Stand Desk deducting 15% from all refunded, undelivered orders - <AUTHOR>

Long time HN follower here. I've just never been concerned with sharing my thoughts with the public until today.
Many of you may be aware of Stand Desk's presence as a Kickstarter project. They offer an affordable, seemingly well-thought-out electric stand desk. The problem is they haven't delivered to most backers. On top of that, they miscalculated shipping costs and upset a flurry of Kickstarter backers.
Through all of that, I was ok with it all. I understand the process of starting a company. There are unforetold paths, missed dates, etc. Anybody who has worked in software understands this, and I'd like to foolishly believe they'd also be able to relate to company trials and tribulations such as Stand Desk's. I even emailed Stand Desk a couple of months ago to say it's ok to run into problems, and that no startup executes exactly as planned. I was sympathetic at that point.
However, my circumstances have changed. I no longer need the desk. I will no longer be working remotely from home, I'll be in an office. I emailed Stand Desk today to ask for a refund, which they replied to in a quick and timely manner. There's just one catch. They want to charge me the 15% for wanting a refund, but I haven't even received the product yet. They're telling me that they incurred costs from Kickstarter and Amazon. Apparently 15% worth.
To me, it sounds like they're placing the fault with me. The mere fact that I placed an order with them, puts me at blame for their Kickstarter and Amazon fees. This sounds like a poor choice of business ethics to me.
Somebody please tell me I'm not being unreasonable to expect a full refund. A company that is delivering promises shouldn't be worried about a few, simple 100% refunds, which leads me to believe they've had even more people wanting a refund, and are struggling to place the blame with themselves. <comment><USER2> Kickstarter is not a marketplace, it's a crowdfunding site. The projects looking for funding are not companies taking orders, they're people looking for startup capital to give their best effort at _becoming_ a company. You can't hold them to the same standards as a retailer with cash flow and profits to spend on making people who've changed their minds about a purchase happy.

You pledged to back the company, not just buy a product, and they're offering to let you renege on that pledge at cost. That's generous. The fees are real (Kickstarter and Amazon both take a ~5% cut). So are the risks you agreed to take on -- Kickstarter makes it pretty clear that projects don't often go as planned and that backing a project isn't the same as preordering a product. Late delivery is something to be expected, and "I've changed my mind" is never a reasonable reason for a refund when not offered (store refund policies are, for the most part, completely voluntary things; they have no obligation to take back non-defective goods after you've purchased).

In short, I think you're unreasonable to expect a full refund from a high- ticket KickStarter pledge, so long as they haven't given up on trying to deliver. Take the 85% refund if you must, or wait until the desk is delivered then sell it.

<comment><AUTHOR> I see your point. I knew the risks ahead of time, and raise you the fact that I received an email about logging in to their site to give them my address and pay for shipping. This was over a month ago. I sent Jason @ Stand Desk and email, explaining to him that I paid via Amazon, and I have no account on their site. And they don't allow you to "sign up." The account must pre-exist. I never received a response from him, so I _could_ pay for shipping.

At this point, it felt like they wanted my money so they could get their ball rolling, but when it came to shipping, they chose not to solidify the sale and allow me to receive anything. I wanted to pay for shipping and give them my address so I can get my desk.

To me, this doesn't sound like good business practice. I understand they're busy, but not returning an email from a paying customer who's wanting to pay even more, albeit just delivery, leaves me to question their goal. It seems like they're trying to buy more time before they send out another round of emails saying "we're delayed again." It's bad enough I've received a couple emails and read several posts about this, and on top of that one about how they miscalculated shipping entirely and upset everybody. Shipping went from $80 to $160 for people across the country. I was perfectly fine with that too, and emailed them saying it was ok, but I wanted an update. That was September, and they promised me a desk in late October, early November. Here we are now, no update for me, and I can't even pay to get the desk delivered if I wanted to.

Somehow this is my fault?

</comment></comment><comment><USER3> Sounds like they have refunded 100% of what they got of your pledge. The rest of your money is with Kickstarter & Amazon. I don't think they even had to give you a refund at all for your pledge. In my mind it's akin to asking a charity for a donation back. Remember Kickstarter is not a store.

</comment><comment><USER4> I understand your frustration and anger. I've been there myself. However, I think you should be angry at Kickstarter.

They've created an environment where people can make promises they don't keep. After all, Kickstarter makes more money if promises are convincing (as opposed to realistic).

So far, I've never backed a project that delivered what they promised. They've certainly never delivered it on-time.

Kickstarter is, and should be marketed as, a gamble. You should never buy something you _need_ there, nor should you expect to get what you "bought". It's not a marketplace.

Kickstarter is asinine for letting these disappointments continue because they're letting the "Kickstarter is full of empty promises" stereotype take hold.

<comment><AUTHOR> I don't mind the waiting. I've waited an extra 2 months for the desk anyways. If my circumstances hadn't changed, I may have continued waiting. My frustration purely is due to how they handled my request for a refund.

Companies should be built to also take losses too, no? I view it like this... if I bought a product, received it and decided it was too small and wanted to ship it back, that's my fault. I would undoubtedly incur a restocking fee. Also, if I received the desk, it'd now be my responsibility to sell it online if I didn't want it. But I haven't received anything at all, so to me this isn't quite computing.

What you said is indeed a shame about Kickstarter. This is the first and only project I've ever backed, and it'll be my last. Lesson learned. I appreciate your feedback.

<comment><USER5> _Companies should be built to also take losses too, no?_

This is the key issue. Real companies build in some financial breathing room but Kickstarter projects don't. This puts them in a precarious position where their only choices are to under-deliver or to declare bankruptcy and probably deliver nothing. So if the rules are "full refund or else", you'll probably get the "else".

<comment><AUTHOR> I agree, but it doesn't and shouldn't make the buyers the ones at fault. Just as the buyers are accepting that the project may be late or may never, ever show up, which is the case with several, the companies should accept that it may upset some users, and refunds will be expected in full.

To my knowledge, and I'm no lawyer (obviously), but not refunding a buyers money in full for a product undelivered doesn't seem legal.

And even if it were legal, it doesn't mean it's good practice to treat the buyer as the enemy.

<comment><USER5> I think this kind of behavior comes from incompetence (setting prices too low), not treating customers as the enemy. Refusing refunds probably isn't legal; you can consult FTC regulations for the details. I'm sure you can get a full refund if you either do a chargeback or threaten to file an FTC complaint. Just consider whether putting them out of business is worth your 15%.

</comment></comment></comment></comment></comment><comment><USER6> Most payment systems will allow sellers to issue refunds either free or with low flat cost (e.g., $.30). But Kickstarter is a different beast. I think they're probably only losing 10%, but maybe they're factoring in the cost of sending you money or if they incurred currency conversion or banking fees.

Ethically, you presumably wanted to support this company, but now you're actually asking them to lose money.

If you really just want your money back, in addition to chargebacks, ask your credit card company about your coverage in the event of refund/re-stocking fees. Some cards offer protection to cover you in this situation. Also, when initiating a chargeback, you can ask the credit card company to do a conference call with the seller and that might persuade them to do 100%, to avoid chargeback fees and potentially losing their processing account.

</comment><comment><USER7> File a chargeback. Since you haven't received the pre-ordered product in the agreed time-frame your credit card (if its Visa) will likely accept it. I don't see Stand Desk having a good chance of winning the dispute since they didn't uphold their end and their current documented solution is to refund you 85% of the original amount.

To the downvote: I think its reasonable for a kickstarter campaign as successful as this one (one where they're effectively an established company coming out of it) to be able to accept these edge cases as cost of doing business. Feel free to comment if you disagree.

<comment><USER8> I don't like the idea because it's lending value to the argument that Kickstarter is a retail pre-order service. It isn't. People pledging money for projects need to understand that there are many factors of risk involved.

<comment><USER7> The spirit of kickstarter is not a pre-order service but ultimately that is how many projects (this one included) leverage it. Even Kickstarter has admitted this via the changes they've made to their policy in regard to product based campaigns.

I certainly would agree that chargebacks are an inappropriate response as a blanket statement for dealing with kickstarters but in cases where the campaign is widely successfully and marketed primarily as a means to pre-order I see nothing wrong it.

</comment></comment></comment><comment><USER9> I think that was pretty nice of them to give you a refund.

<comment><AUTHOR> That's akin to a kidnapper expecting to receive a thank you from a child they just gave bread crumbs and rusty water to for dinner.

I am far from a self-entitled individual, but I expect proper communication from the company I've given $499 to in faith of receiving a product. I refuse to act like I'm a sufferer of Stockholm Syndrome.

<comment><USER9> Then you don't understand what kickstarter is or how it works. It's not the same as a pre-order at amazon. Read the terms at kickstarter, when you make a pledge you aren't entitled to a refund because you changed your mind. This company replied in a timely fashion and offered refund of 100% of the money they actually received from the individual.

You're kidnapping analogy doesn't make any sense. Kidnap victims are taken and held against their will. Who forced you to back that kickstarter campaign?

<comment><USER5> If everyone persists in misunderstanding Kickstarter despite being reminded, does that mean everyone is wrong or Kickstarter is wrong?

<comment><USER9> You're assuming that 'everyone' misunderstands, however that's not the case. Most people get hot it works, it's the people that aren't happy about something that post about it. If it was most people then kickstarter wouldn't be the success that it is.

it's similar to reviews for products, they are always biased to the negative. When you buy something and it just works how you expect, you probably don't go to the website and leave a review, you just go about your day. It's when it doesn't work as you expect that you are going to go post a review about it.</comment></comment></comment></comment></comment>


Show HN: ReviewsApp – The easiest way to track your App reviews - <AUTHOR> http://reviewsapp.in

<comment><USER2> It's free for up to 5 apps, great for indie developers and small business</comment>


As Climate Changes, Taxpayers Will Shoulder Larger U.S. Payouts to Farmers - <AUTHOR> https://www.npr.org/sections/thesalt/2019/07/24/744541143/as-climate-changes-taxpayers-will-shoulder-larger-u-s-payouts-to-farmers <comment><USER2> IMHO a strategy of deliberate over-provisioning for food makes eminent sense, so I have no qualm with that "market" being artificially supported.

