The Very Rich Indie Writer - <AUTHOR> http://www.novelr.com/2011/02/27/rich-indie-writer <comment><USER2> As someone who reads her genre but not her books (saw a few paragraphs, decided to pass), I'd say:

1) The quality was noticeably worse than authors in the genre I enjoy but, critically, difficult to distinguish from at least some New York books that I've paid money for.

2) I did not find myself thinking "Dang, you know what this excerpt needed? A _publisher_. I mean, look at it, it's so... not _published_."

3) I wish her every success, and strongly hope that authors I enjoy adopt the model themselves, because continuing the current model adds no value to me and, in fact, subtracts it when I have to deal with territory lockouts or "The book is ready -- you can read it next year."

<comment><USER3> The value traditional publishing adds is a variety of professional staff (editor, copyeditor, designers, etc), potentially fronting advance money to cover costs for writers to devote full time to writing, and to some extent as a filtering mechanism (you know a published book usually isn't going to have egregious spelling/typesetting errors that make it unreadable).

That's legitimately valuable, but the quotes by Konrath in the article are spot-on: If you don't need the full traditional staff to put out a good product and don't need the advance money, traditional publishing becomes less and less useful to you.

I'm a little more optimistic about the traditional model than most people are - I think with some basic adjustments and modernizations, they've got another pretty good 10-30 years in them doing things similar to how they're done now. But it's definitely more viable than ever to go outside the model, especially for people able to put out a polished product without help.

<comment><USER2> The professional staff is dirt cheap and already almost 100% outsourced by the publishers. That's a barrier like not having Photoshop skills is a barrier to selling on the Internet: pay somebody money, problem solved.

<comment><USER3> Hiring a professional editor and copy-editor is probably going to run you four-figures for a feature length book. Considering most books don't sell well, the first time writer takes a significant risk eating those costs.

Some people can write/polish well enough without those roles, and they stand to gain a lot from the new models. But it'll be a while before traditional publishing is no more. Actually, the biggest worry they should have is that bestselling authors go off on their own after one or two wins, like how Seth Godin just announced he's not doing any traditional publishing any more. That's got to be a little scary for the industry.

<comment><USER4> > Hiring a professional editor and copy-editor is probably going to run you > four-figures for a feature length book. Considering most books don't sell > well, the first time writer takes a significant risk eating those costs.

If you're an author, your first book is like a startup.

You have to either beg your friends and family to do copy-editing for you, do a lot of it yourself, or somehow raise funds to get a pro copy-editor.

</comment></comment></comment></comment></comment><comment><USER5> As an aside, I find that thanks to online web fiction and self publishing I found some works I really enjoyed but probably would never have been published by any publisher... I think that whenever you have gatekeepers like this, they can get a bit too conservative and tend to only accept work that is similar to successful works.

For example, An Intimate History of the Greater Kingdom <http://www.meilinmiranda.com/intimate-history> An erotic (but not the main focus) coming of age story in a victorian world. It's really good and original, but it mixes so many genres and is so different from what I'm used to that I wouldn't expect any mainstream publisher to publish it...

The other big example of this is some works of fanfiction like Eliezer's Yudkowski Harry Potter and the Methods of Rationality which is popular here... It would never be published because it's fanfiction but it's original and is quite different from what I'm normally used to by mainstream publishers...

</comment><comment><USER6> In my opinion this applies to the "find a niche" strategy. She found a niche, a particular audience that want a particular service. They are not looking for professional writing, at least most of them (look at the forum, someone mentioned it but the others don't seem to be too much bothered).

Amazon helped her, the Internet too. She blogs, people get attracted with her stories. After that, She releases a book, cheap like $3, people buy. Her blog, Amazon, word of mouth... all of that bring her sales. She makes money.

Find a niche, figure out what your customers want, make the product and profit.

</comment><comment><USER7> I have a feeling the young adult fiction area (where this author is focused) is where much of the ebook money is coming from in general(but it's going to balloon everywhere). I can see how serial authors who get kids hooked on their series can have a nicely incrementing revenue stream. I'm sure you can think of a couple examples of traditionally published YA fiction that have long lines of fans loyally paying top dollar for hardcover versions of the newest volume.

There was an article earlier this month in the NYT (web version: <http://www.nytimes.com/2011/02/05/books/05ebooks.html>) with some observations on children consuming ebook content.

"At HarperCollins, for example, e-books made up 25 percent of all young-adult sales in January, up from about 6 percent a year before — a boom in sales that quickly got the attention of publishers there."

And that's from the publishing 'house' example.

The NYT article also observes that a lot of kids are getting ebook readers as gifts. When a grandparent/aunt/uncle can't think of a specific book to give a kid for their birthday or whatever, rather than give them a piece of junk toy or unwanted clothes, they can buy an ebook reader, maybe with a small Amazon gift certificate or a DVD full of formatted Gutenberg texts.

I can only imagine it will be a short time before the author's age falls even further for some of these stories of young writers making money. I could see the clever goth girl in junior high pounding out a thin book a month and self- publishing for $.99.[1] Ebooks have disconnected the feeling of "value" and "heft" of a book, which publishers have been inadvertently reinforcing for years with the hard/soft cover versions of books.

