but it the engineer that does it safely in a predictable time, budget and quality".

There is no, "move fast and break things" in designing bridges, the electrical grid, chemical plant, airplanes, or even the town sewerage system. If there is it is normally baked in as a "proof of concept" phase very early on.

When it comes to unwanted consequences, the whole engineering approach is built around conservative, known approaches with low risk of harm to humans, demonstrable in court if need be.

Often the exposure of humans to harm from engineering decisions is involuntary, whereas to software is voluntary. There are even special branches of engineering that use software in preventing harm to humans that are tightly controlled and have certified practitioners (Functional Safety - IEC 61508)

I don't think people who write software for a living are any less, or less important, than engineers. In recent times it is hard not to argue that production of software has been instrumental in changing the world more rapidly than any other one profession or pursuit in the history of man.

But I do think that a lot of the time the workflows and methodologies employed in the pursuit of these very rapid developments we have witnessed are not of an engineering paradigm.

The majority of software development lives by different rules (appropriate for the outcomes, consequences and potential rewards) and should be considered as a different kind of activity, with it's own approaches.

<comment><USER4> In a way I understand these comments, but I think they are drawing a very black white line in a grey area.

I trained as an electrical engineer (but I'm now %100 software), yes there was a lot about responsibility, safety etc, but to me the core of engineering and in being an engineer is to be able to apply theoretical math and physics concepts to real world problems.

That is why I did what I did, I didn't want to be an engineer to be an on time, on budget, project manager. I did it to combine design, maths and physics to build real world solutions to problems.

And this is why I would 100% consider myself a software engineer.

The accreditation and certification is missing (so far) because we are still figuring out the best ways to apply engineering to building abstractions (which is what I believe our field is). To me this doesn't make us any less engineers.

<comment><USER5> It does exist, but sadly not widespread enough for those that care about quality.

<comment><USER6> Quality isn't the end-all be-all. Engineering is about understanding tradeoffs so that you can actually have a profitable business. It has always been tightly coupled with business. You can't build a bridge if no one wants the expense. Government is OK to regulate outcomes (like bridge can't fall down) but it's not OK for it to start mandating that every bridge must be a suspended bridge.

<comment><USER3> This is the first misunderstanding of people not involved with QA in any way. (IS9000 series).

In this sense, quality doesn't mean "goodness", rather it implies predictability and repeatability. eg Are you doing what you said you would do to make something of "goodness" you defined?

Under the ISO standards it is entirely suitable to have a quality assurance system in your company that says, "we will make minimum effort to make to minimum quality, to the measurable metric of x failures per y products and intended product life span of z days".

The colloquial use and technical use of the word quality are quite different.

</comment></comment></comment></comment></comment><comment><USER7> I've got an aerospace engineering degree and have worked across a number of industries, from satellites to robotics. These days my job is about 50% software.

Software development _feels_ the same as other engineering design. You generate requirements, prototype, test and iterate.

To argue that it's not engineering because it's not regulated is stupid, partly because most engineering fields outside of buildings aren't particularly regulated anyway, and partly because there's loads of regulations which are just as relevant to software engineering.

Generally safety standards apply to the whole system - not just the electronic design, but the software and hardware interaction. The complexity of software means you have to take a slightly different approach to actually quantify risk of failure, but it's still very much engineering.

<comment><USER5> Thing is, it is regulated, sadly not enough world wide.

Back in Portugal no one can call themselves Engineers if their degree wasn't done at an university validated by the Order.

And even then, you are only allowed to sign certain kinds of projects after getting the professional title.

Naturally coders, with roles similar to construction workers, can be anything.

<comment><USER7> I think software development is a wide range of things, all the way from hacking on WordPress plugins to safety critical software. "engineering" comes in somewhere on that spectrum. Some software development is engineering, but not all is.

</comment></comment></comment><comment><USER8> Companies work by dividing all tasks into smaller tasks and parceling them up among the employees, aiming to specialise to knowledge of individual workers.

'Engineer' can mean a couple of different things depending on culture & context, including I think a 'person who works on engines'. However, professional engineers are technical decision makers.

A good engineer will think through a project from start to finish, anticipate all the decisions that will come up, and make them. Not obvious trivial decisions like 'does the bolt need tightening' but the big picture ones like 'is this standard acceptable?', 'is this trade off acceptable?'.

Big companies separate engineering from programming. Small companies will not have the resources, so the roles will be combined. Adding a dependency, changing an API and choosing major data structures are all engineering decisions. Deciding how comprehensive the testing framework needs to be. Maybe some algorithm choices.

Typing Python code is not engineering. Implementing some well established algorithm like Quicksort is not engineering. Doing something using an API because someone told you to is not engineering. Writing a unit testing is probably not engineering. Move-fast-and-break-things is not engineering, although it does seem to work very well.

There is overlap. I don't see why someone who is making big picture decisions shouldn't call themselves an engineer. Being regulated and certified is only mandatory if the government says it is.

<comment><USER9> By your definition, anyone who is a full stack developer is actually a software engineer.

To be honest any decent dev is interchangeable between positions in a corporation, its simply better for your career.

I can create whole systems from ground to top, from design through backend and frontend with infrastructure and orchestration. Can i call myself an Engineer then ?..

<comment><USER8> > Can i call myself an Engineer then ?..

Legally, I don't know. Personally, if you might be making a lot of engineering decisions then I wouldn't object. I would probably consider a lot of full stack developers to be basically engineers.

A FSD isn't necessarily making engineering decisions though. I can imagine a FSD who is expected to make all elements of a stack work together without having any real control over what composes the stack - maybe doing bugfixing, configuration and integrating new bits on demand. That wouldn't be engineering to me because there isn't a lot of control over high-level decisions.

</comment></comment></comment><comment><USER10> Does it stop being an engineering practice because a vast number of practitioners are incompetent, and fail to practice engineering rigorously?

Or is it rather the case that it is an engineering discipline with frighteningly little done to train, apprentice, vet, and self-regulate its practitioners?

Is it the nature of the work or the workers that define engineering? I'd argue the former, every time.

As for 'the public good', that sounds like a convenient definition to make a point, but didn't seem like an actual boundary one can set, beyond perhaps the common bindings of engineering ethics blatantly missing in the software world.

</comment><comment><USER11> As an engineer myself (EE) I disagree completely with OP.

Engineering is mostly about making tradeoffs.

It's not that software does things different that other engineering fields, it's just that it faces different cost structures.

Bridges, buildings and infrastructure face huge costs when making changes in the middle of the project. Some operations make changes almost impossible, or so expensive that they are considered impossible. The worst case scenario for software is starting over, but a lot of stuff can be fixed even _after_ release.

By the way, bridges, buildings and the like also have BIG blunders, but since they are not necessarily visible from the outside, we assume they are nowhere to be found. The internet exposes your app to thousands if not millions of people with technical knowledge, but no one can see the cracks on the main pillar of your building, so you fix it, you keep quiet and go on.

</comment><comment> 0-o I get the premise of the article is to show that software developers aren't all that special, and shouldn't call them engineers.

But what's frustrating to me is the blatant comparison of structural engineering with computer security. The comparison stops at the point that they're both in place to make sure nothing bad happens. Imagine building a bridge and having to fend off hundreds of adversaries continuously getting more advanced in finding ways to destroy your bridge.

</comment><comment><USER12> So the article contends that software doesn't play critical role in society. Apparently the author doesnt know that most power plants, nuclear or even hydroelectric are run by software, not to mention a few small things like medical equipment. Oh and airplanes use sofware too.... wait software is in almost all critical engineering projects.

Maybe the author should do more research.

<comment><USER13> I see that you maybe skimmed it a little too fast.

It is _because_ software plays a critical role in society that it needs to be done by engineers; but it largely isn't, and it shows.

