Web Performance 101 - <AUTHOR> https://3perf.com/talks/web-perf-101/ <comment><USER2> IMHO instead of going for compressing/minifying/whatever else, it is far better to just _remove the useless cruft in the first place_ \--- and then you can still apply such techniques to whatever is left to squeeze out a bit more improvement. The best way to make your site ultra-responsive is to cut out all the bloat.

Related item: [https://news.ycombinator.com/item?id=10820445](https://news.ycombinator.com/item?id=10820445)

<comment><USER3> This part is like always missing from such presentations. First point always should be remove as much as possible.

<comment><USER4> You're totally right, but unfortunately, I think that's because the person writing these types of presentations don't have control over the content or design of the website, so removing stuff is often impossible or way more work that these tips.

The core holdback for slow websites is usually political, not technical or lack of skill. These presentations usually just try to make the best of those team dynamics issues.

</comment></comment></comment><comment><AUTHOR> So, in summer, I gave an introductory talk into web performance. This is its textual version :)

The talk includes 94 slides with text about:

      — why web performance matters
      — how to optimize:
        — JS (async/defer, code splitting)
        — CSS (the critical CSS approach & tools for it)
        — HTTP/connection stuff (Gzip/Brotli, preloading, CDN)
        — Images (compressing images, webp, progressive vs baseline images)
        — Fonts (the `font-display` trick)
      — and what tools help to understand your app's performance

Would love to hear your feedback :)

<comment><USER5> I'm saddened to not see Closure listed on there for JS minification. It might be worth mentioning that there are more advanced minification tools.

Also, there doesn't seem to be anything on JSON minification, which is a sizable portion of responses. There are techniques to transpose JSON objects to be easier to gzip compress.

<comment><USER6> Google Closure is still best in class at DCE and cross-module motion, but it's never caught on with the larger web community, partly because it applied certain constraints to your Js code that weren't always met. This has changed a bit with modern Closure better able to consume npm modules, but AFAIK, the only heavy non-Google user is still ClojureScript.

</comment></comment></comment><comment><USER7> > Compress your JPG images with the compression level of 70‑80.

In practice some images can get noticeable artifacts even at around 90. Most of JPEG compressors always apply chroma subsampling which is often destructive on its own [1]. On the contrary, many hidpi images can be compressed at around 50.

> Use Progressive JPEG… Thanks to this, a visitor can roughly see what's in > the image way earlier.

That's not the point of using progressive JPEGs nowadays. The 10-200% decompression slowdown is for the 5-15% size reduction.

> Use Interlaced PNG.

Don't. Interlaced PNGs can easily be 1/3 bigger. There are better ways to show loading images, and it's already used on the website.

> webpack has image-webpack-loader which runs on every build and does pretty > much every optimization from above. Its default settings are OK

> For you need to optimize an image once and forever, there're apps like > ImageOptim and sites like TinyPNG.

These tools are no good for _automatic_ lossy image compression [1]. The default is mostly JPEG 4:2:0 at quality 75, PNG quantized with pngquant at settings as low as conscience allows, missing out many PNG reductions and optimal deflate, no separation between lossy and lossless WebP if at all, etc.

As a result, the images on the website have about 13-24% more to optimize losslessly.

[1] [https://getoptimage.com/benchmark](https://getoptimage.com/benchmark)

<comment><USER8> > _These tools are no good for automatic lossy image compression_

The self-promotion didn't bother me until this claim, because you posted some great advice along with it.

ImageOptim is great. If you choose "lossy minification" it does automatic lossy image compression, preserving perceptual image quality while making huge reductions to file sizes. Users can even adjust how aggressive it is.

I'll take your word for it that I could get 13-24% smaller file sizes with your Optimage product on top of the 80% (or whatever) that I can get with ImageOptim. But I'd prefer that you didn't claim that other choices are "no good".

<comment><USER7> I specifically meant _automatic_ lossy compression with predictable visual quality. If ImageOptim could actually achieve it (automatically), that would save me and others an awful lot of time. But as it turns out it is not that easy.

Some very smart people at Google go to the trouble of creating projects like Guetzli. I personally have spent months on this, and it gets me every time someone claims "just use that one tool" without any evidence. I presented mine and it's reproducible.

ImageOptim is a great tool otherwise.

</comment></comment></comment><comment><USER9> Based on my first scan, I've bookmarked this for the next time I have a perf issue on a site.

One thing I didn't notice is that one of the biggest speedups is removing _junk_ from the pages. That could be too many JS trackers, user-hostile videos, or whatever. IMHO it's an underrated skill for Web developers to be able to push back with cogent arguments when asked to ruin the performance of the sites they work on.

<comment><USER10> Why? Most trackers load async and don't block the page from loading or rendering. I get it's popular to hate but technically they load without blocking page from rendering. A good read is [https://sites.google.com/a/webpagetest.org/docs/using- webpag...](https://sites.google.com/a/webpagetest.org/docs/using- webpagetest/metrics/speed-index)

<comment><USER11> Even just one poorly designed library can cause serious memory issues and trigger a ton of events. Usually it's the marketing and ad people that throw around this "but they are async loaded". That's true, but doesn't change the the fact that 40 trackers and their dependencies that come with it are slowing down and infringing on the users privacy. Let's be real.

<comment><USER10> Can you share an example site with 40 trackers? I believe you but it just doesn't seem common place.

<comment><USER9> There has been a lot written about this, but here's a test I just ran on a random page on Huffington Post:

[https://www.webpagetest.org/result/181031_TT_443f9d1e666d08f...](https://www.webpagetest.org/result/181031_TT_443f9d1e666d08f708e1f78c5811ee5f/1/details/#waterfall_view_step1)

The article is probably <200 words, but the page is 3.2 MB and makes > 200 requests. There are 55 Javascript requests in there.

Right, HuffPo is egregious. How about a site HN readers might frequent, something lightweight like Reddit?

[https://www.webpagetest.org/result/181031_H6_eaa2e64c9969515...](https://www.webpagetest.org/result/181031_H6_eaa2e64c99695156cd97c10867680cfb/)

Random Reddit page, content: medium-sized image. 164 requests, ~12 seconds to render the page on the test rig. 60 Javascript requests. 1.5 MB of JS downloaded to display the post, a 46kb image. There's a 30:1 ratio of JS to post content (what the user wanted to see) here. And there's other bloat beyond the JS.

I just picked these two sites at random. You can do this all day with random websites. I would guess that most sites behind a .com (or .co.uk, etc.) will look similar.

I don't mean to pick on these sites, just wanted to point out that these practices are widespread and even reputable developers engage in them. Which will make it more difficult to undo the rot.

<comment><USER10> I see there is a lot of JavaScript but are you certain that is JavaScript with the sole purpose of tracking or application code? I'm not gonna say these sites could not be implemented better but the claim was these are all tracking pixels. Is that true?

<comment><USER9> You're parsing this too narrowly. I'm not making a claim about the purpose of each request. I'm looking at the totality and saying that maybe making 200 requests to display 200 words of content is overkill.

The larger claim was that the pages are loaded with junk that affects the performance of the pages. The signal:noise ratio on modern sites is broken, and optimizing the junk can only accomplish so much. Developers need to advise stakeholders of the downside costs, performance among them, of loading sites with bloat.

Here's an article I read a while back on the impact of specifically Javascript:

[https://medium.com/@addyosmani/the-cost-of-javascript- in-201...](https://medium.com/@addyosmani/the-cost-of-javascript- in-2018-7d8950fbb5d4)

<comment><USER10> I agree but if you look at the parent response claimed 40+ tracking scripts, I just don't see 40 tracking scripts I see a website using probably too many scripts to implement functionality but I can't claim to know they can do it with less scripts - I can only assume and that is what the website posted in the original document talks about how to optimize... hence async and trackers not blocking comment was correct

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Good document! I wanted to mention, something I've found to be significant in practical testing but often not considered by web developers is reducing the total number of HTTP queries. It seems like fetching 5 CSS files of 5kb each will significantly slow things down compared to combining them into one 25kb CSS file.

<comment><USER13> Http/2 makes this less important. Perhaps still worth it for CSS, but higher effort things like image spriting might not be as attractive now.

<comment><USER14> Yes -- in fact some webperf techniques are HTTP/1.1 - specific, and are actually _anti-patterns_ in HTTP/2\. Spriting is one such example.

<comment><USER14> Domain sharding is another.

</comment></comment></comment></comment><comment><USER15> I know i'm kinda self-promoting here, but since you mention webpack loaders like responsive-loader, and you recommend image-webpack-loader multiple times, I figured I could mention my plugin imagemin-webpack-plugin [0]

The problem with image-webpack-loader is that it only works on images which are `require`d or `import`ed. responsive-loader adds those images to webpack in a way that the loader cannot compress them.

Plus there are a bunch of other fany features that many helpful users have added like caching (no need to re-compress every image every time you run it!), the ability to minify images not in the webpack pipeline, and more.

[0] [https://github.com/Klathmon/imagemin-webpack- plugin](https://github.com/Klathmon/imagemin-webpack-plugin)

</comment><comment><USER16> I've found the server PageSpeed module (in my case for Nginx) does a lot of good things "on the fly".

<comment><USER17> This is the correct way to do a lot of it. For instance, images. Yes you could optimise the things in Photoshop but actually you want your artworkers to be doing the images right, so they look good and tell the story. Optimising the images is something that should be abstracted out, so on your dev version of the site everything is in 100% glorious, maybe even phone-res megapixels.

Then, abstracted out with PageSpeed you can deliver the webp when you need to and also the source set images so every device has the right size images that update themselves automagically if people zoom in.

Same with minification, why have complex build tools when you can just have PageSpeed do it properly?

You can also have beautiful HTML for view source by putting on the right PageSpeed filters.

The list goes on, apart from the results it also does the abstraction bit, so artworkers can do their Photoshop stuff unencumbered, same for frontend and backend devs.