As with the Twilight (although, not so much with the Harry Potter) books I mentioned earlier, our idea of "quality" isn't necessarily important to hook kids. If it's escapist literature with a character with whom a kid can identify, you could pull a George Lucas (oh look, another one) and use Joseph Campbell's Hero with a Thousand Faces as a money-printing machine.

[1] What a perfect time, too: take the last few years of your livejournal blog, put it into chapters, and format it for the Kindle.

<comment><USER2> _If it's escapist literature with a character with whom a kid can identify, you could pull a George Lucas (oh look, another one) and use Joseph Campbell's Hero with a Thousand Faces as a money-printing machine._

This is quite similar to the formula which prints money in urban fantasy, whose core market is grown women. They're often shlocky, but that is part of the appeal.

Anecdotally, from reading reviews prior to purchasing, a lot of my fellow Plucky Mechanic Dating Brooding Vampire Lord readers love their Kindles to death, despite being neither juvenile nor obviously tech savvy.

<comment><USER7> Hah, you just described my wife, who is a very well educated attorney and international policy expert. If it has a vampire in it, she'll read just about any book.

Before, by some strange twist of fate, she finds me talking about her online, she did not read or endorse the Twilight books. She did want to watch the movie "with the vampires fighting the werewolves" but was rather put out that the fight was so short, cramming seventeen seconds of action in a twelve-hour movie.

<comment><USER8> Any HN readers who like books with vampires in and also enjoy "Harry Potter and the Methods of Rationality" might want to be aware of _Luminosity_ (<http://luminous.elcenia.com/all.shtml>) and _Radiance_ (<http://luminous.elcenia.com/all2.shtml>), which bear something of the same relationship to Twilight as MoR does to Rowling's Potter (and are written by another prominent LessWrong'er). They contain both vampires and werewolves, and a certain amount of fighting. I haven't read the Twilight books myself, but my understanding is that although most of the characters are taken from Twilight canon the plot and style are distinctly different.

</comment></comment></comment></comment><comment><USER9> Her Kindle books are $3 per copy, not $9 as the article states. But no matter how you slice it, she's making north of $1M per year.

<comment><USER10> Per this article, in about 9 months she's sold 185k books:

[http://www.huffingtonpost.com/tonya-plank/meet-mega- bestsell...](http://www.huffingtonpost.com/tonya-plank/meet-mega-bestselling- ind_b_804685.html)

At $3/each, with 70% going to her, that's $388k. Not bad, but not >1M.

<comment><USER11> Her books are a mix of .99 (35% royalty rate) and 2.99+ (70% rate).

Also she sold something like 450k books in January alone.

</comment></comment></comment><comment><USER12> I am curious to see what will happen to the major publishers in the next 5 years. I'm not saying that sales of physical books will plummet to their death (I don't see this ever happening), but perhaps the publishers will be forced to offer the authors a much better deal than the current 30%.

One thing that might happen is that the volume of books being printed will decrease dramatically. Maybe they'll implement a JIT inventory strategy.

[edit: Although such an inventory system would only be plausible online. Print on-demand.]

<comment><USER11> Actually, while I can't remember the name, there are machines that have been built where you could basically tell it "I want book x" and it prints you a copy and you pay for it right there, in a reasonable amount of time, if it's in the machine's system.

<comment><USER7> I remember reading about ten years ago that authors were unhappy about print- on-demand systems because quite often, their contracts included rights reverting to the author a number of years after the last printing date. With POD, that can just keep dragging on as people snatch up a copy here and there.

</comment></comment></comment><comment><USER13> Anyone know where her sales figures are coming from? Are they self-reported?

She's obviously doing pretty well based on her Amazon rank, but I'm a little skeptical of the 100-450k per month number.

<comment><USER14> There's a bit more info in one of the articles he linked to. Specifically, in the HufPo piece ([http://www.huffingtonpost.com/tonya-plank/meet-mega- bestsell...](http://www.huffingtonpost.com/tonya-plank/meet-mega-bestselling- ind_b_804685.html)) she's quoted as saying:

"AH: As of Tuesday, January 04, 2011 at 9 PM, I've sold over 185,000 books since April 15, 2010."

<comment><USER13> Thanks! That interview is much more interesting and informative than the OP.

</comment></comment></comment><comment><USER15> OK, I read her last blog post and ... she just doesn't read like a serious writer. Maybe I'm bitter but I've read comments in hacker news that have a better literary style.

<comment><USER16> it's worth noting she writes young adult fiction, so she has a different optimization target than what a typical college educated adult would call good.

<comment><USER7> In addition, the blog just needs to be good enough to keep people buying her books. The best is the enemy of the good.

</comment></comment></comment><comment><USER17> I'm currently working on something regarding Kindle publishing. If you're interested in having an early look, or maybe even interested in contributing, get in touch with me. Hopefully I'll be able to do a 'Show HN' in a week or two.

I'd be especially interested in a quick email chat with people who have written content for it, even though you and other HN readers are most likely not my target market.

<comment><USER18> A quick heads up: you might want to put your e-mail address in your "about" section. I clicked the link to your name and only see a bunch of websites.

Anyway, I'm interested; if you see this, find me at seligerj [[AT]] gmail ((dot) com.

<comment><USER17> Those websites will give you my email address with one or two clicks. Email sent.

