skysight-inc/HackerNews huggingface dataset:
KYC.

Google almost rabidly doesn't want to connect who is sponsoring with what they're sponsoring.

I'm an ad network that does (some) tracking of users. I make it a point to connect advertisers with the publishers I work with because I know all of my publishers. I think this service has value.

Whilst I charge substantially more than Google does, I'm confident I don't participate in any ad fraud. If a Google rep. suggests they don't serve ad fraud, let me know, because I have proof otherwise.
Yes, that is wrong. You MUST tell your users that you are tracking them, and what the data you collect will be used for.
Yes many. IMO it's not really important if it's already available. "How" is more important than "What".
FlureeDB – A Scalable Blockchain-Based Graph Database
Why would you care about someone official? I'd care more about a bot that is set up to save the officials some work.
> the spread seems to be inflated (as they probably make money with it)

The Order Protection Rule of Regulation NMS makes this illegal (during regular trading hours).
I wasn't aware of the "classic" switch, looks like they added it early last year. They appear to call this "classic confinement mode", and it sounds like it functions essentially like a normal package manager, though they insist on saying it's a "relaxed security model" instead of "no additional security model at all", which appears to be the truth of the matter.

Their site claims that only pre-vetted Snaps can be distributed with "classic confinement", so that's something at least. If that's true, it would allow the comparison between Snaps and the AUR to hold -- Snaps would either be pre-vetted and akin to official package repositories, or unvetted but executed within containers (which is still not really an ironclad security guarantee, but better than nothing).

It is deeply sad to see something that supposedly exists to facilitate and promote a sandboxed distribution model give up and cop out so blatantly though. They should've just named the flag "--make-snaps-worthless-you-should-be-using-apt-instead".

Is there a technical reason to prefer "classic" snaps over packages from the official repos? It seems like the default install path may be different and the libraries/installed files possibly better segmented on the filesystem, but ultimately that's little consolation.
If someone has access to your laptop and downloads their photos onto it, who do those photos belong to?

Good analogy! They belong to the person who took them, as per copyright law, not to the owner of the laptop.
I do not see how that applies to observing people when they have no reasonable expectation of privacy. And when using all these websites I'm pretty sure they put at the top of the ToS that they will be using your information.
A good question. But that’s not how these things work. The law has to be self enforced or it’s useless - since as you say, how will small to medium businesses ever be caught violating?

Megacorps comply because of mega fines.

Small business comply because their owners or future buyers are a larger Corp who fears that their sub-subsidiary might be in violation, causing a future mega fine.

So small businesses who care about the value of their company follow these rules. It’s almost exactly the same reason small business buy software licenses. It’s not of fear of fines but because otherwise they don’t look like a serious company.

I question I have been wondering is how many companies will leave some violations such as data in backups - simply because removing it is too expensive so it’s a risk worth taking. I honestly haven’t understood how backup of data fits into the requirement to delete data of a certain age?
IP and browser information are definitely PII, which is Personally Identifiable Information. Those are PII, because they can be used to personally identify an individual.
Mine were: 1) start with a market you have access to, not with an idea, and listen to what the market asks for; 2) hardware is 5x-10x more expensive than you expect
>Fraud? Malware? What does this have to do with adtech?

A lot, actually. There are many vectors in which adtech and fraud/malware intermingle:

> XSS Attacks:

When your website loads HTML into a page without encoding it first, someone can insert HTML script tags that your browser will parse successfully, allowing arbitrary Javascript to execute in your browser. Malicious actors will then usually redirect you to further unsafe pages that will initiate more downloads or (depending on circumstances) compromise your active user session or credentials. All you need is an ad network that didn't take precautions for a malicious ad and you're serving malware to all downstream users.

>True Clickbait with a malware payload:

Less common nowadays in the sense I mean: Ads that are literally designed for you to click on them, giving the same result as above. We're talking things like "Punch out Osama Bin Laden!" from the early 2000s or "Click here to win a prize!" affairs, where there's no reason a user ought to be clicking on the ad except that they were, quite literally, baited into doing so.

>Normal Clickbait with a malware payload

Create some "interesting content", that just happens to also do all of the above. Miracle cures, "BIG cost savings", poorly vetted porn-ads, and so on. A lot of internet chum is of this type, and there's a great article analyzing it [1]

>Literal Scams:

Many ads presented on websites prey on low information individuals, the elderly, or the young, all of whom are less likely to know any better.

My point is, all of the above is served, with some regularity, over many ad networks today. This means in some sense, many ad networks are responsible for the ads they serve and the damage they cause their users; if not legally, at least morally.

