How to Hack a Marathon - <AUTHOR> http://andrewgertig.com/2011/01/how-to-hack-a-marathon-if-you-arent-a-runner/

<comment><USER2> This is good hack and I used a similar plan to travel 9 times this distance (240Km) in as many days ~ [http://www.flickr.com/photos/bootload/collections/7215762379...](http://www.flickr.com/photos/bootload/collections/72157623796440209/) the hack described will not work for completing consecutive marathon distances without some modifications.

My hack involved breaking the day down into _"do-able"_ tasks, following some simple routines and good level of fitness to start with. You need to increase your level of basic physical fitness: cardiac (stamina to do the distance), joint & muscle (to avoid foot & muscle damage) and mind (won't quit).

Physical Prep: Before I started I'd marched some 1600km on foot slowly building up stamina so I could regularly do 32km per day for days in a row. I did this in hilly terrain with weights ~ [http://www.flickr.com/photos/bootload/sets/72157623445003205...](http://www.flickr.com/photos/bootload/sets/72157623445003205/with/4549780731/) This is my hack to take this to another level. You have to be physically able to take the repeated distances and you can only do this with extra training to condition your muscles, joints and mind.

 _"1. # Don't plan on running the whole thing"_

The team was divided into 2 groups - runners, walkers. The runners would run anywhere from 13km to 20km in the morning and doing an additional 20 or so kilometers in the afternoon with a break for lunch ~ [http://www.flickr.com/photos/bootload/4665359650/in/set-7215...](http://www.flickr.com/photos/bootload/4665359650/in/set-72157624081287855/) Then completing the rest of the day together. I chose walking the entire distance not because I couldn't run the mornings but because I knew the chance of injury was pretty high. Instead we'd leave much earlier than the runners and beat them to the midday RV. Only 2/12 runners completed the distance because of injury.

 _"2. Take 4 Advil an hour before the race"_

to blunt any residual soreness but the problem can also mask injury.

 _"3. Take a walking break at every mile marker"_

we'd break for lunch but the more important break was stretching ~ [http://www.flickr.com/photos/bootload/4665736877/in/set-7215...](http://www.flickr.com/photos/bootload/4665736877/in/set-72157624081287855/) At the start of the day, at lunch and any time your calves would tighten I'd do 3 stretches of the calf, hamstring and quadriceps. In between we might depending on how we felt take a 5m timed break every 2 hours ~ [http://www.flickr.com/photos/bootload/4665462901/in/set-7215...](http://www.flickr.com/photos/bootload/4665462901/in/set-72157624081287855/) The longer or more often you stop, the longer it takes.

 _"4. Eat half a banana whenever you see one"_

Eat small amounts regularly. Small amounts so you can digest it. If you fail to eat you will fatigue quicker and recover slower. Meal times was as many calories as possible. I'd also take left over food/drink to keep in case I got hungry. I used specialised rations (MRE/PRE ~ actually PR1M ~ similar to this Australian D ration "click Austalian" to view ~ [http://www.nytimes.com/interactive/2010/09/04/weekinreview/2...](http://www.nytimes.com/interactive/2010/09/04/weekinreview/20100905_gilbertson.html)) when we got into the heavy climbing sections ~ <http://www.flickr.com/photos/bootload/4549780731/>

_"5. Take two waters at ever water station"_

Carry you own water. Drink on average (varies by climate) 1-2Ltr/hr and verify this with the "piss-test" - if your urine is clear you are drinking enough. We had 50litres of water on hand and various additives to replace minerals.

 _"6. Eat no more than 3 Gu energy packs because our stomachs didn't like them"_

Small amounts at regular intervals to avoid such stomach aches. I made up some homemade _"rat-packs"_ ~ <http://www.flickr.com/photos/bootload/4549780725/> to eat at regular intervals to make sure I had enough energy.

 _"7. Take bathroom breaks."_

Never forget doing a #2 under a bridge only to find a live electric fence very close.

 _"8. Walk every hill"_

We actually tried to push hard up hills because the country was undulating but other times the hills stretched up to 15km up so there was no choice. Hills add about 1hr for every change of 1000ft so moving fast down also helped.

 _"9. Meet interesting people and use conversation to kill the pain"_

That works but sometimes you can be on your own. On the second last day we traveled > 40km mostly uphill without a stop and most of that was by myself. You've got to like the pain.

 _"10. Put bandaids on your nipples to prevent bleeding"_

Foot care is more important. An old rule is never wear anything new so all my kit was broken in, boots ~ [http://www.flickr.com/photos/bootload/4418965410/in/set-7215...](http://www.flickr.com/photos/bootload/4418965410/in/set-72157623445003205/) pack etc. At all main stops taking your boots off & letting your feet & socks dry in the sun avoids this type of problem ~ [http://www.flickr.com/photos/bootload/4413036580/in/set-7215...](http://www.flickr.com/photos/bootload/4413036580/in/set-72157623445003205/) This is what happens if you dont ~ [http://www.flickr.com/photos/bootload/4998112005/in/set-7215...](http://www.flickr.com/photos/bootload/4998112005/in/set-72157624974975854/)

11\. We kept going until end of distance

While we had a van for stragglers or injured we had to finish the days course on the day. This turned out to be the hardest aspect. Finishing. You can see it in this shot, shattered legs ~ [http://www.flickr.com/photos/bootload/4666299830/in/set-7215...](http://www.flickr.com/photos/bootload/4666299830/in/set-72157624081287855/)

<comment><USER3> About the runners: What types of injuries do they mostly had? TY!

<comment><USER2> _"... runners: What types of injuries do they mostly had? ..."_

Usual for hard surfaces, long distances - knee and calf issues mainly. For the knee we had ligaments going, tears in calf, no ankles though and exhaustion. Most carried old injuries of some sort. I'm not sure if lack of conditioning could explain it. My reckoning with some other experienced distance movers put it down to _"knowing"_ the limits of how far you could push yourself at any given time.

The two that ran all or pretty much most of the running leg, Dave (ex-forces) seen here on the left ~ [http://www.flickr.com/photos/bootload/4566748995/in/set-7215...](http://www.flickr.com/photos/bootload/4566748995/in/set-72157623824592307/) and Steve (serious amateur athlete), seen here in the white top/shorts ~ [http://www.flickr.com/photos/bootload/4566748995/in/set-7215...](http://www.flickr.com/photos/bootload/4566748995/in/set-72157623824592307/) I would class as both as serious athletes who would have done marathons before & could push on 15-20km/day running on hard surfaces in late 20 to low-mid 30 celsius, NSW outback heat, day after day.

I think myself, Dave and Steve are the only ones who did the entire distance without some sort of injury.

</comment></comment></comment><comment><USER4> I have complered four marathons with times of 4:22, 4:15, 3:56, and 3:36. Only the last of those really felt like I "ran" the marathon. It required an average of 42 miles/week of training (peak week of 60 miles) for 16 weeks.

So, sure, go complete a marathon, it's a great experience. But if you want to truly "run" a marathon, for god's sake, do it right.

<comment><AUTHOR> I agree that if you want to tell someone you didn't stop during the marathon for a break or to walk that you should train for it. What this post demonstrates is that it is possible to complete something that most people avoid out of fear.

<comment><USER4> The marathon should not be feared, but it should be respected. 26 miles 385 yards is a long way. One should also be aware of hyponatraemia which tends to happen more often to the ill-prepared who may not be aware of its cause. (Losing lots of fluid via sweat and replacing it only with water.)

Anyway, completing a marathon is quite an endeavor and it seems to me it's worth doing well, not just to say you did it.

</comment></comment></comment><comment><USER5> 4 Advil before the race? This is a bad idea, from experience. I took 2 Advil before a 10K and felt great, but within an hour after the race, I was in complete pain. My stomach was cramping and I couldn't get up out of bed for at least 45 min. If you Google "Advil" and "running", you will find many articles that warn you about the mixture. I've ran two half-marathons without pain killers, it's definitely the way to go.

</comment><comment><USER6> Watch out on the Advil(ibuprofen)! While that probably really helped your run, you can end up with a condition called exercise-induced rhabdo if you don't hydrate properly.

Here's a readable article [http://www.trailrunnermag.com/article.php?id=193&cat=3](http://www.trailrunnermag.com/article.php?id=193&cat=3)

This might be more of a problem for ultrarunners because of the lengths of the events, but on no training at all anything can happen :)

BTW, your strategy of taking a walk break through every water station is a great one for your first marathon, regardless of whether or not you've done the training.

I do marathons and ultras, but I usually do them pretty slowly.

</comment><comment><USER7> Many people run/walk a marathon at around 10 mins/mile. I think our bodies are better suited to doing that. Most good beginner running programs start with run 1 minute, walk 2 minutes and build you up from there.

