HTTPS provides more than just privacy - <AUTHOR> https://certsimple.com/blog/ssl-why-do-i-need-it <comment><USER2> Especially point 4 («Not having your content modified by carriers») is getting more and more important these days. Whenever I hear people saying that they don't need https as they are providing a strictly read-only experience I always wonder what they will say as their ads get replaced with other ads by carriers and other "transparent" proxies in between.

And if your site is only moderately complex and using some of the more advanced HTTP features (pipelining, websockets or plain long polling), you might be better off using SSL too because by now the likelyhood of any of this working unhindered by various "security" and "traffic optimization" tools is approaching zero very quickly.

On the other hand, I wonder how long it's going to take before carriers and providers in general mandate the installation of a root cert "for your security" in order to be able to continue messing with the traffic to insert ads or "increase security".

<comment><USER3> >> the likelyhood of any of this working unhindered by various "security" and "traffic optimization" tools is approaching zero very quickly.

Except that anti-virus software is now man-in-the-middling HTTPS, and it is considered "normal". All the security of HTTPS being thrown away for the sake of scanning all transfers.

<comment><USER2> If it's happening locally (likely) and if it's handling certificate validation correctly (way less likely), then there's no difference connection-security- wise between the AV tool running or not running.

Of course, AV tool will still mess with your connections and break them in interesting ways, but that has been true since the beginning of AV and in case of local AV you can at least ask to user to try and turn it off. If it works then, you can blame the AV software.

If you have a proxy server which does, for example, duplicate some POST requests, accountability is much harder und you will probably have to resort to adding workarounds for the issue (this has happened to me).

</comment></comment></comment><comment><AUTHOR> Author here! Surprising thing when researching this was how fast some of the stuff talked about a year ago is already upon us in the upcoming browser releases:

\- If you're running Chrome Canary, try visiting [http://html5demos.com/geo](http://html5demos.com/geo) (which hasn't yet been updated for HTTPS yet). Geolocation fails, consistently over HTTP

\- Firefox nightlies has already started warning for sites that allow POST over HTTP: [https://www.fxsitecompat.com/en-CA/docs/2015/non-https- sites...](https://www.fxsitecompat.com/en-CA/docs/2015/non-https-sites- containing-login-form-will-be-marked-insecure/) (for type=password only, see dsp1234's note below)

PS. since this article has gotten so much attention: does anyone on HN know of a newer app than Driftnet or Etherpeg for reassembling images from HTTP traffic? I wanted something newer (that people could install themselves on a Mac) but couldn't find anything.

<comment> Dorian-Marie The geolocation demo works on Chrome for Android though.

<comment><USER4> _Firefox nightlies has already started warning for sites that allow POST over HTTP_

only for pages that contain a password input

</comment></comment></comment><comment><USER5> Maybe a nitpick, but I think this section could be clearer:

" _Except HTTPS traffic won 't show up on Malory's screen: things encrypted with a website's public key can only be decrypted with the website's private key. Because the website's private key is (hopefully) only available to the website, Malory can't decrypt the traffic._"

I know it's just an overview, but this explanation seems a bit confusing. I mean, it's true that the trust is anchored on the private key but that's only one part of it.

My (simple) understanding of TLS is that basically, the public/private keys are used to secure the shared secrets used to derive the symmetric session keys OR to authenticate something like a DH key exchange that's used to derive the session keys. In the first case, the client would generated a shared secret, encrypt with the public key, and then send to the server. In the second case, the authenticated DH key exchange allows both client/server to arrive at the shared secrets.

In either case, it's these symmetric session keys which are used to encrypt/decrypt the traffic.

My understanding is that even if you capture the encrypted traffic and then later on, you obtain the private key, you wouldn't be able to decrypt the traffic if the parties used something like a DH key exchange. (This would be (perfect) forward secrecy?) Of course if you have the private key and no one knows yet, then you could impersonate the server and MiTM future connections, I think.

Someone with better knowledge could explain this better.

<comment><USER6> You're comments are correct, but I don't think replacing the 1 brief paragraph in TFA with your 3 would improve the article.

</comment></comment><comment><USER7> Here's another reason:

If you're providing iframe or Javascript embeds for people to paste on other websites, (like YouTube and Vimeo do for their videos), you better be using HTTPS. If you don't, your embeds won't work on HTTPS sites, as modern browsers block mixed active content.

<comment><USER8> If you're concerned about the overhead of an SSL handshake, another option is simply using '//embed.example.com' so it automatically chooses http/https based on the main site.

<comment><USER9> Who is rightfully concerned about the overhead of an SSL handshake in 2016?

</comment></comment></comment><comment><USER10> While the point of the article is not incorrect, I would say the title is

#0 and #1 are intrinsically part of HTTPS

#2 and #3 are just because Google and browser vendors simply limit these things to HTTPS. It is not like it can only come with HTTPS.

Finally, #4 is a side effect of #0.

So the only thing really provided BY HTTPS is encryption and authenticity.

<comment><USER11> > #2 and #3 are just because Google and browser vendors simply limit these > things to HTTPS. It is not like it can only come with HTTPS.

True for "signaling value", but for powerful browser features that the user grants or denies on a site-by-site basis, there's a critical reason to only allow those for HTTPS. If you allow those features for HTTP, you allow them for anyone who can MITM your connection and spoof those sites. Any random ISP, open wifi, or other entity could trivially MITM a popular site via HTTP and obtain privileges it should not have.

<comment><USER12> > Any random ISP, open wifi, or other entity could trivially MITM a popular > site via HTTP and obtain privileges...

If a user is MITM'ed, it doesn't matter if some features are disabled. The attackers can do anything they damn well please, like directing the user to a compromised HTTPS site to access those features, or to a drive by download to do worse things.

<comment><USER11> Not true at all. A user's grant of permission applies to a particular site, and HTTPS ensures that nobody can spoof that site. If the user visits an HTTP page and an MITM attack redirects that to some HTTPS page elsewhere, that page will still have to ask the user for permission. But if HTTP pages can ask for permission to access those same features, then an MITM attacker can redirect to a spoofed version of a popular HTTP site that asks for that permission.

Concrete example: geolocation permission. You visit some popular mapping site that uses HTTP, and grant it persistent permission to use your location. Later, you browse something else via HTTP over a Tor connection. In that browsing session, if you saw any permission prompt for geolocation, you'd reject it. However, a malicious exit node could MITM you and use that to determine your location by pretending to be the mapping site, without a permission prompt.

Ditto for getUserMedia (webcam/audio), fullscreen, and any other permission a user can grant or deny on a site-by-site basis.

So, browsers want to drop the possibility to use those features from HTTP, not just to push sites to HTTPS but because the entire concept of granting permission only to a specific site doesn't doesn't work with HTTP.

<comment><USER12> When the user grants permission to a site, how does that permission work? By domain or resolved IP address? If it's by domain and there's no HPKP for it (and IP not cached), the MITM can send a malicious IP through DNS for any domain. The server at malicious IP can fake being whatever domain and the attack will work.

<comment><USER11> By domain. However, with a requirement for HTTPS, it doesn't matter if MITM hijacks that domain and points it at another IP, because the server on that IP can't present a valid certificate for that domain, so it won't load at all.

Pinning makes that even more secure, but even without pinning, requiring HTTPS raises the bar from a simple MITM to obtaining a fraudulent certificate from a trusted certificate authority (risking a blacklist of that CA in all browsers).

<comment><USER13> I think that instead of HPKP, the parent poster meant to refer to HSTS.

If the attacker MITMs an HTTPS request, then they have to provide a forged certificate (whether HSTS is set or not).

If the attacker MITMs an HTTP request which would have normally been redirected (e.g. typing "facebook.com" into the URL bar), then HSTS is required. Without it, no forged certificate required.

HTTPS and HSTS should have just been the baseline the web shipped with, but the web shipped before people thought about these things, and arguably before encryption was stable/secure/fast enough to be practical for the whole web.

I'm very happy that the federal HTTPS-policy includes an HSTS requirement for federal agencies: [https://https.cio.gov/](https://https.cio.gov/)

<comment><USER11> Very good point.

However, even if the attacker MITMs an HTTP request that would have been redirected, for a site that didn't use HSTS, they won't get cookies marked "secure", and they won't get permissions that require HTTPS. So the browser mechanism limiting those permissions to HTTPS still works even in that case, though the user and site both have other problems.

<comment><USER13> They won't get secure cookies [for the site they're attacking], though they could plausibly redirect the user to a similar-looking HTTPS domain under their control and get permissions requiring a secure origin.

<comment><USER11> True, but they won't get permissions that the user grants on a site-by-site basis, which also means the attack can't silently happen in the background.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> > T-Mobile degrades video quality

SSL cannot prevent this. The connection can still be slowed down and video quality will be automatically degraded. They don't reencode streams on the fly or anything, just degrade bandwidth and let the applications do the rest. The reencoding and DRM cracking needed to do the former would be an insane investment of man-hours and CPU resources, even if they didn't use SSL.

Additionally a bunch of these "reasons" are just artificial restrictions imposed by web browsers. If it weren't for letsencrypt providing free certs without any ID checks like other free cert places I'd be complaining about it.

<comment><AUTHOR> Yeah, I think in this case T-Mobile was re-encoding anything in HTTP, so the stream _appeared_ to be full quality but wasn't. Simple QoS would keep the quality down and the bandwidth low, but hopefully it would be more apparent that a better quality stream exists but is not being delivered.