</comment></comment></comment><comment><USER19> Here's an excerpt from an interview with the author:

"TP: Do you have any "training" as a writer? Did you take any workshops or college classes?

AH: I've taken every writing class I've had available. I took classes in high school, and I took English and writing classes in community college, but I dropped out of college. I also attended a local writing workshop two years ago."

</comment><comment><USER20> Disruption has three parts I believe:

1\. incumbent, customers, and an offering that is high quality along a dimension valued by the customers. The dimension might be: how entertaining, how educational, how clever, how escapist, etc.

2\. entrant, different customers, and an offering that is _crap_ along the above dimension, but better than nothing for their customers. They can't attract the incument's customers, so they instead attract people who currently have nothing (and to whom "crap" is therefore delightful). It serve them, but the incumbent can't, because it is cheaper and/or more convenient/accessible/customizable.

3\. over time, the entrant improves. The incumbent's customers don't actually want perfection along that dimension, just good enough (like a small meal, you want it bigger, but eventually it's big enough, you are satiated, and you don't want any more). The entrant doesn't need to beat the incumbent; it only needs to be good enough. But it's also cheaper/more convenient etc, so the incumbent's customers switch: disruption.

notes: Disruption might not happen, e.g. if the customers aren't satiated; if the entrant can't improve enough. In considering the dimension, it's important to consider not just want the company provides, but what the customer is trying to achieve (benefit, not feature).

For indy writer's, the product seems to be clearly inferior. But it's cheaper and more convenient (on a kindle - though many books are too). It seems to have already found an audience who doesn't mind that (who is that audience?). Dedicated, intelligent people get better at whatever they work at; so it's reasonable to assume that these indy writers will improve.

Is there any reason to think they won't improve enough to meet the needs of readers of traditional books? One issue is that they have no editor, and an editor can help tremendously. Not just in proof-reading, but also in direction, even plot ideas, character issues - and marketability. It's hard for the one person to be both creator and objective appraiser. But perhaps there could arise a new "indy editor" position? Or writers can persuade their spouse to be their editor (osc does this). Or (who knows) crowd source it (webpage?)/mechanical turk it.

[EDIT _But I cannot edit properly myself. It's just not possible._ \- [http://www.huffingtonpost.com/tonya-plank/meet-mega- bestsell...](http://www.huffingtonpost.com/tonya-plank/meet-mega-bestselling- ind_b_804685.html)]

But note that _it doesn't need to be as good as traditional books_ \- it just needs to be good enough for what the market wants. That's enough to disrupt the incumbent publishers. I will note here that many page-turners that sold very well were decried by critics. It seems almost a truism that popular books are "trash" - til the author's dead, anyway. (Though I note that these sometimes are based on savvy market reading - for example, <http://en.wikipedia.org/wiki/The_Hardy_Boys>) Therefore, it seems quite plausible that indy writers can eventually become _good enough_ to disrupt traditional publishers.

<comment><AUTHOR> I wrote the article linked-to above, and I'd like to add a couple of things to your (great!) comment:

I agree with your analysis of incumbents and entrants. I think it's a clever, really clear way of looking at it.

RE: your 2nd point: Novelr.com is about writers who are posting their fiction online, in a serialized, once/twice-a-week format, and then turning their work to ebooks for sale on the various ebook stores. That's one trend to watch out for, and I can say with confidence that there _is_ a market, however inconsistent the quality may be. There are customers out there for the entrant, and they _are_ biting.

(Plus there's also fanfiction, and sites like Fictionaut, where writers read, comment, and suggest (mostly grammatical & spelling) edits on each others' work. I've been seeing trends like this for about four years now.) It's pretty cool stuff - dynamic, engaging fiction, some good writing (see: <http://webfictionguide.com> \- for the good ones).

RE: Your 3rd point: we're building Pandamian (<http://pandamian.com>), a tool that attempts to make this write-online/publish-to-ebookstores thing accessible to all writers. It's mostly a response to the community's needs - with the mantra that 'writers should not need to read a single line of code'. Our hope, at least, is that the app would allow all kinds of writers the ability to write a book online, get a community of readers around their books, and then publish to the Kindle/Kobo/Smashwords store.

We launched on Tuesday, and now have a small group of very vocal users.

<comment><USER21> Since you are here: Is pandamian intended to be just for fiction? I have a book idea that I actually want to work on and I only want to do e-books. I haven't started in part because I didn't really have a vehicle/format for it.

<comment><AUTHOR> Sure, you can use it for whatever book you'd like to write. We've got one or two users who're using it for their poetry (which really gave me a problem, since I designed the text to be suited for prose).

Do note, however, that proper ebook conversion isn't ready yet. This is more minimum-viable product than anything else - if you log in you'll see a UserVoice forum filled with feature requests, which we're working on.

<comment><USER21> No big. I am currently just looking for a means to start writing and organizing my thoughts and all that. Nowhere near the "let's publish it!" stage.

Will check it out.