<comment><USER14> It definitely shows: in my uni I had a professor (pupil of Dijkstra) who we thought was very elitist (not so weird considering his pedigree) ; he said the world will be a bad place if we continue the bad software practices and was all for allowing (!) non engineers to make games and 'fun things' but not anything that actually does anything that could lose money or health if done badly. I have not spoken with him for a while but he must be crying every night about the JS uprising.

20+ years further, I am starting to agree with many of his points.

</comment></comment></comment><comment><USER15> What makes the whole thing super weird is that where I live, "software engineers" which is to say, javascript programmers, get paid a lot more, say, than civil engineers or aeronautical engineers... so it's weird that computer technicians try to say they are Engineers rather than the other way around.

<comment><USER3> Maybe depends where you are, I live in resources city, generally speaking a good experienced engineer gets paid quite a lot more than good programmer.

Some experience you just can't overwhelm with any amount of youthful vigor or brilliance when the consequences are substantial enough.

<comment><USER15> Yeah, probably depends a lot on where. I'm just a sysadmin, the difference in pay between here in silicon valley and the cheaper parts of the US for my labor are extremely dramatic. I mean, it's dramatic for better educated programmers, too, but not nearly as much as it is for me with no degree and a less prestigious title.

I know a bunch of people who worked at lockheed around here, and, like you'd get literal MIT rocket scientists with security clearances making... dramatically less than me, even though I have one of the lower paid technical roles you can find at the FAANG companies.

</comment></comment></comment><comment><USER16> Engineering is not about building robust structures. It can be applied towards that goal but that's it; an engineer takes specifications and constraints and solves the problem within these bounds.

An important part of an engineer that the article fails to mention is the use of the tools of applied mathematics. If you use an RDBMS and you normalize your database, you are closer to an engineer than someone who can only handle NoSQL.

</comment><comment><USER17> Actually there are different things for which people study:

a) computer science

b) computer engineering

c) business and management

One who is an engineer (b) by training can spend most of his life implementing the wishes of the (c) people, basing his work on some results obtained by the (a) people, and the product can still be against the "public interest" as in the implementation of the MCAS for Boeing 737 MAX (where it can be said that the software was actually produced "according to the specifications" but that the "specifications" were faulty). But that doesn't mean he isn't an engineer, only that he works in an environment that is driven by the goals which aren't of "public interest."

There are even more extreme "non-public interest" stories to be told, but that just means that on many levels there should be more done to move the society to do what the "public interests" are. Which as we know is not easy at all, and surely not decided by the practitioners of of some engineering discipline themselves.

(and moderators, please add 2015 in the title).

</comment><comment><USER18> In a somewhat similar vein, I've always found it odd that engineering students commonly refer to themselves as engineers. I agree with much of the linked article and believe the title of engineer implies that one has already gone through a rigorous testing and certification process and that you conform with continual professional development and regulation. So it irks me slightly to hear a first year student call themselves an engineer. It feels like a medical student calling themselves a doctor.

In other fields where the title most designates that you regularly do an activity and does not imply certification and strict regulation I think it's fine to call yourself by that title even if you are a student. Many CS students are programmers, or PhD candidates in mathematics are mathematicians.

<comment><USER5> Some countries do require certification, just like doctors.

<comment><USER19> Then I think there should be something like the Hippocratic Oath, but for engineers.

"I swear by Hephaestus, god of technology, that I will write only software that causes no harm to humans, and does not infringe on their privacy ..."

[https://en.wikipedia.org/wiki/Hippocratic_Oath](https://en.wikipedia.org/wiki/Hippocratic_Oath)

</comment></comment></comment><comment><USER20> An engineer is just someone who uses ingenuity. Same word. ( _ingenieur_ I believe)

Regulators should treat software as a licensed engineering discipline though.

Needs a [2015] in the title.

<comment><USER21> This is a very poor definition. Probably the poorest.

I wonder what your definition of a doctor is then.

Being a guilded engineer myself but now called a software engineer, I can tell you with absolute certainty that software engineers as defined by industry today do not make the cut.

They are the equivalent of witchdoctors to doctors. Make of that what you may and then tell me again what an engineer is and what software engineer is

<comment><USER20> The argument about the meaning of the word is a massive and stupid misdirection of attention. What counts is licensure. A point I already addressed.

</comment></comment></comment><comment><USER22> Read that article couple years ago, but still I just have to look at the quality of all the electric devices around me... It's not all bridges and hospitals. Heck, even my electric toothbrush from Philipps can't make it through a full year without failing (planned obdolesence or not).

Security aspects are typically even worse in non-software development fields. Just look how awfully unprotected things like babyphones, elevators, cars etc. always were and are.

Only that hardware hacking is usually riskier and less convenient (and often not very rewarding).

But yeah, of course... The threshold to get started with software is lower.

</comment><comment><USER23> Job titles matter to people, why pay someone a raise for being good when you can add an extra buzzword to their job description or change their job title to something that sounds posh? It is a win-win for the company, they can introduce their 'junior assistant' as 'senior engineer' to impress whomever is being given the show and tell.

What I find objectionable to the pigeon-holing is that 'engineering' is one of the most creative disciplines there is, whether you are engineering a bridge or even software. But the wider world of artists can't see this. If you use maths to make something then that is not 'creative' it is 'technical'.

This segregation of 'technical' and 'artistic' starts out in school, so if you end up as an artist making brown pots then that is deemed 'artistic' and thereby wonderfully creative despite the fact that brown pots have been made in a similar way since before recorded history. If you teach an AI system that has been trained on the Utah Teapot to make a brown pot in polygons then that can't be 'artistic', even though art only ever innovates when new mediums come along.

There is a related wrong-phrase with 'Computer Science'. How much science is there is new ways of doing things with ones and zeroes? Or is this 'technology' that we are talking about?

I am not entirely happy with the word 'developer' either. Therefore the phrase 'computer programmer' works for a general audience as in 'I just do programming' or 'oh, here is one of our programmers' (before door to darkened room gets shut). If your work gets used by people then the validation should come from the metrics that come from that, not from a title that is slightly inflated.

</comment><comment><USER24> I don't see any difference between a mailfunctioning piece of software creating serious harm to that of a crashing bridge. They can both kill, create huge social disturbance and leave people ruined. The problem is that the field still largely just thinks of them as bugs when it comes to software. That we have an abundance of programmers not taking software engineering as serious as the mechanical engineer is a huge problem today. When someone gets hurt from a bug, the software engineer mostly gets away with it (or get a reprimand from the boss) and doesn't get his/her licence to write professional code away. To be honest, what we would need is a professional certification where the software engineer should at random be required by law to be audited about his/her code and potentially be forbidden to work with some type of projects if it doesn't pass. I have seen way too many nasty outcomes and suffering during my career in the industry to hold any other opinion. We have real software engineers out there who write clean, rigid & maintainable code - <USER2> the industry is flushed with hobby tinkerers allowed to work on projects that can result in serious harm. Calling oneself a software engineer should be regulated, audited like any other engineering field. That we don't require it, leaves us with the nasty results that is an ongoing disaster. Anyone can write a piece of software, the way anyone can build a bridge. Ensuring neither of them come crashing down and adhering to principles and practices that doesn't make it come crashing down with high certainty is what's makes engineers different. If you have read the book "structures - or why things didn't fall down", you know that those other engineers from other fields also fail on and off. The difference is that in software we just keep building the next bridge go come falling down when the previous broke.

</comment><comment><USER25> I think the article is right for the wrong reason. There is nothing in engineering that relates to public interest particularly. I am sure there are good engineers in the tobacco industry. I hold a formal engineering degree myself, not a single line in the curriculum relates to public good.