The thing about it though is that you need to understand a mix of different things that are nowadays split up into different job roles of ever increasing specialisation. A Photoshop person isn't going to go all command line on the server for the perfect PageSpeed Nginx setup, neither is a CSS person, a UX expert, a JS expert or a backend expert. Not even the guy who keeps the site online is going to typically step up to using Pagespeed for the benefit of the team. Pagespeed just doesn't fit into one of these niche-jobs so it is more likely to be found on smaller one-person efforts where there aren't the organisational hurdles in the way.

<comment><USER18> No you need your artworkers to do it right it the flipping first place and not place excessive load on your live environment - or make the live environment more complex than it needs to be.

</comment></comment></comment><comment><USER19> Careful with GZip and SSL, though - your payloads become vulnerable to the BREACH attack.

<comment><USER20> I've seen that. My understanding is that you can compress CSS, images, pretty much anything that does not require a secret. So if your sending a secret to get an image, I think you're doing something wrong. If you keep the secret in a cookie, or transfer it in a header rather than a body, you should be clear to use Gzip and HTTP compression.

</comment></comment><comment><USER21> I would have liked to have seen more on HTTP/2</comment>


Imprisoned CIA Torture Whistleblower John Kiriakou Pens "Letter from Loretto" - <AUTHOR> http://dissenter.firedoglake.com/2013/05/29/imprisoned-cia-torture-whistleblower-john-kiriakou-pens-letter-from-loretto/

<comment><USER2> So much of whats wrong with the US pops up in one persons experiences.</comment>


Most cryptocurrencies will crash to zero, Goldman Sachs says - <AUTHOR> https://www.cnbc.com/amp/2018/02/07/most-cryptocurrencies-will-crash-to-zero-goldman-sachs-says.html <comment><USER2> Have said it before but CNBC seemingly loves to rag cryptocurrency. Their tweets end up retweeted on my stream and they always have a slant. Unfortunately their @CNBCFastMoney account has 2.2 million followers. Easy to understand if newer entrants to cryptocurrency see surface content like that and panic. It's nonstop.</comment>


Show HN: YouTube Audio Player - <AUTHOR> http://www.gtaero.net/ytmusic/?q=http%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DvW_cPvMJy9U&s=on&psize=m&a=on&loop=on&hd=on

<comment><USER2> Cool I find this somewhat useful at work.</comment>


Posterous Growing At More Than 700 Percent a Year - <AUTHOR> http://techcrunch.com/2010/07/05/posterous-700-percent/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Techcrunch+%28TechCrunch%29&utm_content=Google+International <comment><USER2> The headline, of course, is pretty meaningless.

If I had one user yesterday and two today, I'm growing at a rate of approximately 2^365/100 = 7.5e105 percent per year, but that's still nothing to brag about.

</comment><comment><USER3> Headline may be meaningless out of context, but when t+1 = 2.5 million users, it's a pretty valid figure I think!

I am SUPER impressed with what Posterous has done recently and eagerly look forward to their innovations! I went to reactivate my old, dormant Tumblr a month ago and, in the process, thought to switch to Posterous because it fulfilled my desires better; I was really impressed with how it has changed since I last looked into it.</comment>


Ask YC: When do you incorporate? - <AUTHOR>

Hi YC, so I'm in the process of building a prototype of an idea I've had and I need to purchase some equipment to do this - probably about $3000 worth.  Is it better to just use my own personal funds to do this as an individual or is there a significant benefit to incorporating?  What state would you incorporate in as a software startup?  I was thinking about MA, but CA and Delaware seem popular too - what do you think? <comment><USER2> If you're just prototyping something for yourself I'm not sure it matters. The major reasons to be a corporation are:

* You have assets that you want to shield from liability when your customers sue you -- you'd rather have them sue the corporation instead. But, no customers yet = no problem yet. Assuming that your new idea doesn't involve radioactivity or anything.

* You want to give away shares in your new business to angel investors, VCs, or partners. No investors = no problem.

In any case, if you really think you want to form a corp you should talk to an accountant, and possibly a lawyer, about the details.

</comment><comment><USER3> I incorporated my last startup when someone offered to buy it. This is probably slightly too late, but I think you should delay it as long as possible.

If you need an entity for tax purposes, a sole proprietorship or LLP works fine.

</comment><comment><USER4> If you're going to take investment form a C-Corporation. If you're not going to take investment right away (or ever) elect S-Corporation status.

It's a hassle to sell "shares" of an LLC to investors for capital, so I wouldn't bother because it the possibility is left open with a C-Corporation or S-Corporation.

Being a sole-proprietor or partnership doesn't limit your liability and investment doesn't really apply to either, so they're right out at the start.

And if you're just making something for yourself then there's no need for any of this.

</comment><comment><USER5> I incorporated right away so that I could write off big chunks of my day-to- day expenses. I write off a big chunk of my rent and most of my meals that I go out to eat.

<comment><USER6> Has an accountant blessed the idea of writing off your meals? You may be setting yourself up for an audit at some point where you have to explain how exactly that meal was business related.

<comment><USER7> True. You have to track your receipts also, and it might even be a good idea to have the corporation "reimburse" you for the computer through company funds. I hear you also have to be very careful with the home office deduction, because it's a major red flag for auditors.

</comment></comment></comment><comment><USER8> When do you incorporate?

      As soon as you have to share (with investors or partners)

      or to protect assets.

</comment><comment><USER9> Once you incorporate, you then transfer some personal money to the Corp. as either Owner's Equity or a loan and pay your expenses out of that.

</comment><comment><USER10> You can write off purchases before you incorporate (as a sole proprietorship), if that's what you're asking. Incorporate if you need liability protection or if you're going to take investment. I typically do that right away if it's a project I'm serious about... why not?

</comment><comment><USER11> If you're going to take an investment, you should consider Delaware C Corp.

</comment><comment><USER4> Do you really need the equipment?

</comment><comment><USER12> if u r going to apply to YC (or anyother YC clones) then they suggest/prefer not to inc. this is b'cause they (YC) help you with all these formalities in the best possible way - they have lawyers lined-up to help you.

But if u want to write-off ur expenses then its better u meet an accountant, most possibly he/she will suggest to inc.</comment>


Uber's Long Road into Las Vegas - <AUTHOR> http://www.buzzfeed.com/johanabhuiyan/sex-drugs-and-transportation <comment><USER2> A couple points:

* Uber won't be much cheaper than a taxi in Las Vegas. If you look through their published fare rates, you can see that a 17 minute trip from Mandalay Bay to Fremont Street costs ~$24 with Uber and ~$25 with a taxi [1]. Add in surge pricing and an Uber could cost much more than a taxi. You don't have to deal with the taxi cartel experience, which is a major difference. But you don't win on price like in other markets.

* I posted this yesterday, but earlier this week Uber secretly threw a massive party in Las Vegas for its employees [2]. I suspect Uber did this for political goodwill with the casinos, as a thank you letter for allowing Uber on the strip.

I heard a rumor that several Uber employees were fired for talking to the dailymail about the party.

[1] [http://www.reviewjournal.com/news/traffic- transportation/ube...](http://www.reviewjournal.com/news/traffic- transportation/uber-lyft-applications-show-fees-typical-rides)

[2] [http://www.dailymail.co.uk/news/article-3256259/Luxury- hotel...](http://www.dailymail.co.uk/news/article-3256259/Luxury-hotels-night- partying-posh-clubs-endless-freebies-Uber-hosts-SECRET-Sin-City-team-building- junket-4-800-employees-world-no-drivers-please.html)

<comment><USER3> Wasn't the consensus that cabs constantly try to rip off people in LV, so u need to factor at least an extra 50% "surcharge" on top of that posted price?

</comment></comment><comment><USER4> FWIW I'm in Vegas right now using exclusively Uber and every driver I've talked to has been ecstatic. One even told me about how his first ride this morning was a cab driver getting a haircut, who prefers uber to cabs.

<comment><USER5> If that story is true and the cab driver really preferred Uber to cabs, why didn't he become a Uber driver?.

<comment><USER4> Well I heard the story second hand so I don't really know, but given that the guy needed a ride to get a haircut, I suspect he doesn't own his own car (and therefore can't Uber).

</comment></comment></comment><comment><USER6> As a foreigner who has to visit LV for tradeshows sometimes, if this news means that I won't have to endure a 45-minute wait in line just to get a cab, I'm all for it.

<comment><USER7> They should finish the monorail to the airport. I'm sure the reason that it hasn't been finished is all politics.

</comment></comment><comment><USER8> Do any of the guys at the top see flack from this? All I can wonder at this point.

At this point I want to edit and add that I love using Uber. It's a rare 100% happiness factor to get but with me I got lucky and they nailed it. I just have to know: can the bosses actually make these decisions and not earn lawsuits in each state or are they handling this in a way that makes them personally immune? It's truly fascinating to see this brazen...ness? Definitely ballsy.

</comment><comment><USER9> It isn't explicitly discussed in the article, but Uber is also now operating in Reno/N. Nevada.</comment>


"Old age" is made up–and this concept is hurting everyone - <AUTHOR> https://www.technologyreview.com/s/614155/old-age-is-made-upand-this-concept-is-hurting-everyone/ <comment><USER2> This is a complex topic with many (not-so-related) facets.

From the employment perspective, there certainly are some companies where the benefits a more senior/experienced employee provide are wasted or ignored. In those cases, it makes sense for the company to replace the older worker with younger (cheaper and less opinionated) employee. Granted, I'm on the older side, so I'm not being ageist here.

From a consumer/user perspective, it's more about understanding your user than their age specifically. But generally speaking, much older users have very different backgrounds and experiences; thus, their approach to using things may be considerably different from that of a younger person. That said, most user interfaces and product features probably don't fit any userbase well. So in a way, the sea of bad interfaces isn't ageist - it's just bad UX.

