Hacker News Reader

EricBurnetton Akamai takes Brian Krebs’ site off its servers after ‘record’ cyberattack

Tangent: orders of magnitude are exponential - if you want to say "half an order if magnitude" you have to do it along the exponential curve. 5x is about 0.7 orders of magnitude; half an order of magnitude is a bit over 3x.

EricBurnetton Google’s become an obsessive stalker

Characterizing all data collection as 'snooping' fits in well with the 'existential threat' narrative, but I don't believe data _collection_ to be the threat you describe. Data misuse certainly is, but there's a distinction that needs to be made there, as I'm not fully convinced that the slippery slope of "collection must lead to misuse" needs to be a universal truth.

Rather, I consider the _collection_ of broad data, carefully used, to be almost pre-requisite to the advancement of our species. Whenever I imagine future technologies they're all based on better use of data. "That car over there has a broken taillight - send them a message." "Pick me a movie I'll be interested in in this moment." Or data mining my personal history to make note of conversation topics I wanted to follow up on; promises I made in the moment.

To some degree, society will (and already has) reset our privacy expectations; not everything we've held as protected need always be, at least in general. What we haven't done yet though is figure out how to enable useful collection and some level of relaxed privacy constraints without opening the door to potential abuse. Which is the risk I think you're worried about - it's not that Google is abusing the data they have _right now_, but that they eventually could, and that you find that risk more compelling than all the value they're delivering now. (Which, to be fair, I cannot say is incorrect). But let's not throw the baby out with the bathwater - I want the promises of the future, and it's just a question of how we can safely get to them :).

EricBurnetton Researchers achieve speech recognition milestone

'Ok Google' is a different problem though - needs to be a low resource, always-on listener with a low false-positive rate. That's quite a different problem space than general speech-to-text.

I think I get about 50% hit rate with 'OK Google' and I'm a native English speaker :).

EricBurnetton AlphaGo beats Lee Sedol again in match 2 of 5

Depends if you want _that_ music that you remember, or are looking for _some_ music that you'll like though. Once you're going into it with no prior values, price popularity and expectation of interest will dominate your choices, at which point computer generated options will be totally viable.

EricBurnetton How much is Spotify paying Google Cloud?

You could guess that, but with no real expectation that it's right either. E.g. for a global service I'd guess it's better viewed as a sum of three offset distributions, one per continent, but even then the individual distributions are unlikely to be gaussian.

Having run global services myself I can tell you that the shape is usually no standard distribution. Peak/trough depends on the exact usage demographics, but the one I have on hand has a trough of ~1/2 peak, and an average of ~3/4.

EricBurnetton Google Will Soon Start Punishing Mobile Sites that Use Annoying App Install Ads

Thanks for the link, that's a nice critique. That said, much of their arguments don't apply here. The article take the publisher's ("businesses") perspective, but that's not consistent with a search engine in this case - the original study is more accurate from the perspective of optimizing for the search user.

The business wants to convert low-value mobile users into high-value app installers, and would happily sacrifice most to get a few installs if that's net positive on long-term value. The search engine, on the other hand, wants as many users as possible to be successful in finding what they're looking for. These perspectives are not aligned - high abandonment rates due to interstitials can be fine for the business, yet penalized as destinations from a search engine. The underlying question is who Google optimizes for in this case, the user or the destination.

EricBurnetton Tech Firm Ubiquiti Suffers $46M Cyberheist

I feel like the banking industry needs to catch up here: in this day and age with digital fraud being easy and getting easier, they should be able to reverse any transfer internationally.

This will fall apart when we get to cashing out downstream, or buying physical goods that are on-demand manufactured/shipped, or stock market trades, but a large percentage should be recoverable in $large cases and (outside of certain sophisticated patterns) the receiver of the money who spent it should be on the hook for the difference.

30m unrecoverable as yet is just silly.

EricBurnetton Bazel – Correct, reproducible, fast builds for everyone

https://news.ycombinator.com/item?id=9257187

If you've got the expertise to add it, sounds like it would be welcomed.

EricBurnetton Google Takes Over Operations of Moffett Airfield from NASA

Here is one particular (opinionated) explanation: http://mobile.nytimes.com/2012/01/02/opinion/krugman-nobody-...

In general, the foreign debt taken on by the US is similar - e.g. bonds issued by various countries, and bought by the citizens and the government as an investment asset.