But I think the article is right that programmers are cheapening the term "engineer" by their incompetence. Anyone can call oneself a programmer and for a non technical business owner, there is no way to know that their programmers are not going to pepper their systems with rookie mistakes: sql injection vulnerabilities, unvalidated user inputs, unpatched software, default, shared, hardcoded or missing credentials, clear text passwords, etc. None of this is hard or expensive but this is the cause for the quasi totality of data leaks in the past.

How do we create confidence in this profession? It's not a university degree, I am not sure any CS course even covers this basic stuff, and that does nothing for the stock of existing programmers.

</comment><comment><USER26> Less death is attributable to software engineering, but certainly more harm could be attributed to it. What happens to our species if you engineer the perfect algorithm for controlling the attention of a whole people group, then use it to stimulate their most base emotions?

<comment><USER27> As 'software is eating the world' more and more deaths will be attributable to software development and there comes a point where the rest of the world will no longer be content with the crap our industry produces.

</comment></comment><comment><USER28> > "It undermines a long tradition of designing and building infrastructure in > the public interest."

Well, that's what some of the so-called software engineers actually do. And they are not necessarily doing programming.

I would agree that most of the programmers should stop calling themselves engineers because programming is not engineering per se. I would agree that we must stop considering "SE" and "programmer" synonymous in most cases. Maybe the term "software craftsmanship" can be a good alternative.

However, it does not mean that "software engineering" as a discipline does not exist. I think it exists and people doing it should call themselves software engineers. And those people are not necessarily doing programming.

</comment><comment><USER29> 'The title "engineer" is cheapened by the tech industry.'? That's a little over the top ain't it?

There are a lot of degrees combining electrical & computer engineering. My diploma was in such a degree and my PhD was in informational technology and electrical engineering. I think the lines between the two fields are blurred and by no means do I believe that one title/specialisation is better or harder.

I started working as an EE and later on moved to coding and both fields have their own challenges and hurdles. I never felt that a person that didn't get a degree explicitly in engineering doesn't get to call themselves an engineer.

</comment><comment><USER30> I wrote about the same topic here: [https://redbeardlab.com/2019/04/08/on- dignity-and-self-respe...](https://redbeardlab.com/2019/04/08/on-dignity-and- self-respect-of-a-profession/)

I disagree with the author, some of our work is definitely not engineering, making yet another e-commerce look nice is not engineering) developing browsers, web servers, cryptographic libraries, databases and all the basic tool used in the profession is definitely engineering.

</comment><comment><USER5> At very least those that haven't taken an Informatics Engineering degree, with professional title should stop calling themselves engineers.

There is a certain level of expectation beyond such title.

</comment><comment><USER31> I feel it's false equivalence to consider the "engineering" required to build bridges and buildings vs. coding websites and mobile apps. Mind you, those fields of traditional engineering have hundreds, perhaps thousands of years of experience (read: disasters) to draw upon. Software engineering is barely 50 years old - the equivalent of mud huts, straw roofs and ropes & plank bridges in construction. Like with anything else, these things takes time to mature.

</comment><comment><AUTHOR> "In the United States, registration or licensure of professional engineers and engineering practice is governed by the individual states. Each registration or license is valid only in the state where it is granted"

[https://en.wikipedia.org/wiki/Regulation_and_licensure_in_en...](https://en.wikipedia.org/wiki/Regulation_and_licensure_in_engineering#United_States)

</comment><comment> Avi-D-coder While a random js dev should not be called an engineer, the complexity and societal impact of modern software stacks far surpass most "true" engineering projects.

If Linux, Google, networking, etc.. were to stop working what would be the global economic cost?

If your work requires using formal methods, maths and extensive testing to ensure the reliability of the most complex systems known to man, than your an engineer not just a programmer.

</comment><comment><USER19> An engineer is a person who introduces CPU speculative execution bugs. A programmer is the person who works around them.

Speaking of which, a CPU is typically designed in a programming language such as VHDL, so by the logic of the article Intel's engineers are mostly just programmers as well ...

</comment><comment><USER19> This piece reminds me of the old saying "if Microsoft built cars, they would crash twice a day".

[http://homepage.tinet.ie/~nobyrne/ms- cars.htm](http://homepage.tinet.ie/~nobyrne/ms-cars.htm)

</comment><comment><USER19> An engineer is a person who uses numerical simulation software to guarantee safety of bridges, buildings etc.

A programmer is the person who wrote that software.

</comment><comment><USER32> a term that is widely used will have multiple meanings. considering who gets referred to as an 'artist' these days i can't really be upset with how the term 'engineer' is applied.

</comment><comment><USER33> because bad "traditional" engineering isn't taking lives or casing financial loss and poor health?

The article was a "lets take an ideal apple and compare it to a rotten organge"

</comment><comment><USER34> I think while we are at it, MDs need to remove the Dr. Prefix as well, no other profession regardless of if they have a doctorate or not does this.</comment>


TikTok waited 3 hours to call police after teen's death was livestreamed - <AUTHOR> https://www.businessinsider.com/tiktok-suicide-livestream-brazil-teen-waited-3-hours-call-police-2020-2 <comment><AUTHOR> Full title: TikTok reportedly waited nearly 3 hours to call police in Brazil after a teen's death was livestreamed on the platform, but the company notified its own PR team almost immediately</comment>


Show HN: Watson – inline issue manager with GitHub support - <AUTHOR> http://goosecode.com/watson

<comment><USER2> This is awesome. We the developers love to put those little comments in code for issues/to-dos and syncing it with Github is solid. looks like someone needs to fork it for Python ?

One question though. When an issue is resolved, would that actually go back to the source file and delete that inline comment OR would it add the text "resolved" etc. In both cases though, would we not need a new commit to that source file ? Or does it leave the inline comment in its original state ?

<comment><AUTHOR> It currently leaves the inline comment in its original state. It didn't seem like a good idea to have an automated tool touch the code itself, watson leaves it up to the developer to remove the comment. The "resolved" tag only appears in the report when the issue is resolved on GitHub or Bitbucket to notify a user that they can either remove it or ignore working on that issue.

</comment></comment><comment><USER3> Great idea! I've wanted something like this for a while, but never quite realised it.

What languages does it support? From the look of the front pages, C-based languages (C/C++/Obj-C) are ok.

Have you thought about offering this as a service? You could probably hook into Github and sync issues on commit using the same API that Jenkins uses.

<comment><AUTHOR> As mentioned below, it currently has support for parsing C / C++, Java, C#, Bash, Ruby, Perl, and Python files

It is pretty trivial to add support for any other language or comment type however, take a look at #get_comment_type in lib/watson/parser.rb

Never, thought about offering this as a service, having this as a commit hook is a very interesting idea though, thanks!

<comment><USER4> What about encouraging use/automated installation of local git hooks, ie. run watson locally after a successful push. I've just begun looking at git hooks but this seems like exactly the sort of thing they were intended for

</comment></comment></comment><comment><USER5> This is cool. I built something similar to this in Node. You start the tool and it monitors all files in your project folder for changes. Every time you save, it outputs a JSON object of all your tokened comments. The idea was to be able to plug it into another service, like a custom todo list app, or something like this. I haven't quite finished it, but maybe I'll clean it up a bit and push it to github this weekend.

</comment><comment><USER6> IBM would like to have a word with you.

<comment><USER7> I don't understand

<comment><USER2> Apparently, IBM has a project named "Watson". So he is referring to the name conflict [0]

[0] [https://news.ycombinator.com/item?id=6734100](https://news.ycombinator.com/item?id=6734100)

</comment></comment></comment><comment><USER8> Agree with the general preface of not interrupting your flow with issue tracking. I've been using ghi (command line GitHub Issues)[1] and couldn't be happier.