Thanks.</comment></comment></comment></comment></comment>


Classical Inheritance in JavaScript - <AUTHOR> http://www.crockford.com/javascript/inheritance.html

<comment><USER2> When I need to consider inheritance in Javascript, I just use composition. I feel like I am balancing out all the times I've mistakenly used inheritance, when I should have used composition. Most of the time, inheritance is the wrong tool.

x is a y => inheritance

x has a y => composition

Consider,

A rectangle is a quadrilateral object. Okay, what is a quadrilateral object? Is this what I am concerned with or do I only care about the height and width? Maybe...

A rectangle has a height

A rectangle has a width

A rectangle has a set of quadrilateral properties

Don't get me wrong, sometimes the 'is a' relationship is the true relationship. I just find many people have a very difficult time building 'proper OO' because they are taught to stuff everything into some hierarchy that either doesn't exist or is too rigid to be useful. Think of a "tree is a plant". What defines a plant? What defines a tree? What if you had to consider a fake christmas tree? That is obviously not a plant, but it has many of the same characteristics of a tree. Should it then inherit from a tree? What if your plant can grow? Now you have a christmas tree that can grow.

</comment><comment><USER3> Please, do not consider this article as normative.

Anyone trying to learn JS should have a look to more recent articles.

Examples:

\- <http://bonsaiden.github.com/JavaScript-Garden> \- Good insight

\- <https://developer.mozilla.org/en-US/docs/JavaScript> \- Good place to start learning, and for experienced developers a good place to contribute to

\- <https://duckduckgo.com/?q=javascript+inheritance+performance> \- Search for performance issues

PS: recently I found an article (probably here on HN) describing how v8 treats prototypes, and how to not break the performance boost given by v8 assumptions. Can someone remember which one was?

<comment><USER4> Though I don't know of an article, this video from a while ago describes (at a high level) the "hidden classes" that represent prototypes. It was part of the original launch of Chrome about 4 years ago. Some of the related videos have more info, but basically V8 represents prototypes as classes that act as a cache for the properties, so the lookup of properties within the prototype becomes much faster than a lookup for an ordinary property of an object.

<http://www.youtube.com/watch?v=hWhMKalEicY>

EDIT - Your comment inspired me to do some additional Googling -- here's another (text-based) description that's a little clearer: <https://developers.google.com/v8/design#prop_access>

<comment><USER3> Exactly what I was looking for!

</comment></comment></comment><comment><USER5> That article is ancient, and has drawbacks discussed in other places. Everyone interested has already seen it (its googleable by just "javascript inheritance").

</comment><comment><USER6> Obsolete, maybe. But I am a better person for learning the principles underlying Swiss Inheritance.

</comment><comment><USER7> "I have been writing JavaScript for 8 years now, and I have never once found need to use an uber function. The super idea is fairly important in the classical pattern, but it appears to be unnecessary in the prototypal and functional patterns. I now see my early attempts to support the classical model in JavaScript as a mistake."</comment>


Lys, a language that compiles to WebAssembly - <AUTHOR> https://github.com/lys-lang/lys <comment><USER2> Other than supporting (and requiring?) in-line WASM, what makes this language WebAssembly-specific?

</comment><comment><USER3> Kudos on providing language examples right away.

</comment><comment><USER4> Is Lys pronounced as in "bliss" or "Lice" ?

<comment><USER5> Probably "Lee". At least in French it would be pronounced that way, Fleur de Lys. (flur de lee)

Here it suggests you should pronounce the s: [https://dictionary.cambridge.org/us/pronunciation/english/fl...](https://dictionary.cambridge.org/us/pronunciation/english/fleur- de-lis)

</comment></comment><comment><USER6> It's great to see a language named after a mythical city in Arthur C. Clarke's "Beyond the Fall of Night".

<comment><USER7> Fleur de Lys is an old symbol of French royalty.

[https://en.wikipedia.org/wiki/Fleur-de- lys](https://en.wikipedia.org/wiki/Fleur-de-lys)

</comment></comment><comment><USER8> Is compiler effectively a bunch of javascript running on a re-purposed browser engine?

<comment><USER9> Looks like TypeScript running on Node, yes. Is there a problem with that? A compiler is essentially a pure function from one string to another. You can write that in almost any system.

<comment><USER2> Well, it's slow. But that should be a problem for a later time.

<comment><USER10> Agreed. With first passes ay a project, better to get it up in the air first. The Wright brothers didn't start by making a 737.</comment></comment></comment></comment>


Why working from home might be less sustainable - <AUTHOR> https://www.bbc.com/worklife/article/20200218-why-working-from-home-might-be-less-sustainable <comment><USER2> ...in terms of the environment.</comment>


Sun to change ticker symbol again — now will be called OOPS. - <AUTHOR> http://realdanlyons.com/blog/2008/10/21/sun-to-change-ticker-symbol-again-now-will-be-called-oops/

<comment> patrickg-zill They keep buying companies and hoping for "synergy". StorageTek you can excuse, since the real purchase was the patent protection it got them from NetApp and others. MySQL makes little to no sense from my perspective.

Sun, my advice is to put all your "wood" behind three arrows: Solaris OS, Java programming language and tools, Sun hardware (SPARC and x64). Forget everything else no matter how tempting.

</comment><comment><USER2> The most interesting bit of information in the article is the firm belief that the economy tanking is good for Sun.

This was a big meme during .COM 1.0 because IT helps you save money, and your top worry during down times is saving money, hence:

Recession == IT boom!