[1] https://www.theawl.com/2015/06/a-complete-taxonomy-of-intern...
I read that as The Morty clothing line and immediately went to the site. Only slightly disappointed.
That seems like a weak argument though. Two humans can also have same name and zipcode. They can also have same personal number and bank account number if they are in different countries. Without tracking and correlation, most information on its own is useless.
IP address alone on an anonymous web access log need not be. Start combining it with persistent cookies or a logged in user etc and it clearly becomes personal data as it is then enough to identify someone.

The clause in the regulation is quite clearly worded:

"Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them."
The author of a creative work doesn't have the right to force me to delete something from my laptop if I obtained it lawfully. If a creator downloads their entire collection onto my laptop I can use that to train my models and target ads as I see fit.
Minimum fine is $20 million, isn’t it?
Website owners can have visibility on their visitors if those visitors explicitly consent to it.

Not sure what is so difficult to understand about this.
Currently, or in relation to GDPR? What's your source?

https://ico.org.uk/media/for-organisations/data-protection-r... (20th Oct 2017):

> Like the DPA, the GDPR applies to ‘personal data’. However, the GDPR’s definition is more detailed and makes it clear that information such as an online identifier – eg an IP address – can be personal data
In my experience, if you stick to highly liquid stocks/options (SPY for example) the bid/ask is a penny and you don’t experience much slippage, less liquid stocks you can end up getting a worse price (0.01-0.02, in my experience)

The amount of capital I actively trade with makes Robinhood a good fit for me, the amount of contracts/shares I trade in an average position would need to gain 1-2% more to get the same profit if I was paying fees (particularly on options)
Right - both Python and Tcl/Tk are intended to offload heavy processing to C functions that they stitch together with high level controls.
5. The HN Commentor. This species carries an inflated sense of self worth and uses many opportunities to tell others. Tends to blame shortcomings on others rather than accepting responsibility for own faults.
All SM64 Levels in One – Battle Royale? [video]
This was hilarious. I’d be cool to have flopstarter come up with 20 projects every day. I’d go to the website every morning just for laughs. Well done.
A lot will just move to finance...

However, financial firms are usually pretty against open academic research that would allow publication of papers. Many researchers truly value the ability to contribute to this field openly. Perhaps you are right and they will move to health.
I hate getting meta, too, and I almost always vote up instead of commenting.

In this case I'm pretty disappointed by the replies I got to my question.
PII is not a GDPR term, by the way.
Is IPv6 only for the Rich? [pdf]
Oddly, I think the article underestimates the size of the change coming. I think one side affect of the surge of IT into advertising, is that it has become easier to measure exactly how well advertising works. By and large, it doesn't, very well.

I am reminded of this, from Paul Graham, about his time at Yahoo: http://www.paulgraham.com/yahoo.html

"...The reason Yahoo didn't care about a technique that extracted the full value of traffic was that advertisers were already overpaying for it. If Yahoo merely extracted the actual value, they'd have made less."

I'm pretty sure that, the more we learn about how well advertising works, the less money people will be willing to pay for it. What's happening to billboards and newspapers right now is probably coming to several other industries soon.
git already supports `git clone --recursive[-submodules] URL`, there's no need to use git-subrepo to achieve the recursive clone.

The problem is the requirement of prior knowledge about the repository's use of submodules. The plain clone won't even report any sort of feedback about the submodules being present and skipped, nor any hint as to how to retrieve them: `git submodule update --init --recursive`.

The presence of git-subrepo and `git clone --recursive` is of little consequence from the perspective of the many users who are now familiar with the ubiquitous `git clone URL`.

Does github tell people to use git-subrepo to clone a given repository? Hell, does github even tell people to add `--recursive` when a repository uses submodules? I haven't checked, but don't recall ever seeing it do so in the past.

These are not difficult technical issues, it's just the sad state of the submodules UX in git. I presume it will improve eventually.
> GDPR do its best to target US companies

Citation needed.
Isn't Transferwise basically just using their accounts in both banks to achieve that, and rebalancing them later (if necessary)? That's not really representative of the performance of the banking system, is it?
Which is certainly fine with me. I'm always amused that the notion that I will regret not having "relevant" ads. Where "relevant" means more likely to get me to buy things I was not intending to buy.

Ads make sense to me in the age of information scarcity. But now if I need a thing, searching always turns up what I want. If I need to figure out what kind of thing to buy, I can read review at places like The Wirecutter. If I want to keep up with what's new in a field, I can follow experts via Twitter, mailing lists, etc. And if I have a problem I don't know how to solve I can talk to friends or use social media.

Please do give me random ads; they're easier for me to entirely ignore.
I'm a bit baffled how you think that recording personal information of people you see from your porch, without even telling them what or why are you doing it, is anything but unethical.
That's their position at the moment. GDPR makes it a bit more explicit: if you can combine the IP address with other information to identify a natural person it becomes personal data.
> Under GDPR guidance, IP addresses are considered personal data because they can be used to identify an individual in a moment in time.