[1] [https://github.com/stephencelis/ghi](https://github.com/stephencelis/ghi)

</comment><comment><USER9> Sounds similar to guys who won ClojueCup: [http://clojurecup.com/app.html?app=codenotes](http://clojurecup.com/app.html?app=codenotes)

</comment><comment> w0rd-driven Super nice. Combining this with most support for updating issues via commit messages this makes it stupid easy to almost never leave the code. The only thing you likely can't easily do is deal with issue comments but that would be killer too. Never having to use the githib UI would be the ultimate workflow boon. I'm never a fan of needing to access websites and remember their UI as it feels disjointed from my typical working experience.

</comment><comment><USER10> I start one month ago a project with less or more the same concept! But this seems more powerful, and already done! :)

Btw if you are interested checkout: [http://www.ideabile.com/tirebouchon/doc/?file=index.php](http://www.ideabile.com/tirebouchon/doc/?file=index.php) ( Is just a small preview)

</comment><comment><USER11> What did you use to create your gif screencasts?

<comment><AUTHOR> I used LICEcap ([http://www.cockos.com/licecap/](http://www.cockos.com/licecap/)) from Cockos to generate the GIFs

I wrote the rotating gallery myself, it auto-figures out the duration of the GIF and does cycling for you. I'll probably release it sometime soon...

<comment><USER12> What a clean, concise approach to both the tool and the demo.

Watson also reminds me of Gina Trapani's todo.txt[1], which I love.

1\. [http://todotxt.com/](http://todotxt.com/)

</comment></comment></comment><comment><USER13> The sync with Github is awesome, looks like it would be great.

I have always had "todolist" on my machine aliased to grep -r "TODO*:" .

This basically just searches for all the places where I have TODO comments. This looks like a better way to do this for teams.

</comment><comment><USER14> Screenshots make this thing really interesting. Need to support more languages than just Ruby and Perl!

<comment><AUTHOR> Thanks! The app is written in both Ruby and Perl but it currently has support for parsing C / C++, Java, C#, Bash, Ruby, Perl, and Python files

<comment><USER15> Should be pretty simple to get it working with PHP right? Also, any plans for GitLab issues support? If not, that might be fun to hack on this weekend...

<comment> w0rd-driven Yeah PHP supports // or # as comments so the C language support gets you most of the way there if not all.

</comment></comment></comment></comment><comment><USER16> I helped to test this and have been using it since. it is much less disruptive to work flow to just add comments in one place rather than add comments and have to go through github's ui for work items, bugs, etc.

</comment><comment><USER17> I love it. Good example of enriching the development environment without any kind of special files, databases, etc. Would be great to port it other issue trackers.

</comment><comment><USER18> Looks awesome! If you remove the comment tag as part of a commit, does it / could it in future close the issue?

</comment><comment><USER7> Nice concept! Love it. The two examples are perl and ruby. Does that mean it wouldn't work in, say, javascript?

<comment><USER19> The example in the gif is actually C++, but JS should be fine according to the link. Ruby and Perl just happen to be the implementation languages.

> "Avaliable (sic) in Ruby and Perl, but supports all languages!"

</comment></comment><comment><USER20> Looks really promising! Would like to see this work for Gitlab also.

</comment><comment><USER21> Great work. Cloning the repo now. :)

</comment><comment><USER22> This. Is. Awesome.</comment>


Image manipulation on the fly + CDN = awesome - <AUTHOR> http://cdnimag.es/ <comment><USER2> We had been using this on a few of our side projects for a while now (since Amazon introduced custom origin servers on Cloudfront) and figured maybe it was something others would find useful. The systems is modeled after a similar system we used at Yahoo. Right now we're not charging or anything, just want to see if people find it useful before we expand. Let us know if you have any questions or have other features you'd like to see added.

<comment><USER3> First question would be about how much can I trust this. ie.: would you open source it and provide it as a paying service at the same time (like, say, wordpress). That's the surest way for me to trust any type of infrastructure, ie. if you guys dissapoint or dissapear with the hosted service, I can run it myself.

Second: how helpful is something like this really? Can you give some example use cases?

<comment><AUTHOR> Right now we're hosting it because it makes setup / integration time very quick. We're considering going open source for those who want to setup a box to do this yourself.

Here's an example of how we use it: We push original high resolution versions of photos/graphics to S3. Then to make a page with smaller, cropped thumbnails, it's as easy as calling for the image through Cloudfront with a special cdnimag.es url. (example integation: <http://www.seewhatiwore.com/browse>)

You'll notice with a site like Flickr, they generate five fixed sizes and they are locked into those sizes across their site. (example: [http://www.flickr.com/photos/rappensuncle/183689226/sizes/l/...](http://www.flickr.com/photos/rappensuncle/183689226/sizes/l/in/photostream/))

With cdnimag.es you can generate variations of the original image (sizes, crops, grayscale, reflection) on the fly without doing anything to the original. All this while still enjoying the caching and performance benefits of a CDN like Cloudfront.

<comment><USER4> Would this service support direct uploads to S3?

<comment><USER2> Yes. Currently our API supports pushing images to your S3 account (<http://cdnimag.es/#anc_20>). You can also use our clients for quicker integration (<https://github.com/traviskuhl/cdnimages-clients/>. currently only PHP, but we have a Perl & Ruby client coming soon)

</comment></comment></comment></comment></comment><comment><USER5> Cirruxcache [1] recently added the same capabilities. It's open-source and piggy-backs on Google App Engine - double awesome.

[1] <http://code.google.com/p/cirruxcache/>

</comment><comment><USER6> Guys, seriously get rid of the grey on grey on grey action. Your site is nearly unreadable. I recommend you talk to @limedaring, she's a remarkable designer, was my cofounder, and has done great work for several YC companies.

<comment><USER2> that's what happens when you let developers do design. definitely plan to bring on a designer for the next version of the site.

</comment></comment><comment><USER7> interesting . . . I was thinking of a similar idea last year, using nginx's image filter module (libgd) <http://wiki.nginx.org/HttpImageFilterModule></comment>


Advertisers get hands stuck inside HTML5 database cookie jar - <AUTHOR> http://arstechnica.com/apple/news/2010/09/rldguid-tracking-cookies-in-safari-database-form.ars <comment><USER2> There are so many ways to coerce a GUID out of a browser: single pixel images, cache headers[1], etc. It's not feasible to implement disclosure control[2] retroactively in web standards.

1\. <http://sourcefrog.net/projects/meantime/> 2\. [http://groups.csail.mit.edu/mac/classes/6.805/articles/priva...](http://groups.csail.mit.edu/mac/classes/6.805/articles/privacy/sweeney- thesis-draft.pdf)

</comment><comment><USER3> One thing that truly irks me about mobile browsers is that there is no way (as far as I can tell) to trick them out with add-ons and Greasemonkey scripts to make them behave as you prefer.

As a user I should be able to white- or black-list who can create databases on my mobile device, but so far this kind of control is not possible with the default browsers.

<comment><USER2> Even if you implemented these controls it wouldn't matter. The tracking software would use other information channels available intrinsically in HTTP to assign your browser a GUID.

<comment><USER3> It's not as accurate and still subject to add-ons that munge HTTP headers.</comment></comment></comment>


Ask YC: How do you deal with account downgrades? - <AUTHOR>

Tons of web services use progressively higher account limits based on a pay scale. Take Basecamp, for instance: http://www.basecamphq.com/signup
My question is: how does your company deal with users downgrading their accounts to a level that they are already over?
For example: someone has a Basecamp Premium account with 60 active users and 5 GB stored on the servers, and then decides to downgrade to a Plus account. <comment><USER2> Try to structure your service with monthly allotments. So instead of a total of 5GBs, allow 1GB per month.

Also, from an implementation perspective; make sure that to run an upgrade/downgrade all you need to do is change some database field values. You do NOT want to be running code that has to go through and change a bunch of stuff.

