Google pays no tax on £1.6bn in Britain - <AUTHOR> http://technology.timesonline.co.uk/tol/news/tech_and_web/article6962880.ece <comment><USER2> Casually forgetting the income taxes paid by the employees, of course, though the millions paid in social security contributions (NICs) is mentioned almost as a footnote.

I'm a major fan of The Sunday Times, but I can't believe they went with a non- story whose only intention is to ruffle the feathers of the Times' high income demographic (who are getting taxed to death themselves). What Google's doing is, on the surface, fully compatible with EU tax law. Devolving most of our powers to the EU is the British government's fault, not Google's.

<comment><USER3> How would things be different if the UK wasn't part of the EU?

<comment><USER2> At the least, VAT collectable by the UK would have been charged and earned on all of that £1.6bn (which would be well into the £100~200m range). Instead, Ireland got the VAT due to EU VAT collection harmonisation.

</comment></comment></comment><comment><USER4> I fail to see what Google has done wrong. Why wouldn't they place their European headquarters in a EU country with the lowest corporate taxes rates? Also, how does the UK have any more right to complain than France or Cyprus? This is just political grand-standing!

<comment><USER5> They've done nothing wrong. But what they have done is promote and campaign for politicians who advocate higher taxes, then turn around and do everything possible to avoid such taxes.

<http://online.wsj.com/article/SB122446734650049199.html> (Google CEO Eric Schmidt will hit the campaign trail this week on behalf of Barack Obama)

[http://gawker.com/5119039/google-execs-pay-150000-for- obama-...](http://gawker.com/5119039/google-execs-pay-150000-for-obama-bash) (Google Execs Pay $150,000 for Obama Bash)

<comment><USER6> Only hypocritical if you don't understand what a tax is. Obama didn't go out and advocate that individual corporations voluntarily pay more in taxes. All that would do is make the companies that voluntarily did it disappear from the marketplace as they get outcompeted. He advocated that to solve a collective action problem, a majority dictates (with teeth) that _all_ parties pay more taxes.

Presumably Google could be in favor of Britain fixing the loop-hole (if it really is one) it it affects their competitors as well as them, but they aren't going to voluntarily stop using.

It is like saying someone who advocates that we all quit ironing our pants in order to save energy, but in the meantime keeps ironing theirs, is a hypocrite. That isn't true, and it is a misunderstanding of what they advocated.

<comment><USER7> The ironing example is being a hypocrite. One should lead by example, if they really care about saving energy they will change their behavior to save it.

<comment><USER6> Nope, it is a collective action problem. There is a simple game theory payoff matrix:

(units: e=energy_savings, ss=social_standing)

One guy's payoffs:

                             one guy
                             iron                | no iron
        everyone    iron     0ss - 0.1e = (-0.1) | -1ss + 0e = (-1.0)
                    no iron  1ss - 0.1e = ( 0.9) |  0ss + 0e = ( 0.0)

Society's payoffs (1000 people):

                             one guy
                             iron                    |  no iron
        everyone    iron     0ss - 100e = (-100.0)   |  0ss - 99.9e = (-99.9)
                    no iron  0ss - 0.1e = (  -0.1)   |  0ss -  0.0e  = (   0.0)

Ironing his clothes gives the person no greater benefit than not ironing their clothes-- _so long as no one else irons their clothes either_. It isn't hypocritical to point this out and still iron your clothes.

<comment><USER7> I understand that that it's a collective action problem, but game theory only applies if things stay constant. By practicing what he preaches, and taking the hit to ss he shows that it is important, and he can use that to convince others to do it. As more people do it, the loss of ss per person goes down, and it might even invert (lose ss for ironing).

<comment><USER3> What if not ironing your pants affects your income significantly?

<comment><USER7> That's the price you pay for standing up for what you believe in.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Murdoch shouldn't be the one to point fingers, News Corporation (which owns Times) is one of of the world leaders in tax evasive subsidiaries.

[http://www.bloomberg.com/apps/news?pid=20601087&sid=aK0a...](http://www.bloomberg.com/apps/news?pid=20601087&sid=aK0aqjwsiSCA&refer=home)

</comment><comment><USER9> I think the Google gives the UK a lot more than just taxes.

<comment><USER10> Ad spam on web pages of the world?

</comment></comment><comment><USER11> Sounds like what any company big enough would do.

If this bothers the British, they might want to consider a law that allows them to tax both funds transferred to another country as well as funds reported as the company's local income.

That way the country would always get their share should Google decide to have a presence in the UK.

<comment><USER12> As a member of the EU, the UK can't pass such a law. We've given up some sovereignty for the benefits of being a member of the larger entity.

</comment></comment><comment><USER13> I have to say, what they've done seems perfectly legal -- in British law as well as Irish law. If the Brits feel wronged by this, perhaps they should consider changing the laws that allow it?

</comment><comment><USER14> And of course the only options ever presented in stories like these are more regulation and stricter enforcement. How about lowering tax rates to compete with Ireland?

<comment><USER15> Just take a look at Ireland's current fiscal and overall economic position.

<comment><USER16> And imagine how much worse it would be if Google (and Facebook, and others) weren't paying 12% Corporation Tax to the Irish Treasury.

<comment><USER17> If you thought people were complaining about the December budget... wait till the corporations start pulling up stakes wholesale!

The funny thing is Ireland has very good social welfare benefits - enough that fraud is a serious issue. A coworker told me a recent (non-gov't) investigation suggested it could be as much as 2 billion EUR per year. That's my euros the fraudsters are taking but the government can't be bothered to battle fraud more effectively! _sigh_

</comment></comment></comment></comment><comment><USER18> Couldn't the government require that money collected from UK residents go to a UK company?

<comment><USER4> No, the UK cannot enforce such a law without violating membership in the EU.</comment></comment>


Marvin Minsky's Society of Mind Lectures - <AUTHOR> http://ocw.mit.edu/courses/electrical-engineering-and-computer-science/6-868j-the-society-of-mind-fall-2011/index.htm <comment><USER2> An online HTML version of Minsky's book "The Society of Mind," formatted by Dylan Holmes:

[http://aurellem.org/society-of-mind/](http://aurellem.org/society-of-mind/)

</comment><comment><USER3> The lectures are great but not content-heavy. Professor Minsky goes on tangents, rants, and takes questions most of the time but it's all entertaining and somewhat informative. I suggest reading The Emotion Machine book for more of the theory.

<comment><USER4> I don't like the audio with all the coughing and the mic picking up at times all kind of "smacking" sounds.

</comment></comment><comment><USER5> Is this related to his book "Society of Mind"? If so, ow accurate is this view of the mind today?

<comment><USER6> >Is this related to his book "Society of Mind"?

[http://ocw.mit.edu/courses/electrical-engineering-and- comput...](http://ocw.mit.edu/courses/electrical-engineering-and-computer- science/6-868j-the-society-of-mind-fall-2011/readings/)

I think lot of things like modular architecture are still partially valid but I only have brief idea of his all views. I am sure some have been updated or falsified.

<comment><USER7> interesting reference list - this course seems to discuss specifically layers for cognitive systems. I think "society of mind" addressed more general concepts and ideas about cognition and semantics.</comment></comment></comment>


Getting Started with Blockstack: Decentralized, Blockchain-Secured DNS - <AUTHOR> https://blockstack.org/docs <comment><USER2> isn't this the same as namecoin?

<comment> mike-cardwell [https://blockstack.org/docs/blockstack-vs- namecoin](https://blockstack.org/docs/blockstack-vs-namecoin)</comment></comment>


If you want to recruit better developers, give them broken code - <AUTHOR> http://www.fastcolabs.com/3015662/want-to-recruit-better-developers-give-them-broken-code

<comment><USER2> I've used this philosophy for years - I see that it really can set candidates apart.</comment>


Project Svalbard: The Future of Have I Been Pwned - <AUTHOR> https://www.troyhunt.com/project-svalbard-the-future-of-have-i-been-pwned/ <comment><USER5> But we see that so often. The original founder of a thing has a list of requirements he wants met, he wants to stay onboard. But then stuff happens and the buyer uses his control. Think Instagram, Whatsapp, Tumblr(?) - <USER2> are thousand examples.

I'd hope Troy reconsidered the "just create a business yourself" solution. That could be structured in a way that makes sure the trust Troy earned stays linked to the project. And a bootstrapped company starting from the profitable position I assume HIBP is in now (with the business deals) does not at all have to mean more work for him. He could just offload the work he can't handle anymore to employees.

An acquisition to anyone not as trustworthy as the current solution/the candidates like Mozilla mentioned here would be a disaster mid to longterm.

<comment><USER6> For context, I've sold a business, been a full time entrepreneur for about 16 years, got it wrong many times and am currently the founder/CEO of a biz with a team of around 40 people, strong cashflow and we continue to grow and innovate - and we're founder controlled.

I met with Troy briefly for coffee about 8 to 12 months ago and we chatted a bit about this. I sensed his aversion to growing the biz back then. Seemed like he'd made up his mind. This post from him reinforces that. Even so I feel compelled to post a few thoughts.

Troy is an implementer. I was too. I was a dev guy who started as an ops guy. I really really wanted to build a business and for over a decade I tried to do it myself by writing my own code, doing my own ops, doing my own marketing and so on. It was very very hard, and after many failures and almost financially ruining me, I got to a place where I have an amazing biz and amazing team and I've turned myself into an exec who is no longer doing the day to day implementation, but is leading and coordinating.

This transition is very hard to make for folks like most of the people here - including myself. You have the sense that it's all on you. I need to repeat that in caps because that's how it feels. IT'S ALL ON YOU. I think this deep sense of accountability is what makes great devs and great ops people very good at what they do. But it also is perhaps what leads to burnout.