EricBurnetton Google Takes Over Operations of Moffett Airfield from NASA

I am no expert, but I find it better to look at debts credits together. Debt looks scary, but when other countries owe the US trillions too, it balances out somewhat. The net international investment position is an aggregate measure of how much over-leveraged the country is as a whole, and looks much less stark. This combines government debt with citizen assets, which is good and bad - masks federal policy issues, but also accounts for the artificially low taxes in the US and the impact that has on relative wealth placement.

EricBurnetton Google Takes Over Operations of Moffett Airfield from NASA

Fwiw, US deficit is about 700B. 18T is their foreign debt, which is not terribly meaningful. Net investment position is -4.5T. http://en.m.wikipedia.org/wiki/Net_international_investment_...

EricBurnetton Police Use Department Wish List When Deciding Which Assets to Seize

You can't compare an average 'tax' against the lowest working wage. So I did some rough figuring based on annual income. Assuming forfeiture is spread across all income levels evenly, it would be better to compare against mean income. Looks like (based on 2004 numbers) mean household income was 60,528, mean household size 2.57, for a mean income of 23230 per person. That puts forfeiture ballpark 6%, assuming it all comes from on-the-books assets. So for people working one full time job, about 3 weeks equivalently. Actually pretty close to what you got, I'm sad to see.

Wouldn't want to be living in the us right now, based on those numbers. That sounds like it adds up to a whole lot of corruption.

EricBurnetton Facebook's Top Open Data Problems

I strongly dislike Facebook the product, and to lesser extent Facebook the company, but I'm continually impressed with Facebook's approach to engineering in the open. I find this an interesting dichotomy. Would I want to work there? I still don't think so, but my opinion on that front is getting less strong over time.

EricBurnetton Paramilitary police: Cops or soldiers?

Do juries ever "find innocent" then? My understanding is that innocence is presumed until guilt proven, in which case a jury simply not finding them guilty is sufficient to say they're (legally) innocent.

EricBurnetton EFF adds ASCII art to its DNS

My first thought on seeing that is it would be great for a DNS amplification attack. Not sure the value as an advertisement though...

EricBurnetton How much would $1.50 in 1945 be worth today?

I get the query "$1.50 1945 today" with no answer. What am I supposed to see?

EricBurnetton Did this Tor developer become a victim of NSA's laptop interception program?

All this speculation about what any TLA's may or may not have done seems fruitless to me. If the keyboard seems legitimately suspect, send it to someone to do a teardown or plug it in and capture communications, and find out. That way we'll learn something concrete, and not reinforce this 'NSA of doooooom' crowd mentality.

EricBurnetton Ask HN: Real-world consequences to the NSA of their leaks

Security, not really, in that I don't think anyone but state-supported actors have the resources to tap into them at present. But privacy (from governments local and foreign), yes.

EricBurnetton All tomorrow's crimes: the future of policing looks a lot like good branding

Predictive policing systems seem like they will be very difficult to properly validate. On the one hand, it could go like the drug industry where there are bodies "testing" potential solutions, but the money, incentives, and sheer noise make the results highly suspect. On the other hand, cities and towns may prove to be a good experimentation framework, in the same way that laws are "tested" at the country/state level. I'm curious to see if much useful will come out of this, and how long it will take.

EricBurnetton Ask HN: Real-world consequences to the NSA of their leaks

A few examples:

* Companies like Google and Yahoo will encrypt their internal fibre links, and more of the information crossing internet backbones, making passive information gathering more difficult.

* Funding isn't guaranteed. The NSA hasn't really been impacted yet, but it's definitely possible for their budget to be cut in the wake of the ever-increasing revelations. It'll all come down to what the politicians think will get them the most power, and they'll happily go against the NSA if it will further that cause.

* On a slightly longer timescale, a sustained negative public opinion of the NSA will impact their ability to hire the best people.

The impacts on the NSA may not be as significant as you or I might wish, but they're certainly non-zero.

EricBurnetton NSA infiltrates links to Yahoo, Google data centers worldwide

What proof would satisfy you? It seems like you're asking for something impossible to provide.

EricBurnetton TorSearch launches to be the Google of the hidden internet

The larger internet has the same problem - duplicate content farms, making the "original" of a piece of content hard to discern. It's certainly not a solved problem but by tracking which copy is seen first, using links to imply trust, etc, a reasonable search can still be provided. You'll never have 100% accurate attribution, but that's kinda the point. And when it comes to trusting the search provider, well, how do you choose now beyond seeing consistent result quality?