That's actually the most frightening thing I've heard in a long time. Does the GDPR actually make that connection? If so, it literally links people to an IP address, rather than simply a connection.

If that line is accurate, I'm surprised it hasn't been mentioned before, associating an IP address to an specific person. I have to believe you are wrong, otherwise the legal implications are scary.

For those that don't understand: my concern is that in the US, for a long time, in copyright claims by the RIAA or MPAA, for example, was to go after someone because of an IP address, a common defense was basically: An IP Address is not a person. The above commenter made the claim that an IP address alone can be associate a specific person. So, I'm wondering if 1) that's accurate and 2) what are the ramifications of an IP address being a person in the world of law enforcement?
> The author of a creative work doesn't have the right to force me to delete something from my laptop if I obtained it lawfully.

A valid point - the rights only address the USE of the photos. You can use them privately all you want and would not have to delete them (unless ordered by a court for whatever odd legal reason such as if they were stolen not uploaded).

The difference with personal info is that the lawmakers saw two choices: prevent the use or the keeping of the data. They chose to outlaw the keeping of the data - which is why this law is huge, invasive and clumsy. But it’s also the only reason it makes a difference at all imho. I don’t trust anyone to keep the personal data of millions of people safe.
The author of a creative work doesn't have the right to force me to delete something from my laptop if I obtained it lawfully.

Maybe not technically, but in practice, yes. You may be able to keep them, but you can't actually open and view them. As per MAI Systems Corp. v. Peak Computer, Inc., loading something into RAM counts as copying, so you need a license to do that. And even if you had one once, it can be revoked (not all licenses are non-revokable).
Not without being a completely different company. Google earns 90 percent of its revenue from advertising, and the amount they would be able to earn would go down significantly if they weren't able to provide highly granular targeting info to their advertisers.

Saying "the point is, it doesn't have to be" is like saying "Apple doesn't have to be a designed-focused company." True, they don't have to be, but they are, and that is a huge reason they are successful.
That's not true; I can only assume you're reading the 2011-era DPA guidance.

Under GDPR, an IP address must explicitly be considered as personal data, and any processing of them must be written in the documentation of the data processing activities:

https://ico.org.uk/for-organisations/guide-to-the-general-da...

As another commenter has mentioned, this is included in the legislation. There isn't much interpretation to apply here.
> tracking people without their knowledge, approval or a court order is just flat-out wrong.

Requiring them to check an "I agree to be tracked" checkbox and signing an agreement (which has just happened to me yesterday in an EU country in accordance to GDPR) before they can use a product/service is hardly much better. This reminds me of the Android app permission system which requires you to allow an app to do everything it wants (including ridiculous requirements like when a game requires access to your contacts list) or just give up the idea of installing it (as for me I just grant the permissions at the installation time and then block everything redundant with XPrivacy). So I doubt it is going to do much good, a way like the cookie law doesn't really do anything but just introduces useless cookie warning banners.
In Self-Driving-Car Road Test, We Are the Guinea Pigs
Show HN: Radio Paradise Client Made with Elm and Go
I don't get any on my Danish or British phone numbers. Perhaps one per year on the British one.

It would be interesting to know what's different about the systems in the USA, as I don't imagine robocalling Britain would be somehow less profitable except by regulation or technical measures.
Nope, as I mentioned in my other comment: https://news.ycombinator.com/item?id=17060447

Loading into RAM counts as copying, for which you need a license.
I don't quite share the level of optimism the author seems to have, but I hope he's right. If so, good riddance, just a shame it took this long.
He was being facetious.
If you are so baffled by it you can explain in simple terms why it's unethical?
So if I don't think that Walmart should be able to record me with security cameras while I'm in the store I should have the right to demand that they ask me to sign a waiver before entering the store? Shouldn't it be Walmart's right to do what they want on their property, and my right to decide not to visit Walmart if I don't agree with that. Isn't the converse an infringement of Walmart's rights?
Mother’s day: Hollywood moms share the secret to fit body
TrustMessenger, “a chat app that sends every message to your significant other”, sounds funny, but there is actually a market out there for accountability software. In one example, your browser history is sent to a third party (or sponsor) for review.
Isn't what you're saying in your first paragraph just strawmanning the definition of "relevant"? If you do not want to buy anything no matter what they show you then those ads are by definition not relevant. If they make you want to buy then the ads are by definition relevant. They aren't brainwashing you, at the end of the day the one in control of the credit card is still you.
when it worked at 33.6 kbps...
Ask HN: What questions should I ask my “Show HN” users?
Few days ago I was on [HN homepage][0] for a few hours with my https://refjar.com project.
81 users registered an account, 41 bookmarked at least 1 item, 2 users bookmarked 9+ items.