Running is incredibly hard on the body and most of the work is just building up your muscles, tendons and bones to handle the strain of constant running. The benefits are awesome. Tests have shown that people who have run at least 10 years in their life have 30% more calcium in their spines when they die [Tim Noakes, The Lore of Running - aka. The Bible]

There is absolutely nothing wrong with walk/running a marathon and if you're starting running, that's the only way to build yourself up.

My personal goal is to average under 8 minutes per mile on my daily runs. I've met one real runner. The guy at my local running shoe shop runs a 4:10 mile for University of Oregon.

</comment><comment><USER8> Q: What's an easy way to bench 1,000 pounds?

A: Lift 100 pounds 10 times.

There's nothing wrong with taking it easy, and in fact I think you _should_ if you're just starting out. But at some point you have to ask yourself whether you're in the race because you're passionate about it or whether you're in the race because you want to tell you facebook friends you ran a marathon.

<comment><USER9> Finishing a marathon is a big deal and something to be proud of. Don't belittle it with your awful analogy.

<comment><USER8> Of course it is. I'm saying that maybe the guy investing his time hacking the long run would be more gratified giving his all in the 10k or half marathon. What about that (innocuous?) piece of advice unnerves you so much?

</comment></comment></comment><comment><USER10> The first point says it all, "1. Don't plan on running the whole thing." He completed the marathon at an average speed of 5.8 mph. I'm not a runner but am a hiker, and know that most of us can hike at around 3 mph, over rough terrain wearing heavy hiking boots. Speedwalking on pavement with sneakers at twice that speed for 4.5 hrs sounds entirely reasonable.

<comment> jim-greer Actually he switches between slow running and regular walking, which is easier. Speedwalking that fast is harder than jogging.

<comment><AUTHOR> This is the technique that olympic marathoner Jeff Galloway teaches.

<comment><USER4> There's nothing wrong with Gallorunning -- heck, there are sub-3 Gallowrunners ... but they still train! :)

</comment></comment></comment></comment><comment><USER11> I was ready to hop all over this and point out errors. Honestly - there isn't really anything wrong with this plan at all.

<comment><USER12> I thought the experiment and the write-up interesting, but to say there isn't anything wrong with the plan is tantamount to claiming that training for a marathon is a waste of time. There are dozens of ways you can get injured by running that much without preparing. If the author had merely sore legs for a few days (as he says in the comments), I'd say he was lucky.

</comment></comment><comment><USER13> Something that's left out that, as someone who has trained/run a marathon, you should appreciate is adrenaline. His plan is great, but when you're nervous/excited and taking on something that seems insane, you can count on a little extra in the tank. That said, I'd love to know how he felt the last few miles. :)

<comment><AUTHOR> My friend had told me about "the wall". I found it.

<comment><USER4> <http://www.marathonandbeyond.com/choices/latta.htm>

</comment></comment></comment><comment><USER14> Or, build up to it. 3 x 1.5 hours and 1 2.5 hours per week should get you ready.</comment>


Batman uses nmap in Justice League (Doom) - unix-junkie http://nmap.org/movies.html#justiceleague

<comment><AUTHOR> Fake apologies in advance, this is a meta-comment. I'm throwing this out there, so HN, we need to have a talk.

This article is interesting to hackers, in the sense that Simpsons or Seinfeld or some popular t.v. show is interesting. So it doesn't violate the guidelines per se, unless you use the "intellectually gratifying" interpretation. Sure, nmap itself is interesting, so by proxy people can have their intellect gratified, but submit a link to the home page instead. Tack on a '?' if it's a dupe from a year ago that you really feel strongly deserves a repeat appearance. (nmap probably is.) Sure this submission is on the /classic page too so maybe I should shut up, but I've seen a huge increase in the number of submissions that aren't intellectually gratifying yet still receive a lot of upvotes.

Furthermore I've been pressing the 'flag' button a lot more and downvoting what I see as poor quality comments a lot more. I noticed a massive increase in this behavior after the SOPA incident when we inherited a ton of (presumably) Reddit users, whereas before sometimes there'd be a week of crap and sometimes a week of awesome, it was less predictable.

Feel free to downvote if you think I'm overreacting, just crazy, or it's just me who has noticed.

<comment><USER2> People were already bemoaning the decline in quality when I started reading a year ago, but even then, the type of article that made it to the front page was completely different than what you could find on any other site. We are getting progressively farther from that unique tone as time goes on.

I don't think there is a solution, though. This erosion seems like the inevitable path of any community-driven thing. No one is doing it deliberately, it's just what happens when you average out so many ideas of what "good" is.

I am certainly part of the problem. I haven't contributed anything of value. This comment is actively making the site worse. But this link was such tragically generic drivel, I felt the need to say something.

<comment><AUTHOR> There is a solution, but the community doesn't generally tend to like it even though it's for their own good. The solution is aggressive culture pruning by trusted lieutenants.

<http://lesswrong.com/lw/c1/wellkept_gardens_die_by_pacifism/>

</comment></comment></comment><comment><USER3> nmap saved the world in the matrix...

</comment><comment><USER4> lold at "No Longer Floppy" entry )

<comment><USER5> I can't believe this actually exists. But then again, rule 34 I guess.</comment></comment>


Atom 1.25 - <AUTHOR> https://blog.atom.io/2018/03/15/atom-1-25.html <comment><USER2> Tree-sitter (intelligent code folding) looks really cool. While I am a big fan of VSCode, I really do not like their indentation-only approach to folding. It makes constructs like C switch statements impossible to fold correctly. Something like:

      switch( ) {
      case:
         break;
      case:
         break;
      }

won't fold at the braces, but instead will just collapse one case statement, and it drives me crazy. This is even with the C/C++ language extensions installed.

Good job Atom.

<comment><USER3> Tree-sitter is not just for code folding, it's a full-on incremental parser that's fast enough to run on every keystroke. See their expand selection example for another really compelling use-case.

If you're interested in more details, there's also this talk from the developer behind tree-sitter ([https://www.youtube.com/watch?v=a1rC79DHpmY](https://www.youtube.com/watch?v=a1rC79DHpmY)), where he showcases how they could use tree-sitter to quickly parse entire multi-megabyte minified JS files to provide complete syntax highlighting for them that updates as you edit, and how the accuracy and usefulness of the actual syntax highlighting can improve over regex based implementations due to having access to the fully specified grammar of the language.

I think tree-sitter is also a game changer for extension development once it stabilizes and the APIs are opened up. Extensions like swackets will no longer have arbitrary performance constraints that break user experience ([https://atom.io/packages/swackets](https://atom.io/packages/swackets)), and it opens the door to a whole new set of intelligent extensions that understand the languages you write at a much deeper level that were previously unfeasible due to parsing performance, or required some external heavy-weight language server.

</comment></comment><comment><USER4> I tried really hard to not switch to VS Code. Wasting huge piece of my RAM + randomly and REPEATEDLY crashes which ends up destroying entire settings, packages to newly installed state. I'm done with it. I'm cool with VS Code.

I really had hope when they introduced V8 Snapshots on 1.17, then I had exact same crash couple of days later. And memory management wasn't better. I was even thinking about to replace my mac, because I was running out of RAM just by having Atom + Firefox + iTerm with rails server and console running.

It's really annoying to have your editor, where you spend most of your day, your shortcuts, extensions, settings, theme, all got destroyed in a moment in the middle of the working day. And you have still have to keep working with fresh installation settings. Damn. Worse, although I'm aware of sync-settings, I keep forgetting syncing my settings as they are evolved with time and it still feels insecure to be in need of syncing stuff because you don't know when it will crash for the next time.

Looking at the issues, assuring that I did a good decision by moving away from it.

This one is still open: [https://github.com/atom/atom/issues/12255](https://github.com/atom/atom/issues/12255)

[https://github.com/atom/atom/issues/14909](https://github.com/atom/atom/issues/14909) [https://github.com/atom/atom/issues/14922](https://github.com/atom/atom/issues/14922) [https://github.com/atom/atom/issues/15443](https://github.com/atom/atom/issues/15443)

</comment><comment><USER5> To preempt the inevitable modern-editor performance flamewar, especially with the introduction of a new parser: Has anyone been compiling statistics on time-to-editable on app startup, non-trivial-project-with-a-bunch-of-tabs open, and standalone-file open, for different Atom, VS Code, and Sublime versions, on freshly-rebooted popular laptop hardware? The closest I can find is from 2016, and isn't representative of large projects or code you'd find in the wild: [https://blog.xinhong.me/post/sublime-text-vs-vscode-vs- atom-...](https://blog.xinhong.me/post/sublime-text-vs-vscode-vs-atom- performance-dec-2016/)

All joking aside, it would be a fascinating analysis; all the rationales for browser performance benchmarks apply here as well.