Obviously good times are also an IT boom!

IT BOOM for ever!

</comment><comment><USER3> If the main link isn't working try this one:

[http://realdanlyons.com/blog/2008/10/21/sun-to-change- ticker...](http://realdanlyons.com/blog/2008/10/21/sun-to-change-ticker- symbol-again-now-will-be-called-oops/)

</comment><comment><USER4> Can someone explain to me how Sun even makes any money at all?

<comment><USER5> Our company almost exclusively buys Sun hardware to run our services...and we pay them an absolute fortune for it as well.

<comment><USER6> They are also very entrenched in numeric computing. Sun Sparcs and all. The transition to Linux is very very slow.</comment></comment></comment>


Ask YC: How do you handle security? - <AUTHOR>

I have a site with the usual username/password login hooked to a MySQL backend. What's the best way to handle signup (sending the username/password) and logging in (same)? In particular, can you avoid using a POST and sending text parameters? <comment><USER2> Consult this PDF:

<http://pdos.csail.mit.edu/papers/webauth:tr.pdf>

In general, dont ever send passwords over an unencrypted channel. People reuse passwords. The credentials they are using for your site could be the same for their bank.

Oh, and make sure to hash the passwords in your database. BCrypt is good for this task. Best not to try rolling your own methods (as has been pointed out here on YC news before).

</comment><comment><USER3> SSL.

</comment><comment><USER4> Carefully.</comment>


The MagPi: A Magazine for Raspberry Pi Users, issue 1 - <AUTHOR> http://www.themagpi.com/

<comment><USER2> MagPi people: Please make your landing page non-flash; or at least figure out how to put a link to a non-flash version on the _outside_ of your flash <embed>.

</comment><comment><USER3> HTML and CSS are plenty to create a website with. I appreciate you going the extra distance to make it unreadable in my browser.

Dread to think what the magazine is like if this is what you do to a one page website :(

</comment><comment><USER4> This is a fantastic idea, but possibly the worst implementation possible. Black backgrounds and flash went out with the 90s (well, early 00s). Then you get to the magazine, and the typography is awful! Go out and buy Linux Format instead.

</comment><comment><USER5> Direct link to pdf on skydrive:

[https://skydrive.live.com/?cid=f41ca64cc38a2ec5&resid=F4...](https://skydrive.live.com/?cid=f41ca64cc38a2ec5&resid=F41CA64CC38A2EC5!349&id=F41CA64CC38A2EC5%21349#)

</comment><comment><USER6> This magazine, while made with good intentions, really hurts my eyes. The colors clash, and on many pages its even hard to read the text at all. It's like 1995 web design.

Here's hoping for a better issue #2.

</comment><comment><USER7> Does anyone know of anything in the same price range as the Raspberry Pi that is available right now? I know of beagleboards/bones but they are a little bit more costly.

<comment><USER8> Nothing that has all the ports / features of the Pi, no.

</comment></comment><comment><USER9> 1) The text on your page is too small for me to read comfortably.

2) Zoom is broken on your front page, so I can't fix #1.

</comment><comment><USER10> The forum already has poor signal:noise ratio. Will you be doing anything to help that?</comment>


Running JRuby on the Graal JIT - <AUTHOR> http://blog.headius.com/2018/07/running-jruby-on-graal-jit.html <comment><USER2> I'm working on a project right now that uses jruby for java interaction.

I'm so appreciative that we have an easy way to combine java code with ruby scripting, thanks Charles. You guys make my job possible. :D

I think particularly now that we have the excellent concurrent-ruby[0] project more developers should checkout jruby.

My suspicion is that the main pain point stopping people using jruby is around tooling and process forking.

The ruby tools I would normally use to get fast cycle times for things like running specs without restarting rails mostly rely seem to make use of forking which obviously isn't supported on the JVM.

If I can find more time and tallent that's definitely something I look into.

[0] [https://github.com/ruby-concurrency/concurrent- ruby](https://github.com/ruby-concurrency/concurrent-ruby)

<comment><AUTHOR> Yes the development experience is unfortunately a problem for all the optimizing Ruby runtimes. TruffleRuby with its SubstrateVM precompiling improves this situation quite a bit for trivial commands, but still takes longer than CRuby to boot any large application (e.g. Rails). I have plans to try to improve startup in JRuby using some new AOT compilation and code caching features of Java 10.

<comment><USER2> That will be brilliant Charles. Too be honest I think if we can keep the main JVM process up and running but get code reloaded that would probably smooth things a lot.

I sort of hope that we, the rest of the community, could take care of that for you. Although faster start up would be awesome in general.

<comment><AUTHOR> I believe much of the work on forking preloaders could be modified to work with a single JRuby JVM process, or with the Drip JVM preloader. Hopefully we'll have time to make that happen, or someone from the community will step up to help us!

</comment></comment></comment></comment><comment><USER3> "Ruby 2.6 introduces an initial implementation of JIT (Just-in-time) compiler."