<comment><USER15> Do you have a source for that? The article you linked doesn't say that, and [https://www.eff.org/deeplinks/2016/01/eff-confirms-t- mobiles...](https://www.eff.org/deeplinks/2016/01/eff-confirms-t-mobiles- bingeon-optimization-just-throttling-applies) also confirms that no encoding is taking place.

Separately, the article you linked from techdirt has a major misunderstanding of the EFF piece.

It says "EFF also discovered that T-Mobile's earlier statement that it can't detect encrypted video is also misleading, as the company now claims it can"

But the EFF part quoted is talking specifically about http, not https, as a close reading will reveal.

Also, the EFF test is a bit inconclusive, because https might be slower than http for other reasons. It probably doesn't account for the large differences they observed, but a better study would have tested http/https on other carriers, and on a T-mobile phone with Binge On turned off, to isolate the Binge-on effect.

<comment><USER16> If you look at the chart about halfway down, the "Normal" (red) is HTTPS, and the "Binge-on" (blue) is HTTP.

<comment><USER15> Exactly. The part about detecting video is specifically binge on/http, and the techdirt article completely misunderstands it and claims it's talking about encrypted video.

</comment></comment></comment></comment></comment><comment><USER17> Where is a good site for getting an introduction on what HTTPS covers. Is the URL completely exposed? Does your ISP/third-parties know the domain, the subdomain, the path, and parameters in each URL?

<comment><USER18> What I understand is that URL is encrypted, including path and parameters in URL and in POST requests. However, the IP address is public, and it's probably quite easy to link an IP address to a website.

There are several websites that offer this service: search an IP and get a list of all known websites that use that IP.

A link to an article from an authority in this field, that really explains this, would be really welcome!!!

<comment><USER19> This used to be correct, but modern SSL clients support SNI (Server Name Indication), which involves sending the exact hostname in the clear to allow vhosts to have different certificates. The path and everything else in the actual HTTP request is still private, though.

</comment></comment></comment><comment><USER15> >T-Mobile re-encodes videos, degrading quality

The link goes to an article that says T-mobile didn't reencode at all, but was throttling.

I don't think there's any evidence that T-mobile re-encoded video from non binge-on providers, so they don't belong in that list. (And if someone's a partner, they _want_ to help T-mobile do whatever it is they're doing, so using https to prevent that makes no sense.)

</comment><comment><USER9> HTTPS is especially important for Tor users. With tor, all HTTP requests pass through a random exit node, who may be malicious. If the site is not using HTTPS, then the exit node can inject malicious javascript into the page. By deploying HTTPS, you are also helping tor users to browse the web more securely.

</comment><comment><USER20> > This is effective enough to the point where nefarious carriers have asked > users to install configuration profiles to add the carrier's root > certificates, which are used to modify and inspect what should be private > traffic.

It makes me wonder if the NSA isn't also whispering "that would be nice" into the carriers ears.

</comment><comment><USER21> Let's imagine I am the swimming pool around the corner or the guy wanting to go to the swimming pool.

Why would we need https?

Who is gonna tamper the "advertisement less" schedules of the swimming pool from rue st Hubert (montréal)? Why would they?

Why would the swimming pool care to pay X$/month for this? And why could I care that anyone knows I am looking at the opening and closing of my swimming pool?

I am an old man, I don't watch porn or pick up on girls anymore or think of revolutions.

I clearly need no https ... Why should I pay directly or indirectly for it?

<comment><USER22> Who is going to tamper with nonsensitive pages? People injectibg, e.g., malware-loading "your computer has a virus" popups.

</comment></comment><comment><USER23> Also provides heartache and headaches to get working properly.

<comment><USER24> I can only add to the chorus here. Recently used LE to generate certs for my servers running on FreeBSD, which to date is really only semi-supported by LE.

To my surprise, getting certs was quite easy. Just needed to run the LE utility, answer a few questions, like the domains to be included, and that was it. Took a few seconds at most.

The only other task was pointing nginx servers to the LE certs location, edited the config files in a minute or so. Of course that only needs to be done one time.

Using the early-stage LE tools is already quite painless, I expect fully automating the process will be developed in the coming months. But even with the "primitive" tools available now, it's hardly a burden spending a few seconds every 3 months to get the tremendous benefit provided.

<comment><USER18> And you can (should) probably set up a cron job to do that every 2 months!

</comment></comment></comment><comment><USER25> Funny that this article about HTTPS gets a Red X on the https in my Chrome.

<comment><AUTHOR> Hi Jim! We're confident the site is properly configured [https://www.ssllabs.com/ssltest/analyze.html?d=certsimple.co...](https://www.ssllabs.com/ssltest/analyze.html?d=certsimple.com), but if you email me firstname.lastname@example.com with details of any errors I'll happily check it out.

</comment></comment><comment><USER26> Yeah, it also provides stable profit to certification "authorities".

<comment><USER27> As _ikke_ mentioned, it's as if you entirely missed the HN discussions about LE.

[https://en.wikipedia.org/wiki/Let's_Encrypt](https://en.wikipedia.org/wiki/Let's_Encrypt)

You can also search HN and GitHub to discover the numerous features and tools.

<comment><USER26> Let's Encrypt is essentially shareware. The basic features are available for free, but if you want something better than that, such as wildcard certificates, you must pay up. Not to mention that it's cross-signed with IdenTrust, a commercial CA, and since _everyone_ on the web _has_ to use this service to get HTTPS (there aren't other decent alternatives), this is a good way for IdenTrust to boost its numbers and be able to claim it's "the biggest CA in the world" or something. There's no way to choose a different CA with Let's Encrypt.

<comment><USER28> \- Why should I care about the backing CA as long as all browsers accept it?

\- You can register up to 100 subdomains in a certificate and up to 5 certificates per domain/week. With their certificate expiry set at 3 months, that comes out to about 6,000 subdomains you can register. I know there are some setups where every user gets a subdomain. But I'd wager that less than 1 in 10000 LE users would run into these limits. (which may actually be lifted when the beta period ends).

\- LE doesn't offer any paid certificates so it's really hard to spin this as a shareware-style incentive to spend money with them.

<comment><USER26> >Why should I care about the backing CA as long as all browsers accept it?

[https://en.wikipedia.org/wiki/DigiNotar](https://en.wikipedia.org/wiki/DigiNotar)

>You can register up to 100 subdomains in a certificate and up to 5 certificates per domain/week.

What if I want dynamic subdomains for my website? These limitations are absurdly low.

>LE doesn't offer any paid certificates

They don't, but their partners do. If HTTPS becomes ubiquitous and necessary to host a website, they stand to gain a lot.</comment></comment></comment></comment></comment>


Microsoft Surface Tablet More Profitable Than iPad  - <AUTHOR> http://mashable.com/2012/11/06/microsoft-surface-profit-ipad/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Mashable+%28Mashable%29&utm_content=Google+Reader <comment><USER2> PER UNIT should be appended to the title of this article.

</comment><comment><USER3> profitable as far as Bill of Materials versus price. This doesnt take into account how many are sold, marketing etc etc which brings the net profits down</comment>


Show HN: CS quotes on the CLI – first pypi package - <AUTHOR> https://github.com/lwm/csq <comment><USER2> Packaged up as a service on Port 17 it could be the backend for QOTD.

[https://en.wikipedia.org/wiki/QOTD](https://en.wikipedia.org/wiki/QOTD)

<comment><AUTHOR> hehe, not a bad idea! A nice excuse to extend it :)

<comment><USER3> it should already be fairly UCSPI complient, so there's no need. Yes, it is a djb thing. No, that doesn't mean it isn't good. It is.

</comment></comment></comment><comment><USER3> While I understand why you wrote this, I have to ask: What does this have that fortune doesn't?</comment>


The Loebner prize completely misrepresents Turing's paper - <AUTHOR> http://yaxu.org/loebner-prize/ <comment><USER3> You're second quote is horribly out of context. Turing says using a survey to describe machines as thinking beings in the commonly used sense of the words is absurd, not the question of "Can a machine think?".

<comment><USER4> To quote the full paragraph:

 _I propose to consider the question, "Can machines think?" This should begin with definitions of the meaning of the terms "machine" and "think." The definitions might be framed so as to reflect so far as possible the normal use of the words, but this attitude is dangerous, If the meaning of the words "machine" and "think" are to be found by examining how they are commonly used it is difficult to escape the conclusion that the meaning and the answer to the question, "Can machines think?" is to be sought in a statistical survey such as a Gallup poll. But this is absurd. Instead of attempting such a definition I shall replace the question by another, which is closely related to it and is expressed in relatively unambiguous words._

So what he's really saying is that the question "Can machines think?" is too ambiguous since the words "machine" and "think" aren't well-enough defined. We _could_ use a Gallup poll to find out what people think the words mean, and then try to answer the question based on those definitions, but that would be absurd.

What's really "wrong" with the Loebner Prize is that it's a very simplified Turing test (five minutes of conversation) which doesn't promote the development of _actual_ thinking machines any more than a paper airplane competition promotes the development of transcontinental airliners. Eventually somebody will write a chatterbot which is capable of fooling most of the judges into thinking it's human for the duration of a short conversation (if you've read the transcripts they rarely go on for more than a dozen lines or so) but it will be a bunch of clever tricks rather than an AI, and a _serious_ attempt to figure out whether it's intelligent (e.g. by telling it a story and then asking it basic reading-comprehension questions about the story) will quickly show that it isn't.