For users... keep them around; just disable their login. We're going to be implementing multiple users in our application and we are going to handle downgrades by simply maintaing an "ordered list" of users. So you have 20 users on your account w/ 20 max in that plan. If you downgrade to a 10 user plan, we "gray out" and "disable" the "bottom 10" users. The administrator can rearrange the disabled users towards the top of the list, which will "re- enable" them.

This raises another important point with our approach; we keep all of the users data so that when they downgrade, they can see that all of their shit is there but some of it might be disabled (don't hold your users data hostage or they will get PISSED! Note how for our users approach we don't just disable users willy nilly. The admin/user has control). If they can see their data is there, just not "usable" w/o an upgrade... they might be tempted to upgrade again.

Good luck implementing all of this! It truly is a pain in the ass. Just keep it all data driven and your life will be much easier.

<comment><USER3> This is definitely the best way to do it that I've seen in this thread. Kudos!

</comment></comment><comment><USER4> Ummm, normally you wouldn't let a user downgrade until they remove enough data that they fall under the lower limit. Doesn't seem that difficult...

<comment><AUTHOR> Right, that's the obvious solution. I'm still curious to see if anyone has come up with a different way of doing things, though.

<comment><USER5> You don't need to make downgrading easier than this ;)

</comment></comment></comment><comment><USER6> Most of the time you can't downgrade if you're over a limit. You would have to delete users, files, whatever, and then downgrade.

Or, you're charged an overage fee until you've cleaned out the excess bits.

<comment><USER7> not letting users downgrade, seems a broken model. Let them downgrade then - gray out.

</comment></comment><comment><USER8> I don't think there's a "hard and fast" rule you could apply here, it would have to depend on the service. I'd probably do something along these lines:

* Warn the user with as much notice as possible that they're over or close to the limit of their downgraded plan. It should be painfully obvious to the user that they're about to lose their extra privileges and data. (a red bar with warning always displayed along top of site, for example)

* On the day of the downgrade, send them another email saying the changeover is imminent.

* Actually don't downgrade them for a couple of days, but keep the message up.

* After those couple days, do switch over, and don't allow any write accesses other than deletes until the user has cleared the excess. Make sure your app handles this gracefully. If your app is mostly write once, read many, then put random data over the limit (their most-used files?) into "holding" where they can't get to it until they delete files to get under the quota. (and give a hint that they wouldn't have this problem with the more expensive account type)

* If they don't clear out their stuff after 2-4 weeks, just automatically delete enough data to enforce the quota. Email them a final warning a few days before the deletion.

But maybe that's just me and my naturally customer-friendly point of view. :)

</comment><comment><USER9> For us:

We have 'tiers' and bill a user based on which tier their use fits in, if they increase enough to be in the next tier, they get everything that goes with it, if they only have a small increase, they get an overage, that is some cost between the two tiers.

<comment><USER10> The problem with this is that you are not allowing the user to decide which tier they are in, and you'd probably piss a lot of them off by automatically moving and charging them in the next higher tier.

Overage fees are terrible for user retention, because they just irritate people unless it is extremely obvious and normal in your market to charge such fees.</comment></comment>


Servers for an Accelerated Future - <AUTHOR> https://blog.cloudflare.com/cloudflares-gen-x-servers-for-an-accelerated-future/ <comment><USER2> _" Notably, for the first time, Intel is not inside. We are not using their hardware for any major server components such as the CPU, board, memory, storage, network interface card (or any type of accelerator)."_

<comment><USER3> Who cares? What matters is price performance. They need to deliver value. What's inside, I don't care.

<comment><USER4> In the next paragraph from the article

> This time, AMD is inside. We were particularly impressed by the 2nd Gen AMD > EPYC processors because they proved to be far more efficient for our > customers' workloads. Since the pendulum of technology leadership swings > back and forth between providers, we wouldn't be surprised if that changes > over time. However, we were happy to adapt quickly to the components that > made the most sense for us.

</comment></comment></comment><comment><USER5> > We selected the AMD EPYC 7642 processor in a single-socket configuration for > Gen X. This CPU has 48-cores (96 threads), a base clock speed of 2.4 GHz, > and an L3 cache of 256 MB. While the rated power (225W) may seem high, it is > lower than the combined TDP in our Gen 9 servers and we preferred the > performance of this CPU over lower power variants. Despite AMD offering a > higher core count option with 64-cores, the performance gains for our > software stack and usage weren't compelling enough.

I find this a bit puzzling for density reasons. I can definitely appreciate the clock speed benefits. One 64-core part (AMD EPYC 7742) has the same TDP of 225W, so power should be in the same ballpark. There's also lower clocked 64-core SKUs with 200W TDP. I can't imagine price would be major factor for a company of Cloudflare's size, but it's definitely true that the 48-core part is much cheaper. There's also the 7H12 with a higher base clock than the 48-core part, but its TDP is 280W.

All of these EPYC chips have the same monstrous 256MB of L3, so maybe part of Cloudflare's workloads maxes out the cache before being able to feed all 64 cores, but that's a bit wishywashy. Maybe since they also all have the same PCIe lane capacity 48 cores is the sweet spot.

The 64-core parts still seem like a nobrainer.

<comment><USER6> If you look at how the chiplets are organized, you technically have 4 cores sharing a bank of L3 (2 of these 4 core groups per chiplet). In the 48 core model, 1 core from each 4 core group are disabled, so you have 3 cores sharing the same quantity of L3. So you now have 25% more L3 cache per core. You also have 25% more per-core memory and PCIE bandwidth.

If your workload is cache or memory bandwidth sensitive you might recover some performance despite having 25% fewer cores. You can probably run fewer cores at a higher sustained clockspeed. This may reduce a 25% deficit to something more modest like 5-10%, at which point the 64 core parts are harder to justify.

<comment><USER7> 33% more per core?

<comment><USER6> Ah right, I'm bad at math.

</comment></comment></comment></comment><comment><USER8> This major shift is well received by the tech community and appears to be an industry wide movement [1]. Looks like meltdown [2] and spectre [3] have run their course.

Bravo to Cloudflare!

[1] [https://www.amd.com/system/files/documents/linode-case- study...](https://www.amd.com/system/files/documents/linode-case-study.pdf)

[2] [https://en.m.wikipedia.org/wiki/Meltdown_(security_vulnerabi...](https://en.m.wikipedia.org/wiki/Meltdown_\(security_vulnerability\))

[3] [https://en.m.wikipedia.org/wiki/Spectre_(security_vulnerabil...](https://en.m.wikipedia.org/wiki/Spectre_\(security_vulnerability\))

<comment><USER9> (Disclosure: I work at Cloudflare but wasn't involved in this decision) Spectre variant 1 still affects patched chips with any sort of speculation and the price of fixing via compiler is substantial. It's a multi vendor structural issue. The hardware industry is stuck with some very unpalatable decisions to fix this. In some cases there are tricks to protect particular arrays but it's very finicky especially if arrays aren't a power of two in length.

<comment><USER10> I wonder when these issues will be far behind us... I can't imagine it's very near.

</comment></comment></comment><comment><USER11> Cloudflare's workers and kv store are pretty popular. I wonder if they ever plan to expand that to include more cloud compute. The article seems to indicate they have a lot of the needed unpinnings already.

<comment><USER12> I'd guess they'd need to provision massively more to offer compute. They could offer it for some major data centres but I don't believe offering compute at all data centres would be feasible.

</comment></comment><comment> a-ve [https://blog-cloudflare-com- assets.storage.googleapis.com/20...](https://blog-cloudflare-com- assets.storage.googleapis.com/2020/02/AMD_EPYC-35.jpg)

Looks like they're using Open Compute Project inspired designs, looking at those high-visibility green screws.

<comment><USER13> hey, this is Rami .. I lead hw team in Cloudflare.