<comment><USER3> You managed to take an article about ageism and somehow transform it into a UX problem because that's the prism you wanted to see the world through.

Wow, that's really something else. You see this a lot on HN but this comment is really just breathtaking in the leaps it takes.

<comment><USER2> Subtitle of article: Products designed for older people reinforce a bogus image of them as passive and feeble.

And elsewhere in the article: Half of older longtime job holders, meanwhile, are pushed out of their jobs before they planned to retire.

<comment><USER4> The fact that you so simply replied to that misguided comment with information rather than its much-deserved counter-attack really shows your age. Thank you.

</comment></comment></comment></comment><comment><USER5> Life expectancy past 65 is not, in fact, increasing at nearly the rate of overall life expectancy, which is mainly driven by reduced infant and child mortality. This data is from the UK, not the US, but the curves are similar. In the last 30 years life expectancy for women who reach age 65 has increased only by about 4 years. People are living a few years longer than a generation ago, but not that many. [https://www.nuffieldtrust.org.uk/public/news- item/are-we-too...](https://www.nuffieldtrust.org.uk/public/news-item/are-we- too-complacent-about-life-expectancy)

</comment><comment><USER6> > And don't try to tell me the real issue is that older people aren't tech > savvy. Maybe that stereotype once contained a grain of truth—in 2000, just > 14% of 65-plus America used the internet—but it's no longer the case. Today, > 73% of the 65-plus population is online, and half own smartphones.

This is interesting to me, as while it certainly is true it doesn't come close to saying what the author is trying to make it say imo. Yeah my grandparents have smartphones, I still wouldn't call them tech savvy.

I work as one of a small team of developers in a rather old (demographically) vocational company, and while our team doesn't do IT work per se, all the employees over 50 can't tell the difference between the Dev team and IT support. They have no clue, and explaining it to them is impossible. Further, it's a constant pain point for me working with older people on software related issues, especially when it comes to user interface details. Management is constantly pushing for interfaces to be as plain, simple, and stupid as possible to ensure that all employees can use internal tools without needing assistance.

Older people today do engage with technology but that doesn't make them "tech savvy" and in my opinion they probably never will be. Subsequent generations (mine being one of the first) had the benefit of being introduced to computers at a very young age so to us it's as natural as riding bike or making grilled cheese. I think that, no matter what we try to do, there's no way to make older generations be "tech savvy" because they were deprived of that early exposure.

I think older people absolutely do have a desire to be tech savvy, I just don't see how we get there. I've thought about this often but I don't know what the solution is. Overall great article, and I'm probably a lot dumber than anyone who works at MIT AgeLabs so my opinion probably should be taken with a grain of salt

<comment><USER7> I think that many people you seem to think are tech savvy are really not. I'm 51 and I've been programming since 13, getting paid for it since around 20 years old. My kids are 21 and 19, they both use smartphones, so do my wife and I, I just picked up a OnePlus 7 Pro 5G.

My kids know how to use the latest social media apps sure, but they don't know how anything behind that phone and computer work at all. I can write Android apps all day long but they wouldn't even know where to start.

I had to teach my son how to punch a hole through the firewall to run a Minecraft server for his friends 5 or 6 years ago. After watching me build a few computers, he has now built his own top of the line rig. But he didn't just "know" that stuff because he's young, he had to have an interest and learn, from an old dude no less. It's just like people that drive cars, most of them do not know how cars work but they can still drive. I can also take a car apart and put it back together. I can do a ton of other technical things as well. It's not age, but interest in my opinion, that makes a person tech savvy.

Please don't lump all people over 50 together. Many of us designed and built the tech that you are so proud of now. We stood on the shoulders of giants and so do you. Your time is coming as and "old person." Always remember that.

<comment><USER8> Also, there is a real aspect of "old age," where cognitive function declines, taking savvy with it. It might be known as "dementia" or "senility" when it is very advanced, but subtle changes can happen for years or decades prior for some people. It's been painful watching an ~80 year old relative---definitely tech savvy for most of his life---as he slowly loses his upper-hand on his own technology.

This is someone who worked on radar systems, cryptographic systems, computers, power electronics, control systems, and measurement systems in the military and civilian worlds from the 1960s to early 2000s. He built his own kit electronics for home audio and later a ZX-80 computer. He followed the whole PC revolution from the CP/M and DOS days to Windows 7. He participated in BBS systems in the 1980s and used the Internet since around 1991. He exposed his children and friends to science and tech.

He followed countless changes from minicomputers and teletypes, to PCs with CRTs and text CLIs, to window-based GUIs. Then, he started to struggle with the abstractions of these same GUIs as well as web sites. He struggles to identify the boundaries between different programs and content, like some novice user who never understood how it was all put together. Worse, he is aware of this struggle and of his losses. I can see that it frustrates him daily. Once in a while, I'd say it terrifies him.

<comment><USER9> The longer you live the more likely something will go wrong. That is true but at the same time not all that interesting.

Similar problems come up with very young people. Not only can dementia itself exhibit itself in the young, but people can become tuned out to anything outside their interests and expertise and lose interest in learning through play and experimentation. When this happens people become locked in their modes and may not move forward.

To add some anecdata I know people who were prolific programmers with perl CGI scripts but were never able to make the jump to modern application programming, not even the relatively easy transition to "modern perl". At the same time I know some older programmers who have contributed to modern apps while working on both embedded devices and machine learning and love being at the forward edge of everything.

There are many aspects to work in technology and age is a minor factor especially compared to attitude and interest. This reminds me of how Victor Frankl describes in Man's Search for Meaning that people expected the strong and healthy to endure life in concentration camps and yet many died within days while some who were weak and sick endured because they had something that kept them going through the greatest challenges. Age and experience are factors, but it is how they are framed and leveraged that actually matters.</comment></comment></comment></comment>


Old Thinking Permeates Major Journalism School - <AUTHOR> http://www.pbs.org/mediashift/2008/09/embedded_at_nyuold_thinking_pe.html <comment><USER2> Summary: In this article, a Mashable writer newly arrived at NYU journalism school bemoans old-thinking in her professors and classmates.

Highlight: The comments are full of responses from established journalists, who point out that her "work" for Mashable is largely just copy-pasting press releases and lifting images from other sites.

The writer is really confused as to why she's the only student in her class actively blogging somewhere.

The answers pretty simple, why write for free when you aim to get paid to do it? That's the prevailing opinion among journalists. There's really no equivalent to open source among journalists.

<comment><USER3> Blogging is still largely unprofessional.

I like that, to some degree. I like how informal blogs can get. But very few bloggers are also good writers.

</comment></comment><comment><USER4> This article is depressing. Particularly:

 _Every single journalism class at NYU has required me to bring the bulky [New York Times] newspaper._

This quote gives me visions of the Toy Story "Squeeze Toy Aliens", each with a newspaper in their hands, waiting for a NYT Senior Editor to come down from the sky and take one lucky student to a better place.

This article is obviously working a specific perspective and could be projecting quite a bit of personal experience / opinion into things, but it speaks volumes about the situation the paper media finds itself in.

<comment><USER2> I think that's exactly how most students at journalism schools think. I went to grad school with about 200 smart, young, clever, enterprising people, and to the best of my knowledge, I'm the only one of them who's trying to do his own thing after graduation. Many reporters are all about being "enterprising" until it comes to who they work for, then they're happy to collect a paycheck and work for the advertising guys in the back room who make more than them.

</comment></comment><comment><USER5> I'm interested in seeing how journalism schools approach the unfolding Palin Yahoo! e-mail account hacking story.

This could be a big story, it's happening right now, and it likely won't be talked about. After all, it was just some hacker, not a serious journalist.

<comment><USER2> I don't follow your logic. What the hacker did wasn't journalism, it was breaking the law. Why compare the hacker to a journalist?</comment></comment>


CloudMedx (YC W15) Helps Doctors Spot Patients Who Will Need Expensive Treatment - <AUTHOR> http://techcrunch.com/2015/02/17/yc-backed-cloudmedx-helps-doctors-spot-patients-who-will-need-expensive-treatment/

<comment><USER2> tashfeens, I'm always skeptical about healthcare startups. A few questions: How accurate are your predictions, and how do you assess accuracy? (Do you have any prospective studies?) How is this better than the nanny reminders in current EMRs such as Epic? How does your platform deal with missing data when a chunk of a patient's visits are not transmitted to your platform?

Does the software parse free text, depend on someone taking the time to curate a list of "problems" or "diagnoses", or just look at lab values? What is the explanation given by the software when it makes a recommendation, other than deference to a statistical model?

Why would I, a physician, want to spend time or money on this rather than depend on my own sensibilities and training? (I am not going to watch the demo video on your website because I will not agree to an NDA.)

<comment><USER3> I'm not tashfeens, but given that you have a CS degree and an MD, I'd be curious as to what makes you skeptical about healthcare startups. Or, conversely, what should a healthcare startup do to earn the respect of you and your colleagues?

<comment><USER2> Overall, make a case to truly be worth the time and effort.

Anything that second guesses my clinical judgment, and/or requires extra paperwork to do so, had better be able to show its justification in an intelligent manner. There is a lot involved in evaluating a patient that is not encoded in machine-readable form, so some percentage of things software reports is going to be wrong or pointless. (Trivial example: The K is 3.4. Is the patient hypokalemic?) The time spent ignoring nuisance notices may render the whole thing useless, even if there is useful information somewhere.

Have practicing physicians intimately involved in the UI design process, so the resulting product is usable to physicians and actually saves time. Billing software in disguise such as Epic has a terrible user experience and could be so much better.

There's more, but I have to head to work...

<comment><USER3> Thank you! That's helpful. If you'd ever like to talk further feel free to email me (email on my profile).