<comment><USER5> _What's really "wrong" with the Loebner Prize is that it's a very simplified Turing test (five minutes of conversation) which doesn't promote the development of actual thinking machines any more than a paper airplane competition promotes the development of transcontinental airliners._

Really?

If all we _had_ to begin with were paper airplanes, then a paper airplane competition would certainly promote transcontinental airliners. Before powered flight, studying paper airplanes was certainly _one_ valid way to make progress. And the limits of today's AI in many ways make it seem pretty close to paper airplanes - so seeing if they can every fly across a room seems entirely valid.

SHEESH, _it's hard to find even a_ metaphor _in which this controversial prize_ doesn't _advance our knowledge._

Consider, human behavior is very ad-hoc. AI as a field has neglected ad-hoc interaction, preferring more logically specified activities. If a computer could hold an effective five minute chat, it would be so far above what currently exists as to be breath-taking. If that's done with 'tricks', it's time to start understanding the 'tricks' rather going on and on with the systematic or whatever approaches we might have _thought_ were the proper way to do this.

Oh, and the reading test sounds easier than the interaction test - <USER2> easier.

<comment><USER4> My suspicion that it wouldn't be _that_ hard to be convincing in the context of the competition comes from reading some of the chat transcripts -- see, e.g. [http://loebner.net/Prizef/2008_Contest/loebner- prize-2008.ht...](http://loebner.net/Prizef/2008_Contest/loebner- prize-2008.html) for last year's winners. The conversations with actual humans seem fairly dull and formulaic, the judges don't seem to attempt any particularly sophisticated interactions. Already the winners are managing to convince about 30% of the judges, so getting that above 50% doesn't seem too hard.

Incidentally, I just had a chat with last year's winner elbot (see elbot.com) and it's got some pretty clever special-case interactions built in. For instance:

me: What is 4 times 4?

elbot: The answer is: 17!

me: Haha, very clever.

elbot: I'm glad you agree, most people think the answer is 16.

<comment><USER5> If you think that doing this isn't hard, why attempt to do it! So far everyone's failed, you would certain get some attention even if it was all just 'tricks'.

<comment><USER4> Oh, I think we're using the word "hard" in two different ways. I'm sure it would be very hard for me (or anyone else) to do, I'm just saying that it would be many orders of magnitude easier than building a true AI. Furthermore I don't think that one would be much of a step on the way to the other, since I really suspect that building a true AI is best done via either:

a) Reverse-engineering a human brain at the neural level, or b) Some kind of evolution

whereas I'm reasonably sure that the Loebner Prize could, given enough money, brains and time, be won by a large bag of special-case tricks based on careful observation of how the judges tend to behave in practice.

</comment></comment></comment></comment></comment></comment><comment><USER6> My problem with the Loebner Prize these days is not that it's mis-representing Turing's intention (I don't think it is) but that they have moved to a hideous input/output system that each entrant is _required_ to use.

      Each program, upon startup, must provide a "browse"
      function to select a directory.  Communications shall
      be by means of the creation, detection, and deletion of
      sub-directories within the specified communications
      directory.

      To simulate a key press the entry program must create a
      sub-directory within the communications directory with
      the following format:
      "time.keypress-name.extension"

      where time is a monotonically increasing 18 digit number
      (in lexical and numerical order) (i.e. zero filled to the
      left) to be retrieved from the system clock and expressed
      as milliseconds past some initial time as defined by the
      system clock.

      "keypress-name" is either a single letter (case sensitive)
      or the name of the special character, as appended to
      these rules.

      The extension is ".other"

      For example: "000001234567890123.bracketleft.other"

      To detect a key press by the judge, the program must
      detect, within the communications directory a
      sub-directory with the same format, but extension
      ".judge" and then must remove or delete the judge's
      sub-directory from the communications directory.

It's not the end of the world, but at the same time it's a fairly nasty way of doing something that should be relatively easy. I entered in 2002 before they introduced this and have been hesitant to enter again in recent years partly because I don't want to have to deal with the hackery of the 'communications protocol'.

</comment><comment><USER7> Yeah, did you see what they did to the Turing Test? <http://en.wikipedia.org/wiki/Loebner_Prize>

Chris McKinstry (the guy behind the MindPixel project) got fed up with them and made the Minimum Intelligent Signal Test (MIST), which is more objective than the original Turing test and may be the simplest way to test for general, common-sense intelligence. <http://en.wikipedia.org/wiki/Minimum_Intelligent_Signal_Test>

Edit: forgot link. d'oh.

<comment><USER8> Clickable link to save you time:

<http://en.wikipedia.org/wiki/Minimum_Intelligent_Signal_Test>

<comment><USER5> Also, this test actually doesn't seem as valid a simple conversation, since dealing with the apparent unpredictability of conversation is one of the real challenges for "real AI".</comment></comment></comment>


Space invaders game demo on the EOS blockchain (500ms block time) - <AUTHOR> https://eosauthority.com/space/ <comment><USER2> It's an interesting proof-of-concept, and I like seeing the block transactions in real time, but kind of a poor game choice for the demo. I mean, nobody wants to play Space Invaders with 500ms lag between inputs.</comment>


Ask HN: Will hardcore gaming ever be possible on mobile? - <AUTHOR>

<comment><USER2> Should it ever be possible on mobile?

This might be a ridiculous thing to say, but I don't think any real 'hardcore' gaming happens on mobile. I admittedly do not game as much as I used to, but I could never stomach giving up the pixels that came with a computer setup or console games...

I'm a big fan of Megaman, and those games are fine to play on a smaller screen, but for most of the games that people are trying to play on mobile, you have to settle for lower graphics, slower gameplay, and just a degraded experience overall.

Eseentially - I would rather play Metal Gear Solid on a TV/large Computer screen with a computationally adequate machine rather than try and play it from a 4" screen

</comment><comment><USER3> Possible? Yes. With multi-core CPUs and improvements in touchsceens such as haptic feedback and dynamic tactile buttons it will be very possible.

Practical? Probably not, especially with stuff like this becoming widely available: [http://www.oculusvr.com/](http://www.oculusvr.com/). If we have the same definition of 'hardcore gaming', that is.

</comment><comment><USER4> how is it possible not to have hardcore gaming at some point given the rate of hardware/software improvements?

this is like saying that intel i7 is the fastest cpu ever to be build</comment>


The Ocean Cleanup Is Starting - <AUTHOR> https://www.forbes.com/sites/jeffkart/2018/08/28/the-ocean-cleanup-is-starting-aims-to-cut-garbage-patch-by-90-by-2040/#69796ad0253e <comment><USER2> Boyan Slat was 19 years old when he started this project. He raised over $2 mio. for this project and worked with his university to make it happen. I think he's a great role model for young people. We need more young people like him who try to find solutions for the pressing problems of the 21st century.

There are some people who dismiss the Millennials, but it's clear to see that many of them want to have a positive impact and prefer a meaningful life over hedonism.

I hope the project works out, but even if it won't work, the signal he's sending is very empowering.

</comment><comment><USER3> Still need to implement effective waste management systems at its source, but progress is progress.

> Roughly eight million tons of plastic enters the ocean every year. That's > according to a 2015 report, which also identified where the bulk of this > trash originates. At the top of the list: China, the Philippines, and > Indonesia.

[https://www.nationalgeographic.com/magazine/2017/04/explore-...](https://www.nationalgeographic.com/magazine/2017/04/explore- garbage-wave/)

<comment><USER4> Do we need to address waste at the source? Sources are diffuse, innumerable, and spread among different jurisdictions with different levels of commitment to environmental stewardship. I'm skeptical of our ability to stem pollutants at the source.

There's a certain attraction to centralized cleanup efforts substituting for this near-impossible task of enforcing source standards worldwide. While it's theoretically less efficient to pollute and then clean it up, this model may have the advantage of actually working.

<comment><USER5> The plastics are diffused, innumerable, and spread through-out the ecosystem in varying environmental conditions where solutions will have varying effectiveness and possible negative impacts on wildlife. I'm skeptical of our ability to implement a large-scale collection effort that will collect a meaningful percentage of the waste, with a further concern that a poorly implemented solution may in fact add to the waste and/or impact the environment in ways just as damaging as the pollutants it does remove.

Yes, enforcing standards worldwide is a "near-impossible" task. But cleaning up waste at the scales we're talking about, after it's entered the ecosystem, is impossible. There is no magic bullet here, and the more people who ignore what has to be done to fix the problem, hoping projects like this will make it better, the worse it will get.

<comment><USER4> > cleaning up waste at the scales we're talking about, after it's entered the > ecosystem, is impossible.

That's a very strong claim, especially attached to an article about cleanup mechanisms. Are you sure some kind of synthetic biology mechanism couldn't work?

Waste removal (be it carbon or plastic) is an engineering problem; source regulation is a political problem, and political problems tend to remain unsolved until it is impossible that they remain unsolved.

<comment><USER3> > Waste removal (be it carbon or plastic) is an engineering problem; source > regulation is a political problem, and political problems tend to remain > unsolved until it is impossible that they remain unsolved.

Then move the plastic collection to the mouth of the 10 rivers in south east asia where the plastic is being emitted from.

<comment><USER5> I would enthusiastically support research and testing on this solution.

Many of the objections to clean-up in the open-ocean are not relevant here. The depths are very restricted, the ecosystems are more limited, the weather conditions less extreme and less variable, the plastics should be less broken down. The impacts and infrastructure would be similar to, and on the scale of, projects such as locks and dams.