(And also, kudos to the Atom team for the new tree-sitter parser - very cool stuff!)

<comment><USER6> I don't have a comparison that you are looking for, but I will say that I recently did an experiment.

I timed (by hand using an app on my phone) the total time I spent "waiting" for Atom to launch over a full work week. It came to about 80 seconds.

80 seconds in chunks of like 10 seconds or so mostly at the start of my day. I have a shitload of plugins and my Atom instance loads significantly slower than my coworkers, but even so 80 seconds a week is nothing compared to the time savings that atom brings me.

Yes, it could be faster, but it won't materially improve my experience.

<comment><USER7> Tbf the point of startup time isn't the actual time cost: its _rarely_ significant; even a 5 minute startup is only 5 minutes for an 8-hour workday.

But it _feels_ absolutely awful to have to wait 5 minutes to start doing something useful. Especially when its not necessary, and when you've got alternatives that start up _instantaneously_ (ie basic vim install).

The problem is in that transition from 10ms wait to 10s wait; the difference is immense.

And of course, theres the idea that an order of magnitude difference isn't _just_ an order of magnitude difference; it can enable entirely different paradigms and workflows. In the fashion that the shifts in web-capabilities correspond at least to a degree to the shift in network capabilities. Streaming doesn't make sense on a 10kb/s connection, but on 10mb/s the whole world changes

</comment></comment></comment><comment><USER8> I used Atom for a long time till I encountered VS Code - haven't looked back since. The startup time and integrated terminal just make VS Code awesome

<comment><USER9> The debugger clinched it for me.

</comment></comment><comment><USER10> Every Atom release post is filled with VS Code fans talking it up, it's like a law of nature on HN.

<comment><USER11> I was surprised at how popular VS Code was in comparison to Atom: [https://insights.stackoverflow.com/survey/2018/#technology-m...](https://insights.stackoverflow.com/survey/2018/#technology- most-popular-development-environments)

Is it really that much better than Atom? I quite like Atom, but I started to use VS Code for Flutter development.

<comment><USER12> IMO, VS Code is everything Atom should have been and/or is trying to be.

It's the first editor I've used since the original TextMate that worked well straight out of the box, is easily configurable for 95% of customization needs, and has high-quality extensions that don't feel like they're all conflicting with one-another.

I don't know if Atom has gotten any better in the past year, but it never quite felt right to me. Lack of polish and care, I guess. VS Code had me a convert from day one.

<comment><USER13> Too many people in here running PR for Microsoft. VS Code is just as terrible, if not worse, than Atom.. and built using the same bloated framework.

<comment><USER14> I haven't had that experience - I've found VS Code to be much smoother than Atom, but obviously that may vary by platform and the particular set of plugins any one user has.

</comment></comment></comment></comment></comment><comment><USER15> Atom is my go to editor now. It's simple, it's pluggable, and modern. I really like it.

I've been recently using it with FB's Nuclide, but that's such a massive suite of plugins, it might as well be a considered a derivative of it. I can't recommend Nuclide. It's bloated, and breaks a bunch of behavior from vanilla Atom, but it is the only thing that seems to get remote editing right. I just wish someone would get that piece out of put it as it's own plugin.

<comment><USER16> They are:

\- [http://blog.atom.io/2017/09/12/announcing-atom- ide.html](http://blog.atom.io/2017/09/12/announcing-atom-ide.html)

\- [http://blog.atom.io/2017/11/15/code-together-in-real-time- wi...](http://blog.atom.io/2017/11/15/code-together-in-real-time-with- teletype-for-atom.html)

Still beta, though.

<comment><USER15> Neither of these are remote editing. The first one is a link to IDE cruft, and the second is collaborative editing with a a second full atom installation complete with another GUI for you to click "share" with.

Remote editing is logging into a remote machine, and being able to manipulate the files there just as if they were stored locally. Nuclide gets this right [https://nuclide.io/docs/features/remote/](https://nuclide.io/docs/features/remote/)

Various sync plugins aren't reasonable because they want code in both places, which is a complete waste because you'll never run the local code. Alternatively, many of these require various per project config files which is just too much overhead.

The rmate-like plugins look interesting until you find out that there's no integration with the tree view, or any of the project like searching.

Some "solutions" that people point to are simply file transfer UIs, which is just misunderstanding the problem.

This thread really explains the problems with all of these approaches. [https://discuss.atom.io/t/working-with-a-remote-server- throu...](https://discuss.atom.io/t/working-with-a-remote-server-through-ftp- sftp-in-atom-solved-with-nuclide/28781) Sadly, only Nuclide does it right, but god is there a lot of shit with it.

I guess I'll have to go with sshfs, but that's also a bit awkward.

<comment><USER16> I'm always a bit puzzled that people seem to want every editor to re-implement this same feature.

What's wrong with sshfs? That does it at the OS level and it then works for everything?

<comment><USER15> sshfs is slow on macosx. Also, you have to remember to have a separate terminal opened on the remote machine if you want to do any git stuff. Using your local terminal and just cding into the mount point _should_ work, but in practice it doesn't. The commands are just super laggy.

Also, you have to remember to mount and unmount the drive outside of the editor, (especially if you close your laptop for a while), whereas if the editor manages the connection, then it's transparent to your normal workflow.

</comment></comment></comment></comment></comment><comment><USER17> Has anything been done to improve speed? I tried running it on my Surface Pro (dual-core i7 with 16GB of RAM), and it was unusably slow, ate up a lot of RAM.

I like Atom's interface, but it's such a resource hog. So I will continue to stick with Sublime.

<comment><USER18> I use Atom on a 2nd gen core I5 laptop with 4gb ram with no issues. I use it on a mid-gen i5 desktop 8gb on Ubuntu in Virtualbox on Windows aswell. It would be interesting to know what is causing these horror issues some people report.

<comment><USER19> Could be the size of the files. Atom at least used to just crash when you opened a file too big.

<comment><USER18> Atom warns you with very large files (like logs) before you try and open and is not snappy like Vim. However that is yet to trouble me in my pursuit of a code editor. I don't write code that is 300k lines in one file. When I am reading logs I tend to use tail and grep anyway.

I don't see how this translates into general slowness for normal use cases

</comment></comment></comment></comment><comment><USER20> I'm surprised they still suggest to "store your github username and password" locally when they could just as easily suggest to "store your github username and auth token".

Even if it's locked in my OS's credential store, do I really want to trust a text editor with my passwords? Why not suggest the more secure option? How sure can I be that none of the atom plugins I use will try to steal it?

<comment><USER21> You're trusting Github with your Github credentials. As long as it's secure locally, I don't see the issue.

<comment><USER22> The problem are the many plugins that are not trustable

<comment><USER23> They say it's stored in the systems credential store so in theory a plugin wouldn't have access to it anyways.

</comment></comment></comment></comment><comment><USER24> Does it have a proper Windows installer yet? Multi user, Program Files for the code, Appdata for the config, option to install extensions either for all users in Program Files, or Appdata for one user. You know, standards, and more secure when random programs can't alter the files of your editor

<comment><USER25> Nah, they use the one I wrote still

</comment></comment><comment><USER26> I took Atom for a ride, found it slower than VS Code. Not converting for the time being.

</comment><comment><USER18> I know how popular Electron is on HN, but once it's on I really like Atom. From the first install it had sensible defaults for Python, JSON, XML, HTML, SQL which are my main stays. I even like the default colour scheme. Hopefully in time it can start a bit faster...but that's all

<comment><USER27> Have you tried VS Code? It's also on Electron, but is (or at least _feels_) significantly faster than Atom, and also has sensible defaults.

<comment><USER18> Not for a long time, but I have no need to try anything else really. Atom does what I need it to. One slow day I must try VS Code again, for sure.

<comment><USER28> Today is a slow day.

</comment></comment></comment></comment><comment><USER29> Using Debian 9 and Atom currently. I used VSC for a little while but it became unstable. It would often refuse stdin. Maybe the issue was the vim extension, maybe not. Rather than troubleshoot, I went back to Atom and have had no problems.

I work with about five languages just fine.

</comment><comment><USER30> I've looked at VS Code a couple of times, but the Ruby support wasn't very good (syntax highlighting didn't even work completely). Is it time to switch or should I stick with Atom?

<comment><USER31> Yes, it's definitely time to switch away from Ruby...

</comment></comment><comment><USER32> (points gun) Say Visual Studio Code again. SAY VSC again! And I dare you, I double dare you motherfucker! Say Visual Studio Code one more time.