Naively modeled as a service, if humans "timeout" for food at about two weeks, and there are 7.5B of us, I would want a system who's p99.9999999999 < 14 days.

The problem w/r/t climate change is we're taking the existing system we have, which already does not meet that target, and we're dialing the Chaos Monkey up and up and up.

<comment><USER3> As the chaos monkey dials up speculating on food becomes more profitable too, mitigating at least some of the risk. If I expect harvests to fail on a significant scale, buying up huge warehouses of grain (or other storable food) and selling it when prices soar is a great investment strategy.

As climate change makes disruptions more frequent I wouldn't be surprised if some investment fonds started launching their own cubesats to feed their prediction models to spot such opportunities before everyone else.

<comment><USER4> In theory... In practice, if you think harvests will fail, futures contracts make the whole warehousing thing moot.

Arbitrage and clever tradable (or even non tradable) contracts (eg contract for difference) give you an opportunity to speculate on the price of grain without you (or anyone) actually holding any wheat.

In practice, you just bet someone else that the price will go up, and they pay you the difference if you're right. No wheat has to be stored.

There is very little relationship between derivative markets and the quantity of commodities siloed.

If you want an emergency "buffer stock," you need to buy and hold actual commodities.

<comment><USER5> If enough people bet on wheat prices to rise, futures contracts get expensive compared to the current price of wheat. This opens the opportunity for someone to rent a warehouse, fill it with wheat, and then take the opposite side of the futures contract (i.e. lock in a high future selling price for your wheat), yielding a guaranteed profit.

So if futures prices ever show a price increase greater than the cost of storage, people will start filling warehouses with wheat everywhere. It's just that normally commodities don't increase in price at a rate that exceeds the cost of storage.

<comment><USER4> The warehouse is a theoretical construct, in practice. Whatever the market does and whatever investors want their position to be (long, short..), they can take that position without any physical wheat actually entering or leaving a silo.

<comment><USER6> But the arbitrage is settled physically.

When oil-storage was filling up, oil-futures drop in response (because the market knows that physical space was running out).

That's the thing about the world: people exist in it, and can change the world. Increasing the number of warehouses (to make more money) is a good strategy, and the futures contracts provide a means for allocating these investments more efficiently.

</comment></comment></comment></comment></comment></comment><comment><USER7> I found the last few paragraphs about most of the study's authors leaving USDA because of relocation of their agency to be pretty poignant. Looks like a last hurrah in the face of this administration's campaign to shutdown independent science in general and climate science in particular.

</comment><comment><USER8> I'm quite surprised indoor farming powered by renewable energy isn't being taken more seriously.

I remember seeing these concept towers where food was grown inside in what was essentially a 40 stories of hydroponic grow rooms co-located inside cities so transporting of food was easy.

I guess I'm insanely naive about growing food at scale and indoors (I've dabbled with produce on a small scale) but why hasn't this approach taken off?

<comment><USER9> Farmers in Ohio basically plow empty, undeveloped land, plant seeds, use pesticides sometimes, and nature does the rest. They don't even irrigate, rain comes down from the sky and waters the crops.

The purchase price of farmland in Ohio is about $5000-6000 per acre.

You're talking about building a skyscraper as if crop production can generate enough revenue to justify that expense and somehow compete with all the other farmers who are just using the land as the found it a couple hundred years ago.

The cost to build a parking garage space is $20,000-$30,000 - and parking garages are just a slab of concrete. You'd still have to add in the costs of irrigation and artificially light the crops.

And then, how do you efficiently harvest vertical farms? Farmers in Ohio drive a giant vehicle over the generally flat and square field. How are you harvesting a vertical farm without huge labor costs in comparison?

There's actually nothing "green" about this vertical farm idea when you think about the extra power, concrete, and construction material requirement needed to realize it.

<comment><USER10> You comment is a good reasoning to combat climate change as an existential threat.

<comment><USER9> Yes - this year in Ohio is a great example, many farmers are rained out of planting much of anything at all.

Hit up the Ohio turnpike around Toledo and notice that at least half of the fields aren't even planted (just an eyeball guess on my part, take that "at least half" with a grain of alt). Rain has been too heavy this year and a lot of wheat and corn either couldn't be planted or the crop looks absolutely pitiful.

</comment></comment></comment></comment><comment><USER11> Hopefully, the necessity to deal with climate change will cause the government to run out of money for the ludicrous subsidies of corn for ethanol, cheap HFCS, large agribusiness, etc.

It might also cause the U.S. government to be forced to start to acknowledge and deal with climate change.

<comment><USER12> The government can't run out of money unless you do.

<comment><USER13> A government that prints and thus creates its own money can't run out of money.

<comment><USER14> A government that prints too much money eventually makes it worthless and then "runs out" of it, though. See also: Venezuela, Zimbabwe, Weimar Germany.

<comment><USER15> Both of these are right, rather than contradictory: a government can always keep printing its own currency. What it can't print is _foreign_ currency. So hyperinflation shows up as a forex and balance of trade phenomenon first. As was the case in all three of those examples:

Zimbabwe's land reform destroyed the productive export-led farming industry, so the cost of required imports such as oil drove the Zim dollar into the ground. Similarly Venezuala trashed its oil export industry and failed to develop others.

Weimar Germany was required to pay reparations in gold to France. The postwar destroyed industry wasn't able to export enough goods to pay for the gold, so yet again other imports became prohibitively expensive.

The US is very, very unlikely to experience these kind of problems; it is large enough to not be so dependent on imports, and in recent years not even on oil. The last inflation spikes were due to OPEC: yet again import-led inflation.

<comment><USER14> I disagree. You don't get 79,600,000,000% (in Zimbabwe's case) inflation long after your farms had been idled. The price of goods in foreign "hard" currency actually remained relatively stable after some initial shocks, but the actual inflation was in Zimbabwe dollars after the gov't printed more Z$, which the majority of people there got paid in.

If you study monetary history in the US, you'll find that the OPEC angle of the 1970s inflation was a scapegoat, and the real causes were politicians (in that case Nixon) refusing to raise interest rates (which indirectly slows monetary growth) because it would cool the economy and affect his popularity. It's a prime reason why the Fed (and most central banks in the world) now have "independence" to set rates. If the high cost of oil was all it took, we'd have had higher inflation during the oil spike a decade ago. Heck Germany, which has to import 100% of it's oil, saw it's inflation levels DROP in the 1970s as they raised rates to tame inflationary pressures.

<comment><USER16> That is interesting. Can you recommend some good sources on these economy laws? How can I convince somebody that increasing interest rates, an unpopular move, should prevent large inflation, which is something people want?

<comment><USER15> It's a complex subject, but the ECB seem to have a fairly decent explainer: [https://www.ecb.europa.eu/mopo/intro/transmission/html/index...](https://www.ecb.europa.eu/mopo/intro/transmission/html/index.en.html)

Broadly, cheap credit -> more purchases by individuals and business -> demand expands relative to supply -> prices and wages rise ; or vice versa. The unpleasant side effect of this is that there is a minimum level of unemployment for the policy to work (NAIRU, "non-accelerating inflation rate of unemployment")

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> Just like all the profits made from the "war on drugs" government will just view climate change taxes as a new source of revenue with no incentive to truly end the problem.

</comment><comment><USER18> Farming is an activity that is critical to the national economy and a strategic asset. It's not like this is some boondoggle bridge to nowhere. Seems kind of like FUD spreading to say that we spend $8B subsidizing crop insurance and then saying we'll pay more (which is obvious, IMO) and acting like this is a problem without even floating an number for that future cost. And this is coming from someone who's against most farm subsidies.

<comment><USER3> I agree that farming as a whole is important, but how does subsidizing crop insurance help? Why can farmers not just pay 100% of their insurance premiums instead of only 40%?

<comment><USER19> We can either pay for the risk via subsidized premiums (40%) or through increased food costs (100%). Subsidizing the premiums is arguably less efficient (bureaucratic overhead on taxation) but is progressive in a progressive tax system.

</comment></comment></comment><comment><USER20> Farm subsidies make us have less diversity in our diet because only a certain short list of crops are insured. America makes way too much corn and soybeans, and we should be using that land for something else that could create more value. Not mentioned how soy and high fructose corn syrup get shoved into every food item because of these.

Farm subsidies are anti-capitalist. Milk is a perfect example of how this is an issue, I can get a gallon of milk for about 2 dollars in the USA. It should cost about 8 dollars. The cost difference is made up by farm subsidies. There are many cheaper ways to get the nutritional value provided by milk, but the US government is choking these industries out. If the free market were to decide milk would not be a beverage and only used for cooking because it would be impractical to drink.

I am all for a safety net for farmers, but the farm subsidies need major restructuring with the American consumer and the small farmer in mind, instead of the farm industry and the profits of some of the biggest corporations in the world.

<comment><USER21> >It should cost about 8 dollars

8 bucks? I know that farm subsidies drive down costs, but a 4x increase seems quite high to me.

<comment><USER22> In trade negotiations, the Canadians argued that 73 percent of returns to milk producers in the US are governmental subsidies, but not sure how that squares with the store price.

<comment><USER21> I'm willing to bet that even if farm subsidies went away, the price would at most double. Milk is really popular, and there's no way that supermarkets would let one of their highest volume products soar up in price like that.

</comment></comment></comment></comment><comment><USER23> Socialism for Big Ag so they can insist on cut-throat capitalism for the rest of us.

</comment><comment><USER24> In permaculture we say, the problem is the solution. That farmer should take 1/4 of his land and have airplanes drop rice. The worst case it doesn't work but he learns a lot, the best case is he has a new crop for when this situation occurs.

When life gives you lemons, you make lemonade.

<comment><USER3> I don't know much about farming, but I wouldn't expect a corn farmer to be equipped to suddenly farm rice. None of his machines really work for that, and manual harvesting seems out of the question at US wages.</comment></comment>


Simple tool to share plans visually over email. - <AUTHOR> http://nathancahill.com/calendar/

<comment><USER2> It's claiming my email is invalid - you may want to double check your validation code. It's rejecting firstname.lastname@example.com

(pause)

It's also rejected a xxx.com address, so now I have no idea what email addresses it expects.