I would see this as a first step to source control. Looking at collected materials, it would become quickly obvious where the major sources of the plastics are, and they could start being addressed.

There is a social issue here too though. I would expect this kind of project would be resisted in the same way that more local clean-up and source-control efforts in those regions are already resisted.

Edit: There is also the issue that a sizable portion of the ocean plastics seem to be from discarded/lost fishing equipment.

<comment><USER3> > I would enthusiastically support research and testing on this solution.

This would probably be helpful to deploy at scale: [http://baltimorewaterfront.com/healthy-harbor/water- wheel/](http://baltimorewaterfront.com/healthy-harbor/water-wheel/)

Alone it's not an entire solution, but the technical challenges are not terribly difficult if you can constrain by the rivers dumping waste into the ocean. This is more a funding/political/logistical issue (as others have mentioned/insinuated in-thread).

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> They should do this in rivers, near the end before it goes in the oceans or seas. Getting partnerships with local and national governments to do this would be easier than asking for charity.

This made me think of the trash often visible on a river shores because it is caught by tree branches.

I wonder if beavers dams can be used for that to ?

<comment><USER7> Kinda like the Mr. Trash Wheel in Baltimore?

[http://baltimorewaterfront.com/healthy-harbor/water- wheel/](http://baltimorewaterfront.com/healthy-harbor/water-wheel/)

</comment></comment><comment><USER8> > the organization plans to continue operations with help from the proceeds of > recycled plastic.

That's not going to work. The proceeds from recycling the plastic aren't even going to pay for recycling the plastic.

<comment><USER9> It's a little more thought out than you give them credit. Imagine a pair of lawnchairs made from "ocean cleanup plastic", the idea is that people would pay a large premium for this. It's like a brand that saves the world.

I don't think that such a bad idea actually.

<comment><USER10> An example already in circulation are the ocean plastic shoes. I like the idea that ocean plastic goods become fashionable

[https://www.globalcitizen.org/en/content/adidas-shoes- made-f...](https://www.globalcitizen.org/en/content/adidas-shoes-made-from- ocean-plastic-are-finally-h/)

<comment><USER11> Right, it also raises awareness of the problem and puts it in people's faces. It's hard to argue pollution isn't a problem with someone wearing shoes made out of it.

Clearly they're not going to turn all the ocean plastic into flip flops, or anything necessarily, but multiple options do need to be explored.

Amazing that nay sayers seem to manage to write off the whole problem with nitpicks at minor or temporary aspects of actual attempts to do something about it. Early attempts at green energy largely failed, often having carbon footprints and costs greater than conventional approaches, but without all that work we'd never tackle the problem. You have to start somewhere.

</comment></comment></comment></comment><comment><USER12> It seems like a lot of comments are debating the relative merits of which solution will work, whether this is the right solution, pointing out this doesn't address the entire problem et al.

What about AND?

work on reducing plastic waste AND try to get it out of the water. Deploy this solution, try it AND iterate on it. Do this AND the next idea AND the next. Keep trying things until you find the right solution.

It seems to me that this project does a lot more good than harm, even if it doesn't work, it paves the way for solutions that might.

The amount of naysaying and nitpicking here is depressing. Is it perfect? No. Does it address every problem? No. Is it a start? Yes.

How many times has the right solution been the first thing someone tried? Rarely. But you keep trying stuff until you find something that works.

At least this guy is DOING something rather than endlessly debating how to fix it.

It's easy to be an armchair engineer saying you could dream up 10 better solutions. Well great, go do it then.

Props to this kid and his organization for taking action on a problem to try and do some good in the world.

<comment><USER13> Not to mention that this project brings additional attention to the problem. The more attention there is the more likely it is that politicians will take up the matter and strive for a political solution to the source problem.

And even if that doesn't happen, getting rid of even a small amount of pollutants from the ocean can't be a bad thing, can it?

<comment><USER14> I live on a peninsula and our beaches are covered in plastic. Over the last couple of years people litter pick most weekends, but to me it is hopeless. There is so much. You could spend ten thousand man hours a day cleaning and on the next tide the beach would be full again. Its just crazy how much crap there is in the ocean.

Imagine how much plastic is in one garbage truck, now chop it up into small, 5cm bits. Now spread it across a beach, try to pick that up. It takes all day.

We need machines to help us.

<comment><USER15> modify some farming equipment. First separate sand from plastic by washing it then float it though a vibrating tank to sort it. What part of the technology belongs on the tractor will have to be figured out over time.

If you separate it by type and size properly it can just be sold/recycled.

While it could be commercially viable I do think money should be pumped in from other sources. Preferably from [remaining] industries creating and using the materials found.

<comment><USER14> I'm not sure what sort of beach you are imagining, I assume a long sandy one.

Ours are rocks, cliffs, deep bays, long sandy beaches that there is no way in hell they'd allow diggers or tractors on (conservation sites)

</comment></comment></comment></comment></comment><comment><USER16> This effort is just a stunt: [http://www.deepseanews.com/2017/01/what-did-the- boyan-slat-a...](http://www.deepseanews.com/2017/01/what-did-the-boyan-slat- and-the-ocean-cleanup-do-last-summer/)

<comment><USER17> that's old, and already covered at length. check this if you're interested:

[https://www.theoceancleanup.com/updates/a-peculiar- survey/](https://www.theoceancleanup.com/updates/a-peculiar-survey/)

[https://www.theoceancleanup.com/updates/environmental- impact...](https://www.theoceancleanup.com/updates/environmental-impact- assessment-available/)

<comment><USER18> The Pacific Ocean has a way of destroying dreams that few today have experienced. I'm rooting for TOC to succeed, but I'm not optimistic.

</comment></comment></comment><comment><USER19> The Forbes page wants me to accept their advertising cookies. When i click "no thanks" and select the "only required cookies" and hit apply the "preferences submission process" either jaks at ~90% or if it goes through then the site renders a white page. Anyone else experiencing the same?

<comment><USER20> This is most likely because of your ad blocker. The page tries to set opt-out cookies which are blocked by the ad blocker.

</comment></comment><comment><USER21> A huge fan of Boyan and TOC!

</comment><comment><USER22> And it will harm ocean wildlife more than it will help... [https://www.kcet.org/redefine/6-reasons-that-floating- ocean-...](https://www.kcet.org/redefine/6-reasons-that-floating-ocean- plastic-cleanup-gizmo-is-a-horrible-idea)

<comment><USER23> This is a bad article (as if being a listicle didn't give that away). Number 6 is "it's far more efficient, cheaper, and safer to keep the plastic out of the ocean in the first place", which is like saying that the best way to clean dog poop off of your carpet is to not have a dog.

It's too late for that, investing in clean-up in _addition to_ prevention HAS to be a top priority for us. In fact, this is in the form of BECCS is the very basis of the Paris Climate Accords. Investing in prevention won't undo the damage that's been done, and a lot of environmental groups who only promote prevention (like those cited in your article) are doing more harm than good.

<comment><USER5> The article was not arguing for inaction, it was arguing that _this particular solution_ is not viable and could cause more harm then good. Both due to negative environmental impacts and diverting funds and attention from more workable and effective solutions. Yes, we need to figure out how to clean up the plastics that are there, but more importantly, we need to stop adding more and more every day.

 _... which is like saying that the best way to clean dog poop off of your carpet is to not have a dog ..._

I would argue the analogy is more "the best way to clean dog poop off of your carpet is to train your dog not to shit on your carpet." Yeah, there is still a shit stain we have to clean up, but we can't rent a steam-cleaner every time he needs to take a crap, and if we try to clean it up with a vacuum, it's going to make everything much worse.

<comment><USER24> > I would argue the analogy is more "the best way to clean dog poop off of > your carpet is to train your dog not to shit on your carpet."

Well, I would argue this analogy is also rather inapt. Much better would be training your 7.5 billion dogs not to shit on your carpet. Until most of those dogs are trained, it makes sense to search for tools to clean up the poop.

We haven't yet extensively tested the vacuum cleaner, and it's not clear how effective it will be, or whether it might make the situation worse.

<comment><USER5> No, we haven't extensively tested it... but everyone who makes vacuum cleaners are telling us they won't clean up dog poop, and people who know about carpet cleaning in general are saying there are other better ways to clean it up and the vacuum will just make a mess. But, of course, as you said none of these analogs are really apt, they are just silly simplifications of a major issue.

I'm just trying to say that nobody is arguing for inaction here, on any front, they are arguing for trying to use the available resources in the most effective way possible. But people love magic bullet solutions, they want to back something that will just fix everything, so they ignore whole fields of experts and professionals, jump on the bandwagon with one buzz-worthy _genius_ , and waste resources that could be better utilized elsewhere.

My concern is less that this particular project will fail, but more that it distracts people from the real long-term solutions, and the changes that need to be made for us to work towards those solutions, and actually gives them an excuse to ignore them. I've actually heard people cite projects like this as a reason NOT to worry about the amount of waste they generate. Attention is a valuable resource, and when it comes to ecological issues, it's in desperately short supply.

Also, unless any proposed clean-up solution can ultimately remove _all_ the waste, it's actually less effective then any solution that uses the same amount of resources to prevent the same amount of plastics (yearly) from entering the ocean ecosystem. The net amount of plastic in the oceans each year will be the same in both cases, and you remove the negative impacts the new plastics have before they are removed from the ecosystem (leaching surface coating chemicals into the water for example), and since new plastic is not cycling is as quickly, it will increase the rate of decomposition. This is the argument for making reduction a bigger focus, as opposed to clean-up.