For an entrepreneur, it really is all on you. That work isn't going to do itself. And so that sense is even more visceral when you're a one man show. Now imagine you're running at the scale of HIBP. Pretty hardcore.

When I made the transition to being a leader and once I had a team behind me, the feeling was a bit like I'd imagine one might feel getting over a traumatic experience. It took a while. I felt like I could breathe again. I never wanted to go back to that place, if I have to be perfectly honest. It's a rough gig.

I think the trouble here is that Troy thinks that scaling HIBP is going to be more of the same. More of everything being on him, more work, more implementation, more accountability, more more more!!!

It doesn't work that way and I'm going to use my own path to growing a team (and regaining my sanity) to describe how it actually does (and can) work.

If one were to not sell HIBP and not raise money but instead grow it yourself into a business, it might work thusly:

1\. Immediately work on developing strong cashflow for HIBP. Unfortunately this step is going to take some implementing from Troy. However, with good planning, you can probably hire some help and perhaps even do so in exchange for equity/options if you hire a good lawyer and can structure a cost effective deal. This stage is critical and I'd encourage Troy to get as much advice from other seasoned entrepreneurs as possible. Not folks who have raised VC, but who have actually created cashflow out of thin air. It's a dark art, but many of us know how to do exactly that.

2\. Once you launch, it will take a while for the full revenue potential of the business to reveal itself. Cashflow takes a while to kick in and you will take a while to optimize it. e.g. many simply won't know that HIBP now has a paid option. That will take months, perhaps longer. So keep working and wait it out. I've seen this in every single successful cash generating biz I've created. At first it's a trickle, then a stream, then a river, then a wonderful fun and exciting deluge.

3\. Once you can demonstrate that the biz is clearly going to grow into something with strong cashflow, you can start making your first hires. I would suggest hiring dev first. At this point you are going to have to do something very difficult. Step back from the coal face and trust your first employee. This was huge for me but thanks to Harvard Biz Review etc writing about this founder dilemma over and over, I was primed and I wasn't going to be the baker that can't get out of the kitchen. So I 100% delegated the job to an amazing person who remains with our team to this day. Once I could hire for ops, did the same. Rinse, repeat. Grow the team.

4\. As your expenditures increase, you will need to be very good at managing cashflow. That is because at some point growth will pause. When that happens, if you don't realize that you will run out of money in X months, it will sneak up on you and you will lose the business. It happens every week around the world. Execs take their eye off the cashflow for a few months and byeeeee. Not everyone has the appetite for finance. Some are mildly or even severely allergic. I'm on that spectrum and thankfully my co-founder has a passion for it and happens to be very good at it. This has literally saved our asses and we too went through that growth pause. So if you are allergic, find someone who isn't. This is critical.

Once you do the above, if you build a team you can trust and you are very good at stepping back, finding and motivating talented people and carefully guiding the direction of the biz, things can get weird. You'll see a lot of executives talking about burnout, about how they work 20 hour days and the pressures of being a leader etc. But in your case you'll find that you have more free time and more mental bandwidth to shape the direction of the biz. You'll wake up one morning not sure what to do because you won't have a job anymore. You will have fired yourself from dev, ops, customer service, finance, HR, marketing, blogging and everything else. You'll go "oh shit, what am I supposed to do?"

The answer to this question is really fun: Whatever you and the business want to do. And guess what? You have a CEO who is the company founder and has a ton of energy and bandwidth to continue innovating.

That's pretty much the end of this post. I want to add a few more notes:

Delegating is hard for several reasons: If you're a dev and you have to delegate dev, you need to realize there are developers out there that are better than you and you will need to learn to trust them. You also need to understand that you're firing yourself from a job you are passionate about - <USER3> job you have loved and gotten very good at for many years. This is tough.

To scale a biz, you need to continue to delegate, even the things you love doing. Troy loves blogging and he writes epic tomes. But this too will need to be delegated if he wants to run at maximum effectiveness. I know. I did this. It was very hard. But I now have about 5+ writers in our organization and it's freed me up to launch a video podcast which I am already beginning to delegate to a certain extent.

VC is certainly an option, but know that each round you raise will also raise the bar on what success means. Right now you own the biz and success means a team that frees you up and cashflow that pays everyone better than market rate salaries. After the first round, a $20MM exit will be the definition of success. After a B and then C round north of $100MM will become success. And so it goes.

I'd also like to note that HIBP has built an incredible brand and growth. This is very hard to do. As Naval put it in a conversation I had with him not too long ago, it's lightning in a bottle, and I truly think that HIBP is a great example of lightning in a bottle. This won't happen again in Troy's lifetime. And what he has right now makes it very easy to: recruit, hire, retain, get help from other entrepreneurs, find customers, convince them to sign up, convince them to pay, get them to continue to pay, etc. The list of benefits is long. This kind of biz and brand is very hard to create. Troy's personal reputation is sterling and he's one hell of a nice guy. He is young, smart, healthy, well spoken. Seriously, you don't see this very often and it won't happen again, so choose your path wisely if you're reading this Troy.

And finally - and this is really why I'm writing this as a reply to onli's post - because I agree with their sentiment. Have no illusions that once you sell, you 'exit' in a very real sense. You are no longer the owner of the business. You are an employee. I'll also add that M&A folks are VERY good at selling the dream. I was recently at a certain multi-billion dollar company's offices who were trying to buy us. Their offices are based on Lake Washington up here in the Pacific Northwest. The M&A guy actually suggested that once we join their team we can ride to work in our boat. But in his defense, that's his job. Sell the dream. However, in this case I know the reality because I've been here before. Monday morning after you sell your company you will commute to work in a car, sit in a cubicle or office if you're lucky and you will do what you're told to do by the new owners of your business.

You will stare through those bars longing to roam the great plains once again as a free and wild creature in control of your own destiny. Or as Bodhizafa said in the final scene of the original Point Break: You know I can't handle a cage man!

<comment><USER7> HIBP shouldn't be for profit because it's harvesting personal data and it should be used as a mechanism for people to be aware of serious breaches. There's a lot of legal entanglement possible with this with HIPAA being an example of what can happen. It's probably a more difficult path, but in my opinion, HIBP should be a tax funded service because it's largely a public good product.

</comment></comment></comment><comment><USER8> I cannot say enough praises of Troy and HIBP. But it is a risky operation.

I understand HIBP derives its value from grey-ish hats sharing with Troy any leaked dataset they find because they know him or because of his reputation.

If he leaves, it is not clear to me that his trust and reputation will stay behind with the company running HIBP. The minute HIBP ceases to be the central place for these new datasets to be shared, it ceases to be of any practical use.

<comment><USER9> > I'll remain a part of HIBP. I fully intend to be part of the acquisition, > that is some company gets me along with the project. HIBP's brand is > intrinsically tied to mine and at present, it needs me to go along with it.

He's made it pretty clear in the blog post that he intends to stay on and has acknowledged that his reputation plays an important part in making HIBP what it is.

<comment><USER10> Which matters little, because it matters who the ultimate boss is.

</comment></comment></comment><comment><USER11> I'd love to see a non-profit organisation like Mozilla pick this up, but that's obviously going to mean a lot less money going to Troy.

OTOH, it's kind of difficult to begrudge Troy gaining financially from HIBP, since he's spent years building it up and has helped increase security awareness for so many people.

<comment><USER12> HIBP only works because of trust in Troy Hunt, few organisations have that.

Maybe an organisation not involved in advertising at any level.

<comment><USER11> It's definitely trust in Troy, and the level of transparency he's maintained, that have led to HIBP being successful.

But I, personally, would now trust Mozilla with this, were there to take ownership.

<comment><USER13> I was just thinking, the only ones I can imagine taking ownership would be one of the "big internet foundations" that have earned their trust: Mozilla, the Internet Archive, Wikimedia, or the EFF. Of those, Mozilla and the EFF are the only ones that make real sense. I hope it's one of them, and not fucking Norton AntiVirus or whatever.

<comment><USER11> I agree about EFF - I'd be happy with Mozilla or EFF.

</comment></comment></comment></comment></comment><comment><USER14> I hope that the SHA1 hashes remain freely available for download. I use them to build a bloom filter for password vetting.

We should all do away with password complexity rules (except minimum length) and simply test a large, comprehensive exposed password bloom filter for membership. It's very fast (constant time) and efficient and if the test returns no, then it's safe for a user to select that password.

Here's the code: [https://github.com/w8rbt/bp](https://github.com/w8rbt/bp)

Also note that this approach satisfies the updated (June 2017) NIST 800-63-3B password vetting guidelines.

<comment><USER15> Cool! I did something similar. First I used a bloom filter then a golomb set. [https://github.com/terencechow/pwnedpasswords](https://github.com/terencechow/pwnedpasswords)

<comment><USER14> Very nice. I've never used a Golomb Set (looks interesting). I bet we'll see more organizations doing this and maybe in five to ten years, it'll be the norm.

</comment></comment></comment><comment><USER16> Totally off topic, but still...: Many years ago, the New York Times did a lengthy piece about the Svalbard Seed Repository, referring to it as being located on "the island of Svalbard." It took repeated emails/corrections/tweets by me before they finally corrected the story and noted "Svalbard is not an island, it is an archipelago." All subsequent references in the Times have got it right.

<comment><USER16> Here is the correction, published on April 22, 2010: [https://archive.nytimes.com/query.nytimes.com/gst/fullpage-9...](https://archive.nytimes.com/query.nytimes.com/gst/fullpage-9F0CE6DF163EF931A15757C0A9669D8B63.html)

<comment><USER16> Here is the (corrected) original article — with correction appended — published on April 15, 2010: [https://archive.nytimes.com/query.nytimes.com/gst/fullpage-9...](https://archive.nytimes.com/query.nytimes.com/gst/fullpage-9402E4DA1238F936A25757C0A9669D8B63.html)

</comment></comment></comment><comment><USER17> I'd like to see Let's Encrypt step up and run this service. Seems like a natural fit.