Agreed trust is a problem with hidden services in general, but I think it's one we'll solve by reframing what it means to 'trust' a site in the first place.

EricBurnetton TorSearch launches to be the Google of the hidden internet

What does this even mean? Which freedom, compromised how, and what makes it unretrievable?

EricBurnetton Facebook Operations Chief Reveals Open Networking Plan

BGP was designed for AS-level routing, but that doesn't mean it can't be adapted to work at a smaller scale. iBGP is for in-network routing (as compliment to eBGP), although I couldn't say whether they are using it directly or a variant.

When you talk about 'slower than a spanning tree', that's presumably for route stabilization. But that's also largely irrelevant - routes would change infrequently enough that extremely fast stabilization isn't especially important (and on a LAN, BGB would still stabilize quite quickly). In comparison, BGP lets you add all sorts of routes to your internal network, and spread load among them without hotspotting. It can handle routes of varying sizes, loops and parallel paths, etc. Spanning trees on the other hand will pick one path from point A to point B, which won't necessarily be the best general solution for a network topology. Say you want to add a 'skip list' of rack-to-rack connections, double up others, and use two parallel DC-level tree networks because you're hitting backbone throughput limits with just one. BGP will be much better able to capitalize on this crazy mesh of connections then simpler protocols like building spanning trees.

EricBurnetton A Note from one of Cloudflare's upstream providers

That's only true to a point. In addition to the consumer-directed packets, large volumes of traffic for Google and Amazon never leave their networks. Shuttling data between datacenters for Google; moving data within the many cloud services of Amazon; or transferring between the two companies (e.g. GCS to S3). This means it's no longer a given that telcos must be larger.

The closer we get to living "in the cloud", the more our traffic can be seen as a window into operations taking place within and between cloud services.

EricBurnetton Chrome for Android working on optimizing page rendering via SPDY proxy servers

> Given user reports and experiences of Google DNS, it seems at least its stated aim is barely satisfied in the general case: it is often slower than local ISP servers.

I don't think the claim is being made that it's better in all cases. As I understand it, Google DNS is (positioned as) a secure, ad-free resolver, and tries to be as fast as possible. In practice if there is a better resolver - say, run by your ISP - for you to use, you should use that. But often ISP resolvers fail in one dimension or another, in which case Google DNS is available as a viable alternative.

Incidentally, to your question of what data is being collected: https://developers.google.com/speed/public-dns/privacy

> Similarly, sticking a proxy between a user and their destination may add more latency than it could ever save, leading me to somewhat doubt the public reason these services exist.

Again, in the general case that might be true. I wouldn't want to use a SPDY proxy on my desktop at home, for example, as it wouldn't be able to offer me any speedup. But it's already known that similar services can provide significant benefits on mobile - look at Opera Mini. Useful feature != beneficial for everyone.

EricBurnetton Chrome for Android working on optimizing page rendering via SPDY proxy servers

The major benefits would come from mitigating the (generally) higher latencies and lower bandwidth of mobile. What gains you'd get on desktop would be countered by the extra hop traffic would require. Overall I doubt desktop users would get much benefit from this feature.

EricBurnetton How to stop Time Warner Cable sucking at Youtube

This could actually be due to DNS, rather than anything particular to that edge-cache/CDN. Resolvers that aren't actually close to you (network-wise) could cause problems like this, or TWC partitioning their network in a way that causes geographically diverse locations to get lumped together, etc. In essence you'd be talking to edge-caches on the wrong edge, so to speak.

To test: try a different DNS resolver, and see if you start getting faster video loads. If you're using TWC's local resolver, try 8.8.8.8 (run by Google); if you're using Google's already try the local resolver and/or OpenDNS (208.67.222.222).

If that does work as well, I'd recommend it over the heavy-handed approach of blocking arbitrary netblocks. Especially since that second netblock listed isn't owned by Google, and so you could be collaterally blocking other content that you still want.

(Disclaimer: I work for Google, but in Ads, not anything network or YouTube related).

EricBurnetton Google’s New Office In Dublin

In case it isn't clear from the article, these pictures are actually from a number of different buildings. They're all together on the street, so it's still one "office", but only some of the pictures are from the newest building. We've been enjoying the rest for a while now :).