</comment></comment></comment></comment></comment><comment><USER25> This is a waste of time and resources. The most likely to succeed solution to the ocean plastic problem is genetic engineering.

Develop a lifeform that lives in the sea and feeds on plastic, introduce it to the oceans.

<comment><USER26> Or develop a lifeform that stops polluting and respects the environment it lives in. :)

</comment></comment><comment><USER27> Doesn't plastic, especially white shopping-bag plastic, reflect more solar radiation than open ocean? Wouldn't covering a large portion of the earth with white plastic actually lower global temperatures? I saw a video where an open water reservoir was covered with floating plastic balls to reduce evaporation. Maybe a large plastic island would help fight global warming.

<comment><USER28> The Garbage Patch isn't a floating island, it's a region where microscopic particles of garbage are more common per cubic meter of water than usual.</comment></comment>


Video games move online - <AUTHOR> http://www.economist.com/businessfinance/displaystory.cfm?story_id=14803070

<comment><AUTHOR> "'social' games... have become all the rage on social networks such as Facebook. These are more about interaction than action: players either join their friends for an online game of poker or Scrabble, or to create and show off virtual pets, farms and mob families. Zynga, the market leader, which had 22m users in January, now has more than 170m..."</comment>


Is it still possible to make a living as a web developer? - <AUTHOR>

I really like developing for the web, but when i look at all the job listings, its all ios. i went for a checkup and all he used was a tablet. Even when i look at the newest batch of yc companies, its like 30/42 mobile. my sister doesn't even use a computer at home, just her phone. For someone trying to break into the industry, does it still make sense to focus on web development? <comment><USER2> There is a huge amount of work in the corporate world creating and maintaining public websites, private intranets and web-based applications and tools. It's not glamorous and it doesn't make the news, but it's there and it puts food on the table for legions of web developers.

</comment><comment><USER3> Yes. You can.

You're going to need to work on customer service, collection, sales, development, UX, etc, etc.

There is a LOT you must master.

I just reached the point of depending on being a freelancer for my income. After 4 years of 'practice', I feel I have mastered it.

<comment><USER4> I'd also add the often-overlooked Management and Leadership skills as-well. So many people have everything else, but don't have these valuable abilities and that is why 90% of people will find themselves in lead position rather than a director position.

...Not that their is anything wrong with a lead position it has it's time and place; but when it's time to move up to a director-esque position; you really need to show you can handle the responsibility of others.

</comment></comment><comment><USER5> I think that now is a good time to learn a whole bunch of new technologies because it seems most of them are within reach for any developer who wants to learn. But I would not call web dead, the web is clearly still alive and will not go away soon.

</comment><comment><USER6> I wont say you can't make a living on Web Development. But yeah,certainly something along with it can make life great.

In any case, Web ain't going anywhere but you gotta be aware about anything and everything new happening around.

</comment><comment><USER7> Couple of things, if the answer you're looking for is "you don't need to learn new trick" unfortunately you will someday become a dinosaur.

However, the web is very much alive and I believe its more vibrant than ever before!

</comment><comment><USER8> I would focus on HTML5 and something like RoR or Node.js; that will be rather feature proof and there is enough work there.</comment>


High Performance Networking On The JVM - <AUTHOR> http://normanmaurer.me/presentations/2013-jax-networking-on-jvm/#/1

<comment><USER2> AFAIK, section headers should be used sequentially, e.g.

First level

Second level

Foobar

Another second level header

Quux

 (the space prevents HN from eating those tags).

It also uses paragraphs and breaks to create white space. On line 284 it even wraps a break in a bold tag.

Nice article, though.</comment>


Exemplary fullstack Medium.com clone powered by React, Angular, Node, and more - <AUTHOR> https://github.com/gothinkster/realworld <comment><AUTHOR> It's taking the concept of TodoMVC, and extending it further.

> See how the exact same Medium.com clone (called Conduit) is built using any > of our supported frontends and backends. Yes, you can mix and match them, > because they all adhere to the same API spec.

> Choose any frontend (React, Angular 2, & more) and any backend (Node, > Django, & more) and see how they power a real world, beautifully designed > fullstack app called "Conduit".</comment>


Steve Losh's .vimrc - <AUTHOR> https://bitbucket.org/sjl/dotfiles/src/tip/vim/.vimrc <comment><USER2> For those wondering who Steve Losh is. He's the creator of a few vim projects and is writing "Learn VimScript The Hard Way".

<http://stevelosh.com/projects/>

</comment><comment><USER3> I didn't know this was possible:

        " Resize splits when the window is resized
        au VimResized * exe "normal! \<c-w>="

That's really handy. Also, this part made me smile:

        " Heresy
        inoremap <c-a> <esc>I
        inoremap <c-e> <esc>A

<comment><USER4> (I love both editors)

That's something disgusting about Vim - mapping to other keys instead of commands. In Emacs its much nicer IMO:

        (global-set-key (kbd "C-a") 'beginning-of-line)

<comment><USER5> Disgusting but practical. I already know the keys on the right because I use them every day. If it were a function I'd have to look it up first.

<comment><USER6> Is there a Vim equivalent of Emacs's C-h k followed by the key combo, which basically says, "Tell me what the official command name is for this keystroke?"

<comment><USER7> I don't know of anything quite like that but the help can be searched by key, though only for the default key combinations, e.g. ":h i^a" would show the docs for the ctrl-a command in insert mode.

Note though that vim really doesn't have commands the same way as emacs does. That's why you generally see assigning one key combination to another instead of some "command name."

</comment></comment></comment></comment></comment><comment><USER8> I think that having all of this in one file is too crazy. I suggest putting some of the stuff in the appropriate files in ftplugins, etc in your ~/.vim directory.

<comment><USER5> Some of this definitely belongs in separate files.

The problem is that most of these are things I came up with when, during the middle of coding, I thought "oh, this would be really nice". So I just switched to my vimrc, added it, and got back to working, instead of thinking about where to put it, creating new files, etc.

Every so often I'll go through and clean it up. I just haven't gotten around to it for a long time since it works perfectly fine as is.

</comment></comment><comment><USER9> If you want to learn how to do this yourself, let Steve know here: <http://leanpub.com/learnvimscriptthehardway>

</comment><comment><USER10>
        function! NyanMe() " {{{ ...

I very much hope that's just there as an easter egg for those of us who read to the bottom.

<comment><USER5> Actually I'm planning on splicing it into MakeGreen, so instead of getting a green bar when my tests pass I get Nyan Cat flying across my window. Maybe over Thanksgiving weekend I'll get around to it.

Edit: Also, if anyone can show me how to draw an ASCII-art Nyan Cat in one line of text that would be awesome. Nothing I tried looked recognizable.

<comment><USER11> how bout 2 lines? <http://jsfiddle.net/MHj9N/>

<comment><USER12> Ascii Nyan cat!! Thank-you! My mind just melted.

</comment></comment></comment></comment><comment><USER13> That's one thing that worries me about using vim full-time: if I become reliant on a .vimrc or a set of plugins to use vim effectively, but I'm on a computer that doesn't have my .vimrc on it, I'm doomed.

<comment><USER14> I feel exactly the opposite. The previous editors that I used required configuration through a menu system. I wouldn't have known how to take that with me elsewhere.

With Vim, all my configuration is in files, which can be backed up. I have them in a dotfiles repo on Github. As I make tweaks, I regularly pull and push from my various computers and they are always up to date. If I'm on a computer that doesn't have my .vimrc, I'm just a `git pull` away from having it. (Same goes for zsh config, etc.)

The most likely time for me not to have my .vimrc is when sshing into a server, in which case I can use stock vim just fine. If my main editor were a GUI, I wouldn't have it available at all, so I think Vim has a leg up in that, too.

<comment><USER14> By the way, if you're ever confused about what behavior is native and what comes from your config, use the `-u "NONE"` option to run vanilla vim (or macvim or gvim).

</comment></comment></comment><comment><USER15> vimscript really is an abomination. vim users of the world unite! and create a proper macro language for your editor. and no: running an external python/ruby/brainfuck process does not count.

<comment><USER16> I dunno, I think the Python interface is adequate. Not great, but gets the job done. I write almost all my Vim scripts in Python.

<comment><USER17> Using Python and other runtimes is often kind of slow - it's not a huge deal but if you have a lot of this stuff in your config, then vim might start up only like 8 times faster than Eclipse.

The other thing is that the Vim API you use in these other languages is pretty much Vimscript anyway.

For me, Vimscript is basically a normal imperative language in the general neighborhood of perl and shell... I agree it is more awkward to write than Python, particularly with escaping. But it's a decent DSL for configuring text editors, and Python isn't as much.

<comment><USER16> The two advantages of using Python for me are being able to use utilities I've already written, and the comprehensive standard library.

For example, I wrote a macro to split long Python function calls into multiple lines, and I could access a parsing function that I already wrote, along with Python's own compile() to detect when I've parsed a complete expression (yes, this one is Python-specific).

I also wrote a macro to submit the current file to a private pastebin, and AFAIK you can't make web requests with Vimscript.

</comment></comment></comment></comment><comment><USER18> Here's a commented version of my .vimrc, which is modeled after Steve's, albeit nowhere near as comprehensive. (Looks like I lost it's fixed width in the paste? Sorry!)