<comment><USER18> ProtonMail/ProtonVPN would also be a good fit, but I doubt they could afford it.

<comment><USER19> Just because they're tangentially related to infosec in some way doesn't mean they'd be a good fit.

IIRC aren't there actually privacy concerns regarding Proton? That may just be FUD.

Plus, I doubt they would maintain the level of transparency we've come to expect from HIBP. They don't seem very... transparent.

</comment></comment></comment><comment><USER20> It's a shame as this is _likely_ to mean that we end up with a worse service, but completely understandable. hopefully, I will be proven wrong

</comment><comment><USER21> This is really public utility work and should be treated like it instead of a for-profit project. Many thanks to Troy for his hard work over the years for making the internet a safer place.

<comment><USER22> Sad, but people don't like paying taxes..

</comment></comment><comment><USER23> Worth mentioning that the value of HIBP is largely based on trust in Troy Hunt. I think he's an incredible guy who does incredible work; but he's also an Australian citizen. Due to our new surveillance laws, he could be forced to backdoor HIBP, or more likely, Pwned Passwords.

This is possibly a step by Troy to mitigate that risk, and given his position I'm surprised he didn't mention that at all in this post.

<comment><USER24> What would backdooring HIBP achieve?

It's not a repository or method of communications.

<comment><USER23> Pwned Passwords uses tricky crypto to make sure his service never sees your full password. He could use trickier crypto to make sure that it does.

<comment><USER24> I think that's a bit of a reach.

That's all client/requester side, which has been implemented on third party sites/services. There'd be a lot of questions raised if suddenly it required that you use a different technique.

A more subtle and (IMO) more realistic variant would be to backdoor the javascript to capture all input on that site instead.

But you have to ask yourself - who would be the government target, in that case?

They'd have to:

\- Have a technically sophisticated target where the government doesn't know their password, and is unable to otherwise break their security (eg forcing Google/Apple/Microsoft/etc to do the work, cloning devices, regular surveilance) \- Have that same target also regularly test their passwords against a password strength meter on the public webpage. \- Be willing to risk a public leak that this was happening.

I don't think that anyone who meets the first point would be stupid enough to meet the second. I mean, sure, people make plenty of dumb mistakes - <USER4> surely not that one, repeatedly.

<comment><USER23> It is a reach yes, but that doesn't change the fact that Troy is in a position of trust; which may not be wise given his citizenship.

</comment></comment></comment></comment></comment><comment><USER25> In some ways, wouldn't it be great if the internet had evolved with, analogously to DNS, 'User Name Servers', like a sort of global distributed IAM?

Leak monitoring would be a service provided by the UNS, not falling to a volunteer, and credential revocation could be automatic and immediate.

I suppose we sort of have that bolted on with OpenID/OAuth, but that's still 'choose a provider' rather than 'this is the one way', with many servers run by different entities, but one 'system'.

<comment><USER26> It's existed since 1988: LDAP/X.500[1] It's just not used globally because of three reasons, as far as I can tell,

1) most people don't want their information public and searchable to that extent

2) most orgs _want_ to silo you in or otherwise control your account

3) the org using x500 still needs to have their own permissions separate from the central directory, which is the harder part of auth[nz], so just rolling your own authn is often easier.

[1] [https://en.wikipedia.org/wiki/X.500](https://en.wikipedia.org/wiki/X.500)

<comment><USER25> Ah yes, and Shibboleth is another I should've thought of in earlier comment.

I think you're absolutely right in particular with #2.

But if it had come originally, alongside DNS, 'everything has an address, everyone has an identity', it might've been an unquestionable fact of the internet.

Orgs can't silo you in to their alternate net where they have a more desirable domain name, because it's just not practical or user friendly.

I just think it might have been so for user identity.

</comment></comment></comment><comment><USER27> HIBP could be an excellent B2B offering for companies. Imagine someone like Microsoft offering it as an addon to their business clients to improve security practices.

Or a more independent company offering it as a standalone service, kinda like Mozilla (Monitor) or even something like Symantec (tho they seem to be bleeding money recently)

<comment><USER28> Mozilla monitor is just a front-end for HIBP though, as far as I've seen they exclusively get their results from HIBP.

</comment></comment><comment><USER29> Many people here assuming that Troy Hunt will leave HIBP after selling it. He explicitly mentions that he will remain a part of it:

> I'll remain a part of HIBP. I fully intend to be part of the acquisition, > that is some company gets me along with the project. HIBP's brand is > intrinsically tied to mine and at present, it needs me to go along with it.

<comment><USER30> HIBP has little value without Troy, so he has to come as part of the package.

But for his own well-being over time he needs to delegate and divest himself as the single bus factor for HIBP. But that does not have to happen instantly and can be gradual without affecting the value of HIBP (in money and usefulness for us).

Whoever purchases HIBP also knows this. And as with most acquisitions, they eventually oust the founders. But for it to be successful it is after a long time when it has properly matured into an organisation.

</comment></comment><comment><USER31> I guess he's feeling the heat of sites that do more than parsing emails from SPAM lists. These sites include full cracked passwords, HIBP 2.0, see e.g. [https://scatteredsecrets.com/](https://scatteredsecrets.com/).

</comment><comment><USER32> Brewster Kahle, are you here? This seems like something in your wheelhouse.

</comment><comment><USER33> I missed this verifications.io story and it appears that my personal email address was in the breach. Is there any way of knowing whether or not other data was associated with my listing? DOB etc.

</comment><comment><USER34> It pains me to see how many posters on this thread are not aware of the leakedsource (.ru, .co, etc.) websites that show the exact thing HIBP shows, except with a much higher fidelity.

</comment><comment><USER35> Good luck to Troy. The money would be really good, but hopefully for the rest of us, he doesn't sell to Cisco.

Or Oracle, or any other mega corps that buy and nerf the usefulness of the product.

</comment><comment><USER36> I came here hoping it was something about Svalbard. I went there a couple years ago in the dead of winter. It's an amazing place.

<comment><USER37> Tell us more! I'm planning for a longyearbien/svalbard trip towards the end of this year or summer next year.

<comment><USER36> Sure, what do you want to know?

I went in the dead of winter, so might be a little different from what you might experience in summer. [https://www.facebook.com/dheera/media_set?set=a.101010917929...](https://www.facebook.com/dheera/media_set?set=a.10101091792964948&type=3)

</comment></comment></comment><comment><USER38> I wish you luck, Troy! Just don't sell it to some data mining/ad company.

</comment><comment><USER39> Maybe relevant for Stripe? Based on their acquisition of Indie Hackers, it seems like they're adept at this kind of acquisition. And online security contributes to their goal of increasing "the GDP of the internet."

</comment><comment><USER40> So many people saying the value of HIBP is the trust in Troy Hunt. But surely I'm not the only one that has used the service for years (and shared it with friends) without knowing anything about Troy Hunt...

<comment><USER41> Social credit and trust has a way of naturally propagating. Trust, beliefs, even world views are more often "caught" than deliberately and carefully chosen -- to the detriment of many. All it takes is a few liars with the appearance of trustworthiness to spread false beliefs very widely.

Note, my comment is _not_ about Troy. Security-wise, I think the trust he carries is well-deserved.

</comment></comment><comment><USER42> Troy is an awesome guy and I'm really happy that HIBP is outgrowing him to get more support, datasets, and features.

I hope Have I Been Pwned goes to the right people and they do an even better job at moving it forward! Kudos Troy

</comment><comment><USER43> Guys whats the fuss about -- its just a stupid database - anyone can make this by scraping hacker spoil dumps available on the internet.

</comment><comment><USER44> I hope that other companies will still be able to query to the database for free. 1Password does it now and I like it.

</comment><comment><USER12> tl;dr

He's realised he's the single point of failure, can't do it all himself, wants to balance work & family. Doesn't want the work/cost of hiring people and making a business.

So, he's preparing to sell it and there's a wishlist of what he'd like the new owner to do.

Did I get it all?

<comment><USER45> Also he'll stay on as part of the package.

</comment></comment><comment><USER46> His blog is really good, I have enjoyed reading his other posts as well.

</comment><comment><USER47> TL;DR: Have I Been Pwned is for sale and is being renamed Project Svalbard. Troy is looking for buyers that will keep the service free, and he'll go work with the buyer.

<comment><USER48> AIUI, "Project Svalbard" is the name of the project to find a new home for HIBP. The actual service isn't being renamed (yet).

<comment><USER11> It is indeed common to have a "project name" when buying/selling a company - but in my experience that has always been largely for reasons of secrecy, so it is a bit odd in this case.

</comment></comment></comment><comment><USER49> wasn't HIBP going to a B2B SaaS that you hook up at signup to forbid users to signup with an email/password combination that has already been leaked? I'm a SaaS owner, I would pay for that.

</comment><comment> ga-vu So why was the owner of LeakedSource arrested and charged, and this guy isn't?

He did the same thing. Only instead of selling to hackers, he sold our hacked data to companies and governments.

<comment><USER50> Does HIBP sell the raw data?

<comment><USER51> Nope. Though I suppose if HIBP itself were acquired, that would presumably include the raw data?

</comment></comment></comment><comment><USER43> How is making money from stolen data legal? My email address is in the database and I never consented to it. Is there no legal repercussion?

</comment><comment><USER52> Best of luck Troy and keep up the good work!