EDIT: Note, the "xxx" is simply a redaction - these are genuine email addresses I'm trying.

EDIT: Over an hour later and it's still rejecting email addresses - what does it expect?

EDIT: In short, it's very pretty, I'm trying to use it, it doesn't work for me.

<comment><USER2> OK, so now each time I click the box it says "invalid email address", and yet it has in fact delivered a few emails.

<comment><AUTHOR> Yeah, there was a bug. Fixed now :)

</comment></comment></comment><comment><USER3> Excellent tool. You might want to add support for timeslots, and multiple recipients (if not supported already).

<comment><AUTHOR> Yes! Now live with multiple recipients. Separate each email with a comma.</comment></comment>


Show HN: I Wish There Was An App For – submit your app ideas and we build it - <AUTHOR> https://iwishtherewasanappfor.com/ <comment><AUTHOR> I Wish There Was An App For is an online community run by an app studio where anyone can submit app ideas. We (the app studio) will choose one winning idea per month (crowdsourced by the community) and build it. Want to see your app idea come to life? Submit your app idea and let's make it a reality.

This project was well received by the Product Hunt community; we were #1 Product of the Day on September 18, 2018, #1 Product of the Week (September 18, 2018) and #5 Product of the Month (September 2018).

Also you can support us on Product Hunt by visiting our page - [https://www.producthunt.com/posts/i-wish-there-was-an-app- fo...](https://www.producthunt.com/posts/i-wish-there-was-an-app-for).

</comment><comment><USER2> I wish there was an app for [https://www.surveyking.com](https://www.surveyking.com) its the only way their online survey tools could really be any better</comment>


Tesla Motors Inc. Stock Downgraded (TSLA) - <AUTHOR> http://www.thestreet.com/story/11641455/1/tesla-motors-inc-stock-downgraded-tsla.html

<comment><USER2> Automatically downgraded by an algorithm, not by a human analyst. Not terribly significant news-wise, since e.g. the algorithm can't realistically take into account the recent positive reviews of Tesla's new models.

<comment><USER3> Nor does it take into account the difference between a startup and a mature company. Of course their net margin has taken a dip, they've been tooling a factory _so they can sell cars_.

</comment></comment><comment><USER4> is this a hatchet job? the article is suspicious.</comment>


Performance Comparison Between ArangoDB, MongoDB, Neo4j and OrientDB - <AUTHOR> https://www.arangodb.com/2015/06/performance-comparison-between-arangodb-mongodb-neo4j-and-orientdb/ <comment><USER2> I did a lot of research on graph database technologies recently and read a lot of these "let's compare X to Y" articles. What I found is that most benchmarks - especially those done by people affiliated with a given product - often tend to show a distorted and sometimes plain wrong picture.

For example, concerning the performance and scalability of graph databases the main argument of proponents of this technology is the "join bomb" argument, which states that you can't efficiently store a graph in a relational database since it will require O(log(n)) time to lookup neighboring nodes from the index when crawling the graph. However, this is of course only true for B-tree indexes, whereas hash-based indexing would give you basically the same performance (O(1)) on a graph implemented in a relational database.

Additional features like documents and deep indexes are nice of course but can be (and often are) implemented using relational databases as well, so in the end there really isn't such a large advantage to be gained from using a graph database, especially when taking into account the immaturity of many solutions in that space.

<comment><USER3> >Additional features like documents and deep indexes are nice of course but can be (and often are) implemented using relational databases as well, so in the end there really isn't such a large advantage to be gained from using a graph database, especially when taking into account the immaturity of many solutions in that space.

I've worked with graph data stored in rdbms in the medical informatics space. As you say, there are ways to correctly handle complex graph data in rdbms.

I've also used neo4j as the backend for a wall street analytics app that's in production. Could it have been done in rdms? Sure, but the ad hoc queries that needed to be run against the data were much easier to express as graph traversals than SQL.

There are some obvious downsides with using a graph database, mainly that it's practically impossible to find programmers with non trivial production experience, but it's been a great fit at the two startups I used it at since I got to implement it from the ground up and didn't need a large team.

That being said, database pragmatism is the main lesson to be learned here. Use the right tool(s) for the right jobs.

<comment><USER4> (Disclaimer: Max from ArangoDB here) I am all for database pragmatism. Fortunately, the choice "graph database" or "non-graph database" is no longer binary. We at ArangoDB are convinced that graphs in data modelling have their merits (namely when you need "graphy" queries), but you do not want to be locked in to the graph data model. Therefore we argue for multi-model databases, which can give you graphs, but do not force you to use graphs for all and everything. With "graphy" I mean queries that involve paths in a graph whose length is not a priori known (e.g. ShortestPath).

</comment></comment></comment><comment><USER5> Rant warning:

After working with Neo4j for about six months I would definitely NOT recommend it to anyone. In my experience it has been the least reliable and most buggy database solution I've ever worked with.

From the engineering point of view it has a host of core issues that make it really hard to write code, such as constant deadlock exceptions. These are caused by the fact that the database is largely incapable of handling two simultaneous upserts if those upserts touch the same node. Where most mature, decent DBs can handle this completely transparently Neo4j just panics and returns an error. This means writing Neo4j queries ends up requiring tons of boilerplate to wait for exclusive locks on nodes and/or retry upserts until they succeed.

From the devops perspective managing a cluster is also extremely painful, as there are frequent issues with replicas getting behind on syncing due to the server's pathetically slow write performance even with SSD storage volumes. We tried everything but the bottleneck was the server processes themselves, not the storage volumes, network connection, CPU, etc. We threw some really nice hardware at our Neo4j cluster but it still struggled to keep up with write loads in the range of 500-2000 writes per minute.

The final straw was their latest version 2.2 which they were advertising as a massive improvement in speed and reliability. When we upgraded it turned out to be the exact opposite. A few of our queries got faster but overall most of them got an order of magnitude slower. Their support basically told us that we'd need to rewrite many of our queries or manually set a flag to use their older query engine (and therefore miss out on the speed of the new query engine). Needless to say we decided if we needed to rewrite queries we were going to rewrite them to use a different storage engine entirely.

In my experience Neo4j was little more than a six month waste of time and dev resources.

<comment><USER6> Hi,

I'm Claudius, the author of the blog post. The intent of the blog was not to show, that a particular product is not performing well. There are thousands of different use cases and each database has its strengths and weaknesses. For a different scenario the results might be different. Neo4J is a solid product and is doing a good job. The aim of the blog was to show, that multi-model can compete with specialized solutions. What I wanted to show, is that a multi- model approach per se does not carry a performance penalty.

<comment><USER7> > Neo4J is a solid product

Do you really believe this, in your expert opinion, or are you just trying not to step on toes?

<comment><USER6> We are a multi-model database, which is not in a strict sense a competitor but is competing with Neo4J in some areas. Therefore I'm definitely not a Neo4J expert. However, I'm now working in the field for over 15 years, developing in-memory solutions, databases and application servers. Developing ArangoDB for almost three years and I have talked to a lot of people in that area and to people who are using Neo4J. There are always obstacle when moving to new products. But most of the people who I met are quite happy with Neo4J.

</comment></comment></comment></comment><comment><USER8> IMHO, the community needs a set of specific tasks that can be achieved with all databases (just like [http://benchmarksgame.alioth.debian.org/](http://benchmarksgame.alioth.debian.org/) has a series of algorithms for testing different memory/CPU strengths of languages). Then, proponents of each database (e.g., their sponsors, evangelists) can create code and config for running the tests on their database. This could all be open source, and the tests could all be run on the same host (or hosts) for comparison.

This seems to make sense, and is more akin to what [https://www.techempower.com/benchmarks/](https://www.techempower.com/benchmarks/) has done, IIRC.

<comment><USER9> You have recalled correctly! That approach is precisely what we have taken with the TechEmpower benchmarks.

</comment></comment><comment><USER10> When I compare databases, I also search out the performance comparisons created or sponsored by my preferred database provider, then I know that I can trust the results to be complete and unbiased./sarcasm

Seriously, why is this one of the top stories on HN? These types of tests are so easy to tweak in favor of a perferred database that they are completely unreliable. Even neutral comparisons by third parties are rife with errors like not adding proper indices to all the DBs or using query formulations that avoid the indices on some DBs or other configuration issues (DBs are unfortunately tricky.)

I think the only way to do this objectively is to have a test and then give each DB vendor an opportunity to tweak the DB and queries to optimize performance. Seeing how DB vendors optimized performance would actually be very informative to potential users. Everything else is just a comedy of errors (or worse) as normally people usually only have good expertise in one of the DBs in question, if that.

<comment><USER11> > I think the only way to do this objectively is to have a test and then give > each DB vendor an opportunity to tweak the DB and queries to optimize > performance.

AFAIK they are: the test is open source, the raw results are there, and contributions welcomed. Hopefully the OrientDB team will step up and show how theirs can perform.

<comment><USER12> Hey all, we sent a Pull Request 2 days ago to the author of the Benchmark, as they used OrientDB incorrectly. Now OrientDB is the fastest in all the benchmarks, except for "singleRead" and "neighbors2", but we know why.

We are still waiting for the Arango team to update the results...

<comment><USER11> > Hey all, we sent a Pull Request 2 days ago [...] We are still waiting for > the Arango team to update the results...

Let's see: 1\. You sent it at the weekend 2\. The Arango team have a life 3\. It took you 9 days to send the PR 4\. The start of the week always is busy, regardless of which company you work at...

Give over and stop trying to make out there is something suspicious in whatever the Arango team do. It makes you (look like) a jerk.

</comment></comment></comment></comment><comment><USER13> I would love to see postgres in the mix.

<comment><USER14> Likewise. I started some stuff at work recently comparing Mongo, Orient and PG (using a JSON column). Alas, all the test suite does so far is insert small "documents" (5000 docs w/ 3 name-vals excluding PK/ID) and time that. No read- back tests of any kind yet, so no indices in place either.