<comment><USER4> I can probably echo some similar thoughts that we heard when we talked with providers. I'm not tashfeens nor do I work for his company, but I run Varsa Health, a data analytics company for behavioral health providers. We "earned" the respect of clinicians to a certain degree by spending a lot of time (months) learning about their workflow before we started even writing code. My co-founder used to work on similar work in a research setting, so user experience was particularly important to us. I noticed you were working on Healthcare.gov - that's a massive undertaking and kudos to you for having the civic duty to help clean up the mess that it was. Would love to chat further about some of our lessons learned and share our experiences.

[https://varsahealth.com/](https://varsahealth.com/)

</comment></comment></comment></comment></comment><comment><USER5> Spot expensive patients so they can be denied and reap more profit.

<comment><AUTHOR> Thanks for your comment. The platform helps identify the high risk patients so that physicians can spend more time and effort on providing better care and coordination to improve their outcomes. A majority of heatlhcare utilization is being consumed by high risk patients due to redundancies, gaps in care, lack of data sharing. We are addressing those concerns by using insightful and actionable analytics. So that the financial burden is not felt by the patients :).

<comment><USER5> No problem.

</comment></comment></comment><comment><USER4> From one healthcare entrepreneur to another, congrats. It's difficult to clear that hurdle, especially with the two-sided approach of doctors and patients. What's been your biggest challenge with patient adherence / engagement?

<comment><AUTHOR> We got patients engaged through an app delivery method that integrates a few key features of messages and engagement. Would be happy to connect with you and discuss more :)..

<comment><USER4> Would love to hear some of your thoughts, especially since engagement tends to be an issue we've seen with patient-facing apps after a period of a few months. We're exploring what levels of engagement tend to work best with patients, especially as the length between provider visits increases. I'll be sending you an email and would love to discuss more / share some of our insights.

</comment></comment></comment><comment><AUTHOR> I'm one of the co-founders of CloudMedx. I wanted to thank all the people who commented. Its certainly very encouraging.

The premise of the company is to help organizations identify the high risk patients so that their physicians can spend more time and effort on providing better care and coordination. We are addressing this by using insightful and actionable data. The physicians and organizations that are using our system are making efforts to make costs more manageable for patients.

Our algorithms help predict readmission rates, comorbidity, and financial outcomes using evidence backed data and statistics from renowned institutions. In the end, we are not looking to remove physicians from the equation, nor are we replacing EMRs. Rather we are augmenting both with our actionable insights. When healthcare organizations are managing an entire population health, it provides opportunities for errors or sometimes even gaps in care. This is where we are looking to improve the process for physician organizations and hospital groups.

I hope these comments were useful. And I would love to talk to you individually. Please write to me and we can further discuss this in detail and talk about opportunities in this space.

Best, Tashfeen CEO CloudMedx

</comment><comment><USER6> Congrats! As an healthcare entrepreneur I appreciate the hurdles and challenges of this space. I run AsthmaMD [1]

Our app and hardware is distributed in every 15000 CVS and Walgreens in US.

I'd be happy to meet and discuss any opportunities for partnership.

1: [http://www.AsthmaMD.org](http://www.AsthmaMD.org)

<comment><USER7> This is very interesting. As a med student with a programming and CS background, these efforts are particularly appealing to me. It seems that (polling healthcare workers, mainly docs) technology (EMR) is more of a hindrance than a benefit, which to me has always seemed like poor design, gamblers fallacy + overwhelming costs associated with changing software in a large hospital. I don't see how this can change unless there are standard protocols that allow for flexible data entry and analysis. The problem I see with this new system is that it doesn't (at the surface) appear to offer anything new, whereas asthamMD is creating objective data and a unique pipeline between healthcare teams and patient. It seems like we are just waiting for some software revolution that actually saves doctor time and improves patient outcomes - rather than generate data for administrators and bureaucrats at the cost of inefficiency.

</comment></comment><comment><USER8> That's one ugly EKG in the logo...</comment>


The Public Voice of Women (2014) - <AUTHOR> http://www.lrb.co.uk/v36/n06/mary-beard/the-public-voice-of-women/ <comment> guard-of-terra We were talking about this just the other day.

"Occasionally women could legitimately rise up to speak – to defend their homes, their children, their husbands or the interests of other women"

To this day, writers struggle to find internal motivation for their female characters. Usually an active women character will be fleeing from danger or recovering what's hers.

Meanwhile male character doesn't need to justify his ambition. He just want to conquer, and he's going to.

<comment><AUTHOR> _" To this day, writers struggle to find internal motivation for their female characters. Usually an active women character will be fleeing from danger or recovering what's hers."_

Read _" Hunger Games"_ by Suzanne Collins.

</comment></comment><comment><USER2> What a cool article, tracking the lineage of silencing women!

Its eye-openingly interesting to observe how often the men in meetings speak compared to the women. Sometimes its quite surprising, particularly in meetings that have a majority of women in them!

</comment><comment><USER3> This is an incredible piece. Very well-written and fascinating.</comment>


The coal industry is sick – and it's terminal - <AUTHOR> https://www.axios.com/draft-coal-stuff-2293205721.html?utm_source=newsletter&utm_medium=email&utm_campaign=newsletter_axiosam <comment><USER2> Sure, but isn't 1/3 of coal mined in the US for non-energy use? A huge amount of chemicals are derived from coal.

<comment> rm_-rf_slash I don't know about that 1/3 figure but I do know it's getting easier and easier to produce complex hydrocarbons through organic processes like genetically engineered algae. The costs may be high now but for some high- margin products such as cosmetics, algae hydrocarbons are already profitable.

And this is something that could conceivably work anywhere, without having to buy a mountain and several tons of mining equipment first.</comment></comment>


Ask HN: How should you manage a Machine Learning team? - <AUTHOR> As a manager, how should you manage a group of machine learning engineers? <comment><USER2> The same way you'd manage any other group of engineers. Which depends a lot on company context, team composition, personalities, and goals.

This is a really vague question.</comment>


Comcast injecting JS - <AUTHOR> https://gist.github.com/ryankearney/4146814 <comment><USER2> I thought this code looked familiar!

Here's my writeup on it for whoever is interested

[http://blog.ryankearney.com/2013/01/comcast-caught- intercept...](http://blog.ryankearney.com/2013/01/comcast-caught-intercepting- and-altering-your-web-traffic/)

<comment><AUTHOR> Hey man, this thread really took off! Nice writeup here, if I saw that, I would have submitted that instead. I submitted this right before I left work, after noticing the requests on my server and a quick Google search (on the UUID) turned up your gist and not much else. As a web server, I was kind of trying to start some discussion to see if I was alone in seeing this and didn't expect it to get to #2.

<comment><USER3> Interesting side effect of not serving the entire blog post on the blog itself - the code in your posts won't be indexed by Google on your site, only on gist.github.hom?

<comment><USER2> I had just moved my blog to a new host. I had done an import of my blog using the Wordpress plugin instead of just exporting the entire database to help clean things up.

I forgot to install the gist plugin so my blog post no longer contained the code. I also had 3 different domains serving the same blog due to a misconfiguration with Nginx which caused my blog to take a temporary hit on Google.

I've since addressed those things so hopefully those will make my post actually appear in a google search.

</comment></comment></comment></comment><comment><USER4> Wonder how the folks back at Comcast HQ would feel if the rest of the internet started adding messages to their web browsing telling them this kind of thing is unsatisfactory? Hey, this content injection game is a game that we all can play.

This is the old "windows alert" nonsense. Everybody and their brother that touched the windows system thought the user would want a popup when their program did something. So the user experience was/is full of annoying popups, warnings, and information messages. Log onto a heavily-customized windows machine that hasn't been used in a month or two and it's like visiting Los Vegas. Good luck trying to get anything done.

Comcast. All kinds of other internet providers manage to communicate these things to their subscribers without this nonsense. Take a hint.

<comment><USER5> Interestingly it would be easy to write some code that detected THIS code. Get web developers to add it to their sites and make it show a message that comcast are charging them for traffic they're causing. And then link to the class action.

inject.ly isn't registered (yet) so let's presume some enterprising HN reader uses that.

As a web dev, all I need to do is <script src="//inject.ly/detect.js"></script> and it will detect this (and any future variant) ISP injected content.

Extra points for someone implementing this to have it optionally make a JS call to another function or inject a customisable HTML widget on the page.

<comment><USER6> Or just make it a browser extension.

<comment> Tuna-Fish Browser extension would require action from end-users, making educating them using it rather redundant. Doing detection in JS can easily be deployed on servers with minimal work needed, and can potentially reach a very wide audience.

<comment><USER6> I was suggesting a browser extension to undo the mangling once users _are_ educated. I must have misunderstood the original idea.

</comment></comment></comment></comment></comment><comment><AUTHOR> I'm getting a lot of requests on our servers for "/e8f6b078-0f35-11de-85c5-efc5ef23aa1f/aupm/notify.do" so I can confirm this is in production. I can also confirm they suck at JS.

<comment><USER7> How about creating /e8f6b078-0f35-11de-85c5-efc5ef23aa1f/aupm/notify.do on your server to notify Comcast users about what their internet service provider is doing? If people started doing that en masse it could bring attention to the problem and with enough publicity get Comcast to reconsider JS injection.

I don't really understand the point of this, either. Couldn't they starting redirecting users to a static page somewhere if there were a real need for a "critical and time sensitive" alert? If the supposed alerts aren't critical enough to justify doing that, use email, IM, RSS or twitter, or even build a custom notification notification app.

<comment><USER8> Best idea ever! But, they'll probably prosecute who ever does it for some BS reason and sentence them to a term of 500 years

<comment><USER9> Dont forget a $70,000 fine.

<comment><USER10> Per "violation". So, $70,000 times a a few million pageviews.

<comment><USER11> every 5000ms

<comment><USER12> Of course the alternative is for comcast users to get together and sue the company for running malicious code on their machines.