</comment><comment><USER53> I understand why Troy is doing this. Security is a big and a complex endeavor and having majority of the stuff done by himself alone is taking a toll.

One option that Troy could have done is to spin up a team / small company that would continue this project - with full control and guidance under his direction. That way, the trust that he has built from everyone at the community will be carried forward as the project progresses and matures further.

This will also allow visibility and transparency knowing that the people who would be working on this project will have access to him and everyone is on board on the direction moving forward.

Lots of companies / venture capitalists would be willing to support this cause which could provide the financing the project will need to be sustained and grow further.

</comment><comment><USER54> He's still a Microsoft employee is he not?

Wonder if he couldn't just bring it in-house?

<comment><USER55> When has he ever worked for Microsoft? [https://www.linkedin.com/in/troyhunt/](https://www.linkedin.com/in/troyhunt/)

[https://www.troyhunt.com/microsoft-regional- director/](https://www.troyhunt.com/microsoft-regional-director/) \- "I'm not going to work for Microsoft and despite the title of "Microsoft Regional Director", I'm no more an employee than what I was (and still am) an MVP"

<comment><USER54> Ahh, the title has always thrown me off.

</comment></comment></comment><comment><USER56> Summary: Troy is bored so he's selling out. Great.

<comment><USER24> I don't think it's fair to call someone who's clearly stressed and close to burnout 'bored'.

</comment></comment><comment><USER57> Can we move the project into a blockchain and run it on IPFS?

EDIT: Serious question, generate hashes out of the leaked logins, store them in a blockchain and provide an interface for lookup via IPFS. Those credentials are considered burned anyway so storing them for ever in a blockchain won't matter.

Being in a blockchain anyone can access the data and use them for example on a registration page.

<comment><USER11> What value would a blockchain add here over a database?

<comment><USER58> A breach-monitoring service could act as a data washing service, sic.

Especially if privatized.

Blockchain is Very overrated, but it could be useful in keeping data "safe" where the temptation would exist to index or obscure results. Especially where data collection and censoring / disclosure has value to certain markets, i.e. Timed/rated or delayed disclosure, sic.

IDK, it's not impossible, but it's not my wheelhouse either.

I don't see any reuse or value to old databases and hashes being public, so it's missing that purpose to exist or be used/shared. Like a lot of blockchain is. It's not enough to exist, it has to be shared and kept alive. I suppose.

Still, If you look at the way AV and user security is handled, there are potential vectors to prevent or anticipate, especially if the process of disclosure is censored or segregated.

Perhaps also if they proactively lean towards purges or spontaneous negative actions, in order to obscure their intent or actual content / behavior.

HIBP relies on disclosure, and if it were woven into a typical service structure, there would be a temptation to "alleviate" the workload for customers, offering to "feed the beast" with positive results and competitive, defensive tactics against 3rd parties offering a similar product.

Which could segment the disclosure process, so that you would have multiple options, much the way that AV and Malware is handled.

And now you have the same failures as AV and Malware being segmented domains.

The probability of a corporation being incentivized to airbrush a 3rd party listing in a semi-corporate "index" or offering "alternatives" to anxious, very large corporations to disclosure or remediation. Especially if they deal with financial or legal data, or specific disclosure requirements.

And have problems with timely disclosure, or any disclosure.

Imagine if a clearing house for disclosure existed as a Symantec or Kaspersky "Subscription", with tiers of access and disclosure prevention for corporate members, wrapped up in a daily routine app, such as a 2FA/Password manager.

So that a disclosure would be made silently by the subscription service, without disclosing details, or the level of breach, etc. The accounts or corporations breached, would just have their entire client accounts auto-reset and the updated password would be applied to your password manager within a batch process without the user(s), the press, the security agencies, or the hacker(s) being notified.

That, instead of revealing the time period, the hashes of usernames & passwords, or the name of the user, or their IDs, it would just be rotated on a regular basis, and invisibly managed.

Its a concept with some value, ie "paranoid" security features as a service, to prevent or anticipate disaster, sic. But handled via a handshake type batch process of cycling password management.

But this also has potential for occlusion and obfuscation, especially in examples where the breach would be a crime, or need to be disclosed to federal/state/police agencies, etc.

Thankfully, most security policy would prevent this kind of amorphous takeover, but for small businesses and large businesses, having access security taken away and handled by 3rd parties, for convenience, is inevitable.</comment></comment></comment>


Achieving full-motion video on the Nintendo 64 (2000) [pdf] - <AUTHOR> https://ultra64.ca/files/other/Game-Developer-Magazine/GDM_September_2000_Achieving_Full-Motion_Video_on_the_Nintnedo_64.pdf <comment><USER2> Lately there has also been an effort by a hobbyist to use an MPEG1 decoder (PL_MPEG)[1] on the N64[2].

Disclaimer: I wrote PL_MPEG, but not the N64 port.

[1] [https://github.com/phoboslab/pl_mpeg](https://github.com/phoboslab/pl_mpeg)

[2] [https://www.reddit.com/r/n64/comments/dr15py/i_just_started_...](https://www.reddit.com/r/n64/comments/dr15py/i_just_started_a_dragons_lair_port_to_n64/)

<comment><USER3> Hi, I'm the guy working on that.

I've actually since moved to port a H264 implementation to N64. It's been a long journey and I'm now at around 18 FPS, after nights of manual RSP assembly optimizations, vectorizing most of the intra-prediction and inter-prediction algorithms. I want to reach 30FPS so there's still some work to do.

<comment><USER4> What kind of vector operations does the N64 support for his case?

<comment><USER3> For H264? Basically everything.

Vector registers are 8 lanes, signed 16-bit, so they map quite well to per- pixel calculations on each plane (YUV), which is what video codecs do, as you can process 8 pixels at a time, and you have 16-bit precision to handle intermediate results.

The most complex hurdle is that RSP only has 4K of RAM so you need to DMA in and out macroblocks a lot (especially since I can't possibly rewrite a FULL h264 decoder in RSP assembly, not in this lifetime: I need to write only specific performance-sensitive algorithms, while the bulk of the decoder stays in C; this means that the same data ends up going in & out the RSP a lot, especially since the H264 decoder I'm using is not aware of this problem).

This said, RSP DMA is even rectangle based, so it's another perfect fit: I can DMA a macroblock by specifying the pointer in RAM, width and height (usually 16x16, but some algos works on sub-partitions of 8x8 or 4x4) and the stride (screen width), so that a single DMA call will transfer the block from the middle a frame, skipping the rest of the data.

Vector multiplications in RSP were designed to write DSP-like filters, so they map quite well to the pixel filters required by H264. There are several different multiplication instructions for different fixed point precisions, and there's even one that automatically adds 0.5 (in the correct fixed point precision) which is also a common pattern in FIR filters, and also used in H264.

Saturation (VCH/VGE/VLT opcodes) is also supported; this is useful as most algorithms eventually need to saturate the calculated value in the 0-255 range, so that's another thing which usually require 1 clock cycle for 8 pixels.

When working with 4x4 partitions, half of the vector lanes are ignored; when writing back to memory, you need to do a read / combine / write sequence (as you may want to write 4 pixels and keep the existing 4 pixels, but vector writes will write 8 pixels); in this case, the VMRG instruction is used, which basically allow to combine two vector registers into one, with a bitmask to specific where to get each lane frame.

For IDCT, it comes very handy that most RSP opcodes allows to do partial broadcasts of the lanes of one of the input registers; this allows to keep a 4x4 matrix into 2 consecutive registers and then play some tricks with broadcast to multiply by rows and by columns (which is required by IDCT where you need to compute A' x B x A, with A&B being 4x4 matrices, so if you expand that you will see that you need to rotate vectors a lot).

So well, it's actually a pretty good fit.

PS: in the Gamasutra article, it shows the RSP code used to do colorspace conversion (YUV->RGB). The article says that it give a big boost (and I can believe it: especially in MPEG1, CSC is like 30% of decoding time), but I brought it to basically 0% by letting the RDP do it (RDP is the GPU in N64). In fact, the RDP supports YUV textures: so in my H264 player, the RSP just does the interleaving (that is, merges the 3 separate Y, U, V planes into one) and then asks the RDP to blit a textured rectangle in the correct format. The RDP even runs in parallel to both RSP and CPU. It might be that, back in 2000, this wasn't fully documented by Nintendo, though I found several references in old Nintendo docs. I can't see otherwise why it wasn't used. Once you reverse engineer how to pass the correct constants, it works really well and brings the CSC cost to basically zero.

<comment><USER4> Really fascinating. The dma latency must be pretty small? The 4k of ram and DMA makes the programming model a lot like the Cell, I wonder if experiences with game evs using the RSP microcode encouraged the Cell design. I also wonder how much in common this HW has with the SGI GPUs of the day...

<comment><USER3> The DMA transfers 64-bit words per each bus clock cycle between the main shared memory (RDRAM) and the internal RSP 4K DMEM (or IMEM, to transfer code).

So it's quite fast, but you need to remember that the main RDRAM is shared among the main CPU and the whole RCP (eg: it's also used as video memory for textures and frame buffers by the RDP), so contention is really high.

</comment></comment></comment></comment></comment></comment><comment><USER5> See also, for techniques used on a much earlier console with much tighter constraints:

• [https://youtu.be/c-aQvP7CUAI](https://youtu.be/c-aQvP7CUAI)

• [https://youtu.be/IehwV2K60r8](https://youtu.be/IehwV2K60r8)

<comment><USER6> That Sonic 3D hack is damn clever

<comment><USER7> Regarding the other hack, people did some really cool stuff with palette swaps, e.g. [http://www.effectgames.com/demos/canvascycle/](http://www.effectgames.com/demos/canvascycle/)

And also the Windows 95/98 startup screens.