For this little test (on my macbook), Mongo was the fastest. PG took 1 1/2 times as long, and Orient took 4 times as long as Mongo. All 3 were driven by a Java client connected via a socket to the DB on localhost. (Orient could have been "in process", but I wanted it external as if on a server)

Of course, the main use-case for Orient is reading back graph chains, so it's a horrible test. However, what we need is a supplemental store to dump some flat junk as the app runs.

</comment></comment><comment><USER15> Worked with Orient back in 2012, had some issues regarding performance and switched. Following the news about them, I thought they had made great progress. This benchmark kind of shows the exact opposite.

</comment><comment><USER16> The conversation is continuing here: [https://groups.google.com/forum/#!topicsearchin/neo4j/time/n...](https://groups.google.com/forum/#!topicsearchin/neo4j/time/neo4j/E5LsTfwROb8)

</comment><comment><USER17> Are you sure that you optimized/tuned Neo4j or MongoDB as much as you did with ArangoDB?

Also, I don't like when a company posts a comparison between its product and others. Although some of them are arguably informative and objective, I consider these posts as marketing/ad posts.

<comment><USER4> (Disclaimer: Max from ArangoDB) We have invested considerable effort to optimize each database. Obviously, we know our own product better than the others. However, we have asked people who know the other products better, and we keep this investigation open for everybody to contribute and to suggest improvements. As you can see from last week's post, there have been very good contributions, we have tried them out and have published the improved results.

</comment></comment><comment><USER12> Hey all, we sent a Pull Request 2 days ago to the author of the Benchmark, as they used OrientDB incorrectly. Now OrientDB is the fastest in all the benchmarks, except for "singleRead" and "neighbors2", but we know why we're slower there.

We are still waiting for the Arango team to update the results...

However, who is interested in running the tests themselves, just clone this repository:

[https://github.com/maggiolo00/nosql- tests](https://github.com/maggiolo00/nosql-tests)

</comment><comment> nevi-me Will be interesting to see the 'alpha' test results, interested in seeing how the MongoDB 3.2 series would perform there

</comment><comment><USER18> Anyone using ArangoDB in production who can speak about it? It looks interesting, but like many of the newer databases coming out (Aerospike, Blazegraph, Hyperdex etc.) there is precious little public information from third parties.</comment>


Next-Gen Mask Challenge - <AUTHOR> https://www.xprize.org/prizes/nextgenmask <comment><USER2> Consider compressing the schedule. By the time you pick a winner we will have moved on to COVID-20.</comment>


Java 7 - <AUTHOR> http://blog.tmorris.net/java-7/?utm_source=twitterfeed&utm_medium=twitter <comment><USER2> I didn't think the elvis operator (?:) made it into java 7?

<comment><USER3> It didn't. Several people point this out in the comments.

<comment><USER2> I posted here before those comments were made. Perhaps should have posted there instead.

</comment></comment></comment><comment><USER4> I don't fully get it. Is that blog post basically a "Scala is so much cooler then Java" post?

I must agree that the "We want our language to do everything, and with everything we mean more SymtaX!" approach Java is driving at the moment is not very cool, though. They should continue to optimize for enterprise software and enterprise dimensions as this is what Java is quite good at.</comment>


Silicon Valley Firms Make It Nearly 'Impossible' for Cambridge to Hire AI Staff - <AUTHOR> https://www.forbes.com/sites/samshead/2018/07/06/silicon-valley-firms-make-it-nearly-impossible-for-cambridge-to-hire-ai-staff/#17a37dd73a71 <comment><USER2> UK STEM academic salaries are an embarrassment.

<comment><USER3> That is probably true, but what university is going to pay a prof $1M USD? I think the issue remains valid. Also I doubt it's only UK salaries that are crappy these days.

<comment><USER4> The UK vs US salaries are not even in the same ball park.

Sure they can't afford $1M but in general you are lucky to get $110k+ in the UK even if you have 10 years behind you, even more so outside of London, in London the money doesn't go that far.

It's a no brainer, if you can get a visa and happy to move even if for a few years it can make a big financial life difference.

</comment></comment></comment><comment><USER5> I wonder why Forbes takes so long to set cookie preferences. No other site requires this - given their early adoption of anti-adblock, is this an attempt to make browsing with opt outs unpalatable for users?</comment>


Show HN: Websites in 2018 - <AUTHOR> https://2018.bloomca.me/ <comment><USER4> I found a few bugs: It only has one JS file, and that isn't even 3KB. Needs to be at least 3MB. uBlock only blocks 2 items, not 30. It doesn't have infinite scroll, a sticky header, a fake chat window that pops up and says, "Shana from support is here to answer any questions"... Oh, and the back button still works.

<comment><USER5> Publishers live and die by Google. They do everything they can to try and milk out ANY ROI from ANY visitor to try and sell/market/promote.

Users don't really visit websites anymore - they sit on facebook/google/Reddit/hacker news. So you have to REALLY market to those few people you get from Google search results... as Google really wants you to BUY those users from them - not write good content to get them (even though that's what they say to do..)

one day you can be doing well with google - making enough money a day to pay for your hosting and then next day, serps change and your traffic tanks and you then spend more money to try and correct it and you start copying what others say works - email lists, live chats, exit ads, moore mobile ads - <USER2> pray you start earning high CPMs and you start looking to arbitrate - <USER3> cheap traffic to hopefully pay less than what you earn to get more traffic and you start falling for fiverr deals that are fake an SEO tricks that penalyze you in the end and before you know it, you're 20k in debt running a website that most people leave within 30 seconds and even though you may have solved thousands of people problems my helping them fix something, learn something, do something or expereince something they choose to create a facebook post or tweet about it rather than comment or join your community - so those big giants earn a LOT more revenue on publisher backs.. for the average deal, facebook and google will earn 80 plus bucks a year on what you do, but us lowly publishers will spend more than that per user to try and ink out some successs

and in the end, the irony is that a website set up to show how bad the industry is will end up with more links, more traffic, more google juice, and higher link authority than a publisher with thousands of hours of work put in being creative, helpful and insightful..

and you wonder why the web is getting so painful :)

<comment><USER6> > penalyze

I'm not usually one to point out spelling errors, but this mistake is so serendipitous given your usage of it.

penalize + paralyze = penalyze? Somebody call up them Merriam-Webster folks!

<comment><USER7> Reading this I've never felt more British; those Z's hurt my eyes!

</comment></comment></comment></comment><comment><USER8> I was in the AWS control panel yesterday and it popped a modal at me and I habitually swatted it so fast before I realized "Oh snap, I'm in my AWS account - that might have been something important" and had no way to get it back. Page refreshes didn't regenerate the modal.

Sad that I've turned into one of Pavlov's dogs and that very reasonable methods of increasing functionality have been abused so much that they are no longer useable.

<comment><USER9> I honestly consider this one of the most important computer skills, and its something you can really only get by understanding the different layers (is my prompt the os, software, which framework was it written in, a browser prompt, a website prompt, etc) and that is: what happens when i click [ok] [cancel] [x] (blankspace) etc. Its probably one of the most inconsistent experiences on a computer. One popups Ok is anothers x is anothers cancel.

Ive seen most prompts before. I know what pressing cancel or ok on each one does without thinking. And if I dont know what it does, I have to pause and figure out the consequence of each button.

And when I watch other people use computers, they will close things, and I ask them "what was that" they often respond "I dont know, I didnt ask for it, so I closed it." There seems to be a persuasive misunderstandig that dismissing a prompt will leave everything in its previous state, and that it cant make any changes.

<comment><USER10> I'm always amazed at peoples' ability to observe users, and when user behaviour doesn't match up with the intended design, think "Hmm... the users have a pervasive misunderstanding. They need to be educated to understand the design."

Could it be that the model you describe doesn't fit the mental model of a typical human very well? Could the cause of this "pervasive misunderstanding" be bad design, rather than dumb users?

<comment><USER9> Its not about education. Its about a mindset. Trying to understand the consequence of your action before you click. Reading what a box says before dismissing it.

Read your prompts before closing them isnt the same as "the users have a pervasive misunderstanding." Its usually panic. Its "im not a computer person so Im not even going to try reading this."

Have you ever had the conversation:

"This came up on my pc, what do I do"

"What does it say"

"Oh"

</comment></comment></comment></comment><comment><USER11> Good grief. I didn't last more than 6 clicks or so. This is in the "so real it hurts" category.

The only thing you've got wrong is page load time and overall responsiveness. This needs at least a couple more MB of JS.

Good work.

<comment><USER12> Agree, it definitely loads too fast to be a site 2018. \s

</comment></comment><comment><USER13> I thought it was a list of some unqiue interesting websites in 2018 and robotically started dismissing these things until i started getting a little furious when it hit me. Good work, it definitely fooled me.

<comment><USER14> How far did you get until you got it? It took me until just after the email subscription modal... _sighs_

<comment><USER15> I think the fake "do you want notifications?" notification kind of gave it away for me.

</comment></comment></comment><comment><USER16> I'm not certain this is 2018. I saw the words and letters immedately instead of gray rectangles showing me where words and letters could be before being shocked by the appearance of the actual words and letters.

<comment><USER17> The "gray rectangles showing me where words and letters could be" is so prevalent that Facebook used them in TV ads.

[https://youtu.be/Q4zd7X98eOs?t=39](https://youtu.be/Q4zd7X98eOs?t=39)

<comment><USER18> Wow now I understand, what a great way to make users squint to read grey blocks and lines...

</comment></comment></comment><comment><USER19> Oh god. This is so accurate. I think the GDPR is overall a good thing, but I wish they'd encoded respecting browser sent preferences into law, rather than requiring a user-visible prompt everywhere.

<comment><USER20> It's insane how P3P from 2002 was more advanced than anything the EU can come up with now.

<comment><USER21> The EU didn't come up with any protocols, advanced or not. The GDPR is not even specific to the internet, let alone specific ways of getting consent. It's up to the industry if they want to use fancy protocols to do so.