</comment><comment><USER33> I use Atom for Rails development, because it has better Ruby on Rails support than VS Code.

However, I am sick to death of its excessive memory consumption. This morning it was using 1.5 GB of memory.

It's a text editor for God's sake!

<comment><USER34> I do Rails as well. How Atom is better than VSCode for Rails?

<comment><USER33> With its defaults, I find Atom a bit nicer to use than VSCode for rails.

It may just be because I'm more familiar with it, or because I'm too lazy to set up VSCode and get the plugins for Rails dev.

</comment></comment></comment><comment><USER34> Any reasons to switch back from VSCode?

</comment><comment><USER35> Is 1.25 the number of TB of RAM you need to run it?

I'm afraid my workstation only has room for one Electron-based monster(Slack).

Hopefully the Rust re-write improves things.

<comment><USER36> > Hopefully the Rust re-write improves things.

To clarify, I don't think there are any plans to rewrite all of Atom in Rust; the UI will likely always use Electron. They are just rewriting some of the more intensive backend libraries in Rust for performance.

(Someone correct me if I'm wrong.)</comment></comment>


Things to Know When Making a Web Application in 2015 - <AUTHOR> http://blog.venanti.us/web-app-2015/ <comment><USER3> First of all, thanks for the nice writeup. I hate that comments tend to hone in on nitpicking, but so it goes. My apologies in advance.

> If you're just starting out with a new web application, it should probably > be an SPA.

Your reasoning for this seems to be performance (reloading assets), but IMHO the only good reason for using a single-page app is when your application requires a high level of interactivity.

In nearly every case where an existing app I know and love transitions to a single-page app (seemingly just for the sake of transitioning to a single-page app), performance and usability have suffered. For example, I cannot comprehend why Reddit chose a single-page app for their new mobile site.

It's a lot harder to get a single-page app right than a traditional app which uses all the usability advantages baked in to the standard web.

<comment><USER4> I fully agree with this. SPAs are for web _apps_ , not web _sites_.

For websites, you should _always_ use progressive enhancement - there is no reason why you couldn't obtain the same performance gains by progressively enhancing your site with reload-less navigation. That's what AJAX and the HTML5 History API are for.

Especially don't forget that no, _not_ all your clients support JS. And there's no reason why they should need to, for a website.

<comment><USER5> > Especially don't forget that no, not all your clients support JS. And > there's no reason why they should need to, for a website.

Sure there is, if you care about interactivity, responsiveness, and general user experience. The fact that not all potential clients support JS is probably irrelevant, since that number is probably incredibly small. You might as well say that not all potential clients have access to the Internet.

<comment><USER4> > Sure there is, if you care about interactivity, responsiveness, and general > user experience.

And all of these can be provided just fine using progressive enhancement. This is _not_ an argument for SPAs.

> The fact that not all potential clients support JS is probably irrelevant, > since that number is probably incredibly small.

Your use of the term 'probably' suggests to me that you have not run any actual metrics. Here's a short list of some examples:

\- Bots and spiders

\- Low-powered mobile devices

\- Privacy-conscious users who use NoScript

\- Terminal-based browser users

\- Literally every single one of your users until the .js blob has completed downloading

\- ...

Requiring JS for a website is not okay, end of story. We all collectively understood this 10 years ago, and I'm not really sure where along the way this understanding has gotten lost.

EDIT: Forgot that HN has a neutered version of Markdown. Fixed.

<comment><USER5> > Your use of the term 'probably' suggests to me that you have not run any > actual metrics.

What I really meant is that if you have a significant non-JS-supporting visitor base, you almost certainly already know it. There are a huge class of web apps that simply do not have to worry about it. If you know who your customers/visitors are then you should already know how important it is to support non-JS browsers.

> Requiring JS for a website is not okay, end of story.

It's really not the end of story, and it's not your call except for your own web apps. JavaScript is an integral part of the platform that is the web, just like HTML and CSS. You might as well make the argument that "requiring a web browser for your app is not okay, end of story."

> We all collectively understood this 10 years ago

Things were a lot different 10 years ago, and perhaps your reluctance to update your understanding less than once per decade might explain some of your views. You may as well be saying "making a store than can only be accessed over the Internet is not okay, end of story, we all collectively understood this 25 years ago."

<comment><USER6> > JavaScript is an integral part of the platform that is the web, just like > HTML and CSS

I always think it's interesting when people bring CSS into this, because it's actually a very strong counter to the general argument.

By design a user agent is well within its rights to _completely ignore_ any stylesheets attached to a page, and the idea was always that this should be completely OK, partly because you have no idea what the UA's capabilities are, up to and including whether or not it's doing any kind of visual rendering at all.

This isn't a news flash to everyone, but even those already aware of this seem to think the main reason you'd do this is ADA accommodations and those are some kind of minority afterthought. My experience is that this is misguided -- accommodations for unusual visitors _is_ important, but I think the biggest benefit might be that the simpler you make things for the client, the less complicated the engineering tends be, even if you can't import your Java- imitation-of-smalltalk-inspired application paradigm of choice.

And "too bad if you didn't have JS!" position seems to basically boil down to the idea that serving a custom client that consumes JSON instead of HTML as the media type for a given URI is Real Progress™.

Keep things as simple as possible. Don't require JS unless what the application needs to do can't be done without it.

<comment><USER5> > By design a user agent is well within its rights to completely ignore any > stylesheets attached to a page, and the idea was always that this should be > completely OK, partly because you have no idea what the UA's capabilities > are, up to and including whether or not it's doing any kind of visual > rendering at all.

I think that is just an outdated idea that does not apply to highly interactive, long-lived web applications. The user agent is well within its rights to ignore anything it wants, of course, but the user agent is not _owed_ anything by the server. With CSS, or JavaScript, the app may just not work.

<comment><USER6> > With CSS, or JavaScript, the app may just not work.

When it comes to CSS, generally most apps _will_ continue to work even if the CSS is simply ignored.

Because that was one big point of CSS. Separation of presentation from content and function.

It's funny. That kind of separation of concerns is something developers talk about valuing, but the SPA/webapp craze erodes the user-facing aspect of it, even while developers are very proud to demonstrate they're thinking hard about which specific kind of separated-concern architecture they're working with well away from the boundary where an outside user or UA would care.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> If you're new to web application development and security, don't blindly follow the advice of someone else who is also new to web application security.

You should instead have a security audit with people who have experience in security, so they can help you identify where and why you're system is vulnerable. If no one exists on your team/company that does, then hire a consultant.

Security is a hairy issue, and no single blog post/article is going to distill the nuances down in an easy to digest manner.

<comment><USER8> Security is never perfect. It is a deterrent, not impenetrable prevention. So sure, to security people, it is never good enough. To everyone else, a easy to digest blog post might give them food for thought that would make their work one step better than it was before, resulting in security that is still flawed, but better. So why not just accept the post for what it is - <USER2> basic advice to do that one better step.

<comment><USER7> > So why not just accept the post for what it is - some basic advice to do > that one better step.

[http://www.nytimes.com/2015/07/10/us/office-of-personnel- man...](http://www.nytimes.com/2015/07/10/us/office-of-personnel-management- hackers-got-data-of-millions.html)

<comment><USER9> Look up "medium-brow dismissal"

<comment><USER7> I did. Wasn't sure what I was looking for.

[https://www.google.com/search?q=medium- brow+dismissal&ie=utf...](https://www.google.com/search?q=medium- brow+dismissal&ie=utf-8&oe=utf-8)

It's clearly a logical failure to suggest heeding the authors advice would result in a catastrophic security breach.

Not paying attention to security by reason of "I've done a little better than nothing at all" feels like willful negligence.

<comment><USER10> [https://news.ycombinator.com/item?id=5072224](https://news.ycombinator.com/item?id=5072224)

(edit: this is an explanation of what "middle-brow dismissal" is)

</comment></comment></comment></comment></comment></comment><comment><USER11> This is a bit of a pet peeve of mine, but that banner image is 10 megabytes, it can be compressed down to 2mb without any perceptible loss of quality. Heck it could probably be shrunk further if you can accept a bit more loss because most of the image is blurry and noisy anyway.

heres a compressed version: [https://www.dropbox.com/s/bw606t7znouxpj1/photo-141847963101...](https://www.dropbox.com/s/bw606t7znouxpj1/photo-1418479631014-8cbf89db3431_mini.jpeg?dl=0)

<comment><USER12> Good catch.

That is ironic on so many levels.

I mean there is even a section on "UX: Bandwidth"...

Maybe the author should brush up on image compression best practices and consider adding a subsection on images and other media.

EDIT: Realized my previous wording was probably a bit too harsh considering the author is still relatively new to web development.