Great observation! these chassis are designed for 19" racks, not OCP spec. But, who does not love green thumb screws!

<comment><USER14> Can I ask the chassis and motherboard combination? I know previous generations have been based on QCT chassis and motherboard components. I am curious what the non-hotswap, shallow depth, 1S is as it probably saves a fair amount of money dropping the HPC/density and hot swap premiums.

<comment><USER13> We're still using ODM built servers that are available for the public. Yes, moving off the shared infra chassis helps us improve reliability & cost thru simplicity, and enables us to scale our infrastructure using single nodes vs. X nodes as the smallest scaling unit. Our machines are stateless as our globally interconnected infra is widely distributed and replicated. Hence we moved to no-hotplug.

</comment></comment></comment></comment><comment><USER15> > For memory, we continued to use 256GB of RAM, as in our prior generation, > but rated higher at 2933MHz.

Is ECC memory being used?

Also, great write up! The recent benchmark numbers from Netflix [0] comparing dual socket Intel Xeons with AMD EPYC Rome (64 cores) also showed really impressive results!

[0] [https://news.ycombinator.com/item?id=22229431](https://news.ycombinator.com/item?id=22229431)

</comment><comment><USER16> Are they running 2x 25Gbps NIC's per server over standard cat 6? I thought 10Gbps over cat 6 was generally accepted as the fastest it can reliably push?

<comment><USER13> This is Rami from Cloudflare ... we actually use DAC Cables w/ SFP+ for all of our 25G nics.

</comment></comment><comment><USER17> >> For storage, we continue to have ~3TB, but moved to 3x1TB form factor using NVME flash

Are they not using additional storage for caching? I also kind of expected some GPU's for some tasks.

<comment><USER18> What cache tasks are possible on GPUs? Maybe computing a hash, but that doesn't seem like a big problem.

<comment><USER19> I could imagine CloudFlare using GPUs for image optimization or video encoding. They do a lot more than caching these days.

<comment><USER20> Neither is "great" on a GPU:

• Image optimization is still mostly software: JPEG, PNG, WebP. GPUs do not bring much to the table here at all, and consume a lot of power, which is likely to upset the hosting ISP of that cache node.

• Video encoding is better, but still average. NVENC (Nvidia's encode Engine) has some quality challenges and limitations.

Further, doing this at the edge makes less sense: if you have to fetch the source material from the origin, do the heavy lifting centrally and store the results at the edge. Storing 4-5 renditions is cheap compared to GPU running costs here.

</comment></comment></comment></comment><comment><USER21> In the last picture, the server seems to be 1U, but also squarish. Is there a benefit or a reason for not using the entire depth of the rack, or was there just nothing more to include?

</comment><comment><USER22> With the LUKS full disk encryption, how are you managing the encryption keys?

I assume the keys are not password protected so the server automatically decrypts on boot?

</comment><comment><USER23> Immense kudos for the Douglas Coupland reference.</comment>


Guess I'm Done with Discord - <AUTHOR> https://wowana.me/blog/guess-im-done-with-discord.xht <comment><USER3> Discord's phone verification is awful. They are using some super old database of what provider is associated with your phone number. I ported a Google Voice number to Verizon and they said I can't use it for phone verification because it's Grand Central, a company that went out of business before Discord even came into existence.

I pay them $99 a year, and their customer service treated me like shit for this. What do I care if someone hacks my account and destroys the large community that I moderate? That's their problem, not mine. But I doubt they care.

<comment><USER4> That's Twilio's database, not Discord's. Maybe it's fair to be upset at Discord for using Twilio if Twilio can't keep their database up to date, but I don't think there are that many alternatives to Twilio.

</comment></comment><comment><USER5> I am more and more thinking of this as a symptom of the "Data wars." I define that as the conflict between how much data someone is willing to share in exchange for a 'free' service.

The services aren't free of course, they pay their overhead and costs by re- selling the data they collect about their users. And as other sources of revenue (like ads) have lost value the data service has filled in. And since the data buyers know that the service provider is in a weak negotiating position they keep pressing on them to get more and more datamilk out of their data cows for the same amount of money.

The pressure is on to create a low friction pay as you go service for these things that don't extract data.

<comment><USER6> Since the OP is specifically talking about Discord, it's worth mentioning that what you're talking about doesn't seem to be the case for them - they make money from Nitro subscriptions and their game store, and state in their privacy policy that they are "not in the business of selling your information" ([https://discordapp.com/privacy](https://discordapp.com/privacy), in the section 'Our Disclosure of Your Information').

So relating back to the post, their justification doesn't necessarily make it right, but I think it's incorrect to attribute it to a malicious cause.

</comment></comment><comment><USER7> It's frustrating to be a power user in general with these sort of 'automated lockout detection' mechanisms.

I've lost count of the number of times I've tried to log in to, I dunno, eBay or whatever, and computer says no, and I have to call some bloody line and speak to someone who hates their job and doesn't understand what I mean when I talk about IP addresses.

I wish that these services had a way to check some box and say "look, I really know what I'm doing, let anyone with the correct password/SSH key/whatever in".

If it gets hacked, _then_ I can go through all of that shit. In this case we're talking about a bloody chat server for christ's sake.

<comment><USER8> You think the right set of people will check that box? And that if they do get hacked they won't cost the company a ton of resources in support/lawsuits/etc?

<comment><USER7> I mean, in practice, the 'right set of people' just don't use the service, so you're probably right.

I've probably made about ten discord accounts with random names to join some one off server, then gone back to IRC, because it just works.

</comment></comment></comment><comment><USER9> Tor breaks a lot of shit for me, and I dont even bother with captchas becuase it usually just flags me as a bot. So I dont think this is particularly surprising or out of the ordinary.

But yeah, discord used to be held in high standards by me and plenty of other gamers, but they have made it clear that they cannot handle tough situations, and dont really care about their userbase. Someone should start a privacy focused phone number as a service, acces to texts online and through an app. Allow people to basically have a spam phone number that they can give out to online services, but make people pay for it obviously. Like 10minutemail but long term and for texts only.

<comment><USER10> I mean it's not exactly privacy focused but if you just use it for spam then Google Voice or Skype numbers would work fine for this.

<comment><USER11> Many sites don't accept Google Voice or VOIP numbers unfortunately. Or fortunately, depending, as it'd be easier to use GV for text spamming.

</comment></comment></comment><comment><USER12> Why the insistence on Tor? Just use a normal VPN. Tor exit nodes are limited in number, and the same IP probably ends up being used by thousands of people... I assume a lot of them use it for nefarious reasons so you just end up in the same bucket. To some extent VPN providers can get hit by this too, but it's easy to just switch outbound IPs (for most of them). And if you want more than that, get a cheap VPS and install OpenVPN on it (you get your own unique exit IP address) - pay with bitcoin for the privacy aspect, also a good place to install an ad-filter, a secure DNS proxy (DOH) and so on.

I also don't understand the 2FA point, that says nothing about your accounts' intentions.

The account history is an interesting point... if you have a long-standing history with no reports of inappropriate actions, they should factor that in somehow into their algos.

<comment><USER13> >Why the insistence on Tor?

Short answer: I'm a privacy activist. That should be a valid enough reason for this context.

>I also don't understand the 2FA point, that says nothing about your accounts' intentions.

No, but it shows my account is secured from intruders, which means reCAPTCHA is just an additional nuisance to me, the legitimate account holder.

>The account history is an interesting point

Yeah, and they just glance right over it. It doesn't mean anything for my case that I've been an active user with this account for almost two years (I had a previous account for a bit and then left Discord because I was not in any communities worth sticking around for). Never have I done anything wrong on Discord's platform; haven't uploaded any lolis or evaded any bans (I believe I was only banned from one guild, even). They just don't seem to want me as a user, and that's fine.