<comment><USER20> Nobody has confidence that an explicit "I don't care about cookies" setting would satisfy GDPR.

</comment></comment></comment></comment><comment><USER22> Almost perfect, actually needs the following: Needs to be material UI but poorly implemented so it's really slow. Needs a "do you have time for a short usability survey?"\--bonus points for stacking it _on top_ of the cookie notification. The "got it" button on donate/adblock needs to shame the user more. There needs to be an on-hover action for some of the buttons that causes an alert to push the about-to-be-clicked button down so the user accidentally navigates away, then, when they navigate back, have to re-do the process.

</comment><comment><USER23> I was exposed to this idea a few days ago via this tweet: [https://twitter.com/burgervege/status/1053557632265527296](https://twitter.com/burgervege/status/1053557632265527296)

I enjoy the result of releasing this experience into the wild.

</comment><comment><USER24> As a publisher of the medical technologies news website (since 2004), I can tell you that what we have now is monopolized internet.

Few entities, like Google and FB, took over the internet and crafted the landscape to their advantage. They monopolized ads revenue, search traffic, and more importantly, they are actively spying on the general public, taking away any possible advantages from publishers. The result is a dearth of advertising money for publishers and regulations aimed at destroying any attempt to take over these behemoths.

When was the last time you saw GFPR notice on Facebook or Google? Do you think publishers enjoy having "Please Donate" pop-ups? When was the last time you heard of investment rounds in online publishers?

In the olden days we had websites and blog networks being born, Gawker, Weblogs Inc, TechCrunch network, political networks, etc etc. And what do we have now? Central stations with fake news shenanigans and retarded memes. While publishers, including your local newspaper and your favorite websites, are struggling. And that's the story behind all these popups.

<comment><USER5> pretty much spot on. We have to change our habits if we want the web to survive. I'd love to get rid of google tag mamager/analytics/facebook pixel and all that jazz and it would be nice if people would signup with patreon and donate a few bucks a month so i could work on publishing vs milking every visitor...

wish there was a way that people would realize that getting back to smaller communities and supporting publishers is actually a good thing

<comment><USER24> This internet monopoly is bad for our IQ, our society and our democracy.

</comment></comment></comment><comment><USER25> There is a tweet going round with a similar (but more glossy) video

"Every website in 2018" by @darylginn

[https://twitter.com/darylginn/status/1053646859686809600](https://twitter.com/darylginn/status/1053646859686809600)

edit: which is something to do with the 'UX Live' channel on telegram which OP also mentions

</comment><comment><USER26> Totally unrealistic. It loaded way too fast. It should have: weighed 12MB, taken 10 seconds to render properly on 4G, text jumping wildly around the page while it did, and have slowed my pocket supercomputer to a stuttering mess everytime I scrolled.

<comment><USER27> Also, everytime you click somewhere to highlight something or tap to scroll, an ad should load under your finger and redirect you to the product.

</comment></comment><comment><USER28> One that I "like" the most is the "We'd welcome your feedback" popup that appears the moment I open a website...like how am I suppose to give you any positive feedback if you are preventing me from using your damn website in the first place!

</comment><comment><USER29> Since pretty much every engineer under the sun knows this experience sucks, how can we attribute this to anything other than the rise of MBAs running the show?

<comment><USER30> Let's run through it:

1\. Do you want to receive notifications: Business or marketing request

2\. Your privacy/cookie warning: Likely legal requirement.

3\. Age requirement: I'll assume it's an 18+ site, so requested by legal dept.

4\. Subscribe to our newsletter: Marketing request

5\. Disable adblock: Business request

6\. Donate: Business request.

7\. Did you find what you were looking for: UX request

8\. Something went wrong: Engineering

<comment><USER31> 2\. For the vast majority of sites, this is a Business request, since the cookies aren't necessary for operation. They're just for tracking. A login cookie being set would trigger the legal requirement, but a user with no account shouldn't even see the box.

<comment><USER32> > A login cookie being set would trigger the legal requirement,

Are you talking about the EU privacy and data protection directives? Because they have an exception for Authentication, Session and Security Cookies as well as several other types of cookies which are necessary for the function of the site.

A user that is logged in should not need to see this either.

</comment></comment></comment></comment><comment><USER33> Drives me nuts, click a link to read an article, get 2 sentences in and then:

"Want more content like this in your inbox?"

I may have considered it if you allowed me to actually read the content first, but I certainly don't now.

<comment><USER34> Not to mention the guilt trip if you don't find the close button. "Yes, sign me up!", "No, I don't give a shit about myself and my loved ones."

</comment></comment><comment><USER35> Would've been good if, in spite of just being text and a few buttons, it had been built with react, redux, redux-saga and had some contorted webpack build resulting in five JS bundles.

</comment><comment><USER36> Don't forget the JS library that senses your mouse position so that when you move your mouse up to the tab bar, it opens a final "Wait, don't go! Here's a free e-book, etc." modal on the page.

<comment><USER18> I've never seen that, do you have an example link you could share?

<comment><USER37> Here's an example (that you can add to your own Wordpress, too!): [https://www.brontobytes.com/blog/exit-popup-free- wordpress-p...](https://www.brontobytes.com/blog/exit-popup-free-wordpress- plugin/)

For more real-life examples, just try searching for some cake recipes. Cooking web sites _all_ have this.

</comment></comment></comment><comment><USER38> Too real! The chat popup is missing? Or I couldn't find it

</comment><comment><USER39> ads blocked -> mine monero instead, also missing autoplaying video as a background, scrolljacking and some weird bug in non-chromium based browser

<comment><USER40> Scrolljacking is _so_ 2016.

<comment><USER41> so the 2018 version would be the page being a fancy animation that you play by scrolling, right?

</comment></comment></comment><comment><USER42> Where are the auto playing video ads at full blast?

</comment><comment><USER43> Related reddit thread from 2 days ago, on the video that inspired it:

[https://www.reddit.com/r/funny/comments/9q22c2/every_website...](https://www.reddit.com/r/funny/comments/9q22c2/every_website_in_2018/)

</comment><comment><USER44> I would change that second to last screen to be about browser compatibility. A site being down/broken happens, no matter what year it is. But the fact sites like BofA do not support a common browser like FireFox I feel is much more in line with the other nonsense in this demo.

<comment><USER45> Added bonus if there's a link to a list of supported browsers, and your browser is actually on that list, but it still pops up that warning.

</comment></comment><comment><USER46> "Translate this page" is missing.

<comment><USER47> Isn't that a chrome feature? I've never seen a website give me that directly.

</comment></comment><comment><USER48> I used to make sites when i was a kid in the 90s. i want to get back into webdev but without all the complicated stuff. How can i make an html only site? any site builders like dreamweaver in 2018?

<comment><USER49> GitHub pages is free and great for static websites.

<comment><USER50> He said "without the complicated stuff" and "Dreamweaver". Github Pages is all command-line and uses Git for file transfer, does it not? I think the OP is thinking drag-and-drop folders through FTP like good ol' Dreamweaver.

</comment></comment></comment><comment><USER51> Chrome and the other browsers should be slapped actually. Of all the popups the one that annoys me the most is the chrome (I'm assuming other browsers do it too) thing that tells you to run things in the background or web workers or notifications or whatever it's doing.

That should never have been architected that way. It annoys me the most because its the freaking browser that is being an annoying little shit. My browser shouldn't be part of the problem it should be the solution.

</comment><comment><USER52> Doesn't work in Firefox for me past turning notifications on/off. Accurate.

<comment><USER53> Don't forget to disable, if you have, "Don't care about cookies" extension !

<comment><USER54> Thanks. That's why it wasn't working for me. I think that extension it's really working.

</comment></comment></comment><comment><USER55> So the real question is, what are the webdevs of the world going to do about it? My guess is nothing. I can't blame them really, for everyone there is a number that is greater than their sense of shame, but at least they could stop pretending that the web is some brilliant platform that will lead computing into a new golden age.

<comment><USER56> > what are the webdevs of the world going to do about it?

Tell the marketing department that it's a bad idea then have to do it anyway

</comment></comment><comment><USER57> You forgot God's forsaken feature of the internet - Captchas.

</comment><comment><USER58> You know who has the worst intrusive popups? Stack Overflow. First, if you are logged in but haven't visited in a while. They put a position fixed huge bar on the top reminding you that you haven't been to the site in a while. I hated that popup.

<comment><USER27> Try reddit on mobile. They keep trying to push you on their shitty app.

<comment><USER59> They've done a lot of work on making it more annoying recently. The "continue" button that actually means "don't continue but instead go and install the app" is inspired-evil.

The flashing app icons, seemingly on every interaction, .. I mean for real.

</comment></comment></comment><comment><USER60> I love this. There's not enough loading going on though. Everything was too snappy.

</comment><comment><USER61> The depressing part is that this is an understatement.

      - please turn off ad blocking
      - GDPR: Consent to all these things: y/n (N)
      - --scroll
      - -- choose from 6 confusing choices
      - -- back
      - -- try again
      - --

<comment><USER62> With checkboxes looking like [X] (is it checked or not??), confusing on/off switches, very big 'Allow all' button, fake delay to opt out from tracking, a message telling you that you can't be sure to be opted out if you do not allow 3rd party cookies, very very long list of 3rd parties to switch off one by one (unless you find the confusing optional 'disable all' switch) etc. etc. It's a concentrate of dark patterns.

</comment></comment><comment><USER63> Now hang on, that can't be right - I didn't once get a Google overlay asking if I've ever bought a gift card for myself instead of someone else (seriously Google, has your data analysis not yet shown you I'M NEVER ANSWERING YOUR QUESTIONS). Nor even an autoplaying video with a five-second countdown timer that expires before you can get done with the click-throughs and aim the mouse at the one-pixel-wide target that will stop it playing.

<comment><USER64> Can you elaborate on the gift card part? Have you found a way to increase Play Store credit in a private way?

I noticed that when redeeming a Play Card, I still had to fill in an address and phone number.