<comment><USER13> Considering the way the handle their customers (myself being one of them), they honestly wouldn't care.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> This is nothing new..

Rogers has been doing this for years in Canada already..

They use it to notify subscribers when they are approaching their bandwidth quota (75%) and then again when they hit 100%. You actually have to click a "I understand" button to have it not show up over and over.

<comment><USER15> Rogers also used to serve ads in place of an error message when a bad URL was requested. That was the final straw causing me to cancel my service with them and switch to Teksavvy.

<comment><USER16> For me it was their really low bandwidth caps. Acanac ftw!

<comment><USER15> That was reason #2. Going from a 60gb cap (which I'd often go over by about 20gb) to a 300gb cap actually saved me a lot of money because of overage charges.

</comment></comment></comment></comment><comment><USER17> This is just one more reason for using HTTPS _everywhere_. Doing so prevents ISPs from intercepting and rewriting HTTP traffic.

Shame on you, Comcast.

<comment><USER18> If some interns running a corporate intranet can get a transparent htts proxy, what's stopping an ISP from rewriting your https traffic?

<comment><USER19> Your browser, for one. What you describe is the very definition of a MITM attack, regardless of proxy structure.

Your bank, for another. Indeed there are far too many parties with an interest in keeping https secure, that you needn't worry about it.

</comment></comment></comment><comment><USER20> So if you were proxying some other protocol over port 80, Comcast might just inject some JavaScript into the stream and corrupt your data?

I don't even like the thought that they're running some kind of hardware that makes this possible. They're sending packets impersonating a web server you actually want to talk to, pretending to be part of a response you requested?

<comment><USER21> I'm sure they are checking content-type headers...

Just because you can do this doesn't mean you should (i will stay away from comcast xfinity).

<comment><USER22> I wouldn't be so sure. They're barely even checking what browser you're running.

<comment><USER21> if they weren't then all JS and CSS files loaded through them would have their script tags in it.

i have had these types of issues a while back at coffee shops that try to inject ads, it was breaking my XML.

<comment><USER22> Oh, good point, I guess there's got to be some kind of semi-intelligent HTTP parsing going on in the background.

<comment><USER23> The point is that it is impossible to do this right. This system breaks software.

</comment></comment></comment></comment></comment></comment><comment><USER24> So, If I'm reading their javascript right, we all need to put a file on every website we can at "/e8f6b078-0f35-11de-85c5-efc5ef23aa1f/aupm/notify.do" with the text "43a1028c-7d11-11de-b687-1f15c5ad6a13" in it, and any unfortunate comcast user in their bandwidth-cap-limited areas will have Comcast's stupid alert box stay on.

For example: [http://iainchalmers.org/e8f6b078-0f35-11de-85c5-efc5ef23aa1f...](http://iainchalmers.org/e8f6b078-0f35-11de-85c5-efc5ef23aa1f/aupm/notify.do?dispatch=checkBulletin)

;-)

</comment><comment><USER25> This code is beyond awful - it fails to display, makes endless AJAX requests, and more; here are a few fun tidbits:

1\. The code is not encapsulated in an IIFE, so it clobbers any global variables (like 'image_url') in the page, breaking any scripts relying on those variables.

2\. The code spends an inordinate time checking if you're running Netscape Navigator 6.

3\. Strangely, they include a whole bunch of code allowing the message to be dragged around the window (which is nice) but they don't allow it to be closed. Of course, it closes itself after making a single AJAX request into a black hole, so there's that. Bugs piled on top of each other make this entire message mostly harmless, if it weren't for the variable clobbering & bandwidth usage (see the next item...)

4\. Upon load, checkBulletin() is immediately invoked. This does an AJAX call to '/e8f6b078-0f35-11de-85c5-efc5ef23aa1f/aupm/notify.do?dispatch=checkBulletin'. I assume this is to check if the bulletin has changed, to see if there are new messages, or maybe to check if the user has acknowledged the message yet. Unfortunately:

* This URL is relative, which means it will never actually reach its intended target (instead filling your web logs with this request)

* Upon xmlhttp.readystate=4 (request finished, successful or not, so this will change to 4 even on a 404 error), the comcast message is hidden. This means that the entire 'bandwidth exceeded' message will actually be hidden _as soon as this request completes_ , which may be in <500ms, giving the user absolutely no time to see or acknowledge it.

* The author makes an attempt to not continue sending AJAX requests to this URL after a successful attempt, but botches it, so __this request is actually sent indefinitely, every 5000ms __, while every any page is open. This means every single tab on your system is popping AJAX requests every 5 seconds for the whole month that your account is nearing its quota. This likely brings you over quota pretty quickly if you leave your computer on all day.

That's right, _this code causes every page served on your system to pop an AJAX request to the wrong URL every 5 seconds, as long as the tabs are open._

We can sit and argue all day whether or not it's ethical to display messages by injecting code into the DOM, but it is certainly unethical to write such awful javascript that clobbers global variables and drives up bandwidth costs by making AJAX requests to the _wrong url_ every 5 seconds until the cows come home. Whoever wrote this script should be fired.

EDIT: Similarly, back in the dialup days, some ISPs would inject ads into their content. One way this was stopped was to argue that it was not legal for the ISP to charge you for data, then artificially inflate the size of that data by injecting ads. This script is doing just the same in a measurable way by causing these AJAX requests to be run every 5 seconds on every tab in your system.

<comment><USER26> Ethical stuff aside, I can't imagine hiring someone to actually produce code THIS bad. Where the hell did they find the coder to make this?

<comment><USER27> They're all over the place. People just starting out. It could've been an intern fresh out of college. It could've been someone who just never graduated beyond copy-and-paste-from-StackOverflow. It could've been written by a person who never did web development before and was just told to make it work.

The little HN/Twitter/Reddit "awesome programmer" bubble is just that... a bubble. It's easy for us to forget that lots of people write lots of bad, untested code all day long. As much as it frustrates me, lots of people code who don't care about code - it's just their job.

<comment><USER28> >They're all over the place. People just starting out. It could've been an intern fresh out of college. It could've been someone who just never graduated beyond copy-and-paste-from-StackOverflow. It could've been written by a person who never did web development before and was just told to make it work.

I'm an intern, just moving past S.O. copy-pasta jobs and generally get scared at what the hacker news crowd might say about my code... seeing this caliber of shit get pushed live by a major ISP is almost comical, if an admitted novice such as myself can see that it should be a sign as to the ineptitude of our current crop of ISPs.

<comment><USER26> The code on your GitHub, for the most part, seems fine.

One thing I can say is don't use exec[1] if you can avoid it:

        $string = 'rm /var/www/Giftest/*.gif';
        exec($string);

While there's nothing * technically* wrong, it's platform specific and I think it would be better to use PHP's unlink[2] function. Also, sorry if this is wrong, I haven't looked at the regex but it seems your parsing YouTube URLs? Have you looked at oEmbed[3] - it may be an easier way to accomplish what your doing? You can use it with json_decode[4] to get an object.

[1] [https://github.com/Machtap/GiffyTube/blob/master/download.ph...](https://github.com/Machtap/GiffyTube/blob/master/download.php)

[2] <http://php.net/manual/en/function.unlink.php>

[3] <http://apiblog.youtube.com/2009/10/oembed-support.html>

[4] <http://php.net/manual/en/function.json-decode.php>

<comment><USER28> would you be willing to discuss this further? No contact in your profile.

<comment><USER26> Sorry for the delay in getting back to you. Check your emails.

</comment></comment></comment></comment></comment></comment></comment><comment><USER29> This is probably part of their "Web Notifcation System". They have a published RFC talking about how it works (RFC6108).

Using that system they can selectively notify customers. Like if they detect your system is infected with a virus. Or warn you your service will be discontinued if you don't pay your bill.

<http://tools.ietf.org/html/rfc6108>

<comment><USER25> Look at all the work that went into that RFC. Unbelievable that they couldn't get a half-decent developer to verify that the notification is coded well enough to _even show properly_.

<comment><USER29> I agree. The entire concept is about trying to be less invasive in the web browsing experience (by adding a popup instead of redirect the entire web session) but that all falls apart because of crappy JavaScript.

</comment></comment></comment><comment><USER30> Isn't JS injection a copyright violation, since it creates a derived work? Or has that idea been shot down before?

<comment><USER31> This remains an untested field of copyright law, as far as I know. I've been waiting for literally over a decade for some test case on this matter to come up, and it never does. Perhaps by 2023.

<comment><USER32> Isn't this just a matter of

1) building a webpage where you own the copright

2) Have someone in one of the cities where this is happening browse to your page.

3) Copyright violated, and _you_ get to be the test case!

<comment><USER33> Courts will generally refuse to take on manufactured cases. Their job is resolve real disputes.

A lower court would probably just throw the case out.

And if it didn't, the higher courts, which would set a widely binding precedent, would exercise their discretion simply not to hear the case. Yes: they get to pick and choose what appeals to hear.

<comment><USER34> It doesn't have to be manufactured, someone just has to notice it already happening.

</comment></comment></comment></comment></comment><comment><USER35> Comcast is such an incompetent company. I tried to sign up for service once and they charged me ten bucks to ship me two coax cables yet I was never able to get my service activated because I mistakenly thought my place was hooked up to cable when it wasn't and when I tried to call to correct this and schedule an installation I kept getting put on hold for a half hour before being given a message saying there was an error with their phone system and to call back. I mean seriously wtf.

<comment><USER36> after 2 weeks, 3 techs coming to my house,5 chat conversations and multiple phone calls I finally have service... I don't really like this legal monopoly for cable companies... I would switch to ATT but right now they are about twice the cost...

<comment><USER37> As a different point, my place was already pre-wired. I bought a cable modem from Best Buy, and plugged it in. It synced immediately. Then I went online and ordered service. They charged me $10 to send a self-install kit, but it wasn't needed I was actually online within minutes.