What do you think are the best kind of questions I should ask these people to help me move with refjar into the right direction?

[0]: https://news.ycombinator.com/item?id=16984532
This combined with this reality: https://www.reuters.com/article/us-iran-nuclear-bolton/bolto...

Means map makers will be in business soon. Might not be a bad idea to get some potasium iodide.
> XSS Attacks

Not true with safeframes

The latter two can happen on the internet in general, third-party advertising is in no way a unique delivery vector.
Requiring them to check an "I agree to be tracked" checkbox and signing an agreement (which has just happened to me yesterday in an EU country in accordance to GDPR) before they can use a product/service is hardly much better.

That's specifically not allowed under the GDPR. Either the information is needed to provide the service (and needed means actually needed, not "my business model depends on it"), in which case they don't need to ask, or the use of the service can't depend on that consent.

(By the way, even if the information is needed, they still need consent to use it in other ways, and the same applies)

See the ICO guidelines on the issue: "If you make consent a precondition of a service, it is unlikely to be the most appropriate lawful basis."

https://ico.org.uk/for-organisations/guide-to-the-general-da...
One other fundamental shift that information technology makes to advertising is that digital tools, reviews, and marketplaces somewhat undermine some primary functions of advertising. I no longer care about brand or advertising information when buying commodity products on Amazon; I simply sort by # of reviews * avg score, read a sample of reviews at each star level, and I already have a general picture of the product's quality and consumer satisfaction.

The parts of advertising meant to demonstrate "Hey, we're a quality company that can afford this prestigious advertising slot, therefore the reliability of our products is assured" has been eaten by frictionless digital review platforms. Of course, advertising and branding serve other purposes as well, and will always be some part of the purchasing decision. But social software and AI will likely continue getting better at matching consumers with products over time.
I wonder if there's some way to simulate the row by row image loading. I guess that's not the point of this website, but that would make me feel nostalgic.
How is this related to GDPR or the adtech bubble?
Security, such as analyzing how quickly a form is filled out, or whether the person is coming from a location that is known to be home to a lot of fraud, and other such checks, for example.

Using that data as well to improve learning so we do a better job of detecting fraud and not flagging legitimate customers appropriately.

Also, using analytics to determine if a user is having issues on the site. For example, are users having a difficult time filling out forms, or becoming confused, and being able to provide help in an appropriate manner.

These are just two things I immediately thought of. Security, and customer support. I'm sure there are many other users of analytics aside from ads and ad-tech.
Two "might" occurrences means it's unlikely. The chances are these people will be swallowed by whatever the most profitable industry is at the time.

My guess would be similar learning systems that aren't subject to GDPR, such as government, external to EU (US), the ludicrous information of things (smart sensors, cloud, etc) where information doesn't leave the user's control, AI driven products, etc.

Then you'll have quite a few who will just continue regardless, sometimes it's easier to apologize (and pay a small fine) than it is to ask for permission.

Don't get me wrong, I would love for all of these people to end up in the (Scientific) health industry. (It's worth mentioning Scientific, as there is a lot of useless crap that uses some form of learning and offers no real gain - would be disappointing to see them all end up applying deep learning to homeopathy for example.)
Clicking around a little on the OP site's gallery led me to http://blog.geocities.institute/

and, in particular, to the post on the front page as of today, "9/11 and Vernacular Web" http://blog.geocities.institute/archives/5983, which catalogs Geocities pages updated on 9/11. Pretty haunting.
Someone should point out --- and it should have occurred to me earlier to look into this and point it out myself, and I should catch some flack for that --- that the Trustwave bug is situational, but is reported as if it impacts all Electron applications.

In fact, a good number of Electron apps, including Signal and Slack, are confirmed not vulnerable to this particular bug, despite the misleading way the report was written. (There's another bug being talked about which is adding to the confusion).

The authors of this report should update it to clarify, rather than simply naming the most popular Electron apps as a means of whipping up attention.
PyCon 2018 – Conference Day 2 (May 12)
The Nerds Were Right. Math Makes Life Beautiful
Sorry, but I think this is complete BS. Sundar Pichai was put into an absolute no-win situation with the James Damore issue. While I agree a lot of the reaction to Damore's "manifesto" seemed knee-jerk and groupthink, I absolutely think that anyone with half an ounce of emotional intelligence should have anticipated that reaction, and should have known that writing that as he did would have been completely counter-productive and cause a huge shit show for the company.

Do you honestly believe that if Pichai had kept Damore around that it would have engendered good relationships with "the community"? If so I hate to break to you but "the community" is a lot more than people who think like you.
Making european VC a little more human