<comment><USER11> Hard not to catch it when its loaded in progressively on a 20Mbps connection :P. Websites are way too fat these days.

</comment></comment></comment><comment><USER4> > If you can get away with it, outsource identity management to Facebook / > GitHub / Twitter / etc. and just use an OAuth flow.

The thing that everybody seems to overlook here: _this has serious legal consequences_.

You are demanding of your users that they agree to a set of TOS from a third party, that does not have either their or your best interests at heart, and that could have rather disturbing things in their TOS - such as permission to track you using widgets on third-party sites.

Not to mention the inability to remove an account with a third-party service without breaking their authentication to your site as well.

Always, _always_ offer an independent login method as well - whether it be username/password, a provider-independent key authentication solution, or anything else.

> When storing passwords, salt and hash them first, using an existing, widely > used crypto library.

"Widely used" in and of itself is a poor metric. Use scrypt or bcrypt. The latter has a 72 character input limit, which is a problem for some passphrases, as anything after 72 characters is silently truncated.

</comment><comment><USER13> Question about JavaScript and CDN for mobile devices. Should I use a CDN for standard libraries or should I just concat and minify all my JavaScript?

The concat and minify seems better as that reduces the JavaScript libraries and code load to a single HTTP request.

A CDN seems nice in theory. Reality is: Does the browser have the library cached? Is the library cached from the CDN that I'm using? The browser is making more HTTP requests, which sometimes takes more time to request than to download the library.

I agree that using CDNs is a good speed boost. I'm trying to figure out if hoping for a library cache hit out weights a library cache miss.

<comment><USER14> Just to clarify. General CDNs tend to be a good idea of you are having latency issues.

Standard libraries for major JavaScript project, all served from a single shared CDN (like Google, maxcdn, cdnjs, etc) also tend to be called "CDNs" but this is a little confusing. Yes, these shared files are often stored on a CDN, but that's not the so-called major benefit of these shared hosts. The main benefit is supposed to be that, if everyone references the same copy of jQuery on one of these shared hosts, the when visitors hit other sites, jQuery will already be in their browser cache.

This rarely works in practice. The URLs to these shared libraries. Multiple shared services. Multiple version numbers. HTTPS vs HTTP. The net result is that the probability that someone visiting your site has a copy of the exactly same resource referenced via the exact same URL is very low.

With the overhead of having to do a DNS lookup, a TCP connection, TCP slow start, its rarely worth it. Just concat/minify into your own block of JS served from your own systems. Shared JS hosts/CDNs are a terrible and annoying hack, all in an attempt to save 50KB or so

<comment><USER15> Ugh, I will never understand this reasoning. Overheads of fetching library from a CDN are applicable to the first request. Why do you consider this to be an important factor?

Also can you provide any stats/citation that cache hit probability on first request is in fact very low?

<comment><USER14> First, research on hit factor:

[https://zoompf.com/blog/2010/01/should-you-use-javascript- li...](https://zoompf.com/blog/2010/01/should-you-use-javascript-library-cdns) [http://statichtml.com/2011/google-ajax-libraries- caching.htm...](http://statichtml.com/2011/google-ajax-libraries-caching.html) [https://github.com/h5bp/html5-boilerplate/pull/1327#issuecom...](https://github.com/h5bp/html5-boilerplate/pull/1327#issuecomment-14799362)

I have more recent data on this that is not yet published from my day-to-day work at a web performance company. The pictures has improved somewhat, but not significantly.

You are correct, "Overheads of fetching library from a CDN are applicable to the first request" The problem is, because of the fragmentation, every website is asking you to hit a different URL, so every request is a "first request". You aren't leveraging the browser cache.

Most sites are already serving you site-specific JS anyway over a warm connection (even more so with HTTP/2), so there is even less benefit to going to a 3rd party host to potentially avoid downloading a few dozen kilobytes. Couple that with the security implications of injecting 3rd party code into your page, its just plain silly and wasteful to do this for a modern website.

<comment><USER15> jQuery CDN cache hit rate is 99.8%[0], Google CDN numbers should be comparable. So yes, you are leveraging browser cache for most popular libraries.

Also I was talking from the subsequent requests from the same client.

[0][https://www.maxcdn.com/blog/maxscale- jquery/](https://www.maxcdn.com/blog/maxscale-jquery/)

<comment><USER14> You are confusing browser cache hits with a CDN/edge server cache hit.jQuery, or MaxCDN for that matter has no idea what the "hit rate" of a browser cache is.

This sentence should be a big clue: "We usually average around 15,000 hits per second to our CDN with 99.8% of those being cache hits."

"We" in that sentence is Kris Borchers speaking collectively about the jQuery foundation, talking a MaxCDN interviewer. But he is not talking about the browser cache. He can't be, because jQuery, or MaxCDN for that matter has no idea what the "hit rate" of a browser cache is.

Example: If I go to _1.example.com_ , which links to _maxcdn.com /jquery.js_, and then later I go to site _2.example.com_ , which links to the same _maxcdn.com /jquery.js_ file, my browser doesn't send any requests! That is the entire point of far-future caching! I was able to use the version of jquery that was in my browser cache. However MaxCDN, or jQuery for that matter, have no idea this hit took place.

By the same token, if I go to _1.example.com_ , which links to _maxcdn.com /jquery.js_, and then later I go to site _2.example.com_ , which links to a different URL like _maxcdn.com /master/jquery.js_, my browser has a cache miss. /master/jquery.js is not in my browser's cache, I've never been there. MaxCDN, or jQuery for that matter, have no idea that I requested something different then before.

CDN cache hit rate has nothing to do with browser caches. In fact, people that are not you, being able to detect if something is in your browser cache or not, is a massive security problem. See my talk at BlackHat in 2007, Many of Jeremiah Grossman's talks at BlackHat (2006, 2007, 2009), or go all the way back to Ed Felton's work on using the timing side channels against browser caches.

In the industry, "99.8%" cache hit on a CDN's edge server means that 99.8% of the time the edge server can handle the request, instead of the request having to go all the way to the origin. They have no way of knowing how often a random person on the internet loads a random file from their browser cache.

This whole thing proves my point: Calling shared, common, publicly hosted copies of popular JS libraries "CDN's" or "JavaScript CDNs" is just confuses people. CDNs are about reducing latency. Share JS libraries are about trying to avoid requests altogether by leveraging the browser cache, and they are largely ineffective.

<comment><USER16> Maybe they are talking about 200 vs 304 caches.

A browser can use be told to revalidate files, telling the server to return the content using the "If-Modified-Since" and "If-None-Match" headers. This way, the server will return 304 and empty content if the file has not changed or 200 and the file if it is new or it changed

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> >When storing passwords, encrypt them

Nopenopenopenopenope!

This is terrible advice. Don't do this. Remember what happened when Adobe did this?

<comment><USER18> The full quote is:

"When storing passwords, encrypt them first, using an existing, widely used crypto library. If you can get away with it, outsource identity management to Facebook / GitHub / Twitter / etc. and just use an OAuth flow."

Can you elaborate on what's so "nope" about that advice? Are you saying one _shouldn 't_ encrypt passwords?

<comment><USER19> Of course one shouldn't _encrypt_ them, one should salt and hash them. With a cryptographically secure hash such as bcrypt or scrypt.

If you use a batteries-included web-framework, this is already done for you. If you do not, you better understand the tradeoff of redeveloping those parts.

<comment><USER20> I imagine the OP probably meant that and simply wrote the wrong thing in the post. I probably wouldn't have noticed it was the wrong wording if not for this comment chain.

<comment><USER9> The only acceptable advice in this situation is "use bcrypt". Vague stuff about "hashing or encrypting" is not good enough.

<comment><USER21> Wait, what about "scrypt"? Maybe the only acceptable advice changed in the last hour? :-)

<comment><USER9> Bcrypt is a very easy to use hashing tool that exists in all popular languages. It is the best choice, and the easiest to implement.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> > If you can get away with it, outsource identity management to Facebook / > GitHub / Twitter / etc. and just use an OAuth flow.

OAuth isn't identity management, it's for authorization.

Each of those platforms does provide it's own identity management, but that isn't OAuth.

<comment><USER22> I took that to mean use both identity management as well as OAuth.

<comment><USER7> 1\. Why use OAuth unless you want to grant 3rd parties access to your services data, on behalf of your customers?

2\. Security best practices subject to "open for interpretation."

<comment><USER23> While OAuth isn't "for" authentication, everyone uses it that way by "authorizing" access to "view your email address" which is as good as authenticating your email address.

<comment><USER7> Can you link to implementations that use OAuth in such a manner?