</comment></comment></comment><comment><USER8> I rather wish the 3DO version of The 11th Hour had seen release, but the publisher canned the project quite late in development.

There, we had about an hour of video - on CD, it should be noted, not a cartridge - at 288x320 (using an interlaced display mode, which virtually nobody used beyond splash screens), with a perfectly solid 30fps. Left unregulated, the decoder yielded around 40-70fps. All ARM assembly, and a _huge_ amount of fun to write. ^_^

No hardware acceleration, needless to say, other than page blitting to copy the previous frame to the current buffer.

</comment><comment><USER9> The Gamasutra web article on this is not as pretty. But, it includes the RSP microcode.

[http://web.archive.org/web/20081221184231/http://www.gamasut...](http://web.archive.org/web/20081221184231/http://www.gamasutra.com/features/20001004/meynink_pfv.htm) (edit, link fixed, thanks!)

If you like this kind of stuff, check out [https://www.reddit.com/r/TheMakingOfGames/](https://www.reddit.com/r/TheMakingOfGames/) and [https://www.reddit.com/r/videogamescience/](https://www.reddit.com/r/videogamescience/) I often post games-related stuff I find here to there. But, this might be the first time I've seen something posted to HN because it was first posted there :)

<comment><USER10> Your link seems to be broken, here's a working version: [http://web.archive.org/web/20040313034855/http://www.gamasut...](http://web.archive.org/web/20040313034855/http://www.gamasutra.com/features/20001004/meynink_pfv.htm)

</comment></comment><comment><USER11> Absolutely fascinating, high-quality, deeply technical article with a healthy dose of nostalgia. I'd love to see more of this (even though we often have quite a bit!) on HN.

Does anyone know if this technique was ever used again on the N64?

<comment><USER12> Not to my knowledge, the only other time _good looking_ FMV was used on N64 was in Pokemon Puzzle League. I am not profiecent enough in RSP to disassemble that microcode, though I can tell you resident evil 2's fmv codec came after the HVQM fmv system used in Puzzle League

</comment></comment><comment><USER13> It always amazes me reading about the novel techniques N64 devs used to squeeze every last ounce of performance out of such a hardware / storage constrained platform. Nowadays I get excited if a Call of Duty patch is under 10gb....

<comment><USER14> It's incredible to me to see just how much smaller Nintendo Switch versions of games are than their PC counterparts, even when the visual differences are minimal.

<comment><USER15> Note also that the textures on the switch are for a console that does 1080px max so it would be smaller.

edit://Visual difference minimal you say?

<comment><USER14> For example, Cuphead at 3.3GB is 1/4 the size on Switch as it is on Xbox One. Another is Doom 2016, which, while obviously having lower fidelity visuals, is 13.2GB on Switch and 77GB on PC.

</comment></comment></comment></comment><comment><USER16> I have feeling this is a lost art and wasn't used since xbox one / ps4 release (and probably way less before that).

<comment><USER17> Fitting things onto a 32MB cartridge isn't a constraint anymore. Current consoles use 50GB discs and next-gen ones are going to use 100GB BD-XL discs. Makes it less necessary to do stuff like that.

<comment><USER18> Some use 32GB cartridges.

</comment></comment></comment><comment><USER19> I owned this game as a kid and I remember the cartridge being noticeably physically heavier than all of my other N64 cartridges. As I remember it, the FMV sequences looked basically identical to their PS counterparts.

</comment><comment><USER10> Interestingly the N64's RSP has some instructions specifically intended for implementing MPEG decoding (ctrl+f for "MPEG"in [http://ultra64.ca/files/documentation/silicon- graphics/SGI_N...](http://ultra64.ca/files/documentation/silicon- graphics/SGI_Nintendo_64_RSP_Programmers_Guide.pdf))

<comment><USER3> Yes unfortunately they're _very_ specific of MPEG1, so they're not really useful for other codecs in the MPEG family. I'm not using them in my H264 implementation (see sibling answer).</comment></comment>


Website allows you to experience what it is like to live with dyslexia (2016) - <AUTHOR> http://geon.github.io/programming/2016/03/03/dsxyliea <comment><USER2> This seems like an exaggeration of the descriptions I've heard about dyslexia, in that letters move way too far. Another huge problem is that the first and last letters don't change, and I'm betting that for dyslexics, those anchor letters don't exist. With the anchor letters, I find this trivial to read. It barely slows me down at all. Studies have shown that most people can read fairly easily when the first and last letters of a word are fixed and the inner letters are scrambled. Given the difficulty that dyslexics have, I suspect this isn't a realistic simulation.

It's an interesting idea. I appreciate the goal. I just don't know that this is anything like the real thing. I'm not sure it's possible to know what it's subjectively like.

<comment><USER3> I'm dyslexic, you're right, this is an exaggeration, but it's almost impossible to simulate the real thing. It's not like the letters move around the page, it's that you perceive them to be other letters or words. Then you realize that you read doesn't make sense and your brain just replaces it with the correct words or letters when you read it again. It kind of makes you aware of the fact that what you see and what is there are two distinct things which are not always the same.

<comment><USER4> I have ADHD (where dyslexia is a common co-morbidity). I'm not dyslexic, but I tend to experience dyslexia-like symptoms with numbers. Never letters, just numbers. It made math hell in school. Like you describe, it's not that the numbers are literally moving on the page. It's that they sort of... blob together in my consciousness, like there's a blind spot in my visual understanding, and my brain tends to fill in with numbers that look close enough. I tend to transpose numbers very very easily, swapping 6s and 9s, 2s and 5s, 7s and 1s.

There's an additional layer of challenge where numbers are involved; with words, there are spellings that are obviously not words, or words that don't make sense in a given sentence. With numbers, there's no easy way for your brain to check whether what you read is accurate, because there's no equivalent of numbers not making sense.

<comment><USER5> I have exactly this, still have a lot of mental math. At school teachers just gave up at some point and gave me a calculator, I still have a lot of trouble with mental multiplication and converting between analog and digital time (doesn't help that in Dutch you say 15:30 like 'half four').

I'm also terrible at holding numbers in my head, if I do not keep paying conscious attention to it, they get reversed or substituted. I remember all my PIN's by the motion you used to input them instead of the number itself.

Programming made me discover how much I love math, but I still miss a lot of basics because I never 'got it' in elementary school, and thus ended up in the lowest levels of math in highschool, where it was extremely boring and tedious (because it was actually way to easy), I wish I could send a programming book/numberphile videos to my 12-year-old self, because I think I could have ended up using high-school time way more effectively, instead of just going through the motions.

<comment><USER6> I have ADD and used to have significant trouble with these kind of issues, while I still have trouble with time, almost all of my issues with remembering number (pin codes etc) went away after an "intensive" regimen of essentially n-back training prescribed by my care provider.

While my improvement after 30min a day for a couple of weeks was something of an aberration in magnitude (from 70"th percentile to 110'th, from well below average to above), it was reportedly quite consistent in increasing recall percentile with ~10% as measured against the general population. Which especially at lower percentiles is quite impressive!

It's not really realated, but to me the whole thing was quite a strange experience! After roughly a week of daily practice, it suddenly felt like I found a part of my brain I didn't even know existed. I could suddenly pick numbers, or sequences of "lights" turning on on the screen, seemingly from nothing! The first times it happened I didn't really remember the sequence, I only knew which button to push, but after a little more practice I started to be able to consciously recall the sequence from this new place in my mind.

It was truly stunning to be suddenly able to look at a code at the car wash, and sometimes remember it for hours afterwards!

Me, who several times had forgotten my card pin, who though I loved and was good at maths had to read digit by digit to get the numbers right (and often still didn't), and who had in general tended to permute any kind of number more often than not for the ~30 years I had known what numbers were!

The brain is so strange sometimes.

<comment><USER7> >an "intensive" regimen of essentially n-back training prescribed by my care provider.

can you describe the treatment protocol to us in brief or link us to additional resources on this topic? this sounds very interesting and potentially very helpful.

</comment></comment></comment></comment></comment></comment><comment><USER8> Dyslexic here. Dyslexia is not a single condition. The only way we define dyslexia is difficulty reading caused by the way the brain processes text so not something like poor eyesight or low intelligence. Therefore by definition this is not what a large percentage of dyslexics experience because there is no common experience. Maybe this is how some dyslexics experience reading, but I am not one of them and I don't think I have ever actually heard another dyslexic describe literally seeing letters changing as they look at them. It is often more that things seem to change when you aren't looking.

For me personally, I have no problem with letters. A "b" is never a "d" or whatever stereotypical explanations you might hear about dyslexia. My problem is with entire words. I will often substitute one word for another while reading (and writing). I can go back and might still read that incorrect word. But I don't think I ever really "see" that incorrect word. It is more that my brain is lazy and isn't actually reading, it is just assuming what is supposed to be there and that assumption is occasionally wrong.

<comment><USER9> I have dyslexia and find this simulation pretty accurate. Obviously it's just a simulation though. When I read, letters aren't literally jittering around the page, but I do have to do a lot of "double-takes": looking back at words and thinking hard to decode them.

As a kid, reading aloud in class was always nerve wracking because of this. The game was to do these double-takes so quickly that nobody could tell you were doing all of this extra work. Often you read ahead of what you're saying so that you can double-take before saying the word.

<comment><USER10> > As a kid, reading aloud in class was always nerve wracking because of this.

Yup, reading out loud was the absolute worst. I have different issues though, and because of my reading's tight associations with speech(1), I couldn't even read ahead. I think my "only-when-read-out-loud" stutter comes from the social anxiety I developed here.

(1) i.e. To read words with my eyes, I have to mentally speak them to myself.