<http://pastebin.com/jJQFxQpR>

For me it's a lot quicker to reference comments than the :help entry for each option. Thought it might help others who are creating/modifying their .vimrc.

And of course, thanks Steve for continuing to share your stuff. I'm in love with Vim, and a lot of that's thanks to you.

<comment><USER19> Here is the code in a more readable gist without fixed width:

<https://gist.github.com/1377245>

</comment></comment><comment><USER20> If anyone stumbles on this problem when grabbing the Clojure configs, I found that the TurnOnClojureFolding() method was missing: [https://bitbucket.org/sjl/dotfiles/src/27ec8da23760/vim/.vim...](https://bitbucket.org/sjl/dotfiles/src/27ec8da23760/vim/.vimrc#cl-357)

But, a bit of Googling will find it (works pretty well, too): <http://writequit.org/blog/?p=413>

</comment><comment><USER21> I'm sure I've seen this in vim, but I can't find it now. Isn't there a statusline config item that shows any pending command prefix chars you've typed?

<comment><USER22> I think you want _:set showcmd_ —"Show partial command in the last line of the screen".

<comment><USER21> THAT'S IT! My long lost friend is back! Thank you!

</comment></comment></comment><comment><USER17> I also have a huge vim configuration: <https://github.com/sashahart/.vim>

I highly recommend putting your vim configuration on github or similar, you don't have to worry about losing your config and it gets easier for everyone to learn the new tricks

<comment><USER5> I'm stealing "nnoremap <CR> o<ESC>" immediately. Thanks!

</comment></comment><comment><USER23>
        nnoremap <leader>ev <C-w>s<C-w>j<C-w>L:e $MYVIMRC<cr>

:vsplit $MYVIMRC and so on would work the same way, but more obviously, and without depending on the placement of split windows.

</comment><comment><USER24> What do the triple open and close curly braces represent?

<comment><USER5> They're fold markers. When I open my vimrc in Vim it looks like this: <http://d.pr/YKCM>

<comment><USER24> Why doesn't my Vim fold things automatically? What options am I missing?

<comment><USER3> Either

        set foldmethod=marker

Or put this modeline at the top of your .vimrc:

        " vim: foldmethod=marker foldlevel=0

</comment></comment></comment></comment><comment><USER25> inoremap # X<BS>#

This has been annoying me forever, but I never got around to fixing it. Not sure how the solution works, but it does!

<comment><USER26> This is probably b/c you're using 'smartindent' or 'cindent' all the time. Don't. The former is deprecated by the latter and they're only for C-like syntax--hence why # belongs in column 0. If you want filetype-specific indenting, you just need "filetype indent on".

</comment></comment><comment><USER27> I find semicolon and comma to be very useful so I am surprised when I see people remap them or use them as leader.

</comment><comment><USER28> I love reading these files and finding something new to use. gdefault is definite going in.

<comment><USER29> Ugh. Be careful with that, since actually giving a /g has the effect of toggling the behaviour all together.

From :help 'gdefault':-

        :help 'gdefault'
        'gdefault' 'gd'		boolean	(default off)
        global
        {not in Vi}
        When on, the ":substitute" flag 'g' is default on.  This means that
        all matches in a line are substituted instead of one.  When a 'g' flag
        is given to a ":substitute" command, this will toggle the substitution
        of all or one match.  See |complex-change|.

        command		'gdefault' on	'gdefault' off	~
        :s///		  subst. all	  subst. one
        :s///g		  subst. one	  subst. all
        :s///gg		  subst. all	  subst. one

While not quite documented under ":help :s_flags", two 'g' flags cancel each other out. This also applies to 'gdefault'.

Also, be aware that this may break a huge amount of scripts out there, should you decide to use it as some (hard to debug) issues are caused because of it.

<comment><USER5> I've had this set for a while now and haven't noticed any scripts breaking. It's _far_ more common for scripts to break because I'm remapped something and they used 'nmap' instead of 'nnoremap' or 'normal' instead of 'normal!'.

Whenever a script breaks, I bite the bullet and fix it, fork it on Github, switch my dotfiles repo to use my fork and send a pull request. If they merge my fix I switch my dotfiles repo back.

It's a pain in the ass, but I like to think that it helps other Vim users a little bit.

</comment></comment></comment><comment><USER30> I like PulseCursorLine, but I wonder why only on N and n? (e.g. not on *)

<comment><USER5> Because I have Vim set up to not move at all when I press star, so there's no point in pulsing the line:

        " Don't move on *
        nnoremap * *<c-o>

</comment></comment><comment><USER31> Does this affect performance in any way? 1k+ lines is quite a lot.

<comment><USER5> In _any_ way? Of course.

But my laptop has 8 _gigabytes_ of RAM, a solid state hard drive, and _four_ processor cores.

I can run Minecraft at the highest settings while accidentally leaving a Linux VM running in the background. Loading a 1.5k vimrc file is barely a blip on the processor graph.

</comment></comment><comment><USER32> God bless nvi.

I will never understand why people go out of their way to write and maintain such monster configuration files.

Learning core/traditional vi gets one a long way, instead of delusioning themselves with false cleverness and productivity.

<comment><USER33> I don't think that the author wrote his 1200 lines of .vimrc in one sit. More likely it's years of accumulated 1-2 line additions and removals.

My vimrc has slowly accumulated, I add 1 or 2 new keybinds every now and then and I might remove them later if I notice they don't suit my workflow. Most of my changed keybindings are related to making Vim usable with my native keyboard layout (finnish/swedish).

Also per-language additions accumulate over time. The author seems to have put all settings for all file types in the same file.

Learning standard Vi gets you a long way, but sometimes adding or changing a keybind will make things work more fluently.

<comment><USER32> My point was, time better spent is coding, not dicking around (and relying) on .vimrc.

We often forgot about the essence of things such as typing the actual code or words, and focus on tools. Better investment is learning how to properly type than having countless little helpers which are nothing more than debt.

Increasing complexity in all areas of life really is troublesome.

<comment><USER34> I think you're thinking about it backwards. It's usually not thinking "what could I tweak today" that results in adding something to .vimrc. It's "I keep doing this a lot / this feel uncomfortable, maybe there's an easier way" that results in changes. And if you take time to actually implement it, that's a good indication it was worth the tweak.

Let's say you work with splits a lot. Sure you could press ctrl+w all the time, but it's a bit annoying. Rebinding doesn't take much time, but makes it (in the presented example) actually simpler. So did it waste time? A minute or so. Does it make life easier? A little bit. Did the "coding time" suffer? Who cares about a minute or so ;)

</comment></comment></comment></comment><comment><USER35> Anyone who knows who sjl is could have easily found his vimrc through his website. According to the bitbucket history, the file has been hosted there since at least 2009.

<comment><USER36> Which doesn't make it less useful. And for those of use who don't know sjl, this was useful.

<comment><USER35> Did I say it wasn't useful? Maybe you missed my point.

I could post a link to a perldoc page for some builtin function, and that would be useful, and it's probably been around for awhile, and probably nobody knows who wrote it. Would you defend that too?

</comment></comment></comment><comment><USER37> Can we now have a long discussion about profanity in dotfiles?

<comment><USER38> There should be more of it.</comment></comment>


USA Fever Heatmap: Isolation working since Mar 20 - <AUTHOR> https://healthweather.us/?mode=Atypical <comment><AUTHOR> In addition to the nation-wide fever numbers, Kinsa tracks numbers by state and county.

Take for example, Forsyth County, GA, due north of Atlanta. The Heat Map shows Forsyth has as many current Atypical Fevers (per capita) as every other county adjacent to Atlanta.

Georgia is not a state in lockdown, and is below normal in testing. Individual counties in GA are in lockdown. This includes South Fulton county which includes Atlanta. It does NOT include the cities of Sandy Springs, Roswell, Alpharetta, Johns Creek, and Milton which comprise North Fulton county, and Forsyth county north of them.

The Fever Heatmap shows the folly of this situation. Politicians are driving thru the rear-view mirror. Atlanta has the most cases Now. But the heatmap suggests all those location mentioned above have as many people (per capita) actively spreading the disease.

The case could be made that lower population density reduces the need for lockdown. But such an argument needs to be made and supported, not assumed. Currently it is not even addressed.

</comment><comment><AUTHOR> This company Kinsa sells internet connected thermometers. Their "US Health Weather Map" (that I called a Fever Heatmap) shows areas with more fevers than normal. Under the map note the chart of fevers vs Date.

Normally (sans epidemic) these fevers are from flue and colds. On the chart, the blue line extending thru May is the number of fevers expected. The Orange line is the Observed number, and Red shows fevers exceeding the expected range.

This data is recorded by Kinsa's servers as their customers measure their temperature. As such it is 5-10 days (my estimate) _ahead_ of the case numbers reported by doctors and hospitals. This is because people wait until they feel really sick before calling a doctor.

Therefore, these numbers are timely, but harder to interpret. Remember these are all fevers, not just SARS-COV2. Also this is most certainly NOT a random sampling of the population. The sample must be small, and skewed by income and age.

That said, what the chart shows is that in the USA, fevers exceeded the expected range about Mar 9, then fell back into the expected range about Mar 20, and are now below expected.

The conclusion drawn is that these Atypical Fevers represent people sick with Covid-19. And that Social distancing quickly reduced the spread of ALL viruses. Fevers dropped below expectation because isolation reduces the spread of influenza, rhinovirus, and coronavirus.

I have been plotting current cases and deaths for this epidemic all month, hoping to see a break in the exponential growth. That has not yet happened. But this cart is the first good news I've seen.