[https://www.ruby- lang.org/en/news/2018/05/31/ruby-2-6-0-prev...](https://www.ruby- lang.org/en/news/2018/05/31/ruby-2-6-0-preview2-released/)

\--

Some benchmarks ( 2017! )

[https://github.com/vnmakarov/ruby/tree/rtl_mjit_branch#mjit-...](https://github.com/vnmakarov/ruby/tree/rtl_mjit_branch#mjit- organization)

\- "Graal is too aggressive with compilations and almost always needs more CPU work than MRI interpreter"

\- "JRuby and Graal are the worst with memory consumption"

\- ...

<comment><USER4> Of course it's going to initially take more CPU work to just-in-time compile something than to just interpret it.

Of course it's going to initially take more memory to just-in-time compile something than to just interpret it.

Most just-in-time compilers will also include an interpreter, so yes you get the same time and space needed to run to run the interpreter, and then you get extra time and space needed to run the compiler as well.

I don't really see why this would surprise anyone!

You just hope that over time it pays off when you get the faster code out of the end of it, which isn't something Makarov gave them a chance to do in this post. You'll notice that when he moves beyond running micro-benchmarks, and starts to run things like OptCarrot in later posts than this and with more reasonable time for warmup, he then sees the pay off of the more sophisticated just-in-time compilers.

> still the results are worse than the latest Graal Ruby

[https://youtu.be/emhYoI_RiOA?t=7m41s](https://youtu.be/emhYoI_RiOA?t=7m41s)

<comment><USER3> thanks for the youtube-video link!

</comment></comment></comment><comment><USER5> Great stuff!

Devs often complain about Java being boring and old-school, but it never ceases to amaze me how cool Java and Java-related techs are (JDK, JVM, GC etc.)!

Literally, state of the art, almost alien technology. And it seems that more cool stuff is coming.

<comment><USER6> There are also alternative languages flourishing on top of the JVM.

Besides JRuby mentioned in TFA, there are awesome languages you can use like Scala, Clojure, Kotlin or even Haskell [0], all enabled by a runtime that proved to be truly multi-language, as in alternative languages are not just superficial syntactic sugar for Java (like CoffeeScript is for JS, or VB.NET is for C#).

Every time I have to use Java, the language, I hate it, however those languages are not Java, yet can leverage the decades of knowledge, libraries and tools built on top of the JVM.

It's a little funny in retrospective, I remember Microsoft's marketing in early 2000 and .NET developers were saying " _Java is single language, multi- platform and .NET is multi-language, single-platform_ ". Nowadays both statements are false.

[0] [https://eta-lang.org](https://eta-lang.org)

<comment><USER5> True! Personally, I'm in love with Kotlin. But also like Clojure. However, it is really nice to see that Java itself is getting better and better each release.

</comment></comment></comment><comment><USER7> Back in 2013, when I worked for the Federal Gov, JRuby was the best way to get Ruby on Rails apps to run in a Windows-only world. I absolutely love the work that folks like Charles do!

<comment><USER8> Feds used Rails? That's neat!

If you don't mine telling, were you a contractor or like a permanent dev? I'm very surprised that feds would choose Rails for projects. Maybe for prototypes or in house stuff or whatever.

Anyways, cool!

<comment><USER9> Federal Government does not necessarily equal cool FBI agents with suits and trenchcoats.

But, still very cool yeah!

<comment><USER7> Ha, yeah, FAR from "cool". But we did deal with some cool satellite imagery, and I can confirm, the earth is indeed roundish.

</comment></comment></comment></comment><comment><USER10> There's some impressive engineering involved in JRuby and some interesting possibilities with the Graal JIT. That said, I've had a net negative experience working on a product with a mix of Java and JRuby code. The JRuby LOC was in the high 5 to low 6-digit figures and while the interop with Java was good (so long as it was done carefully in performance-critical sections), the instability of the JRuby 9k releases was so bad that we spent an inordinate amount of time tracking down regressions. We also had a kind of chicken and egg problem keeping current with newer Java versions because that required newer JRuby releases but those introduced more regressions. Unfortunately, the net effect of all of this is that the product is languishing because of the development effort required just to keep it current let alone to develop new features. At least in our case, choosing JRuby as a platform proved to be a strategic mistake.

<comment><AUTHOR> I'm sorry to hear this! We have worked very hard to keep JRuby stable, but sometimes things drift when more issues come in than we can keep up with. If you can point me toward the issues you're having, I'll try to prioritize them for the next release.

It sounds like you are trying to update to newer JVMs but running into problems, yes? I did a bunch of work about six months ago to support Java 9+ JVMs better, but I know there's more to do; the module system it introduce is tricky to work with/around.

</comment></comment><comment><USER11> Thanks Charles, exciting stuff. Ruby and JRuby have mostly been fast enough for my applications, but faster is better. Will it be a year or two before a standard JRuby distribution contains the free version of Graal?

<comment><AUTHOR> JRuby 9.2 already included some general improvements designed to help Graal optimize, and 9.2.x will continue that process. I have already landed logic in 9.2.1 that will "right-size" objects based on observed instance variables, and I'm hoping to land a 64-bit long/double version of Array that will reduce the cost of numeric algorithms that use arrays (e.g. matrices, image manipulation).

I don't know that we will really _need_ to ever ship Graal; if you get OpenJDK 10+ you'll have it available. However we may at some point detect that Graal is available and turn it on for you. In the short term, the JAVA_OPTS env var is pretty simple to use, or just run on the community version of GraalVM that uses Graal JIT by default.