</comment></comment></comment><comment><USER11> I work in the field of dyslexia and always find these simulations be interesting because they are in conflict with the so-called prevailing wisdom regarding dyslexia here in the US.

Largely due to research out of Yale, there is an entrenched belief among many dyslexia experts that dyslexia is not experienced visually, but is rather a phonological condition. However, if you ask 10 people with dyslexia whether their condition has a visual component, you will get at least 4 people (and quite likely more) who say yes.

Websites like this reinforce the understanding that dyslexia does – at least for some people — have a visual component. Fortunately, the international community seems to be less allegiant to the Yale research.

They view dyslexia as a set of conditions that can be more visual for some and more phonological for others. And there are also many practitioners (assistive technologists, occupational therapists, tutors) in the US who share this broader view of dyslexia.

But it remains baffling to me that so many of the "experts" in the US are unwilling to listen to actual people with dyslexia who state in no uncertain terms that they experience dyslexia in a visual way.

The reason this has come up as a frustration for me (as someone who works in the field but does not have dyslexia) is that my startup's technology is visual in nature. The tech I built [1] has become quite popular among people with dyslexia — despite not having been created with this audience in mind.

I always assumed that experts/advocates would be happy to have another tool that could help people with dyslexia. I never imagined that there could be such a strong orthodoxy of "dyslexia isn't visual, it's phonological" could exist. This website, and the comments in this thread, provide damning proof to the contrary.

1: [http://www.beelinereader.com/education](http://www.beelinereader.com/education)

<comment><USER12> This is interesting, I'm Dyslexic, but wouldn't consider my experience to have a visual component (or I don't think of any visual component as being a notable part of my experience).

However I do find tools like yours very useful, it makes reading much easier for me. It definitely helps with line transitions, which I do have slight difficulty with, but isn't the primary cause of reading comprehension issues for me. Instead most reading comprehension issues are my brain simply ignoring or replacing words completely without me realising.

<comment><USER11> Glad to hear it helps! Do you find it only helping during line transitions, or does it also help with the accidental ignoring/replacing of words?

</comment></comment></comment><comment><USER13> I'd be interested to know what someone with severe dyslexia thinks of this interpretation. I have a mild case (constantly flipping digits in numbers, but rarely struggling with words) and my experience is much more swearing I just read 1917 and then looking back and realizing it says 1971 and then having to read it again because I was so sure it was 1917.

It's true that the digits did jump around on me, but it's not experienced as active motion, as portrayed here. It's more that I see a false representation of what's in the page.

I think words aren't an issue because my brain is good enough at picking the word from what's there and context.

It would be more like rendering the page with a few different Random letters swapped each time, rather than continuous movement of letters on the page.

<comment><USER14> It's almost like it needs eye tracking. Then swapping around letters while you aren't looking at them.

<comment><USER15> Maybe you could simulate this by asking the reader to highlight on the page as they read (another commenter with dyslexia mentioned using this strategy)? Then hold the words immediately before and after the end of the selection constant. And maybe instead of randomly shuffling letters, swap out whole words with likely mistakes (given the number of dyslexic people in these comments, you could probably start with no substitutions and crowd-source a list of _actual_ mistakes. To prevent the visual motion of swapping words from being distracting, you could make all non-selected words be very low contrast with the background. And if you wanted to be really fancy, maybe you could only make selection persist for a certain amount of time or words, so one can't simply select the entire document to fix it in place.

</comment></comment></comment><comment><USER16> I have dyslexia. The best way I can explain it is that when I read, it's more like I'm sampling from a probability distribution than actually seeing what's on the page. This is why I have difficulty spelling too...because I'm not sure which way something is spelled, i.e., when I sample from the spelling distribution, multiple competing items come out and I don't know which one is the correct one.

This website isn't accurate for me per say...but I guess it does capture the "hazy" feeling when I read.

I do believe us dyslexics have significantly different brains. I get along with dyslexics more than neurotypicals. We seem to have a strange bond. I suppose we're more "abstract" thinkers...in the sense that we are used to reasoning about spaces instead of particular instances...owing to the probabilistic nature of our minds...but maybe I'm using the wrong language here.

</comment><comment><USER17> Somewhat related; I have a lesser known disability which is related to dyslexia called dysgraphia[1]. For simplicity sake, I often describe it as "like dyslexia, but for output instead of input". Basically, it makes it very difficult to write legibly.

Dysgraphia, and (the often accompanying) ADD, are part of why I initially got into computers. I would type much much more easily than I could write, so I would beg teachers to let me type assignments instead of writing by hand, which was significantly less common when I was young than it is today. In retrospect, it's a good part of how I ended up working in technology.

Unfortunately it has, I think, also hampered my career. It makes it, as you can imagine, significantly more difficult to whiteboard. My whiteboarding either looks like something a child would produce, or requires immense focus (often both), completely separate from the engineering consideration, to produce what seems simple for most people.

Inconspicuous disabilities are such a strange thing to live with. They're not evident, so I think it's difficult for people to relate to them. I really appreciate the effort that was put into making the linked site and I hope it makes it easier for people to understand the struggles some people deal with without most other people ever noticing.

1: [https://en.wikipedia.org/wiki/Dysgraphia](https://en.wikipedia.org/wiki/Dysgraphia)

<comment><USER18> Thanks for your comment. In german both of these are usually group together, so it never occurred to me that in english they are separated categorizes. Even tho the word used "Legasthenie" means "reading weakness", it still is applied to both cases.

As already was mentioned, there is a wide range of ways this can express itself. I have something called "phonological processing deficits" [1], which means that letters which sound similar k/g, d/t, b/p are hard to distinguishes for me. In reading this is not much of a problem, in writing it I have extra attention. In recent times I notices that I recognize misspelled words not on the letters/sounds involved, but rather on the overall shape/silhouette of the word, meaning the up and down of the letters.

1: [https://pubmed.ncbi.nlm.nih.gov/21109251/](https://pubmed.ncbi.nlm.nih.gov/21109251/)

</comment></comment><comment><USER19> Letters don't just abruptly appear to change to another valid letter. I like to describe it as each letter oscillating in and out of different letter eigenstates, appearing to smoothly interpolate between various letters. Once you look directly at a letter, you collapse the letter to the correct state.

The letters are like 98% in the correct state, but contain small components of other letters, giving a breathing/morphing effect like what you would see on shrooms.

</comment><comment><USER20> I recommend reading the book "Language at the Speed of Sight: How We Read, Why So Many Can't, and What Can Be Done About It" by Matthew Seidenberg.

It starts off with the history of writing, which I actually have to go back and re-read because it's such a crazy evolution. Talk about standing on the shoulders of giants. I can't imagine getting thrown back into the stone age and having to figure out a way to communicate ideas.

It also talks about the fascinating ways that the brain uses different modalities to converge on meaning - really made me thought a lot about machine learning algorithms. It refers to a lot of well-designed studies with results that provide valuable insights into the inner workings of the brain.

It also talks a lot about dyslexia and how it is a rather broadly defined disorder. I'm pretty sure I could be considered dyslexic based simply on how poor of a reader I am. This also, however, could explain why I did better with math and science where you are doing yourself a great disservice to trying to skim the texts. I read that shit at the pace of a snail, but hey, maybe that allowed me to process the concepts better.

</comment><comment><USER21> As a diagnosed dyslexic, this website feels nothing like what reading is like for me. It might be representative of some dyslexic experience, but certainly not mine.

</comment><comment><USER22> On the same theme, there are several videos on Youtube related to schizophrenia. This is a particularly frightening one:

[https://www.youtube.com/watch?v=63lHuGMbscU](https://www.youtube.com/watch?v=63lHuGMbscU)

</comment><comment><USER23> I wish sites would stop forcing overriding the user default font or a least render nicely with their custom font override. I use the [OpenDyslexic][1] typeface which really helps but I'd say about 50% of sites I visit have custom fonts and css rules dependent on their custom font.

This is particularly frustrating when viewing GCP or AWS support docs. I get the lack of accessibility on marketing oriented sites but support docs for major could providers should render coherently with an alternative font!

[[https://www.opendyslexic.org/](https://www.opendyslexic.org/)]: 1

<comment><USER24> This sounds like a problem a simple extension would trivially solve, I might write one up and publish it later today when I have some free time. I'll edit this comment when I do.

Edit: Should've googled first, there seems to be plenty of extensions that solve exactly this issue.

<comment><USER23> What exact issue does it solve?

Here is a screenshot of what it looks like with the OpenDyslexic typeface [https://gist.github.com/rudolph9/e4e86fee61cccd722f6b56eb841...](https://gist.github.com/rudolph9/e4e86fee61cccd722f6b56eb84126810)

<comment><USER23> Actually now that I look at it again it's mostly the icons that aren't rendering nicely. I've got OpenDyslexic installed in the OS and then set as the font in firefox setting but for what ever reason "up arrow", "down arrow", etc are rendering at text instead of icons. Any tips to fix this?

<comment><USER24> Hi, sorry I missed this - I seemed to misunderstand the question. There's a simple fix that I guess I might now make an extension either today or tomorrow depending when I have free time.

Here's how you could do it on your own, this is for the google cloud docs reference [https://cloud.google.com/compute/docs/apis](https://cloud.google.com/compute/docs/apis).

Note you have to allow pages to set their own fonts in firefox if you use this option

0\. Open up your console in dev-tools (F12).