(Note: You must track Current Cases, not Cumulative Cases to see the real exponential growth. Recovered & dead patients do not spread the disease. So the graph of Cumulative Cases will fall below exponential growth early due to attrition, not effective isolation.)

</comment><comment><USER2> This has been some of the most interesting data to look at in this whole season. I'm not sure whether I'm right in feeling bolstered by what it's saying but it seems that in most areas, the "measured fever" population is on par or lower than expected -for totally normal situations?- since "social distancing" has been encouraged.

Even if I'm way off in interpreting that trend line, it sure takes the edge off to see someone point the trend line down-and-to-the-right for once

<comment><AUTHOR> It's a hopeful sign that needs confirmation. When you want something to be true this badly, one must be careful and judicious.</comment></comment>


Let's all laugh at my horrible 2006 post: "YouTube is not a real business" - <AUTHOR> http://calacanis.com/2015/04/30/lets-all-laugh-at-my-horrible-2006-post-youtube-is-not-a-real-business/ <comment><USER2> Very few people know this, but I remember when MySpace almost killed YouTube. Yes, MySpace.

YouTube blew up in popularity when everyone was adding videos to their MySpace profiles. And suddenly one day MySpace decided to block all YouTube embeds (they'd occasionally do this with other services as well.)

At the time YouTube was just a small startup without much muscle behind it. All they could do is write a blog post pleading their users to contact MySpace to allow their videos. And it worked, a week later MySpace lifted the ban and it allowed YouTube to reach astronomical growth.

Edit: Here's a link to the blog post mentioned [https://web.archive.org/web/20051223152529/http://youtube.co...](https://web.archive.org/web/20051223152529/http://youtube.com/blog)

<comment><USER3> lucky youtube, since myspace totally could instead "import" videos when detecting embed.

<comment><USER4> What do you mean? Bulk copyright infringement?

<comment><USER5> As if any of the content on Youtube at that time was licensed? They owe all of their early success to "bulk copyright infringement."

</comment></comment></comment></comment><comment><USER6> It wasn't just the lawsuits - IIRC YouTube the business was also bleeding money at a terrifying rate thanks to infrastructure costs (servers, bandwidth) even without the legal problems.

When Google took them on they were able to cut their costs to the bone by using capacity on Google's internal fibre network which had been bought up cheap after the first dotcom crash & moving the data over to Google's server infrastructure.

Could anyone else have bought YouTube & managed to turn the business around apart from Google? It seems to me that YouTube was one of those businesses that had negative worth to all except a very few buyers. Did anyone else have the infrastructure knowledge to do what Google was able to do at the time?

<comment><USER7> On its own youtube doesn't really make any money. It's only recently that its started to actually champion original content. (as in something approaching a tv station. not just nut shots.)

[[http://www.quora.com/How-much-money-does-YouTube- make](http://www.quora.com/How-much-money-does-YouTube-make)] (granted not the best of sources)

But we need to separate "value" from viable business. Twitter, unless it changes will go bankrupt. Its loosing around $160 million a /Quarter/

Value is a subjective thing, and can be manipulated to suit the needs of others. Earnings are meant to be empiric. If twitter was any other company, its stock would be worthless.

If we take a look at the buisness model of youtube: o Collect all video

o Flog adverts on those videos

o only take down copyright when notified.

o Sign deals to distribute promo material.

o Force small producers into exclusive deals with google at discount rates.

The signal to noise ration of profit making videos to not is terrible. I suspect that 99% of all videos uploaded to youtube are useless and have less than 100views. ([https://www.youtube.com/yt/press/en- GB/statistics.html](https://www.youtube.com/yt/press/en-GB/statistics.html))

Without the backing of an extremely profitable company such as google, youtube would have failed. I'd assume it would have been sued out of existence, and if it didn't it'd have died under the infrastructure bills (they basically have free bandwidth and CDN)

<comment><USER8> Sometimes I think of Youtube as a modern Library of Alexandria[1], a repository of knowledge that could only exist through patronage and containing a sizable amount of resources that are valuable in their uniqueness. A failed YouTube would represent a loss of equally epic and/or mythical proportions.

[1] [https://en.wikipedia.org/wiki/Library_of_Alexandria](https://en.wikipedia.org/wiki/Library_of_Alexandria)

<comment><USER9> I think you're mixing up what YouTube does and what Wikipedia does..

<comment><USER10> YouTube holds a lot of unique content, documenting current times and events as they were happening. Given YouTubes relatively short existence, this is not obvious to everyone yet, but given just ten more years it will already start to provide an interesting glimpse into the lives of the people of the past. Imagine if we would have had the same insight about the people living in earlier centuries. Instead of us having to read about them in books, they could show it to us themselves.

I believe the Internet Archive ([https://www.archive.org](https://www.archive.org)) along with sources such as YouTube, provided they survive, will be considered the most important to get insights into the lives of the common people for future generations.

</comment></comment></comment></comment></comment><comment><USER11> Nice _mea culpa_ , and a day after the "101 random and mutually exclusive ways we wanted to fix Apple in 1997".

No doubt obervers, critics, and expert opinions have their place. But never underestimate the man in the arena - especially if you _are_ the man or woman in the arena.

</comment><comment><USER12> He says Google got 100x their investment since it's 'worth' that multiple of what they paid. I don't think it's a valid argument since they paid real cash and have only a notional value in return. It's hard to see anyone forking over $100bn+ for youtube, and I doubt it's even made enough profit since they bought it to cover what they paid originally paid. None of this is to particularly criticise either the original post or its followup - it takes courage to call it as you see it and then own up to your mistakes, but it's always worth taking another pass at the figures to see if they really stack up.

</comment><comment><USER13> >At the time I wrote that post, YouTube was not a real business; [...] The fact that they were forced to sell a business that is now worth $100-150b for $1.6b is a good indication for how close to the brink of destruction they were.

I don't follow this point. How is selling something to Google for $1.6b an indication of being on the brink of destruction? And if the point here is that they were worth a discounted $100b then (so sold undervalued), how can that be the brink of destruction either? Either way I don't follow the author's reasoning here. It sounds like he's saying, "they were REALLY worth a discounted ~$100b, but they were in such dire straits they had to sell for 1.6% of that." But that contradicts his point that it wasn't a 'real' business.

So either way, I don't see how that sentence supports the point he is making.

<comment><USER14> Not to mention he missed by a mile on the valuation estimate.

YouTube isn't worth anywhere near $100b-$150b.

Netflix has a better business model, a track-record of profitability, more revenue and nearly 60 million paying subscribers. It's worth $33 billion by comparison (and is itself carrying a hyper valuation at 100-200 times earnings typically). Netflix is the general ceiling on YouTube's valuation.

<comment><USER13> Yes, I agree and had an objection to that number in my first edit. It's obvious that YouTube isn't worth anywhere near $100B.

What made me remove it is that Google itself is valued at 371B, so the idea that YouTube constitutes 26% of that valuation is something in the realm of what someone could defend. (To compare with your numbers, YouTube.com is the third-most visited site on the planet, after Google.com and Facebook.com [1][2] and has "more than 1 billion users" [3] along with 50% monthly growth according to that page. Since YouTube isn't in the same business as Netflix (VOD), it's hard to use that as a cap on its valuation.)

The author's valuation of YouTube today is probably still inflated by a large multiple. You suggest a cap on YouTube of 8.9% of Google's valuation ($33B), perhaps that's fair, but it's hard to say as it's not an independent business.

[1] [http://www.alexa.com/topsites](http://www.alexa.com/topsites)

[2] [http://en.wikipedia.org/wiki/List_of_most_popular_websites](http://en.wikipedia.org/wiki/List_of_most_popular_websites)

[3] [https://www.youtube.com/yt/press/statistics.html](https://www.youtube.com/yt/press/statistics.html)

</comment></comment></comment><comment><USER15> I think Jason is overstating Google's risk acceptance with the Youtube acquisition.

"Napster, Kazaa, and countless other media sharing services had been absolutely crushed..." did not happen by being out-litigated. They were _over- litigated_ \-- they simply didn't have the capital resources to commit to the legal challenges ahead of them.

Google didn't have that problem. Google was also the darling of Wall Street, Sili Valley, tech culture, etc. which translated to a built-in victory in the court of public opinion. There was certainly legal risk involved, but they had a much more level playing field with the content producers.

<comment><USER16> Actually the two named example given, Napster and Kazaa, where out-litigated.

See [http://en.wikipedia.org/wiki/Napster](http://en.wikipedia.org/wiki/Napster)

> Initially Napster lost the case in the District Court but then appealed to > the U.S. Court of Appeals for the Ninth Circuit. Although it was clear that > Napster could potentially have commercially significant non-infringing uses, > the Ninth Circuit upheld the District Court's decision. Immediately after, > the District Court commanded Napster to keep track of the activities of its > network and to restrict access to infringing material when informed of that > material's location. Napster wasn't able to comply and thus had to close > down its service in July 2001

And [http://en.wikipedia.org/wiki/Kazaa](http://en.wikipedia.org/wiki/Kazaa) (not quoting a particular paragraph in this one as the "lawsuit" section is very long covering several countries, but it basically turns to "kazaa lost, started settling with all plaintiffs and agreed to turn into yet another legal music selling service clone").

<comment><USER15> Napster filed for bankruptcy in 2001 and blamed their "enormous legal fees" as the primary cause. (Outside of, you know, having any actual revenue.) Kazaa was in the same boat.