</comment></comment><comment><USER65> The ad blocker and donation sections hit particularly hard for me, as I've tried to make several web apps/games (like editfight.com) that didn't have a clear monetization path, so I experimented with applying for ads, which Google rejected as the site was too unimportant, and with asking for donations, which backfired as the community was small, so it just appeared as me personally being greedy to the users.

<comment><USER5> i wish there was a better way... i make about 2 bucks a day on a site that costs many more times that to run and most of my success (haha 1.00 a day is a success? meh) is based upon luck - that changes every month depending on what google thinks my content is worth...

yet those that cheat the system or have the money to "pay to play" dominate it... just not sure that they're actually making any money.

</comment></comment><comment><USER66> Didn't realize it was a joke, got frustrated and left after 2 clicks and left... decided to check the comments... you win.

</comment><comment><USER67> Doesn't have lots of mb of media and javascript files. Doesn't start playing video. Doesn't use ridiculously large fonts. Doesn't display a myriad of links with clickbait pictures and titles. Loads fast and doesn't make my laptop CPU with 4 cores sweat.

In a good sense, that was actually not bad for a 2018 website.

</comment><comment><USER68> Making everyone implement a cookies popup is the most idiotic internet-related piece of legislation I've ever seen.

<comment><USER69> Yeah, the problem is that it completely overshadows all the benefits of GDPR since most people just associates it with annoying cookie popups.

</comment></comment><comment><USER70> Has anyone thought about adopting the permission management on phones to solve such kind of issues?

Use NLP to modularize the T&Cs and create some sort of authorization system to manage consents to various setups so we don't need to do it over and over. Plus, it could be an unique identification system!

Just be sure to decentralize it.

</comment><comment><USER71> Wow I was actually getting really pissed off with their UX until I realized... that was the point. Well done!

</comment><comment><USER72> Feature request: an ad that asks me to rotate my device (bonus points if it does it for desktop users too).

</comment><comment><USER73> First website, while at work:

> You Can't Visit This Website

> According to the California Law §28, Hague Convention and > Maritime Law, we > can't show the content of this website to > people who have not reached 18 > years age.

I'm not sure what it was but I'm glad I didn't click that I was over 18.

</comment><comment><USER74> This isn't so bad. Maybe it's because I'm used to an onslaught of interruptions and I automatically dismiss them. What hits me the most is when I'm halfway through an article and then the interruptions re-appear. You're never comfortable in your browsing.

<comment><USER75> Firefox's reader mode does help for this kind of issues: [https://support.mozilla.org/en-US/kb/firefox-reader-view- clu...](https://support.mozilla.org/en-US/kb/firefox-reader-view-clutter-free- web-pages)

</comment></comment><comment><USER76> Ha ha, ironically that is much nicer to use than most "real" 2018 websites. For example: news.com.au / dailymail.co.uk I dare you to try those naked with no ad blocker. Or dare I say reddit.com on mobile.

</comment><comment> ju-st A "Will you help improve the website?" survey popup is missing too.

</comment><comment><USER77> I've started blocking a bunch of these sites from my searches using uBlock Origin. I don't even use websites that aren't someone's blog anymore because I'm sick of the trendy bs.

</comment><comment><USER78> Please add a 5 second gmail loading screen before your page is interactive.

</comment><comment><USER5> As someone who is trying to run a website, I try and avoid these pitfalls - just not sure how to actually survive/compete in a world where this stuff you hate is where the bread and butter is.

<comment><USER55> Whats the point of surviving if it means contributing to making the world a place you don't want to live in? You can probably earn a living some other way.

<comment><USER5> I don't want to give up, I just want to see what people actually want out of content/publishers/journalism...

just for example - asking HOW/WHAT to change got me downvoted here... how can the creative publishing industry survive if it's being punished for asking what would be better?

</comment></comment></comment><comment><USER79> The back button wasn't broken, I didn't get a disbale adblock notification, or a pop-up when trying to close the tab. Definitely not 2018 enough /s

<comment><USER71> Really? That's strange, I got a disable ad-block request.

</comment></comment><comment><USER80> This clearly wasn't created by someone at Yelp; it didn't show deceptive reviews asking me to download the Android app every time I visit a page.

</comment><comment><USER81> Things missing:

* (weird) scroll animation effects, like paragraphs appearing out of nowhere etc.

* Disqus/other comment section loading (with screwing other elements position)

</comment><comment><USER82> Are there any websites that _don 't_ use cookies?

Maybe the browser should have a global disclaimer that all websites use cookies unless otherwise stated.

<comment><USER83> Plenty - just not the kind most people are browsing.

My personal website doesn't use any Javascript or set any cookies and doesn't track the user.

</comment></comment><comment><USER84> I don't get it. I click "Start" and then "no" when asked to allow notifications. After that I get a blank page.

</comment><comment><USER85> You forgot the "live at product hunt" combined with the annoying "HI IM X LETS CHAT?" that takes up each corner.

</comment><comment><USER86> Good run. Feature request: you are missing the pop up (awww sorry to go/before you go..) when you are about to close the tab.

</comment><comment><USER87> The fact that I thought this was a real site until the third or fourth click really shows how bad it really is.

</comment><comment><USER88> You forgot to hijack the back button :)

</comment><comment><USER89> This website is missing a subscription gate. How am I able to view the site if I'm not a member!?

</comment><comment> crooked-v This definitely needs to be either Material UI or a barely reskinned Bootstrap to better fit the look.

</comment><comment><USER90> I have JS disabled, but I was still able to see the "Start" button and some text. Not accurate!

</comment><comment><USER91> You forgot the splash loading screen to load in the tens of MB of javascript

</comment><comment><USER92> Didn't get any useful content. Goddesses bless script blockers.

</comment><comment><USER93> Where is the "Would you like to install the app" header?

</comment><comment><USER94> This is the terrible version of that GIF circulating on twitter.

</comment><comment><USER95> Sad, but true. Time to change.

</comment><comment><USER96> where are the ads that block 70% of the screen?

</comment><comment><USER97> why isn't video content auto-playing???

</comment><comment><USER98> Url changed from [https://github.com/Bloomca/website- in-2018](https://github.com/Bloomca/website-in-2018), which points to this, which makes the point rather more effectively.

</comment><comment><USER99> Is it in Times New Roman, or it's not loading some stylesheet?</comment>


Spying on HTTPS - <AUTHOR> https://textslashplain.com/2019/08/11/spying-on-https/ <comment><USER2> Very interesting article, although if the message displayed to the end-user really was left at "You are using an unsupported environment variable: SSLKEYLOGFILE..." that would be truly awful UX with some potentially disastrous consequences.

<comment><USER3> Why? What "disastrous" consequences are you envisioning from a message like that? Note that the rest of the message (the part you omitted) explains in plain English what the part you quoted means to the average user.

<comment><USER2> Someone gets nefariously MITM'd and instead of giving the user an informative message, they're presented with something which means nothing to the lay- person.

<comment><USER3> But as I said, the rest of the text on that bar clearly explains what the message means, in terms a layman can easily understand.

Is there anything lost by _also_ including the technical information necessary to diagnose the problem?

<comment><USER2> You mean "stability and security will suffer"? Sorry I didn't exclude it to try to make my point more convincingly, I just missed it altogether.

Assuming that's the part you meant, do you really think that is sufficient in explaining the situation to the user. I'm very unconvinced, my parents would have no idea what that means and just close the warning.

<comment><USER3> _Can_ the warning be closed? My assumption was that it's persistent.

I agree the warning isn't as specific or actionable as perhaps it would be ideally, but seeing as the browser has no idea _why_ the SSL keys are being logged (it could just be for debugging purposes) or how to fix it without breaking things further, I'm not sure what more it could say.

<comment><USER2> Yeh, I acknowledge it's a difficult problem to solve, but I think if you have messaging at all, it should probably be a lot clearer, and link to some kind of article explaining the situation (which could cover the legitimate use cases such as anti-virus usage etc.)

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> Ok, dumb question. If apparently any kind of technique to intercept an HTTPS stream makes security experts frown, how _are_ you actually supposed to inspect them if you have a legitimate reason? (e.g. monitoring unusual behavior of your own system)

Or is the security best-practice to just trust any app not to upload my contact list?

<comment><USER5> The SSLKEYLOGFILE approach is a good one; the warning being considered for Chrome just makes it clear when it's in use.

(Not that you could detect it by inspecting decrypted HTTPS if a closed-source app really wanted to secretly upload your contact list. In that sense, security best practice is minimal app permissions and reproducible builds.)

<comment><USER4> > _Not that you could detect it by inspecting decrypted HTTPS if a closed- > source app really wanted to secretly upload your contact list._

In theory yes. If every app had their own hand-crafted binary format, scanners would be out of luck. However, in practice, developers value existing tooling and most of the actual data on the wire seems to be formatted in a manageable number of well-known formats (JSON, XML, url params, protocol buffers, etc). If nothing else, a scanner could at least find out with some reasonable certainty that an app _is_ trying to obfuscate something.

I think the amount of detection and analysis tools that exist give some hinds that even if you cannot analyze everything, there is a lot of things you _can_ find out.

> _In that sense, security best practice is minimal app permissions and > reproducible builds._

Reproducible builds of what? We haven't even got this to work for most open- source software and with closed-source software, you per defintion doesn't even have anything to build in the first place.

<comment><USER5> > If nothing else, a scanner could at least find out with some reasonable > certainty that an app is trying to obfuscate something.

Only if the developers did a bad job of hiding it. You can tell a positive from decrypted traffic, but not a negative. It's a useful first step before putting more effort into reverse engineering, sure.

> Reproducible builds of what?

Of open-source software. The context was "security best practice", so anything closed-source is a no-go.

<comment><USER4> > _Of open-source software. The context was "security best practice", so > anything closed-source is a no-go._

Sorry to be blunt, but that is impossible to archieve in practice if you actually want to take parts in modern society.

</comment></comment></comment></comment></comment><comment><USER6> Honest question, is it possible to have chrome disable the functionality to export the SSL private key?

IE on that notification is there a button to deny the stream?

<comment><USER4> To my understanding, this exports the session keys of an active TLC connection. Those are temporary keys that were created during the handshake of a particular TLS connection and are only valid for this particular connection.