1\. Load Jquery (Give it a second, let the script load)

      var jq = document.createElement('script');
      jq.src = "https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js";
      document.getElementsByTagName('head')[0].appendChild(jq);

2\. See all the font-families the page is using

      fontSets = new Set();
      $('*').each( function() {
        fontSets.add( $(this).css("font-family"))
      });
      console.log(fontSets)

for google cloud docs this reveals:

      Set(7) [
        "Roboto, Noto Sans, Noto Sans JP, Noto Sans KR, Noto Naskh Arabic, Noto Sans Thai, Noto Sans Hebrew, Noto Sans Bengali, sans-serif",
        "\"Material Icons\"",
        "Google Sans, Noto Sans, Noto Sans JP, Noto Sans KR, Noto Naskh Arabic, Noto Sans Thai, Noto Sans Hebrew, Noto Sans Bengali, sans-serif",
        "Roboto, RobotoDraft, Arial, sans-serif",
        "Roboto, RobotoDraft, Helvetica, Arial, sans-serif",
        "Google Sans, Roboto, RobotoDraft, Helvetica, Arial, sans-serif",
        "Material Icons"]

3\. Make an educated guess, I guess its probably Material Icons that OpenDyslexic is messing up, so lets update all the font-families that don't contain Material Icons

      $('*').each( function() {
        if ( $(this).css("font-family").indexOf("Material Icons") === -1)
          $(this).css("font-family",`OpenDyslexic, ${$(this).css("font-family")}`);
      });

</comment></comment></comment></comment></comment><comment><USER25> This has been on HN several times [1], [2].

I highly recommend that you skim through the other thread. I found, as someone who deals with kids with dyslexia, that the insights helped me better understand and deal with them.

Also, understanding the different types of dyslexia helped me organize some contradictions I had heard.

[1]: [https://news.ycombinator.com/item?id=15226676](https://news.ycombinator.com/item?id=15226676) [2]: [https://news.ycombinator.com/item?id=11218677](https://news.ycombinator.com/item?id=11218677)

</comment><comment><USER26> I could still read the ad titles. Goes to show that there's nothing that marketing can't solve!

</comment><comment><USER27> It's good to realize "dyslexia" is different for different people, with a subset of them seeing "dancing letters" like this visualization shows. It's still incredibly worthwhile to experience visualizations like this if only to vaguely understand what it's like.

I implemented this particular vizualisation into Polypane so you can run it on any website and from what I experienced with people with dyslexia, there are definitely people that don't see a difference between this on or off.

</comment><comment><USER28> Tangentially related Chrome devtools now tries to simulate various vision issues

[https://developers.google.com/web/updates/2020/03/devtools?u...](https://developers.google.com/web/updates/2020/03/devtools?utm_source=devtools#vision- deficiences)

So maybe your designers with their tiny thin fonts can learn some compassion for us poor sighted folk.

</comment><comment><USER29> I don't have dyslexia, but I found the webpage pretty easy to read except for a few long words I didn't know. For those I just had to hover for a few more seconds. That being said - if I had to look at that every time I read, I would probably avoid reading for the rest of my life... so that is a challenge.

</comment><comment><USER30> I used a similar method to write a dynamic poem using javascript several months ago ([https://jminjie.com/@Jordan/from-the-eyes-of-birds- bd5bbe0c9...](https://jminjie.com/@Jordan/from-the-eyes-of-birds-bd5bbe0c91))

</comment><comment><USER31> I'm waiting for the site that'll let you experience what it's like to have ADHD.

Oh wait. That's Twitter.

</comment><comment><USER32> I appreciate the effort but it focuses only on the disadvantages of dyslexia. Their is good evidence that dyslexia an other learning-disabilities are a neurological tradeoff between short and long Cortical Minicolumns, where dyslexics have on average fewer and shorter column that are thicker, have less connection, but that reach farther. Sort of like the difference between GPU and CPU. Maybe we need a tool to showcase the advantage of interconnected reasoning and narrative skills instead of just focusing on the negative aspects.

<comment><USER18> Thank you for your comment. This led me to reading about it and discovering some interesting research on this topic!

<comment><USER33> > discovering some interesting research on this topic!

Please feel free to share :D

<comment><USER18> I first found the book "The Dyslexic Advantage: Unlocking the Hidden Potential of the Dyslexic Brain", which in turn talks about the spacing between minicolumns in the brain. So looking for these terms yeilds some intressting stuff, for example this:

[https://dept.wofford.edu/neuroscience/neuroseminar/pdfspring...](https://dept.wofford.edu/neuroscience/neuroseminar/pdfspring2010/autism&deslexia- minicolumn.pdf)

[https://corticalchauvinism.com/2016/12/12/dyslexia-and- autis...](https://corticalchauvinism.com/2016/12/12/dyslexia-and-autism- cognitive-profiles-at-the-tail-ends-of-the-same-spectrum/)

<comment><USER32> Yes, The Dyslexic Advantage is a good start, it's where I first encountered the science.

<comment><USER18> I started it and are actually surprise how much it fits to my own experience to this day. Can you recommend further reading? Thank you bring this to my attention!

</comment></comment></comment></comment></comment></comment><comment><USER34> At first I thought it was saying dyslexia makes text too small to read on mobile, and then I realized it's just the typical styling of a site that does adaptive design poorly.

</comment><comment><USER35> Wikipedia says that there is no research showing that the commercial font called Dyslexia is useful for people with dyslexia (in improving readability). I also see free and open source clones like OpenDyslexic. [1] I presume this wouldn't help much either.

What else can web developers and/or content writers do to make content better readable or more easier to comprehend (even if it's by easy guessing)?

[1]: [https://www.opendyslexic.org/](https://www.opendyslexic.org/)

<comment><USER11> You're right that the research on these fonts is mixed. After receiving many feature request emails from users, I offered OpenDyslexic in my browser plugin that helps people read more easily (and which has been picked up as an assistive technology for people with dyslexia).

I think the reason these fonts are popular with some people with dyslexia is that they are heavier (thicker lines) and have more space between characters. For some people, including people with visual impairments, these features make reading easier. This is especially the case if the alternative is some super- thin font that is dark grey, against a light grey background.

I've seen discussions in the WCAG (web accessibility) community and other community around how to make reading easier for neurodiverse populations. Unfortunately, most of what I've seen has been along the lines of "don't use big words" and "use short/simple sentences". While this is all well and good for some uses cases, it is not practical advice if your app is an ebook reader or your website talks about complex financial instruments.

Fortunately, there are some layout-related things that you can do to make text more inclusively designed, and you can check out the Center for Applied Special Technologies' website for an interactive demo. [1] Full disclosure, one of the technologies they feature was created by my startup, BeeLine Reader. Let me know if you want to try out our JS on your site — contact info is in my profile.

PS: the commercial font you reference is "Dyslexie", not "Dyslexia". A common typo, I'm sure!

1: [http://demo.cast.org/cisl-demo/](http://demo.cast.org/cisl-demo/)

</comment></comment><comment><USER36> Another form of dyslexia is meres-irlen syndrome, such that the text can ripple, blur, or white-spaces move about.

My partner said the visual experience from this video[1] is close to what she experiences when trying to read text.

[1] [https://www.youtube.com/watch?v=FARizLljRkc](https://www.youtube.com/watch?v=FARizLljRkc)

<comment><USER37> I think I had a form of this as a child. Words would not e arranged on a straight line on the page but would be too high above the baseline or too low. I haven't suffered this illusion since I was ~10 years old or so.

</comment></comment><comment><USER38> > With the anchor letters, I find this trivial to read. It barely slows me > down at all

Not unfair, but you've had a lifetime of non-dyslexic reading to perfect this skill.

It may be exaggerated, but I found it interesting to see the difficulties that dyslexics have to put up with. I really empathise with children trying to learn to read with this condition.

</comment><comment><USER39> It seems relatively easy to read known words, but almost impossible to read long, complicated ones (like typoglycemia).

I can understand that learning to read with dyslexia is super frustrating... This is a great way to make people understand what dyslexia feels like.

It would be amazing if we had something like that to understand what it's like to be black in America...

</comment><comment><USER40> Reading all the comments I can't help appreciating two observations:

1\. How vastly differently we experience the world 2\. How little our experience resembles what there actually is outside.

That brain of ours seems to be a real little f*cker what comes to creating an illusion that we observe some kind of objective reality. I need to keep that in mind.

</comment><comment><USER41> Don't have dyslexia, but I am pretty bad at spelling and grammar(and no, no amount of reading will change my grammar).

I can easily spot that I spelled a word wrong, but can't necessary spell.

I been remedying this through anki and spaced repetition, but it's a slow process and my mind sometime switch to incorrect spellings anyway.

<comment><USER42> Out of curiosity, is English your native language?

</comment></comment><comment><USER33> Just a random dumb idea: this could likely be made much more freaky (and maybe more realistic?) with an eye-tracker and possibly some letter morphing to hide the actual changing from the reader, seems to me, would more closely resemble what people with dyslexia here in this threat describe.

</comment><comment><USER43> For me letters rarely move around, but words will move or disappear. Even then though they don't constantly shift, it'll just not be there and then a minute later it's there.

My problem with numbers is that they add themselves together and move around.

So I might see something like:

\- 22

\- 376

\- 4021

As:

\- 242

\- 367

\- 4022

Which makes things like long division impossible or writing out my credit card number in an online checkout take 5-10 minutes

</comment><comment><USER44> On a related note, there are fonts designed to make reading easier for people with dislexia, such as OpenDyslexic.

[https://www.opendyslexic.org/](https://www.opendyslexic.org/)

<comment><USER45> And also famously Comic Sans, though I don't know if there's actual research supporting this popular claim

</comment></comment><comment><USER46> I wonder if tts readers like google assistant's "read it" feature improve this situation.

At least for me, having 2 sources of information greatly increases the degree of comprehension and reduces eye fatigue.

</comment><comment><USER47> Believe or not, I faced that for ~30 minitues after whole day of coding... it's like combining and switching everything, from up and down, left and right without any order...