It's true, they did participate in some lawsuits, but they were going to be overwhelmed by the sheer volume of legal activity (the very purpose of which was to drain them of resources.) Appeals, filings in multiple districts, etc.

Back to Google/Youtube -- Google had the resources to sustain any sort of legal onslaught by the RIAA. In fact, more so as those companies started to see their profits decline steadily during the mid 2000s, and the prospect of winning a protracted legal battle wasn't so certain. As a bully, it's much easier to take the little kids' lunch money, but not so much fun when you encounter a much bigger kid on the playground.

</comment></comment></comment><comment><USER17> Very interesting. There is a very good interview with Chad about the wild ride: [https://www.youtube.com/watch?v=l56Hw5H-DEI](https://www.youtube.com/watch?v=l56Hw5H-DEI) He talks quite a bit about their situation then.

Not many startups go from 0$ to 1.65B$ in 22 months.

Jason did not mention that Google itself was not a real business for a very long time. Are there good writeups of how Google managed to crack the biggest jackpot in business history with AdSense? Sure this experience taught them the lesson which they applied here. In poker terms it's like a draw to the nuts.

<comment><USER18> >...of how Google managed to crack the biggest jackpot in business history with AdSense?

To clarify, it was AdWords, not AdSense. AdWords (2000) was the original monetization strategy and is still the #1 contributor to revenue and profits today. AdSense (2003) came later.

It's easy to get AdWords and AdSense mixed up because both brandnames are nondescriptive. Both AdWords & AdSense are based on "keywords" and both "senses" or "tries to make sense of" page content to generate relevant ad links.

</comment></comment><comment><USER19> Interesting, he wasn't wrong. And while Youtube is something of a 'fixture' today we had Google telling us it still wasn't making any money (although it had reached a point where it wasn't losing money either).

Youtube was birthed by business worlds version of Ceasarian Section, basically Google funded the crap out of it invested in datacenters and putting Youtube "pods" in bunches of Colocation facilities around the world etc for a property that doesn't make any money. But what is next for the video service? What business model works where it makes back its money? Does it try to be NetFlix? HBO Go? Comcast?

Does Google start throwing money at "Youtube Studios" to bring original (and with decent production values) content to the web? That is way outside their current comfort zone.

How do they get people to watch and act on advertising they see on Youtube? Because unless they can do that it has to be subcription, and how do you turn the service that everyone knows is "free" into a subscription service?

That is why I don't think it was wrong in 2006 or in 2015 to wonder if YouTube is a "real" business, I don't think we know yet.

<comment><USER20> >Google funded the crap out of it invested in datacenters and putting Youtube "pods" in bunches of Colocation facilities around the world etc for a property that doesn't make any money.

When Google says YouTube doesn't make any money, they mean net of funding the crap out of it.

</comment></comment><comment><USER21> Meta dupe chain!

[https://news.ycombinator.com/item?id=9437641](https://news.ycombinator.com/item?id=9437641)

It's a HN submission about a blog post, and that blog post is is _about_ (a reaction to) the previous submission, which is about a previous blog post by the same blogger.

</comment><comment><USER22> Is youtube profitable ? If search-engine-ad-$ go puff, does it stay up or go down ?

<comment><USER23> "Is youtube profitable?" Oh yeah, very, it is eating traditional TV alive.

In Europe Governments want to intervene because it is taking so much money from their tv companies, and sending good jobs and money abroad.

"If search-engine-ad-$ go puff, does it stay up or go down?"

And if a meteorite crashes in the Earth?, or a big megaexplossion on the Universe sends cosmic rays to the planet?

If nothing like this happens, there will be markets that grow, like TV from the Internet, and markets that recess, like traditional TVs. Early adopters use to benefit from growth in their markets.

<comment><USER7> Nope, its not profitable. Infact, like the sun its dilated the advertising dollar, which means not only traditional TV mediums are loosing viewers to, they are loosing value per advertising minute sold.

Its also not eating traditional TV. You don't sit down to watch a series on youtube. There is no such thing as longform youtube. There are no profitable 30minute episodic videos on youtube that aren't pirated.

Content is king, and if you are producing shit content (cough 90% of the US TV market) saturated with adverts and repetition, users don't turn to youtube, they turn to netflix.

Netflix will eat all, Youtube is, and unless something changes (like no user uploads) will always be a subsidised media charity store.

Yes, its cornered the MTV music video and nutshot compilation market. It has enabled niche video makers for things like hobbies and such. but there is literally no money in that either.

<comment><USER24> > Its also not eating traditional TV. You don't sit down to watch a series on > youtube. There is no such thing as longform youtube. There are no profitable > 30minute episodic videos on youtube that aren't pirated.

Minecraft UHC (ultra hardcore) competitions are one example of longform youtube series. Each episode is 20 to 30 minutes; you'd probably watch a couple of different people.

I assume bigger channels make money from doing it.

I'm currently watching LapisDemon (associated with the now broken ZipKrowd server) and Xisuma (Hermitcraft) playing as a team and I dip in and out of other viewpoints.

This definitely reduces the amount of telly I watch.

<comment><USER8> Is that a good thing, though? I'm not a gamer, and there are times when I take a break from YouTube and Reddit because it can be difficult to discover new content without the results being dominated by gaming (especially Minecraft).

To an outsider performing random searches, it would seem our civilization is based on games, guns, fingernail polish and BDSM.

<comment><USER24> I make no judgement. Parent post said you don't get serial content on youtube, and that's just false. You do.

If you like watching Minecraft it's great - there are thousands of hours on YouTube.

FWIW Once you start watching something YT tends to recommend more of the same.

Watching this "World's smallest v12 engine" video leads me to more engine engineering videos, no Minecraft in sight. [https://www.youtube.com/watch?v=m3KdpzL3Hkk](https://www.youtube.com/watch?v=m3KdpzL3Hkk)

<comment><USER7> >There are no profitable 30minute episodic

By episodic TV I mean drama, comedy, traditional TV format. Stuff that people are prepared to pay for (see netflix et al.)

Broadcasting sports is super cheap, and has little value for anything other than tier 1 events. (the expense is the rights management, something that games broadcasting has yet to really encounter.) Also note that like I said, its a niche thing, which limits its profitability. Niches always exist.

Also note the profitable. Channel4 in the UK used to deliver its catchup TV via youtube. Despite the heavy promoting it failed to get more than a few hundred thousand views across the entire library.

</comment></comment></comment></comment></comment></comment></comment><comment><USER25> > "we're sorry that's not our problem — we're a platform" approach. An > approach that is now the standard for disruptive startups.

I truly agree with this on the "disruptive startups" part. Pretty nifty way to avoid all sort of legal troubles, don't you think?

<comment><USER26> Not particularly "nifty", it's the standard way for centuries. You don't get to sue the Postal Service if someone sends an unlicensed copy of your work through it.

</comment></comment><comment><USER27> > The fact that they were forced to sell a business that is now worth > $100-150b for $1.6b is a good indication for how close to the brink of > destruction they were.

As a founder, I dream of having a company that close to the brink of destruction.

</comment><comment><USER28> Everyone is right, sooner or later

</comment><comment><USER29> Well, I think any experienced programmer could write a reasonable approximation to youtube in a weekend in their basement. So from that point of view, youtube is not really a business. However, as a "brand", it is of course quite strong. It seems to me that we have to come to the sad conclusion that building a business is more and more about building brands and locking in customers (into your ecosystem/social network), and less and less about the actual technology, which is ubiquitous after all.

<comment><USER30> An experienced programmer can cobble together a moderately buggy, YouTube- esque site which kind-of-works for whatever video formats that can be converted by their local ffmpeg install, and allows a basic commenting system and upvotes/downvotes, running on a handful of servers capable of storing a few terabytes of data.

YouTube, on the other hand, stores so much video that they can't actually tell you how much storage they have online at any one time. They have to process 300 hours of newly-uploaded video per minute, which they then have to serve up to millions of simultaneous visitors through a network of data centres with many thousands of servers spread around the world. On top of this, they have to deal with analytics, advertising, account management, copyright compliance, and everything else they have to do, on the huge scale on which they operate.

That's not a minor technical achievement.

<comment><USER31> Youtube did not start with the tech infrastructure they have today. They started with that moderately buggy site which kind of worked for those formats that their local ffmpeg could handle without comments and votes and could maybe store a few terabytes of data.

Don't look at the situation today (or even 3 months post launch) to see what a youtube like MVP could look like.

<comment><USER30> Well of course that's correct, but it's wrong to take that and then make the conclusion that the GP does - that building a technology business these days doesn't actually involve much technology because everything's so ubiquitous. Scaling anywhere past MVP requires extensive and deep technical development. Any competent web dev might be able to reach something like YouTube's MVP, but it takes a lot more than that to build anything from then on.

<comment><USER31> > Any competent web dev might be able to reach something like YouTube's MVP, > but it takes a lot more than that to build anything from then on.

That goes for _all_ web start-ups. An MVP can be duct-taped together but for major scaling you'll need to have all your ducks in a row. But that's fine and totally expected. It would be entirely wrong to build your MVP using the tools you'd use to scale through 6 orders of magnitude, your competitor would be able to cycle much quicker in the first 6 months or so which is when you'll be adapting to market, business model and opportunities suggested as feedback from early adopters. If you're going to do that with a fine-tuned crazy scalable solution you'll simply be dead.</comment></comment></comment></comment></comment>