Login with FB, Google, Github, Twitter, etc different systems, separate from OAuth.

<comment><USER21> GitHub How To: [https://developer.github.com/guides/basics-of- authentication...](https://developer.github.com/guides/basics-of- authentication/) And the OpenID Connect standard (essentially OAuth V2 + identity service): [http://openid.net/connect/](http://openid.net/connect/)

</comment></comment></comment></comment></comment></comment><comment><USER24> _> All assets - Use a CDN

> If you can get away with it, outsource identity management to Facebook / > GitHub / Twitter / etc. and just use an OAuth flow._

Questionable advice. At the very least neither of these two are some kind of automatic "best practice" everyone should just follow.

 _> it can be helpful to rename all those user.email vars to u.e to reduce your file size_

Or maybe you should less JavaScript so length of your variable names does not matter.

</comment><comment><USER25> One thing to note is login redirect. Please be sure that redirect parameter is local URI and don't redirect user to another site.

Maybe even append HMAC signature to that parameter with user IP and timestamp. Might be an overkill, but still be careful with craftable redirects, they might become vulnerability one day.

<comment><USER26> True, open redirects can cause serious security issues. Do not have an route that simply does the equivalent of `return redirect(params["url"])`, either at login or anywhere.

</comment></comment><comment><USER27> "You don't have to develop for mobile..."

... well, no. Technically you don't _have_ to. But you almost certainly _should_.

<comment><USER28> Was surprised to see this too, considering the article's title is Things to Know When Making a Web Application in _2015_

If anything the advice should be inverted by replacing 'mobile' with 'desktop'

<comment><USER29> Yes, even moreso now since it hurts your Google page rank to not make your app mobile friendly.

<comment><USER27> I believe it only hurts your google rank for searches conducted on a mobile device.

So, most searches, then.

</comment></comment></comment></comment><comment><USER30> As a web application developer in 2015+ I would argue that developing with mobile in mind should be required. At least taken into consideration. At bare minimum have a pre-deployment test: is my app unusable/does this look terrible on the most popular iphone/android.

<comment><USER31> And that it passes Google's mobile check, so it doesn't get penalized in SERPs.

</comment></comment><comment><USER32> For mobile apps that use WebView and/or has the capability to execute javascript or any other language provided by any network available resource I'd like to add:

ALWAYS USE CRYPTOGRAPHY for communication! Simply doing HTTP to HTTPS redirects is not sufficient. The origin request must be via HTTPS. Also make sure the app is properly validating the HTTPS connection.

Sorry I had to shout, but I'm growing tired of downloading the latest cool app that is marketed as secure only to find that it doesn't use HTTPS and as a result I can hijack the application UI to ask users for things like their password, credit-card number, etc., all without them having any way to tell if they are being asked by some bad guy.

</comment><comment><USER33> How to make a reasonbly-decent webapp in 2015 without having to worry about bcrypt and open redirects and such:

1\. Use a widely-accepted framework.

2\. Implement your application using that framework's methods.

Why a beginner would implement even 1/3 of this list manually is beyond me.

<comment><USER34> I think this is more of a question of what kind of project or team you are working on, not one of experience in web development. Because it seems that you're suggesting beginners use Sails or Meteor (if focusing on JS), which are great and allow for rapid prototyping, but they and other 'high-level frameworks' that implement these methods for you tend to be very opinionated with important details of developing for the web abstracted away.

If you're a student or are serious about learning web development (and want to focus on developing in JS), it would make a lot of sense to dedicate your time to actually learning Node and Express, figuring out all of these hairy details and 'manually' implementing the items in Venantius' list.

Or don't figure out the hairy details, because many of his items have proven and documented solutions in the Node context, and learning how to properly use bcrypt and passport isn't too difficult. These libs are a good middle-ground between low-level details and something more out of the box.

</comment></comment><comment> martin-adams >> When users sign up, you should e-mail them with a link that they need to follow to confirm their email

I'm curious, why is this good? Sure, sending an email to them so they confirm they have the correct email, but what is the benefit of the verification step? Is it to prevent them from proceeding in case they got the wrong email? It would be nice if this was justified in the article.

I would also add, that changing a password should send an email to the account holder to notify them. Then when changing the email address, the old email address should be notified. This is so a hijacked account can be detected by the account owner.

<comment><USER21> This may not be the writer's reason, but I tend to get people's e-mail accidentally. One time someone signed up an iTunes account with my email, then kept requesting new verification emails. Most of these automated emails do not have a "this isn't me" link, since they assume that the person who signed up and the person getting the email are the same.

</comment></comment><comment><USER35> > The key advantage to an SPA is fewer full page loads - you only load > resources as you need them, and you don't re-load the same resources over > and over.

I don't know much about web development, but shouldn't those resources get cached? Isn't the disadvantage of SPAs that you are unable to link to / share a specific piece of content?

<comment><USER36> > Isn't the disadvantage of SPAs that you are unable to link to / share a > specific piece of content?

Actually, this is achievable with push states, so isn't a strong argument against single page apps.

I think the problem with SPAs is that they exacerbate memory leaks, since they don't have the typical 'reset' of a browser page load to clear them. Also, a lot of SPAs re-implement browser functionality like scrollbars and the back button without proper cross-browser testing - let alone usability testing.

Conceptually, there's nothing wrong with SPAs, but many of the implementations are shoddy at best with no clear advantage gained.

</comment></comment><comment><USER37> One big omission from this list: gzip. Before you ever think about uglify, make sure you're gzipping your textual assets.

</comment><comment><USER38> Rails has most of this out of the box. Use Rails :)

<comment><USER39> I think, even Django also has most of this stuff.

</comment></comment><comment><USER40> I like this list.

> Forms: When submitting a form, the user should receive some feedback on the > submission. If submitting doesn't send the user to a different page, there > should be a popup or alert of some sort that lets them know if the > submission succeeded or failed.

I signed up for an Oracle MOOC the other day and got an obscure "ORA-XXXXX" error and had no idea if I should do anything or if my form submission worked. My suggestion would be to chaos monkey your forms because it seems that whatever can go wrong can. Make it so that even if there is an error the user is informed of what is going on and if there's something they can do about it.

</comment><comment><USER41> > Avoid lazy transition calculations, and if you must use them, be sure to use > specific properties (e.g., "transition: opacity 250ms ease-in" as opposed to > "transition: all 250ms ease-in")

Why is it better to be specific?

</comment><comment><USER42> I was surprised at the lack of mention of SVG. The biggest change to my working habits (apart for working in a SPA) is that every non-photographic image I use is now SVG.

<comment><USER12> Don't be surprised. See this: [https://news.ycombinator.com/item?id=9866461](https://news.ycombinator.com/item?id=9866461)

</comment></comment><comment><USER43> >If you can get away with it, outsource identity management to Facebook / GitHub / Twitter / etc. and just use an OAuth flow.

Has anyone built a lasting stand-alone business that relies on Facebook, et al for identity management?

<comment><USER44> Tinder? Facebook only when I tried. Valued > 1 $bn

[http://www.businessinsider.com/jmp-securities-analyst- note-o...](http://www.businessinsider.com/jmp-securities-analyst-note-on- tinder-2015-4)

</comment></comment><comment><USER45> When using SPA, validate CORS origin instead of allowing *.

</comment><comment><USER46> Internationalization?

</comment><comment><USER47> _> For all of its problems with certificates, there's still nothing better than SSL._

Yes there is. It's called Transport Layer Security (TLS).

</comment><comment><USER48> web2py is a batteries-included framework that has all of this and much more done for you, tested and proven over many years.

</comment><comment><USER49> I was thinking to make a web app for my college project. Can you please help me with some inspirations for my project ? :P

</comment><comment><USER50> Hey uncss supports dynamically added stylesheets too (via running in through PhantomJS).

</comment><comment><USER51> > sent to a page where they can log in, and after that should be redirected to > the page they were originally trying to access (assuming, of course, that > they're authorized to do so).

Smells like an information discolsure highway. I usually 404 all requests that hit "unauthorized" content.

</comment><comment><USER41> > Confirm emails

Why?

<comment><USER52> It's for authentication. It's kinda like: you (email server) know this person, then we (developer) know this person.</comment></comment>


Streaming Anomaly Detection Using Randomized Matrix Sketching [pdf] - <AUTHOR> http://www.cse.psu.edu/~kasivisw/randsketch.pdf <comment><USER2> If I see correctly, this is essentially an online version of Halko's algorithm for truncated SVD, applied to the domain of anomaly detection? (with some cool additional error analysis)

If so, there has been an efficient implementation for this in the gensim library for a couple of years. Would be interesting to see a direct comparison.