So, if this data is picked up immediately by a network sniffer, it can decrypt the currently active TLS connection. However, the keys will not allow anyone to decrypt any past or future connections.

<comment><USER7> This should be correct. This is super useful for developers and operations people to debug traffic ... Or for security/monitoring software (e.g. company or parents monitoring people). But limited use otherwise. Considering the hoops you go through to turn this in, this is usually okay, but it is not necessarily apparent to end users when it is on.

</comment></comment></comment><comment><USER8> I just want to state that some kind of clear-text inspection of content is and should be absolutely expected for security and DLP purposes in an enterprise environment. If TLS is going to become un-MITM-able, then we need to do it on the host.

</comment><comment><USER9> I said awhile back that QUIC leaving out having a "non-s" mode was going to mean people would just leave keys dumping on :(

<comment><USER10> Which is the desired result, right? Key escrow forces you to be explicit about who you're allowing to decrypt your traffic rather than letting it be everyone by default.

<comment><USER9> The average user doesn't think like that. They see, "oh in order to get to the next level of farmville I just have to modify this really easy shortcut!"

</comment></comment></comment><comment><USER11> Last I checked, Wireshark can't be configured to decrypt a TLS 1.3 session (at least not yet).

<comment><USER12> Time to check again, Wireshark can consume TLS 1.3 keys from a client or server to decrypt the session using the environment variable described here. I'm not actually sure which version you need, maybe 2.6 or later?

</comment></comment><comment><USER13> Is MITM, as described in this article, using sslkeylogfile possible on Chrome for Android?

</comment><comment><USER14> Around two weeks back chrome hid its address bar.

Could it be a coincidence or both are related?

</comment><comment><USER15> > monster in the middle (MITM)

That's not what it stands for. There's nothing sexist about using an acronym the same way everyone else does.

<comment><USER16> I have seen it in at least one other project: [https://blog.cloudflare.com/monsters-in-the- middleboxes/](https://blog.cloudflare.com/monsters-in-the-middleboxes/), [https://github.com/cloudflare/mitmengine](https://github.com/cloudflare/mitmengine)

I think it's equally understandable, and monster is objectively a more fun word. Seems like not a big deal?

<comment><USER17> Are we also going to change the middleman to middlemonster?

<comment><USER10> No, that would usually be intermediary. If you want to be more specific you can say reseller or broker.

Monster in the middle is at least cute and conveys the authors intent that this agent is untrusted and assumed malicious.

People in this thread clearly don't like being called a monster which I think demonstrates exactly that words matter and these ones are doing their job.

<comment><USER18> No one here is objecting to it as a standalone phrase, but as a replacement for a perfectly good phrase that existed all ready. There is no reason to change existing terminology and cause confusion; who decided this was a problem, any way? It reminds me of Bro being renamed to "zeek" because of the whole "brogrammer" thing, even though it was named before any one ever started complaining about that after Big Brother. It's not a real issue. I wouldn't have a serious problem with it, except that some one who wants to learn more is now stuck searching for one of the three other people who decided this was an actual issue and used it instead of MITM. Again, same as with Bro: now you have to search for two terms, even if you're familiar with the distinction. I can find posts going back to the 90s on Bro; "zeek" has very little in comparison.

It turns out even cloud flare used man-in-the-middle in the project, because it was in some other code, I guess: [https://github.com/cloudflare/mitmengine/blob/master/process...](https://github.com/cloudflare/mitmengine/blob/master/processor.go)

(line 24; now wait for some one to realize his "error" and change it.)

</comment></comment></comment></comment></comment><comment><USER19> Listener in the middle is most accurate and Politically Correct.

<comment><USER20> MitM can imply modification as well as eavesdropping. Meddler in the Middle makes more sense.

<comment><USER21> Human in the middle?

</comment></comment></comment><comment><USER22> _There are many problems with using a MITM proxy, however. The primary problem is that it's very very hard to ensure that it behaves exactly as the browser does and that it does not introduce security vulnerabilities._

FUD. Why should we want "behaves exactly as the browser does", when browsers (in fact, mostly Google's) are in fact turning against their users?

 _While browser vendors are wary of any sort of interception of HTTPS traffic_

 _Especially_ Google's, because that's one of the ways you can still block ads and modify pages to have them displayed as the user(-agent) wants, while it continues to slowly remove abilities from browser extensions.

 _Similarly, the MITM might not support the most secure versions of protocols supported by the browser and the server (e.g. TLS /1.3)_

AFAIK there is no general protocol insecurity with TLS <= 1.2, unlike SSL3. There's also no reason for MITM proxies to not start using 1.3 too once it becomes more common, which I'm pretty sure will happen.

 _this approach is generally preferable to MITM proxies._

...because it provides no way to modify the content, i.e. being able to do things like block ads, inject stylesheets, and generally behave as the user wants.

IMHO the whole "security" thing has turned into a power-grab for companies to enforce their control over users, which is the most disturbing part. We want security, but also control, which is not the "security" they want.

(This comment was posted from a browser that does not support even SSL 2.0, but is using TLS 1.2 via a proxy... and I know that 1.3 will be coming sometime in the future. When that happens, everything that goes through it can also start using 1.3.)

Edit: yay, instant downvotes! I hope you enjoy being herded by Google, because that's where the future is heading if we don't oppose.

<comment><USER23> > FUD. Why should we want "behaves exactly as the browser does", when browsers > (in fact, mostly Google's) are in fact turning against their users?

Issue of scope. Chrome isn't selectively insecure.

>AFAIK there is no general protocol insecurity with TLS <= 1.2, unlike SSL3. There's also no reason for MITM proxies to not start using 1.3 too once it becomes more common, which I'm pretty sure will happen.

Browsers are very particular about how they communicate certificate validation failures. This is generally obscured by the MITM proxy, as is the certificate itself. Making MITM easy will inevitably lead to people running badly made proxies, especially if such a proxy is installed to the system as adware, the same reason both Chrome and Firefox wouldn't allow random unsigned extensions.

I'd honestly be surprised if any of them do HSTS properly.

>IMHO the whole "security" thing has turned into a power-grab for companies to enforce their control over users, which is the most disturbing part. We want security, but also control, which is not the "security" they want.

You can run dev builds - usually even the official ones - to turn most of those security features off. They're intended for your average non-power user.

>Edit: yay, instant downvotes! I hope you enjoy being herded by Google, because that's where the future is heading if we don't oppose.

That's what you get for making an argument about browser vendors about Google and conflating it with Chrome issues in a different scope.

<comment><USER4> > _I 'd honestly be surprised if any of them do HSTS properly._

Maybe I'm missing something, but what would an MITM proxy have to do here as long as it passes the HSTS headers on to the browser?

As far as I understand, HSTS changes browser behavior in two places:

\- A browser will _always_ connect to a domain via HTTPS, even if the URL says HTTP. \- TLS errors become unskippable.

Both behaviors are carried out by the browser and are not influenced by the specifics of the TLS connection itself (as long as a connection can be established).

> _You can run dev builds - usually even the official ones - to turn most of > those security features off. They 're intended for your average non-power > user._

But this _is_ about average non-power users. Because the current trends force those users to place their complete trust in browser vendors or website operators, even if there were local administrators or third-party tools who could do a better job.</comment></comment></comment>


French "3 strikes" law returns, now with judicial oversight - <AUTHOR> http://arstechnica.com/tech-policy/news/2009/07/its-baack-french-3-strikes-law-gets-another-go-from-senate.ars <comment><USER2> With every new law against file sharing and open communications I'm edging one little step closer to becoming an activist.

I wonder how many people are in that same frame of mind.</comment>


Boosted Board v2 – no longer water resistant - <AUTHOR> https://boostedboards.com/2nd-generation-standard-range-battery-pack-recall/ <comment><USER3> > As a result, we are no longer marketing the 2nd generation board as water > resistant and strongly recommend against riding in water or wet > environments.

Riding in wet conditions is a huge no-no for normal skateboards - <USER2> waterlogs the deck, rusts the bearings, and ruins the griptape. Battery or no battery you should never ride a skateboard in the rain unless you intend to ruin it.

</comment><comment><AUTHOR> Which is kinda' a shame since this was one of _the_ big marketing points for the v2. Especially in rain hotspots like the UK :)

<comment><USER4> As someone who's ridden, and crashed, a Boosted Board in light rain, I wouldn't recommend it. You have to be very diligent about avoiding metal things like manhole covers and light rail tracks. The board also gets pretty gross with road dirt.

I'm more excited about the swappable and extended battery.</comment></comment>


For first time ever, feds asked to sit out Defcon hacker conference - <AUTHOR> http://arstechnica.com/security/2013/07/for-first-time-ever-feds-asked-to-sit-out-defcon-hacker-conference/ <comment><USER2> If they are going to ban the feds from attending the conference, are they going to ban the contractors who are working with the feds also? I imagine that the majority of the "security and hacking" type work is not done directly by the feds but by their contractor (e.g. in Snowden's case he was not working for the NSA but for Booz Allen Hamilton).

If they are just banning the feds then I think this is just a press stunt since it won't change a single thing.

<comment><USER3> Of course it's a stunt. That's the whole point, to make a symbolic statement. There is no imaginable practical consequence from this besides expressing unhappiness. That doesn't mean the gesture is meaningless.

<comment><USER4> True. To be honest I would be quite suprised if they didn't do something like this. Kudos to them.

</comment></comment></comment><comment><USER5> Long HN discussion on this: [https://news.ycombinator.com/item?id=6024094](https://news.ycombinator.com/item?id=6024094)

</comment><comment><USER6> Roll over and take it, or push back, those are the only two choices.

There's little question there will be consequences to pushing back against the Feds, they're often vindictive bastards when you don't bow to their authority, but who can stand to live with actively helping to ensnare your fellow citizens in a police state?

<comment><USER7> Do you know any "Feds" yourself? You may be surprised at who is a "fed" or not. Prejudice is definitely not a noble trait.