</comment></comment><comment><USER8> > I refuse to provide phone verification as I believe it is Discord's fault > for flagging my account...

> I will be communicating with a couple communities with which I'm involved to > explain that I am unable to use Discord

Does this person not have a phone? 'Unable' seems like a stretch. If this person said, "I don't want to provide my phone number to Discord, so I'm going to stop using it" I'd understand.

Their opening email also strikes a pretty aggressive tone -- calling Discord anal, insulting, "spit in my face" then goes on to make a number of demands of the company? I'm not super surprised the customer service rep on the other side didn't go out of their way to help.

<comment><USER13> Just a note: I do not ask to have my blog entries submitted to this site, precisely because the comments I receive here are very assumptuous and negative. I have had prior interactions with Discord which influenced the tone of my E-mail. My blog post is simply presented as-is and I really do not care what others have to say about it, but I have no control over what is submitted here. I just want people to keep this in mind should future posts of mine be submitted, before someone points out "hey, you got onto Hacker News again" and I have to be subjected to a bunch of people not getting the full picture (and even some people complaining how _pink_ my site is... grow up).

<comment><USER14> Personally found the post interesting. I don't use Discord but I also refuse to give my number out for verification purposes - as you noted there are other ways to verify a users identity.

Hopefully you don't get too much grief for being a female on the internet with an opinion :-/

<comment><USER13> I don't capitalise on my sex/gender; I just prefer the use of neutral language when talking about anyone of unknown gender. In any case; I signed up for this when deciding to put my ideas online, and it has given me a chance to connect with a lot of nice people, despite also having to take the negative audiences along with it. I definitely am surprised that my blog attracts as much positive attention as it does; I never really wrote with the assumption that I'd have far reach. But, it's nice that others out there do care about some of the things I do.

Currently Discord doesn't require a number if you use your home IP to connect, but that could change at a moment's notice with their opaque methods of operation. I've used Tor with Discord for months without any issue until recently. So, it's probably better not to start using it now than to take that risk and be upset when they do find a reason to demand your personal information.

</comment></comment></comment></comment><comment><USER15> This is a typical response from service companies in the Internet age. They don't care about truth, or what actually happened, the algorithm says you're bad then you're bad. There's no human to appeal to, no human oversight of if their algorithm is right or wrong. They use another algorithm to check it, which tells them that you must be a bad actor.

I've had my own issues with Lyft that are similar. Banned from using their service even though I've never actually ordered a ride from them. Banned upon sign up. No review, no appeal, they don't even follow their own terms of service.

I'm not one to normal advocate for government regulations and oversight, but there's way to much consumer abuse for these Internet age services. Consumer protections can't come soon enough.

<comment><USER16> Assuming you're willing to share, how did you get banned from Lyft without ever ordering a ride?

<comment><USER17> Dunno about GP but I had a similar experience with Lyft, which had to do with the type of card I registered to Lyft. I don't remember the specifics but my case wasn't particularly weird… I was using an EU mastercard of some kind and they decided it was a bad one so they banned me. This all happened without ordering a ride.

Had a similar experience with Uber, except that Uber actually eventually fixed it. Lyft was… unhelpful.

</comment></comment></comment><comment><USER18> Social media gets less and less "social" every day.

My last remaining social media with input from me is HN. But I accept that, sooner or later, HN will be just as intrusive, aggressive, just plain nasty and censoring as the rest of them. And then it will be time for me to "go completely dark" as far as my contribution to the internet is concerned.

</comment><comment><USER19> I like that for privicy reasons they won't tell you why you were banned. Whose privicy?

Does that just mean "our black box NN has banned you and we won't know or care why" ?

<comment><USER20> Their own privacy most likely. Don't want to reveal the techniques used to identify the accounts they ban, so the scammers can't learn from it.

</comment></comment><comment><USER21> Point 2 in particular rings true.

...If you can't filter out your core user base with 2FA (!!!) from bullshit like recaptch then you've got real problems

<comment><USER4> 2FA is account security, not proof of being a good human user. TOTP is a very simple algorithm (python impl: [https://github.com/pyauth/pyotp](https://github.com/pyauth/pyotp)) that can be easily automated. After all, your phone telling you the code to type in has automated it.

<comment><USER21> Yeah

That risk is acceptableness to me though

</comment></comment></comment><comment><USER22> Strange I was just thinking about this issue the other day

Discord is a bit of a haven for spammers / scammers with my own account having received messages from several hundred random accounts ( to be fair the user is normally deleted before I read the message )

As a discussion / personal curiosity point how would the HN community reccomend discord handle this level of spam going forward?

<comment><USER23> It becomes extremely obvious when someones sharing a link to thousands of users they have never spoken to before. Idk about how you use Discord but I can only send so many messages to so many people in a few minutes.

</comment></comment><comment><USER24> I understand the frustration on the part of the user and I dislike that we're all being forced to give up our anonymity to use these platforms... but also the tone of both emails was quite antagonistic. They may have had slightly better luck if they'd been friendlier and not attempted to school the Discord staff on how their app should behave.

<comment><USER25> > but also the tone of both emails was quite antagonistic

The customer is always right.

> They may have had slightly better luck if they'd been friendlier and not > attempted to school the Discord staff on how their app should behave.

Or not. Besides, it should not matter, either they did something bad or they did not, the tone of the message may upset the recipient but when you ban someone just like that _you can expect them to be upset_ and your first line support people should be able to take that sort of heat in stride.

Sucking up to support staff when your account has been banned for no particular reason should not be a pre-requisite for having it dealt with professionally, in fact a good first line support worker will be able to de- escalate such a situation quickly by showing some competence and making sure the user is dealt with as they should.

<comment><USER13> For free services, I'm the product, not the customer. I understood this and used Discord regardless, because at the time it was the easiest way to talk to certain communities (mostly gaming related).

If I was using Nitro, I'd have to agree with you, but I had a clear stance not to give a dime to a company I do not support.

<comment><USER25> > For free services, I'm the product, not the customer.

That's been beaten to death by now. Let's start with that I don't agree with it. If the service is free the price is $0, that does not suddenly transform the person who the _product_ is being delivered to into the product itself. It merely changes the revenue stream into another one that is invisible to the customer. The company then has many options in order to get paid, none of which involve selling the customer. They might sell data _about_ the customer (illegal in many places if that data has been collected for different purposes), or they might attempt to upsell the customer on a different service.

But in no way does the actual customer get sold.

The whole thing smacks of defeatism: we don't pay so therefore we have no rights as customers so don't whine. But that simply isn't true, users are not cattle to be sold at auction and companies should not treat them as such. And users should not tell each other that they only got what they deserved.

<comment><USER13> Perhaps I shouldn't have used that phrase, but I felt it would resonate with people more immediately than any other choice of words. In any case, I don't pay for Discord so I am definitely not a customer, whether or not I or my data is a "product".

<comment><USER26> There is nothing wrong with the expression or the idea behind it. We all know what it means, and what you mean when you say it. We all (seem to) need the reminder.

It would be nicer not to be the product, but the world isn't always nice. Sometimes it is.

</comment></comment></comment></comment></comment></comment><comment><USER27> If the only deal breaker is your phone number, this is going to be an issue for you moving into the future with many service providers. Consider leasing a number through Twilio, it will save you from frustration.

<comment><USER13> I'm probably going to leave phone companies entirely, when I'm no longer on my family's plan, and set up a VoIP number because it'd give me hands-on experience with how VoIP works and it seems more cost-effective for my use case. I'll remember Twilio if I _need_ it for any verification purposes, but it's definitely a sad state of affairs that phone numbers are seen as a mandatory identification step in this day and age. I understand that it's an easy choice for some companies to make, but it doesn't mean I have to be happy with it.