<comment><USER12> Hey Charles! Since we have you here, can you clarify the differentiation between JRuby and TruffleRuby? Do they fit different niches? Is TruffleRuby parallel work that may eventually merged into or succeeded TruffleRuby?

<comment><AUTHOR> TruffleRuby and JRuby have always been separate projects, but TR kinda "grew up" as part of JRuby for a couple years. Eventually we decided the goals were becoming too different so TR split back off into its own project.

We still communicate, we share several support libraries, and I'm sure we'll mimic some of their optimizations just like they've mimicked some of our features, but there's not a lot of commonality between the projects anymore.

</comment></comment></comment></comment><comment><USER13> I wonder what happened to torquebox. Back in it's glorious days, it provided a STOMP messaging service, an infinispan session store and JBoss server for Rails applications running on JRuby.

<comment><AUTHOR> Torquebox was indeed a great server, but never generated enough interest from the Ruby community to become a full product. Without that, sadly, the developers didn't have a lot of motivation to keep working on it.

<comment><USER13> My only problem with the server was the fact that classes that were generated at runtime couldn't be garbage collected, and that required a reboot of the server after some time.

</comment></comment></comment><comment><USER14> I really admire the work of Charles et. al. and we have a couple of Rails apps on top of Jruby in production. Unfortunately, while the language implementation is itself is developed constantly, the ecosystem has stalled.

The activercord jdbc driver implementation is particularly problematic because it effectively keeps us from upgrading to Rails 5 (we use SQL Server as backend). There is also a lack of app server options. The Jruby app servers like Trinidad or Torquebox are not maintained. Warbler has issues, too.

Charles and the other devs can, of course, spend their time however they want, but from my perspective, having a well maintained software stack for production deployments is far more important than a further speed optimization.

<comment><AUTHOR> I'm not sure if you've looked recently, but we support the big three databases up through Rails 5.0, with sqlite3 support available for 5.1 and mysql and pgsql coming very soon. We need help keeping up, but we're not that far behind anymore after making a big push for Rails compatibility this past year.

SQL Server support still exists in our codebase but it has not been updated due to lack of resources. We want to continue to support it, but there's only three of us working on this stuff at all, and only two do this as our jobs!

As far as app servers...we recommend deploying like other Ruby folks do, using Puma as a server in multithreaded mode. Torquebox has unfortunately been put on hold because there are no resources to maintain it...but Puma works very well.

<comment><USER14> Charles, thanks for the reply. You guys are doing a really great job and the fact that you are only three main devs is just amazing!

</comment></comment></comment><comment><USER15> I wonder whether this means we should not expect any more performance improvements on a < Java 10 JVM. That would be good to know, as that influences what I can expect for code running at a place that just upgraded to Java 8 and probably won't switch to 10+ for many years to come.

<comment><AUTHOR> JRuby 9.2 will continue to support Java 8 through the end of the year, and then we'll reevaluate minimum Java version for JRuby 9.3 early in 2019. Maintaining support for older JVMs, especially ones that have been officially end-of-lifed, does put a strain on our efforts to keep JRuby current, but I understand the move from 8 to 9/10/11 is a tough pill to swallow.

That said...the work we're doing to perform better on Graal will also speed things up on non-Graal JVMs: inlining more code, specializing data structures, reducing call overhead. You can rest assured things will continue to improve on Java 8 as well.

<comment><USER15> Awesome, thanks for your response!</comment></comment></comment>


Show HN: Followlotto.com – Written in Go and Martini with Twitter OAuth - <AUTHOR> http://www.followlotto.com

<comment><AUTHOR> Hi all, this was an idea I came up with yesterday and was able to execute in 4 hours with Go and Martini last night in a coding frenzy! Any feedback is appreciated!</comment>


Some men go professional boxing; other join the army. Some choose C++ - <AUTHOR> https://hackernoon.com/blood-sweat-and-c-294c8bb7836 <comment><USER2> If you work on the things I do, suggesting that there is a viable alternative to C++ is ridiculous.

I'd love to write everything in Python & Rust, personally, but it's just not a viable option for many types of projects.

With the smallest amount of self discipline, C++ is safe, expressive, maintainable, cross platform, and interoperable.

I rather like that it's not forcing training wheels on my every statement and condescendly telling me what I'm allowed to do.

Of course, it means that code from the article's example is possible. You can write code like a sloppy asshole in any language. Don't blame the scissors if someone decides to start running while holding a pair.</comment>


How Not To Design A Logo - <AUTHOR> http://www.webdesignerdepot.com/2009/01/how-not-to-design-a-logo/ <comment><USER2> Strongly disagree.

For example, crowdsourcing logo design is a highly efficient and inexpensive way to get a professional logo. I know Stackoverflow.com's logo was crowdsourced through . . . 99 designs, I think it was. It's a great logo, too. Same with offbeatearth.com.

Whether designers like the author of this article like it or not, web-based competition (crowdsourcing sites) are reality. His little screenshot of the Xed-out $50 contests on a phpBB site isn't even accurate. Most design contest sites have professional sites (99designs, crowdspring, even logotournament, which I'd never heard of but which was mentioned in the comments) and awards that are much higher than $50.