As was brought up in the other thread, Dark Tangent himself can be considered a Fed, considering that he sits in the Homeland Security Advisory Council, as well as a top officer in ICANN.

Perhaps we'll be seeing Dark Tangent resigning his post as Homeland Security Advisory Council? Or perhaps there is more to "Feds" than you might think.

<comment><USER6> You're incorrect. I'd argue it depends on what you're prejudiced against, as to whether it's noble. I happen to be very prejudiced against police states, and government tyranny in general, and the people that actively help to make it possible. In this case, my use of Feds is meant to represent the federal authority figures that are leading the charge in erasing my civil liberties, and I think that was obvious given the rampant discussions here for weeks on the NSA and its leading proponents.

A proper synonym for prejudice is bias. I like that word even better than prejudice in this case. It can be said that I'm absolutely biased about this subject.

<comment><USER7> Lets start with a basic fact. A good portion of the NSA is dedicated to purely defensive cybersecurity. They have contributed to SELinux, created the DES encryption algorithm, as well as SHA-1 and SHA-2. NSA had a part in AES as well. They were also involved in figuring out what happened with regards to the Google and Nasdaq hacks.

Even if you believe the NSA's actions were wrong with regards to collection of metadata... a good portion of even the NSA's workforce have nothing to do with that current controversy.

Even then... if you manage to convince yourself to be a bigot towards ALL NSA employees, you'd have to be awfully bigoted to then further apply your judgement to the rest of the Federal Government workforce.

<comment><USER8> and the german government under Hitler built the autobahns and created Volkswagen.

At some point, any participation in a system that allows such broad and systematic abuses needs to be called out.

yes, i know about godwin's law, thanks.

<comment><USER9> I can't say I harbor any great animosity towards road builders in Germany in the 1930s.

<comment><USER7> And ditto to us Americans as well. WWII was filled with errors, and yet our ideals have remained strong.

A brief history lesson: Office of Censorship, Atomic Bomb (historic Kyoto was on the list of places to utterly demolished... fortunately the Japanese surrendered before then), Napalm-based firebombings against a civilian population (Japan). Blatant racism in the form of the Japanese Internment camps, etc.

The existence of these programs are in direct contradiction to many principles that America stands for... especially the Office of Censorship. But we don't hold any ill-will towards our Grandfathers during that time. At worst, we recognize the specific faults in the specific laws in the context of the time period, and then write laws to ensure it never happens again.

Same thing will happen here. "Feds" in general were not related to this controversy. Showing ill-will to such a large group of people is straight up bigotry. We have the intelligence today to focus our energies on specific departments, specific people... specific regulations that have gone wrong in this case.

And that is what law is about. Figuring out the root of the problem and eradicating it. Painting entire groups of people (aka, "The Feds") with a single brush is wrong.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> No better group to stand up to them! I don't count myself among the defcon types (my computer wouldn't last 5 minutes on their conference Wifi, I'm sure) but they, if anyone, have the right mindset to challenge the feds, and come out with only minor bruising.

</comment><comment><USER11> This could be important. If the security community continues to publicly hold these agencies at arms length, working for them may acquire a stigma. If the effect were strong enough, the agencies might feel a need to change their stance in order to be able to hire.

</comment><comment><USER12> DT's post is analogous to _you can 't fire me, I quit_. The sequester is affecting travel & training budgets and gov't employees can't afford to attend.

</comment><comment><USER13> I most likely going to get down voted for this, but am I the only one who sees the irony in that this is a conference dedicated to breaking into systems and they don't want the people who are arguably better at it than anyone else?

<comment><USER14> They didn't break in, they asked for the keys and were given them</comment></comment>


Senator Rand Paul: We Must Demilitarize the Police - <AUTHOR> http://time.com/3111474/rand-paul-ferguson-police/ <comment><USER2> This is one of those cases where both left and right party interests are being served by growing the police force.

The right will tell you this is a result of the left's 'big government', while the right's military infrastructure contracts benefit from the police (or pentagon as the article states) purchase of heavy machinery for local law enforcement. I doubt the local police of a town of 12,000 said "we need to buy an armoured personnel carrier and an anti-aircraft gun". Though I'm sure they thought it was pretty cool when told they would be getting one.

</comment><comment><USER3> While I feel that the senator is _likely_ using this event to get back onto a national soapbox, I completely agree with the argument he presents and that the issue of a militarized police force is problematic as a whole. I hope this becomes an issue that voter start caring about in the 2014 or 2016 elections.</comment>


Ask HN: Javascript for desktop apps? - <AUTHOR> I've been wanting to learn Javascript lately, and I've become curious as to how Javascript/ECMAscript fares as a language for writing software to be ran on the desktop. Are there any ECMAscript implementations with good FFIs? Are the good libraries/bindings for writing GUI desktop apps in ECMAscript? Is it possible to get acceptable performance(comparable to Python or at least Ruby, perhaps?) from ECMAscript?
If you were writing a desktop app in ECMAscript, which implementation would you use? Would you actually consider using ECMAscript to write a desktop app?
Are there any good books or other resources you would recommend on writing desktop apps in ECMAscript? <comment><USER2> why not simply embed a web server and connect to the localhost ? That makes your application internet ready as well when the time is right as well as giving the user to connect to your application from other pcs on the same lan.

I've built a music management system along these lines and it works quite well. The internet ready part of it causes all kinds of unintended but useful side effects, stuff that I never thought of when building it.

<comment><USER3> Not sure why you were downvoted. I don't think the idea so "out there". Apps embed their own sql servers, too, why not a web server.

I think it would be nice to have a launcher that launches both the client and the server then.

<comment><USER4> If you were referring to Firefox / sqlite3.. I wouldnt consider sqlite3 a server at all. Nonetheless, I agree with what you are saying

<comment><USER3> Strictly speaking it's not a server, true.

<comment><USER4> sorry if i was being nitpicky

</comment></comment></comment></comment></comment><comment><USER5> On the windows desktop platform you can use JScript and the .NET Framework to write just about any desktop application you can imagine.

This language (which is a good implementation of up-to-date ECMAScript) is somewhat light on texts however. There is a SAMS book by Justin Rogers which does cover the basics.

You might be better off looking at something like Adobe AIR which is an excellent approach to making a web style application run like a desktop application - well worth exploring and could be a good platform for developing portable (and applicable) JavaScript skills.

<comment><USER6> Yep, I'd suggest giving Adobe Air a spin. With some plain HTML, CSS and JavaScript you can create a decent (enough) cross-platform application. If you need an idea to get started, have a look at <http://github.com/roam/morse/tree/master>.

</comment></comment><comment><USER7> Actionscript 3 is very close to javascript. The Adobe Air framework allows you to deploy desktop apps.

Depending on what you're trying to do you might want to try XUL Runner <https://developer.mozilla.org/en/XULRunner> . It will allow you build an html/js app that can run as a desktop app.

</comment><comment><USER8> I _love_ Javascript, but I think people who want to develop server-side or desktop apps with it might be better served by Lua. Lua has functions as first-class values like Javascript does, which allows you to approach problems similarly in both languages.

Lua has also already been in use as a server-side and desktop language for some time, and while the available toolkits pale in comparison to what's available, say, for Java, Python or Ruby, there are still more options than there are for Javascript right now. Lua is very fast; for most benchmarks at <http://shootout.alioth.debian.org> it's the fastest interpreted language.

Sorry this is doesn't exactly answer the question you're asking but I thought it might be worth mentioning as another possibility to consider.

</comment><comment><USER9> Check out the Titanium Developer platform. It's exactly what you want. <http://www.appcelerator.com>

</comment><comment><USER10> You could try Rhino:

<https://developer.mozilla.org/en/Rhino_documentation>

Steve Yegge suggests it's the next big language.

<comment><USER11> This is very convenient now that Java (as of 1.6) has JavaScript/Rhino built in as an implementation of the Scripting API: <http://snipplr.com/view/17501/javascript-swing-application/>

Execution is as simple as 'jrunscript app.js'.

</comment></comment><comment><USER12> The KDE desktop shell, Plasma, has js bindings so you can develop plasmoids (applets) with javascript.

[http://techbase.kde.org/Development/Tutorials/Plasma/JavaScr...](http://techbase.kde.org/Development/Tutorials/Plasma/JavaScript/GettingStarted)

<comment><USER12> Sorry, forgot: This stuff is quite new so you might find some stuff missing from the bindings, but it's growing speedily. For the curious, it uses QScript.

</comment></comment><comment><USER13> Performance wise, consider that people have been using scripting languages since the 90'ies (Tcl/Tk) with perfectly acceptable results, so that's not really your problem. The issue is going to be finding how to do a GUI.

</comment><comment><USER14> <http://live.gnome.org/GnomeShell>

Written mostly in javascript, with dynamically-generated bindings to GTK+ et al.

<comment><USER3> Interesting, though ultimately I would prefer to spend resources on cross platform stuff.

<comment><USER14> You might not want to hack on that project, but in all cases you have to install a runtime, be it a web server or xulrunner or whatever.

GTK+ can be a pita to install, but it's as cross-platform as anything else.

<comment><USER3> Then I misunderstood, I thought it was a Gnome only project. GTK would be OK.

</comment></comment></comment></comment><comment><USER15> You could use XUL for the GUI. The German car rental company Sixt did that in 2005 for their corporate apps. I don't know what became of it, though.

</comment><comment><USER16> Adobe Air is a possibility

<comment><USER17> Not just a possibility, its an emerging method of taking the web technologies to the desktop. You can mix AS3 and HTML/JS for a very clean, and fast implementation of typical desktop UI features. Honestly, AIR is perhaps the easiest way to package these sorts of things.

</comment></comment><comment><USER18> You could use the LGPL Qt4.5 (cross-platform), which includes an ECMAScript scripting engine (with debugger).</comment>


Extract figma design styles to your project - <AUTHOR> https://github.com/figmatools/figma2css-app <comment><USER2> This is great! Good idea, very useful.

I love figma, it's one of those cases that showcase the actual potential of the web, and that performs equally or better than native alternatives. And the API is really easy to pick up. Figma boom hasn't even started!</comment>