<comment><USER3> could you point where in gensim is that implementation. tks</comment></comment>


Palm Pre Review - <AUTHOR> http://www.boygeniusreport.com/2009/05/29/palm-pre-review/

<comment><USER2> _The only problem with this is, Palm's never been a hardware company that anyone's really cared about. They have been the furthest thing from innovative since circa-2003 — their hardware has always been second rate at best and it doesn't seem to be changing now. Couple that with the nation's underdog carrier at a $299 price-point (before rebate), and we're not sure how many people are going to be lined up overnight, yet we're pretty confident once people are able to play a real unit themselves, there will be more than a lot of happy Palm Pre customers._

That's kinda the feeling I'm getting too. As a Sprint customer who is eligible to upgrade, I'm really excited - finally a WebKit based browser in a Sprint phone! However, I wish Palm could have been more competitive - on price, on applications, and on hardware. Not that it's terrible or anything on any of those fronts. It's just that it would be nicer if it were a tad more competitive when compared with the iPhone. Would a glass screen have killed them? Maybe a preliminary SDK for games? Maybe not require the rebate?

Well, I'm excited! New phone!

<comment><USER3> If you go to Best Buy, you don't need the rebate. You just buy it for $199.

<comment><USER4> Yep, and don't forget: Sprint themselves are contemplating dropping the mail- in rebate in favor of an instant one (according to Gizmodo).

</comment></comment></comment><comment><USER5> I was excited that maybe there would be a phone with the PalmOS calendar/todo/notes I _still_ wish I could use (really REALLY don't care about physics engine based UIs) and a 3g data connection. Instead it looks to be another shoddy knockoff of the iPhone. About the only thing it has going for it is the form factor, but even then I wish it wasn't a slider. Android at the very least has hardware independence in mind, where exactly is Palm headed?

</comment><comment><USER6> I really like the keyboard!

The future of the developer network and app-store is the real question here. How are they going to build that?</comment>


Thunderbolt Flaws Expose Millions of PCs to Hands-On Hacking - <AUTHOR> https://www.wired.com/story/thunderspy-thunderbolt-evil-maid-hacking/ <comment><AUTHOR> The research itself: [https://thunderspy.io/](https://thunderspy.io/)

</comment><comment><USER2> Are there really millions of PCs with a Thunderbolt port? It's mostly some NUCs and expensive laptops that have one.

<comment><USER3> It'a actually hard to get one with it. Our go-to vendor for mobos, SuperMicro, doesn't have it on board or in an add-on card for their workstation product line.

[https://www.supermicro.com/support/faqs/faq.cfm?faq=26987](https://www.supermicro.com/support/faqs/faq.cfm?faq=26987)

From the article

> All the evil maid needs to do is unscrew the backplate, attach a device > momentarily, reprogram the firmware, reattach the backplate, and the evil > maid gets full access to the laptop,"

There's a lot you can do with this sort of access. The "evil maid" could also hide a camera in the room that can see the computer's keyboard and get passwords, etc. I wouldn't worry too much about this risk. Not too many laptops can be quickly unscrewed and put back together these days....</comment></comment>


The Overton Window and Political Control - <AUTHOR> http://thefutureprimaeval.net/the-overton-bubble/ <comment><USER2> > it has become much easier to build intellectual conversations outside of the > overton window of the universities.

I don't believe that is true. In fact the problem with the current rhetoric is that academia, (that is, the part of academia that can publish (thus the part that passes the review of its peers)) pushed its fringe identity politics rhetoric to the mainstream media, instead of the actual economic issues that cause the global Trumpism[1]. It's not a new phenomenon - academia always had control of the media rhetoric.

On the other side, conspiracies have always existed. From my european perspective, it actually amazes me how everyone is surprised and looking to russian conspiracies for explanations, when we have had this propaganda phenomena for a very long time under the cold war from both sides (and i doubt they caused a huge swing in democracies). Social media doesn't really make such a huge difference, because social networks have always existed, just not online, and just less transparent to everyone. I think Occam's razor would suggest it's much easier to explain your election results on economic terms (again, [1]) than doing a witch hunt.

1\. [http://www.realclearpolitics.com/video/2016/11/18/mark_blyth...](http://www.realclearpolitics.com/video/2016/11/18/mark_blyth_global_trumpism_and_the_revolt_against_the_creditor_class.html)

<comment><USER3> Yes, the tension is mainly economic. Without a vision of opportunity everyone operates from a zero-sum game perspective. Identity politics becomes a way of marshalling power to fight over fixed resources.

Blyth has the best analysis of the changes the West is undergoing. I recommend the video you linked to everybody.

<comment><USER4> I agree, except that the fixed resource is votes, not economic resources (which everyone here knows are not fixed in any practical sense).

Democracy is a vote market, and strong identities are the strongest persuasive tool available for acquiring votes. Strong identities we know of are skin color, religion, and universalist ideologies (think communism).

Once a particular identity, or combination of compatible identities becomes large enough to have a chance at becoming a winning coalition, the logic of the democracy market almost guarantees it will be deployed for that purpose. Even in the absence of underlying economic factors.

TLDR; democracy has a lot of very scary failure modes, and the US has been lucky to avoid them because until very recently, there haven't been strong competing identities, so people have been free to argue over tax rates.

<comment><USER5> _I agree, except that the fixed resource is votes, not economic resources (which everyone here knows are not fixed in any practical sense)._

But doesn't this Presidential election at least suggest that enough people got unhappy about the _very_ "fixed" (more like steadily declining) economic "resource" known as the working class job to swing the election to Trump?

All the raw statistics, from labor force participation to suicide rate changes, suggest your point isn't correct, except in a theoretical sense, or "any practical sense" except in the very long term.

</comment></comment></comment></comment><comment><USER6> Could someone well-versed in "political sociology" provide one or two primary sources for the concept of "Overton window"? None of the links from its Wikipedia page end up in anything like a published study.

Just to be clear-- I'm talking about a paper that a) makes a hypothesis about public policy, b) presents relevant data, and c) makes a conclusion based on the results of that data.

Edit: removed redundant line

<comment><USER7> I think you are unlikely to find what you want, because the idea of the "Overton window" is not especially controversial, in the sense that it's basically a shorthand for a number of not-especially-new-or-different concepts that have been around, and are widely understood to exist, for a while. It's not really a new concept as much as it's just shorthand for "the range of acceptable opinions that reasonable people can have" on a particular issue. In fact, you could probably find/change every instance of "Overton window" to that phrase, and not lose very much, but you'd gain a bunch of extra syllables in the process. Humans love data compression.

<comment><USER6> That makes sense for a policy wonk enumerating potential positions and situating them between two extreme poles to find an efficacious strategy, or perhaps a group looking to change opinion on a currently fringe idea. I can imagine that being a clarifying exercise.

But it's sheer confusion to use that same concept as a metric for freedom of thought. Suppose that respectable opinions on encrypting messaging apps, treating dimentia, and political correctness all shifted and narrowed in the last 10 years. So what? You must still look into the details and context of each shift to have any idea whether or not speech got stifled in the process. So I don't understand how reference to a narrowing "Overton window" (or "Overton bubble") has any explanatory power wrt freedom of thought.

</comment></comment></comment><comment><USER8> So what is actually outside the Overton window?

My preliminary list would be

\- human neurological uniformity

\- anti-Semitism

\- Islamophobia

\- ethnonationalism

\- conspiracy theories

\- libertarianism and Objectivism

Also there is a kind of inverse-Overton, subjects that can be safely debated because they are unlikely to lead off the reservation. For instance abortion and gun control. Everything's already been said.

</comment><comment><USER9> Exercise for the reader: analyze how this (purely political, off-topic) post itself attempts to take control of an "Overton window" to position its preferred side of the left/right trope.

Here's a hint: liberal academicians and "people using social media to communicate directly to citizenry" do not, in fact, constitute a dichotomy.

<comment><USER10> Exercise for you: join the actual conversation instead of preaching from above like a schoolteacher and wielding the red marker that is the flag button when it doesn't follow your orthodoxy.

It's funny though, because the other day there was a free speech debate at the University of Toronto where a gender ideologue explicitly denigrated her opponent's outreach on Youtube as amateurish videos unworthy of consideration. Despite him being a tenured professor. [1]

Then again, both his opponents also expressed how dismayed they were that this debate was taking place at all, after they reinterpreted its topic as being offensive to common decency. They ignored the indecent actions from their camp that led to it though. It seems liberal academicians do not like debate of any kind, official or otherwise, they'll just bang on about empathy and care while denying it to those they disagree with.