So sometimes their systems work...

I was very sad about switching from my other carrier (Sonic.net), but they ultimately couldn't deliver very much bandwidth. And Comcast was actually cheaper.

<comment><USER38> > And Comcast was actually cheaper.

At least for the first 6/12 months. Then you get to haggle and threaten disconnection for a day, then you are good for another 6/12 months.

<comment><USER37> In my case, their published (non-promotional) rates were cheaper than the bonded DSL I was using. I really didn't want to switch, but I just couldn't justify the amount I was spending for the bandwidth I got.

</comment></comment></comment></comment></comment><comment><USER39> Has anyone other than OP actually seen this in the wild? None of the systems I know about on Comcast here in Chicago have had HTTP manipulated at all today. Maybe they're not doing it here because the 250GB bandwidth cap is "temporarily suspended"?

<comment><USER37> This is the real question. We can laugh all we want to a out their crappy code, but what I want to know is where this code is actually in the wild. If I see this coming down my Comcast connection, I'm likely to cancel my service that day.

<comment><USER2> If you search for the GIUD that's part of one of the URL's in the code, you can find other places online including someones "Top 404 pages" log. While not widespread (yet), it is indeed happening. This post was from last year, but this month Comcast bumped me up to 100Mbps so I will be purposefully reaching my 300GB limit to test if it's still in production.

</comment></comment></comment><comment><USER33> I'd be interested in hearing from a lawyer whether this would constitute interception of or tampering with telecommunications. In a lot of places that's highly illegal except for installation/maintenance/repair, law enforcement or where it's been invited and approved.

<comment><USER40> > where it's been invited and approved.

I bet the permission to do it is part of the ToS agreement.

<comment><USER33> I suspect so. But depending on jurisdiction it may not be waivable. Or the ToS may be drafted in a way that doesn't cover this.

<comment><USER41> Not to mention violation of the copyright of the website (and other rightsholders):

• derivative works

• public performance

• willful infringement

• GPL violation

• patent infringement

</comment></comment></comment></comment><comment><USER42> Cox is doing something very similar. It's somewhat disconcerting to see JS like this ending up in pages, especially since they didn't get the URL right and a future version of this script could conceivably allow someone to serve malicious content to every Comcast subscriber, injected directly into your page.

</comment><comment><USER43> This is felony computer tampering on a worse level than accessing a URL that is accidentally public but nobody will be fined or imprisoned for it.

</comment><comment><USER44> Has this been confirmed to still be happening? The guys blog post[1] states that this was on Nov 20th 2012. Anyone currently using a comcast account want to put down their pitchfork for a second and help verify this?

[1] [http://blog.ryankearney.com/2013/01/comcast-caught- intercept...](http://blog.ryankearney.com/2013/01/comcast-caught-intercepting- and-altering-your-web-traffic/)

<comment><USER2> Hi awj, I'm the author of the blog post. As dangrossman said, Comcast only enforces the limit in 2 cities. I live in the Nashville area, so I'm affected. They just doubled my 50Mbps connection to 100Mbps so I will go over my limit this month as I have 2 more grace periods left. If it happens again I'll update my blog post.

<comment><USER45> Are there down sides to contacting the FBI about this? They in part exist to document and keep track of potential crimes(potentially correlate them over long time frames that may not be worth while to keep track of for an individual but can add great benefit to society at large when the burden and information is centralized.) This seems like it would fall under their definition of internet crime found on:<http://www.ic3.gov/faq/default.aspx>.

If there are not major down sides please file a complaint with the FBI, I believe the url is:<http://www.ic3.gov/default.aspx>.

I encourage you to explain

* your evidence that when accessing various websites they appear to be tampered with between the server and your computer.

* Your worry that it impacts your bill with Comcast as it seems to be eating up you bandwidth. An estimate of the amount of money being eaten up if you have reason to suspect it is a city wide occurrence how much money is lost for everyone across the city?

* If you have packet logs of these occurrences I encourage you to include them.

* Unless you have hard evidence that points to Comcast that is doing the tampering I would not accuse any party of responsibility.

* If you have concerned friends who can independently verify similar conditions, it would probably be valuable to have them file similar complaints, referencing each other where applicable.

</comment></comment></comment><comment><USER46> It would be nice if there was an easier way to find out ISP injections for the layperson who can't really use wireshark/proxy and data comparisons, or for technical people that just don't have the time.

This project had potential ( it detected torrent traffic shaping) but it seems to no longer be under dev. <http://broadband.mpi- sws.org/transparency/results/>

Also this is a good read and contains comcast traffic shaping info: <https://www.eff.org/wp/detecting-packet-injection>

ps. Who cares about the shit JavaScript, this discussion should be about detecting packet injection and shaping.

<comment><USER47> There is validity in scrutinizing the code quality as well.

I agree that the ethical discussion is likely the paramount concern here and should be discussed, but the code they're using floods the global namespace which in theory could actually degrade service for end-users (by potentially breaking commonly visited JS-powered sites that happen to use globals of the same name).

Its worth pointing out that it would take minimal effort to make this code not suck as much (wrapping it in a closure for a start). IMO it gives more context to the initiative on Comcast's part. No time, effort, or care was put into considering the ethical implications of this practice nor its practical effect on the end-user.

</comment></comment><comment><USER48> They're also violating this patent:

<http://www.google.com/patents/US20110264729>

Which I can tell you for certain that they don't own. Bastards.

<comment><USER49>
        Inventors	 Denis Kulgavin
        Applicant	 Kulgavin Denis

Which one are you?

</comment></comment><comment><USER50> If visiting a public URL is "accessing a protected computer without authorization" if the owner didn't mean to make it public, I would suppose that hacking my communications with a website in order to inject code into my web browser should be too.

</comment><comment><USER51> Comcast is an awful awful awful company. Yet I pay them over $100/month. I hate them with a passion. I've never experienced worse customer service. If I could pay double the price with a different company for internet/cable, I would do it in an instant but I unfortunately have no other options.

<comment><USER52> Yeah, me neither.

The worst part is that once I was griping about the horribleness of Comcast on Twitter, and a Verizon representative chimed in cheerily to tell me to check out FIOS. Only thing being, it's been ten years since they first announced FIOS was "coming soon" to my neighborhood and _it still isn't here yet._

Sometimes you don't know whether to laugh or cry, you know?

</comment></comment><comment><USER53> And this is why you should just encrypt everything (even Hacker News) with ssl and install ssl-everywhere.

</comment><comment><USER54> My ISP does something similar, but it's meant to inject ads: one ad that scrolls in from the bottom every two-three minutes (for ten seconds or so, and that can't be dismissed), as well as another ad that _covers up_ ads that other websites serve up.[0]

I've now resorted to using a remote VPN for all of my traffic.

[0]: A reddit post in which I discuss it: [http://www.reddit.com/r/self/comments/19zhl6/my_isp_is_injec...](http://www.reddit.com/r/self/comments/19zhl6/my_isp_is_injecting_advertisements_into_my/)

<comment><USER45> I will encourage you like I have in several other posts, example <https://news.ycombinator.com/item?id=5484850>, at this point to contact the FBI. If this was happening over a 56k modem on a phone line it would clearly be wire tapping.

I do not currently see a downside, if you see one let me know.

</comment></comment><comment><USER55> The hilarious thing about this is comcasts ridiculously buzz worded job ads for engineers. It's like they just cut and pasted everything any manager read in a blog or magazine and pasted it to dice: [http://www.dice.com/jobsearch/servlet/JobSearch?op=302&d...](http://www.dice.com/jobsearch/servlet/JobSearch?op=302&dockey=xml/a/7/a7dd8fbbd6dddc796dc4ed71eaae455b@endecaindex&source=19&FREE_TEXT=&rating=)

<comment><USER56> \- Regular, consistent and punctual attendance. Must be able to work nights and weekends, variable schedule(s) as necessary.

WOW.

\- Other duties and responsibilities as assigned.

No developer in their right mind would apply for this job.

<comment><USER57>
        > Tasks
        > Consistent exercise of independent judgment and
        > discretion in matters of significance.

This one literally stipulates that you will be expected to think for yourself on a regular basis. Why on earth is this in there?

<comment><USER58> as a catch all. if they want to get rid of you, they can always cite this as a reason.

</comment></comment></comment></comment><comment><USER59> This is the js my ISP (VodafoneFJ) injects into all web pages: <https://gist.github.com/mark-up/5297830>

It basically optimizes images and replaces all image alt text with text saying to hit CTRL+R to load full-versions of images.

I know that VodafoneUK and VodafoneAU do the same.

On the bright side, at least they respect the no-transform cache-control header directive.

<comment><USER20> I believe T-Mobile does this in the US as well.

</comment></comment><comment><USER60> Better hope you aren't naming any of your javascript variables similarly..

</comment><comment><USER61> They're probably just desperate because for some strange reason, people don't seem to be getting the alerts sent to their @comcast.net email addresses...

</comment><comment><AUTHOR> edit: I'm OP, not the content author. I serve a media website, which is where I noticed and from where my concern stems. Comcast users should also be concerned about this.

Just scanned my logs more fully and have serious concerns. As people have noted, this really does make requests every 5 seconds. My 404 page is currently 18KB, which means these users (who are being warned about their bandwidth) are being forced by their ISP to download extra web traffic from the site they're sitting on. For me that number is 1/3MB / minute and I'm seing users who sit around a very long time.

Also, this isn't restricted to the two metros Tuscon and Nashville people have mentioned. Here is a sample of hits I'm seeing (removing final octet from IP/hostname):

c-75-65-181-xxx.hsd1.la.comcast.net West Monroe, LA

c-174-52-141-xxx.hsd1.ut.comcast.net Provo, UT

c-69-137-179-xxx.hsd1.az.comcast.net Tuscon, AZ

c-76-109-127-xxx.hsd1.fl.comcast.net Miami, FL

cpe-72-225-230-xxx.nyc.res.rr.com New York, NY

c-68-48-154-xxx.hsd1.md.comcast.net Washington, DC

c-98-224-83-xxx.hsd1.ca.comcast.net Fresno, CA

c-66-41-214-xxx.hsd1.mn.comcast.net Minneapolis, MN

So what do we do about this?