</comment></comment><comment><USER28> Hey. I work at Discord - and actually, this system is a thing I work on - <USER2> code my team wrote caused your account to be locked. If my team is doing a good job, you won't notice us. If we're doing a bad job, you might get some spam, or your account may be blocked for false positives.

Discord gets a lot of spam. We've disabled, and/or challenged millions of accounts for trying to use our platform for unsolicited spam (trying to advertise their service, sex bots, crypto spam, etc...). Our anti-spam systems continue to evolve - just as the spammers who target our platform continue to evolve. The spam attacks against our platform vary in terms of how elaborate and skilled they are. Some are very obvious in terms of a detection perspective, and some are not. As such, we use a blend of signals, heuristics and machine learning algorithms to determine whether someone is spamming on our platform. Additionally, we look at where spam is originating from as an input to our heuristic.

One such source is TOR exit nodes - and as such, our system considers content created (DMs opened, etc..) from people using TOR exit nodes with more stringency than other sources. As such, if you are using TOR, it is definitely more likely that you may get challenged either via captcha, or phone verification. The system is definitely not perfect - and unfortunately in OP's case, it flagged the account for phone verification.

To address the 3 demands in OP's email:

> 1\. Discord's anti-spam isn't so anal,

I'm not entirely sure what this means, nor what actionable steps I can take. You are using TOR, a source of a great amount of spam/attempted spam on our network.

> 2\. my account (and other accounts in good standing and with proper 2FA) is > exempt from such checks

Having 2fa is not a strong signal as to whether or not an account is legitimate. It is very trivial to automate setting up 2fa on an account. [https://github.com/pyauth/pyotp](https://github.com/pyauth/pyotp) can be used to both generate and validate 2fa codes. It'd be trivial to hook that up to the registration flow to enable 2fa - and if that was a way to 'bypass' our anti-spam measures, it'd surely be exploited.

> 3\. I don't have to solve a Google reCAPTCHA for an account I have taken > every step to protect against bruteforcing. Using Tor is not a crime; don't > treat it as such.

Malicious actors constantly attempt to brute-force logins on our system - generally from public password dumps or other leaks. A lot of these brute- force attempts come from TOR, and other public proxies. In order to avoid information disclosure, we always captcha logins from these kinds of IPs, regardless of whether or not an account exists with the e-mail in question, whether the login credentials are correct, or there is 2fa enabled on the account. So, the "captchas" you notice are not really specific to your account, but rather, the origin of the login. Using TOR is not a crime, you are right - but - it's also our responsibility to our users to make it reasonably hard for their accounts to get compromised on our platform (even if they don't employ the best security practices - and reuse their passwords across the internet.)

Finally, I'd like to address: "Discord has shown to be hostile toward FOSS and privacy for a while now" and understand why that is.

As a company, we have tried to give back to open source software (either by financial sponsorship, or by contributing our bugfixes/changes upstream.) We also attribute all open source projects we use in our software here: [https://discordapp.com/licenses](https://discordapp.com/licenses). Additionally, we host many open source communities on our platform: [https://discordapp.com/open-source](https://discordapp.com/open-source). And finally, we try to open source software we make which may be useful to the eco-system in general: [https://github.com/discordapp/](https://github.com/discordapp/).

As for privacy, we've stated that we don't sell your data. When you verify your phone number, we ONLY use it for the purpose of anti-spam, and it is never shared with anyone (aside from twilio, which sends you the SMS), especially for the purpose of financial gain. We're pretty up front about how we make money (freemium model: [https://discordapp.com/nitro](https://discordapp.com/nitro), in-app commerce: [https://discordapp.com/sell-your-game](https://discordapp.com/sell-your- game)). We provide privacy controls: [https://support.discordapp.com/hc/en- us/articles/36000410991...](https://support.discordapp.com/hc/en- us/articles/360004109911), and allow you to request an export of all the data we have stored on your account: [https://support.discordapp.com/hc/en- us/articles/36000402769...](https://support.discordapp.com/hc/en- us/articles/360004027692-Requesting-a-Copy-of-your-Data)

I know this reply won't satisfy everyone, but hopefully, being truthful and upfront about this will help!

<comment><USER29> >Malicious actors constantly attempt to brute-force logins on our system - generally from public password dumps or other leaks. A lot of these brute- force attempts come from TOR, and other public proxies. In order to avoid information disclosure, we always captcha logins from these kinds of IPs, regardless of whether or not an account exists with the e-mail in question, whether the login credentials are correct, or there is 2fa enabled on the account. So, the "captchas" you notice are not really specific to your account, but rather, the origin of the login. Using TOR is not a crime, you are right - but - it's also our responsibility to our users to make it reasonably hard for their accounts to get compromised on our platform (even if they don't employ the best security practices - and reuse their passwords across the internet.)

Solution: add a checkbox "disable account security measures", so a user who doesn't want CAPTCHAs when logging into their account doesn't see them. It would have a warning so any user selecting it would know what they're doing.

<comment><USER28> No, I don't believe that adding the ability to reduce the security of your account is necessarily a good idea.

<comment><USER29> A user can already choose to reduce their account security, by reusing passwords, choosing common passwords, not using 2fa, etc. Allowing a user to choose to not have to complete a CAPTCHA before a login attempt, or allowing the user to choose to not require their account to have a phone number in case of suspicious logins, is reasonable, and would make many people who care about their privacy respect Discord much more.

</comment></comment></comment></comment><comment><USER21> I've been waiting for this in a way.

This surge in adopt is pretty classic. It feels artificially hot / running at too high temps if that makes sense.

I don't see a superior product so don't see this crashing, but Discord is going down only from here

</comment><comment><USER30> I want to be done with discord. The only value i find is the notifications when you have an @reply. Isn't there someone that has done this for freenode or other IRC ?

<comment><USER31> I used to use a bouncer, vnc, which there's a plugin for push notifications. Now I use matrix.org, which bridges to freenode and many (all?) other IRC servers and does notifications well. Quite happy with it, personally.

<comment><USER32> Yep, I wished matrix would replace discord and all other proprietary crap. Unfortunately the UX is still a bit lacking, but if you somewhat know what you are doing it's great.

</comment></comment></comment><comment><USER33> 1)You're not a paying user

2)You use proxies/tor which probably makes your concerns the concerns of 0.01% of the user-base.

Why should a company whose primary motive is to be profitable go so far out of their way for you, a non-paying client whose concerns represent basically none of the legitimate user-base?

<comment><USER13> The post is entitled "Guess I'm done with Discord", not "I'm entitled to my Discord account and everyone who disagrees with me is an idiot." As I said in another comment, my post was purely informative and not even in a format that would be digestible by people who do not know me.

<comment><USER26> Thank you for the informative posting. I have had no contact with Discord, so I learned something.

</comment></comment></comment><comment><USER34> A private company has the right to choose where its traffic comes from, nothing surprising here.

There are legitimate reasons to block TOR traffic, and even if there where none, they'd still have the right to block anyone of their users.

There are plenty of alternatives, simply remember not to choose one ran by a private company again.

<comment><USER13> Luckily I never had all my eggs in Discord's basket, and thankfully so. I will remember this, and I know they are welcome to discriminate against Tor or any other traffic, but that just means they opt for lazy solutions and don't care about false positives. I host websites and online services (at a _much_ smaller scale than Discord, at that) and I know how people use Tor to abuse services. But, I also know that there's a comparable number of incidents coming from traditional ISPs, hosting ranges, dynamic home IP addresses, public proxies... you name it. This is extremely apparent in the form of E-mail SPAM.

I just believe that placing bans or flags on IP addresses is not the answer, and I will work on my own software and services with this ideology in mind. Ironically, Discord did have what I believe to be a stellar answer to guild moderation: invite links. They allowed a whitelisting model for private guilds, as well as varied forms of controlled access for more-public guilds. I'd like to see this kind of control everywhere.</comment></comment>