[1] [https://www.youtube.com/watch?v=JDvj6DQd93o](https://www.youtube.com/watch?v=JDvj6DQd93o)

<comment><USER9> Nothing you wrote responds in any way to my comment. The irony is, in response to an actual criticism of the article† _you_ decided to preach for three paragraphs without acknowledging any part of that critique.

I'm also not an academician, or part of the academy in any sense (I joined the workforce at age 18), which makes your specific choice of sermons, well, dumb.

† _which might or might not be valid (I think it is, but then I wrote it)_

</comment></comment></comment><comment><USER11> Lots of abstract conceptualization, not a single concrete example or piece of supporting evidence. Alluring rhetoric, but vacuous.

<comment><USER12> If he mentioned the heresies, this post would not be read by those in the Overton bubble. An example, in the Overton bubble the cause of all differences in outcome between people is discrimination or perverse socialization. This leads to the following reasoning:

Programming is a well paying, desirable job.

White, Asian, Indian, and Jewish males are over-represented in the trade.

All people have identical abilities and preferences on average, therefore the demographics of a profession should exactly match the census.

We note that this isn't the case, therefore these demographics are the result of a subconscious and economically counterproductive racist and sexist conspiracy.

Our reigning ideologies believe in a Lysenkoism of the mind, despite all psychometric evidence. There really are blogs with better epistemology on this topic than the top universities in the Overton bubble. Ideological indoctrination is the practice of instilling in people priors of 0 and 1 on certain topics, immunizing them against empirical experience. It is the practice of making geniuses more deluded than fools.

<comment><USER13> > All people have identical abilities and preferences on average, therefore > the demographics of a profession should exactly match the census.

That is rubbish. A straw man. I've spent more than a decade within the so- called Overton bubble at a university, and this is decidedly not the consensus as I experienced it.

All biology is known to yield population variation. That is obviously true by necessity. However, there are both ontogenetic and phylogenetic influences on outcomes. The progressive/egalitarian view is that the cultural dynamics that result from small population differences (that are in any case too high variance to be reliable for making individual discriminations) should not inhibit phylogeny. Put another way, an individual's self-expression should not be limited by the fact of their membership in a particular category.

Further, while there may well be, in lab settings, reliable significant population level differences, these differences at an individual level may entirely be swamped by cultural influences, rendering them insignificant.

Lastly, the _sources_ of the population differences may, in some instances, be factors that are entirely culturally malleable. Males as a population may have a slight predisposition not to understanding mechanisms better, but instead to finding them interesting, which over the course of development leads to greater competence. This predisposition may be easily changed at a young age by an encouraging mentor or compelling Hollywood film. Similarly, someone may be predisposed to kidney failure not because of bad kidney cells, but because they don't have as strong a compulsion to drink water (a deficit trivially remedied).

<comment><USER12> I agree that the best evidence of a person's intelligence and inclinations is their phenotype, not the average of their racial group or sex. Thus, race and sex should not be used as a proxy for any characteristic when employing people. We don't need proxies when we can directly measure - though note, some forms of measurement (such as culture fair IQ tests) are illegal for anyone but universities to use in employment, a delightful hypocrisy.

Nonetheless, those parts of academia that define the narrative on these topics (sociology, history, feminist academia, and political science) do not believe there is significant non-cultural variation in any economically relevant trait among the sexes or ethnically distinct populations, and put anyone who openly states the obvious through a struggle session that usually results in their firing, as happened with Summers. Though the vast majority of psychologists admit that IQ is largely genetically heritable, accepting the consensus of the twin studies, any future inference about what this implies is outside the Overton bubble.

Just as not knowing disease was caused by small invisible germs made us unable to treat disease properly, our inability to admit that intelligence and stupidity are caused by small, invisible alleles has made us unable to treat social pathologies properly. The distribution of intelligence is grossly unfair. But we can fix it if we are willing to admit its cause. Let us seize the high-IQ alleles and distribute them to the proletariat!

I think there is a deep sense in which education as a treatment for stupidity is like wearing perfume to prevent the plague.

Also, acknowledging these differences prevents racism. Antisemites love pointing out that jews are overrepresented in many high-status occupations, postulating crazy conspiracy theories for why this is the case. But once you acknowledge the IQ gap (Ashkenazi Jews score roughly a standard deviation above gentiles in most psychometric tests) we have an entirely benign explanation and it's evident that these conspiracy theories hold no water.

These differences are a perfectly valid subject of inquiry of very little use to the individual, but becomes necessary to discuss when progressives beg the question, assuming falsely (just as antisemites do) that underrepresentation in cognitively demanding endeavours necessarily implies discrimination that isn't based on ability.

<comment><USER13> It is obvious that genetics matter. What isn't obvious is how, or how much.

Ontogeny is context dependent at every scale of analysis. As such it is sensitive to precise manipulation in myriad ways, the vast majority of which are likely not yet known. We remain profoundly ignorant of what intelligence is, let alone what underlies it.

It's likely that large population differences are the result of a synergistic interaction of genetics and culture, with each depending on the other. Ashkenazi Jews benefit from one such interaction, but there may well be many others yet to be discovered.

I disagree that the social theorists as a whole are entirely ignorant of basic biology. I think they would argue that the cultural forces swamp genetic signals often enough to be worthy of criticism.

There are no doubt theorists with views that are more extreme, but the appropriate response isn't to counterweight by going further in the other direction.

Group membership cannot be destiny. If it is we're not free.

</comment></comment></comment></comment></comment><comment><USER14> We have an Overton window here on HN. It's enforced through downvoting. I would very much like to see downvoting eliminated, or at least modified so that a small number of upvotes can counteract it.

There are a number of perfectly reasonable comments in this thread that carry the stain of appearing in light gray.

EDIT: It appears that I've been downvoted, and I don't know why. Anyone care to explain?

<comment><USER15> Here's my idea to help - [https://news.ycombinator.com/item?id=12412788](https://news.ycombinator.com/item?id=12412788)

Rather than each comment having a global score, each user sees comments scored based on their voting history. This means non-conforming opinions no longer get buried for everyone.

An upvote should mean "I'd like to see more of this" not "I'd like everyone to see more of this".

<comment><USER16> I agree with your use of 'downvoting' to remove content personally but less so the correlation to 'upvoting'.

Just because there's an up button and a down button close together, and clearly the intent that they are correlated, doesn't mean that the usage in practice is the same.

A vote up means that the post is on topic, and relevant of showing to others preferentially in the eyes of the voter.

A vote down is often used on topics that the voter simply /disagrees/ with, irrespective of relevance to the topic.

Therefore I would propose that 'mixed votes' indicate a contentious, but likely on topic, point of discussion for further discourse and refinement.

There should clearly be a threshold (a large number of votes, with a vast majority of them negative) for indicating actually harmful content.

</comment></comment></comment><comment><USER17> TL;DR: The Internet allows people to self-publish ideas, uncontrolled by universities which [according to the article, really!] were the main gatekeepers of speech before.

<comment><USER18> > universities which [according to the article, really!] were the main > gatekeepers of speech

This erroneous concept seems to have spread to this writer via Curtis Yarvin (of Urbit/Strange Loop fame/infamy.)

It seems superficially valid because the media loves to use witnesses of academic prestige that back its own agenda. However, it should be clear that the ultimate gatekeeper has always been the media, not any media-selected credentialed proponents of whatever position the media wants to be seen as the most prestigious and scientifically valid.

<comment><USER12> I don't know much about Yarvin but I imagine his point is the universities indoctrinate the teachers and the journalists who in turn indoctrinate the public.

<comment><USER19> It baffles me that university professors, who are in front of a minority of the population for typically only 4 years, are viewed as having all this control, whereas the people who literally own the media, who can arbitrarily hire and fire any voice they please, are viewed as somehow having less sway over their own company's output.

<comment><USER5> You're ignoring the power they have to shape minds during that 4 year period, which is particularly powerful for residential students who are out of the nest for the first time, how they can keep doubleplusungood people out of a lot of professions by not letting them graduate (it's now getting explicitly official in some, and personally sobering for me, the moderate conservative- libertarian I was in 1979? No way today I could become a scientist in the US today), and apropos of that, _they control who gets to teach K-12 students_ , the Overton Window in K-12 curricula (which has had a serious allergy to effective teaching of reading for close to a century now, and much later math), etc.

<comment><USER19> I don't disagree, but my point is that it's still less power over media than those who actually own the media have.

If universities are really brainwashing people, then those who own the media can just not hire those brainwashed people. Power over hiring is the ultimate level of control over any organization, media companies included.

You can make the argument that the media needs an audience, and if the masses are brainwashed then they have to speak in that language. But if you're talking about non-objective-truths such as values, and those values are so widespread that media has to cater to them - that's not brainwashing, that's just popular culture.</comment></comment></comment></comment></comment></comment>