</comment><comment><USER48> Compounding the frustration with trying to read this page is the sans-serif font, making Is look like Ls, etc. This certainly makes a clear use case for serifs in my head.

<comment><USER11> Funny, I hear so many people assert that serifs are worse for readability, and that this has been 'proven'. It seems unlikely that such a thing could be proven across the entire population, if a decent chunk of those people (including you and me) state a preference for serifs.

</comment></comment><comment><USER49> Previous discussion here [https://news.ycombinator.com/item?id=11218677](https://news.ycombinator.com/item?id=11218677)

</comment><comment><USER50> Previous lengthly discussion (2017):

[https://news.ycombinator.com/item?id=15226676](https://news.ycombinator.com/item?id=15226676)

</comment><comment><USER51> I'm just a very slow reader, have to read word by word.

I'm 35, is there anything to fix that?

I feel kinda bad about it, because I'm a professional writer.

<comment><USER52> I have the same problem and I trying to tackle it bit following a few tricks from speed readers. The main point as far as I can see is to stop your inner voice. You can play classical music while reading (with no lyrics) so that it drowns out your internal voice. Also saying random words to yourself, chew a gum, or counting is used to override your brain from reading back the words in your head. Hope this can help you.

<comment><USER33> > The main point as far as I can see is to stop your inner voice.

I just tried this while reading your comment and... I just can't xD

I'm even listening to music in the background, but my brain just blocks that out the moment I start reading.

<comment><USER52> I know! It's a struggle and it takes a very long time. I'm still practicing too...

</comment></comment></comment></comment><comment><USER53> I've always wondered if that special Dyslexia font on Kindles actually helps. Can anyone in this thread with Dyslexia enlighten me?

</comment><comment><USER54> I am dyslexic. I don't still cannot recall the full alphabet in the right order. Does anyone else have the same issue?

</comment><comment><USER55> i am dyslexic, this is an over exaggeration. most of the time i experience words shifting. the only time i experience single characters shifting is reading numbers. this is why i've tried to train my self to reading numbers in pairs. for instance... i read phone number not as 5-5-5-1-2-1-2, but 55-51-21-2.

</comment><comment><USER56> If I can read this website with relative ease, does that mean that I have dyslexia? :-/

<comment><USER57> I was going to ask similar question. I've read through it and had almost no problems whatsoever. Is it weird or typical?

<comment><USER58> Your brain's like an Intel processor, it's guessing what you are reading. Fast but error-prone.

</comment></comment></comment><comment><USER59> > Wouldn't it be possible to do it i....y on a website with Javascript?

What is that missing word?

<comment><USER59> Oh...interactively.

</comment></comment><comment><USER60> Pro tip: visit the website without JavaScript and cure your dyslexia!

</comment><comment><USER61> Am I the only one that has no major problem reading this?

</comment><comment><USER62> Interesting! I have to admit, I do look at that and think that it is a large exaggeration - however that is acknowledged in other thread here.

On the other side, I suffer from migraines (the ones that give you auras and take you out for days), and the visualisation of the letters changing is exactly how words look when I try and read text during my aura phase. I am going to have to borrow this site to explain to my doctor what I see here, as this is probably the most accurate representation of the effect I have seen. (TL;DR: Thank you!)

Now I need to look away, because the effect is causing my vision to go a little funny! :)

<comment><USER33> I used to have migraines with auras as well; in my case, it started with a blind spot somewhere in my cone of vision that would gradually grow, sometimes even covering my entire field of view except for a very tiny point I was looking at.

The funny thing is, sometimes, I would still be perfectly capable of reading. I didn't see the text, or at least didn't perceive it, but apparently it still reached the parts of my brain responsible for interpreting writing.

If I remember correctly, there's even some people who have this as a permanent condition, that is, are completely blind but can still read text even though they don't even see it.

It's quite weird, honestly, and if it hadn't been for the fear of actual migraine that would follow the aura distracting me, I imagine the experience itself would have been quite uncomfortable on its own.

Another interesting effect was that in the days after a strong migraine, my vision would stay messed up and start to get weirdly distorted whenever I tried reading something, which might be quite similar to what dyslexia feels like, at least for those cases where it's more on the visual side.

I've always found all of this incredibly fascinating, as it goes to show just how complex the human brain is and how it can malfunction and react to internal and external influences.

</comment></comment><comment><USER63> How accurate is this?

</comment><comment> globular-toast I still find it pretty easy to read. I'm quite sceptical about dyslexia. Reading needs practice like anything else.</comment>


Elevating user trust in our API ecosystem - <AUTHOR> https://developers.googleblog.com/2018/10/elevating-user-trust-in-our-api.html <comment><USER2> There's one simple feature I want. Any API that has access to any portion of an email's content should have their icon prominently displayed near the header in the field similar to 'Bcc' indicating that they have been sent a copy.

A click on that icon should display a popup which explains who it is, a link to the privacy policy, date when the Integration was enabled, count of how many emails it has seen, and provides an option to disable the integration with a single click. It would be nice to have the ability to apply filters to limit which emails are shared with that provider in the future.

It's too easy for users to add an Integration at one point and forget months or years later that it's active. But also mentally when people add these add- ons it often doesn't really click exactly that you are literally Bcc'ing the add-on every message you send.

<comment><USER3> I can't upvote this enough.

There is precedence for this kind of UX change and Google. It used to be that chrome extensions could optionally add icons to the Chrome menu (the icons to the right of the address bar). Now all Chrome extensions appear in the Chrome menu, both reminding the user that it is there and also giving an easy way to remove the extension should they no longer need it.

</comment></comment><comment><USER4> Before you shell out $15k-$75k be aware that Google's record of maintaining API's is very bad. They very aggressively deprecate API's with little or no warning and provide zero alternatives. In my opinion, they have very little concern or respect for people developing on their various platforms. Maybe it's not applicable here but I've been burned by them before because of this.

<comment><USER5> When I read the headline, I expected them to address trust related to their lack of API maintenance.

</comment></comment><comment><AUTHOR> Google will require Gmail add-on developers to pass a security assessment:

> Your app will have the remainder of 2019 to complete the assessment.

> The assessment fee is paid by the developer and may range from $15,000 to > $75,000 (or more) depending on the size and complexity of the application.

> This fee is due whether or not your app passes the assessment; the fee > includes a remediation assessment if needed.

<comment><USER6> I imagine that's going to be a pretty bitter pill to swallow for a lot of companies. How do you think they'll continue to police it? What happens in a year's time when than company is sold to someone else, for example?

Personally, I feel like people in general are too quick to hand apps access to their machines. For example, I know a bunch of people who used grammarly, and I said to them at the time - wait, you're basically installing a key-logger that sends your data to a 3rd party - what happens when they lose it?

<comment><USER7> My experience is that many people simply don't care. A friend of mine told me that he uses the Kayak app a lot. He gave them access to all his emails. They scan every incoming email for trip itineraries and push it to his app whenever they find something. I was a bit shocked and asked him if he didn't care that they could read all his emails. He said "no I don't care, there's nothing I'd like to hide and I love the convenience". Well, fair enough I thought.

And then, there's is often nothing I can tell people to make them afraid. Sure, I'd never do such a thing. But because I don't trust the corps, not because I could really articulate what bad could possibly happen in the worst case.

<comment><USER8> I wonder if your friend would object if you asked to browse through his email right then and there, or download it all as an archive to look through later.

I imagine most people wouldn't really want to do that, even if they believed they had nothing to hide and use apps like kayak.

Might be a good way to make a point (or maybe not, but it's interesting to think about).

<comment><USER7> Interesting thought. He would have said no I guess. But maybe the apt question is to ask if he'd hand it to a total stranger running by.

<comment><USER8> Yes that's also a very good question. I think if you combine the two, you get "would you prefer to give email access to your friend or to a random stranger" \- it's actually a tough question for me to answer.

I guess maybe it's like how you're comfortable talking about a medical issue with a doctor you've never met before, but you wouldn't necessarily want to discuss it with friends.

</comment></comment></comment></comment></comment></comment><comment><USER9> Do I understand it correctly that I would have to pay $15k to $75k to release a Gmail Addon?

<comment><USER10> Well, you'd be paying $15K to $75K to Google who then use that money to pay for a 3rd party security assessment of your addon but yes, basically.

</comment></comment><comment><USER11> How does this affect open-source apps? The other day we had a thread about using Emacs as an email client, and I linked to docs on how to get offlineimap to work with XOAUTH2. The Google docs currently say that you can opt in to using apps under development - so in practice, an end user of an open-source app can go to the Google developer console, get a key, and put that in their personal config file - but it sounds like that conflicts with the spirit of these policies. Is that changing?

[https://developers.google.com/gmail/imap/xoauth2-protocol](https://developers.google.com/gmail/imap/xoauth2-protocol)

<comment><USER12> > Applications that only store user data on end-user devices will not need to > complete the full assessment but will need to be verified as non-malicious > software. More information about the assessment will be posted here in > January 2019. Existing Applications (as of this publication date) will have > until the end of 2019 to complete the assessment.

Not clear what "verified as non-malicious" means in this case, w.r.t. cost.

</comment></comment><comment><USER13> Before even delving into API's, why not address the low hanging fruit of getting rid of Google Chrome extensions that harvest your click and traffic data? And selling it to marketers?

<comment><USER14> They are? [https://betanews.com/2018/10/01/google-chrome-web-store- exte...](https://betanews.com/2018/10/01/google-chrome-web-store-extension- security/)

</comment></comment><comment><USER15> There goes unroll/slice intelligence

</comment><comment><USER16> If google trust its users, root account shall be available.</comment>