<comment><USER62> "So what do we do about this?"

Use TLS, warn customers about a malicious ISP attacker their connection, set up an encrypted proxy/VPN service for people to use, etc.

</comment></comment><comment><USER63> So this sucks, but its not as bad as many are making it out to be. In a previous role, I was forced to deploy an appliance that did this exact same thing. Its not a man in the middle, or traffic intercept with forged responses.

Most of the time these appliances act as a 'cache' device. They will sit some where in the network ( inline, out of band, or as a WCCP device ) that will answer common router cache lookups.

In the case of WCCP, User behind cable modem X requests www.google.com ( HTTP Non Secure Traffic ONLY! ) and the router asks the appliance, "Hey, do you have a cache record for this request from this user behind modem X?". At this point, the appliance will do a DHCP Lease Query for that IP and get Option 82 from the lease record. Most of the time this is the mac address of the Modem. Then it takes this Mac address and either looks up in an internal database or an external one to check if this user has a message 'waiting', IE: Over allotted bandwidth, billing note, spam or just BS. If there is a message waiting, the appliance will tell the router, "YUP, i've got it. Let me send back this small .JS response". From my experience, this small JS ( Even if it is horribly written ) will be returned to the user with some code in it that does another request to the website originally requested in a frame of some sort. Request is made again, but this time the "message" waiting for the user has already been delivered, so the initial process returns "Nope, nothing for that user" and the content originally requested is loaded upon the 2nd round trip. Its still your PC with a fake original response. I won't pretend to know how Comcast or Rogers does this, but I know one Vendor I have used did it this way. I fought it till I was told to put it in production or find other employment. It sucks, but if done correctly on HTTP Non Secure traffic only in a manner that is described above, I think its a better idea than products like procera or sandvine do which IS MITM forged responses. Hope this helps explain a little better what maybe going on in this situation.

<comment><USER63> It looks like based on the code and reference to 'bulletins' this is a product from PerfTech ... <http://www.perftech.com/bulletin_system.html>

</comment></comment><comment><USER64> Something that we're used to see in China (China Telecom is regularly pissing me off with injected ads), but that I would not expect to see in the US. Though I seem to remember seeing such kind of practice once in San Francisco.

What are the legal recourses you have with regards to this type of forced advertisement?

</comment><comment><USER65> Not only that but it appears people are using Comcast as a DOS proxy [http://blog.ryankearney.com/2013/01/comcast-caught- intercept...](http://blog.ryankearney.com/2013/01/comcast-caught-intercepting- and-altering-your-web-traffic/#comment-776514886)

</comment><comment><USER66> This is either a bad april fools joke, or it might be related one of the following:

* ISP - 'six strikes' of content abuse

[http://www.techradar.com/us/news/internet/broadband/six- stri...](http://www.techradar.com/us/news/internet/broadband/six-strikes-us- copyright-warning-system-to-launch-this-year-1096822)

* EBS - Emergency Broadcast System

[http://www.washingtonpost.com/blogs/blogpost/post/wheres- an-...](http://www.washingtonpost.com/blogs/blogpost/post/wheres-an-emergency- alert-system-for-the-internet-and-the-phone/2011/11/09/gIQAlYGR5M_blog.html)

[http://news.cnet.com/8301-19882_3-57321623-250/wheres-the- em...](http://news.cnet.com/8301-19882_3-57321623-250/wheres-the-emergency- alert-system-for-the-web/)

</comment><comment><USER67> To add to the old news litany: Saw this on Vodafone over in Germany a few years back. To add to the security litany: SSL. EVERYWHERE. Firesheep ends up useful again :)

That said, this was probably only noticed as quickly as it was due to its stupidity and intrusiveness.

IMO what should be championed for is good decentralized end-to-end security, something like opportunistic IPSEC / anonymous SSL everywhere by default.

Sure, there are holes in it you can fly planes through, but it's a world better than it being cost effective for whoever to inject and MITM everything.

I'm not even going to touch on the pros/cons of over-subscription and business models which rely on it. (IMO most do, at least implicitly, and I'm not sure how to normalize analysis of that.)

<comment><USER68> Any opportunistic encryption would simply be blocked by the ISP that wanted to do this kind of thing, so the clients fall back to plaintext.

</comment></comment><comment><USER69> Comcast does this for good reason.

<https://amibotted.comcast.net>

Yes, the javascript is crappy, but no reason for their customers to be outraged. I don't know any other ISP that is helping out with the botnet problem.

</comment><comment><USER70> Um, is this something that is always injected? I have comcast and I don't see it in any pages.

I'm guessing this is their clever way of reminding you to pay the bill when you're late?

Pay your bill or they'll stuff ugly JavaScript in your browser, you've been warned!

<comment><USER71> It's right there near the top....

 _You have reached 90% of your <b>monthly data usage allowance</b>._

<comment><USER70> Nope, I don't have it. Are you Canadian? Maybe it's a Canada thing? Doing it to tell you about your data allowance is a bit excessive, for sure.

<comment><USER20> You don't have what? Comcast had a data cap nationwide (250GB/mo) even if you weren't aware of it. They temporarily stopped enforcing it outside of two test markets (Nashville and Tucson) where they're working out exactly what limits people will put up with. You wouldn't see this popup unless you live there and you've used over 225GB this month.

<comment><USER70> Thanks for the explanation.

</comment></comment></comment></comment></comment><comment><USER72> I don't grok why they'd even try to inject their code into a webpage you requested. Why not simply create a separate page that you see BEFORE, that you read and acknowledge receiving, and then finish sending the requested page?

</comment><comment><USER73> The easiest way to combat this is to use SSL. You should be doing that on your website anyway.

Another effective way of combatting this is to detect what's happening and add a "This ad was sponsored by Comcast:" message.

I can sort of see the intent behind this. I just wish they'd tell their customers about their service usage out-of-band, like sending them a text message or an email.

One part of me realized "OMG they're going to track which websites I visit by looking at the HTTP Referer!" But then I quickly realised that as my ISP, they already have access to that information anyway...

</comment><comment><USER74> Do comcast users come from a recognisable range of addresses? If so I might have to add a warning to everything I output along the lines of:

"Your ISP (Comcast) adds terrible Javascript to the code of this page without our knowledge or permission, therefore if you have any problems with this application please contact their support line in the first instance and not us. While your ISP is modifying our code, especially while they are modifying it by adding such terrible code of their own, we simply cannot support you, sorry."

<comment><AUTHOR> No but their hostnames generally call out "comcast" somewhere therein. I've called out some affected clients elsewhere.

</comment></comment><comment><USER75> This is why I run an always-on VPN

</comment><comment><USER76> Ladies and gentlemen, this is why if you are hiring a programmer, you always ask for a work-sample test before making the hiring decision final.

<https://news.ycombinator.com/item?id=5227923>

Yes, the code sample suggests someone clueless about programming in general, even more than being clueless about the particular language of this program. So on what basis was the coder hired?

</comment><comment><USER77> I live in France and I'm a customer of Orange. I was really surprised to see on my mobile, on Facebook (m.facebook.com - I've noticed it only there, but perhaps there are more pages like that) they're injecting a HTML with "Return to Orange World" link in the footer directing to orange.fr. Not sure if anything more though - I have a plain old mobile with Opera Mini.

I'm curious if they have some deal with FB to do it.

<comment><USER78> It could be the fact that you have a strange combination of both an old phone and (what could be a customized) Opera Mini.

I have an iPhone at Orange and never saw this.

<comment><USER77> I've installed Opera Mini on my own, so it's not customized.

</comment></comment></comment><comment><USER79> Major web sites should sue for theft of service. They are modifying someone else's copyrighted content to steal their advertising revenue.

Also: https everywhere, now.

</comment><comment><USER80> I'm glad I'm not on Comcast anymore. Terrible customer service combined with anti-customer practices like this, in addition to the lowest cost/service value on the planet and I'm glad to be done.

We switched to CenturyLink and we're really happy. I'm regularly getting 35-40 Mbps for half the price of 6 Mbps on Comcast. It is a little unnerving to know that 40 is literally the limit of their DSL technology though.

</comment><comment><USER81> I'm pretty sure Comcast aren't the only ones doing this. I had mobipcs for a while (when I just got new house, had to wait for DLS to get installed) and they injected js that tracked your browsing and replaced certain ads it found (as well as caused various errors because it wasn't written properly). I wouldn't be surprised if other companies did the same.

</comment><comment><USER82> Non-quality of code question, and sorry I haven't been able to parse this from the comments so far. Am I reading this correctly to mean that Comcast's method of alerting customers that they are close to their cap drives them closer to their cap?

</comment><comment><USER83> Some of the worse Javascript I have ever laid my eyes upon. Polluting the global namespace, checks for Netscape Navigator 6... It burns my eyes reading this. Did they actually hire a programmer who wrote this?

</comment><comment><USER84> I see a lot of discussion on the quality of the code, but not much about the fact that Comcast is modifying the content they are serving without informing their customers AKA the legality of the situation...

</comment><comment><USER85> The image_url variable references "constantguard/BotAssistance", which turns up in search results as a system used to alert customers of DNS changer malware.

</comment><comment><USER86> Wait, does the Detect Browser script actually work for browsers made after 2001? I'd hope that Comcast's customers aren't using Netscape 6...

</comment><comment><USER87> I'm torn.

This seems bad, but the warning (exceeding your bandwidth quota) seems valuable. I can't think of another, better way to message this.

<comment><USER88> Here are some other ways.

1\. They could email you. 2\. They could send you a SMS. 3\. They could let you view your bandwidth usage by logging into their site. 4\. They could provide an application (desktop or mobile) to keep track of your bandwidth and alert you at certain points.

<comment><USER89> My provider (T-Mobile in the UK, using a mobile 3g dongle) send me an SMS, and the connection software has lots of graphs and numbers.

They still send interstitial content warning me that I've exceeded my fair-use limit. It's a bit annoying because I very carefully checked what the limits were before I signed up.

What's worse is that they use weird, broken, IP addresses and horrible proxies for image mangling.

EDIT: Here's a pastebin.

(<http://pastebin.com/k6ddD0sJ>)

EDIT: Here's a Security \\\\\stack Exchange question about it: ([http://security.stackexchange.com/questions/9368/mobile- carr...](http://security.stackexchange.com/questions/9368/mobile-carrier- javascript-injection))

</comment></comment></comment><comment><USER90> Another reason to use an SSH tunnel or VPN for all traffic, combined with HTTPS Everywhere.

</comment><comment><USER91> brainjar! My go to resource for DIV positioning back in 1999.

</comment><comment><USER92> Where is the Chrome extension to block this?

<comment><USER93> HTTPS Everywhere[1]. Using SSL certificates helps prevent man-in-the-middle attacks[2], such as this. Comcast wouldn't be able to read any of your traffic and insert js without spoofing SSL certificates.

[1] [https://chrome.google.com/webstore/detail/https- everywhere/g...](https://chrome.google.com/webstore/detail/https- everywhere/gcbommkclmclpchllfjekcdonpmejbdp?hl=en)

[2] [http://security.stackexchange.com/questions/8145/does- https-...](http://security.stackexchange.com/questions/8145/does-https- prevent-man-in-the-middle-attacks-by-proxy-server)

</comment></comment><comment><USER94> Another reason to use SSL everywhere.

</comment><comment><USER95> if they just went to unlimited internet, they wouldn't need this thing.

</comment><comment><USER96> Mobile carriers do this too. I see the exact same feature being provided on my Sprint line.

<comment><USER45> If this was happening on a 56k modem over a phone line it would clearly be wire tapping. I encouraged the op in another post, <https://news.ycombinator.com/item?id=5484850>, to contact the FBI. If you see a downside to this let me know, but until I realize one, or have one pointed out I encourage you to do so.

<comment><USER96> I was just blocking 184.108.40.206, which the inserted js used to download the rest of the "features". I have no reason not to report this to the FBI accept I don't really understand whats going on here so I wouldn't be a good contact.

If you would like to see the content of the script, I can show it to you, it's bit different than the one posted here.

</comment></comment></comment><comment><USER97> OMG LOL. Have they never heard about jQuery? Christ, they could have made the code so much more elegant.

<comment> jarek-foksa Their jQuery code would probably look like <http://enterprise-js.com/23>, with _aggressive_ caching methods used on all jQuery selectors: <http://enterprise- js.com/27>

<comment><USER98> Wait, what? Why didn't I know about this website before? I am writing all these down!!!11oneoneone EOSarcasm</comment></comment></comment>


Show HN: Bored? Play my game Now with less Ads - <AUTHOR> https://play.google.com/store/apps/details?id=com.victorribeiro.qubes <comment><AUTHOR> After releasing QUBES, my first "commercial" game, I got about the offers from publishers (I guess) offering to promote my game for a fee. Is it the way to go if I want to make some money with it? I got some free credits on Google Ad and I'm running a small campaign trying to gather players. After 3 weeks I got about 300 installations, I feel this is a very small number. People tell me they like the game, some complained about the amount of ads which I now reduced, but besides that, I don't know how to get more people to play it.</comment>


Ask HN: Is there anything like Erlich Bachman's "incubator" in real life? - alex-wallish Is there anything like this in real life, in the bay area in particular, where you can live in someplace for free for a certain period of time, in exchange for equity in whatever you create during that time? <comment><AUTHOR> I believe hacker hostels like the one represented on SV are a thing of the past. Prevalent in the late 90s and early 2000s. Several folded around 2010 and my buddies around San Jose say they haven't heard of any in 5-6 years. Interested to hear other people's input as well. Have wondered myself.</comment>


Radical Traffic Experiment in NYC: Cars All but Banned on Major Street - <AUTHOR> https://www.nytimes.com/2019/08/08/nyregion/14th-street-busway.html <comment><USER2> Not sure why it's so radical.. whoever wrote this headline has an agenda.

</comment><comment><USER3> Isn't it going to chaos on the nearby streets? as the cars would have to drop the passengers and turn off?</comment>


The Pursuit of Emptyness by John Perry Barlow - <AUTHOR> http://w2.eff.org/Misc/Publications/John_Perry_Barlow/HTML/The_Pursuit_of_Emptyness.html

<comment><USER2> Thoughtful essay that I bet rubs some people the wrong way. I permanently delicio.us bookmarked this, but I am not sure which of my friends and family (if any) I'll send the URL to.</comment>


Best Google plus alternatives in 2019 - <AUTHOR> https://alternativoj.com/google-plus-alternatives/ <comment><USER2> An alternative to Google Plus? It's not like anyone was using the platform in the first place.</comment>


Introducing the "Bug Video" - <AUTHOR> http://blog.getbugcam.com/2011/05/introducing-bug-video.html

<comment><USER2> Really looking forward to this. Never seen bug-tracking and video screen- capture in one product.

<comment><AUTHOR> Hey Aure. Just a tool to create bug videos. No bug-tracking built-in. Integrates with most popular bug tracking tools (FogBugz, JIRA, Mantis, Trac, etc.).

<comment><USER3> Perfect. Everyone already has bug tracking software, and I doubt most people are going to want to switch to be able to record videos.

</comment></comment></comment><comment><USER4> Looks incredibly useful!

<comment><AUTHOR> Thanks Charles :-)</comment></comment>


Dictionary Objects in JavaScript and TypeScript (2017) - <AUTHOR> http://blog.jessitron.com/2017/07/dictionary-objects-in-javascript-and.html <comment> james-mcelwain JavaScript has a map type that accepts non-string keys.

<comment><USER2> The syntax for instantiating Maps is really ham handed. An array of arrays of key value pairs. I get it. I just wish there was a better syntax. We need Map literals and for that I think we need another type of brace character.

I just want Python's dict everywhere. :)

<comment> james-mcelwain If you're ok with string keys, you can always do `new Map(Object.entries(obj))`. Alternatively, just implement the `iterable` interface on your custom data type.

Literals are nice sugar, but it hardly seems "ham handed".

<comment><USER2> Everything is sugar. The right sweetness makes the language.</comment></comment></comment></comment>


Why study finite-dimensional vector spaces in the abstract? - <AUTHOR> http://www.dpmms.cam.ac.uk/~wtg10/vspaces.html

<comment><USER2> I'll note for the record that there are many other very interesting articles about mathematics living at that site,

<http://www.dpmms.cam.ac.uk/~wtg10/>

the academic home page for Timothy Gowers.

</comment><comment><USER3> If R^3 is taken with vector (x1,x2,x3) defined using x1+x2+x3=0 then I can't quite picture that, I can only imagine the projections on the axes, not the actual plane ... anyone know of a simply 3D graphing tool online.

<comment><USER4> Draw (or, better, imagine) a cube with corners at (+-1,+-1,+-1). The plane through the ++- vertices is x+y+z=1. The plane through the +-- vertices is x+y+z=-1. The plane you want is parallel to those and half-way between them. Does that help at all?

<comment><USER3> Thanks to you and Jabavu, the "normal (1,1,1) vector through the origin" is the best description for me.</comment></comment></comment>


Ask HN: Are tenacious salespeople/marketers here? - <AUTHOR>

I think a team which includes a great hacker, web designer, and marketer is a killer combo. A reason power is shifting from investors to founders is because such a team can go far enough to gain traction and profitability without requiring a cent of investment, especially if they refuse to quit and keep iterating on ideas. It seems pretty easy to connect with great hackers and designers, probably looking no further than right here at HN. However, I wonder if finding great marketers is as easy. I don't mean marketers that focus on online tactics like SEO, SEM, social media etc. Anyone involved with Internet startups will likely be okay with picking up slack in those areas. I'm talking about a different personality type. I'm talking about traditional sales -- picking up the phone and cold-calling, or pounding the pavement, just doing whatever it takes to get the sale. There is a whole world that still doesn't know any more than what they need to know, or may have heard casually, about what's happening on the Internet. To reach these people ideally you will have a tenacious marketer. Paul Graham says his company Viaweb had such a person, someone they could call "an animal". My question is where do you find such people? <comment><USER2> Great salespeople never lack for a job, so you'll find them already employed, making good money. As for where online you'd find them, I'm not sure. I'm not a great salesperson, but my wife is, and she frankly doesn't spend a lot of time in online communities. I'm sure there are some who do, but that's my data point.

<comment><AUTHOR> Yeah, it makes sense that they would never lack for a job! I guess that could make them an even more valuable commodity than an awesome hacker. Hmm, perhaps it would be smart to look for them at a younger age, before they get into an established sales position.

<comment><USER2> Indeed. The problem, I've found, is identifying people who will truly succeed in sales, rather than people who are desperate for a job and willing to take a position that doesn't suit them.

</comment></comment></comment><comment><USER3> _picking up the phone and cold-calling, or pounding the pavement, just doing whatever it takes to get the sale_

People who are good at this are the same people who are good at landing great jobs and constantly getting promoted. In the rare event that they are without a job, they are likely on the phone nonstop or pounding the pavement to find one. Probably the best way to find a great marketer is to steal one from another company. You'll have to offer something attractive enough to warrant leaving a good job to come work for your startup, though.

<comment><AUTHOR> That makes sense. I guess they would need to be convinced their income potential could benefit greatly with the move.</comment></comment>