</comment><comment><USER3> You can judge for yourself. Check out Crowdspring.com, you can see the quality of the logos from the crowdsourcing. I think it is often VERY good.

The designer that wrote the article needs to learn how to compete in the new marketplace.

</comment><comment><USER4> I disagree as well. I have used 99designs before and was very happy with the results.

I know that designers don't like these sites anymore then coders like elance or anything, but if it works... people will use it

</comment><comment><USER5> Summary: A logo designer insults inexpensive alternatives to his expensive service, with no justification.</comment>


How much would Bernie 2016 cost you? - <AUTHOR> https://medium.com/@thainsimon/how-much-would-bernie-2016-cost-you-fa040b83c258#.qxtmpb9f6 <comment><USER2> One thing I don't see discussed in "tax the rich" discussions about US politics is that it actually often means "tax the capital". But capital is very mobile in modern world; the moment you increase tax on capital gains in US, markets rebalance, and capital moves to other parts of the worlds, reaching some kind of risk/gain equilibrium.

For me, an outsider, the US was always in contrast with other first world countries in terms of how lucrative it to the capital, and how powerful and healthy the whole economy is on a large scale, and how quickly it recovered after 2007, compared to other economies that were similarly affected. Everybody moves to US for jobs, or to start a business. Doesn't US left wing sees that as something worth preserving?

<comment><USER3> I don't really have an opinion on what the optimal capital gain tax rate is, but wrt your specific point of capital being mobile _in the sense of being able to evade a higher tax rate_ (as opposed to being mobile in the sense of being able to choose what to invest in) - I'm not sure it is _except for the few very, very rich people_. If an American divests from US stocks and reinvests the capital in European or Asian stocks, AFAIK they still have to pay taxes for their capital gains, and Americans specifically even have to pay capital gain taxes if they move elsewhere, unless they renounce their citizenship. Certainly pension funds managing the capital of millions of Americans will pay a higher capital gain tax regardless of where they invest the capital and millions of Americans will not emigrate as a result. As to corporations, the US is making it tougher to escape its unusually high tax rate on profits by targeting "inversions" right now.

So while I'd guess that higher taxes will hurt growth at some point, I'm not sure that they're that easy to escape; perhaps I'm missing some obvious loopholes.

<comment><USER2> Uhm, but private citizens don't usually invest themselves — if I understand correclty, typical 401k (or whatever american pension plans based on investments is called) is invested into huge funds and banks, which operate trillions of dollars in assets and can move them all over the world.

<comment><USER3> Move - yes, but does this stop the government from collecting the capital gains tax? I think not.

So if you make American companies less profitable through some regulations, capital will move elsewhere, but if you raise the capital gains tax, I'm not sure it will.

</comment></comment></comment></comment><comment><USER4> Lies, damned lies, and statistics.</comment>


Stop Validating Email Addresses With Your Complex Regex - <AUTHOR> http://davidcel.is/blog/2012/09/06/stop-validating-email-addresses-with-regex <comment><USER2> Why not have a simple validator that works with 99% of users emails but not make it mandatory that it passes validation?

"We see that bob@localhost doesn't look like a email address are you sure it's right?"

That way you can help users that messed up their email but not prevent all the corner cases. The idea is that most email addresses fall in a very narrow subset of the RFC: firstname.lastname@example.com and most people would have entered their email wrong if it didn't match that pattern.

</comment><comment><USER3> I don't think this is good advice.

From a previous startup we saw a ton of signups like, "john@gmail" and the like. Obviously this person will not get a validation email -- and in all likelihood will not be able to log in to his account when he returns. It's best to catch him when he's entering the information.

<comment><USER4> I hear and understand a lot of the comments on this thread mention that regex saves the user from a typo and such. So I want to vouch for a github project called mailcheck[0] by the Kicksend team that's great.

At Ventata, we used to have the same issues you've all described with people forgetting things like ".com" and "gmial" vs "gmail". Once we started using mailcheck our bounce rate went way down. Now we only get bounces when people deliberately give us faulty addresses, but we aren't really concerned with trying to convert them. They are checking us out and want to stay anonymous, I don't mind that.

That condition aside, Mailcheck is pretty much all you'll ever need.

[0] <https://github.com/kicksend/mailcheck>

<comment><USER5> The only thing mailcheck doesn't do is check if the domain has MX records, so valid looking domains that you'll never be able to send anything to will pass.

I've tried to help this situation by creating an API for you guys: <https://www.emailitin.com/email_validator>

<comment><USER6> Domains without MX record can be valid, as mail servers, upon lack of MX record, will query for A record.

<comment><USER7> Or AAAA records.

</comment></comment></comment></comment></comment><comment><USER8> The question is why people are validating the email in the first place.

* to ensure it is deliverable? Well, then you better send them an email.

* to let people know when they misread the labels and put something that was clearly not an email in the email field? A simple check for an at-sign is usually sufficient.

* because some tester opens a ticket saying you can enter an invalid email in the email field? Yeah, that's where most of the complicated regexps come from.

<comment><USER9>
        to ensure it is deliverable? Well, then you better send them an email.

I deal with user support for a site and I'd estimate at least 2% of our new users (>50 people PER DAY) enter wrong email addresses. Not "I forgot to put .com at the end" but "I thought my email was email@example.com when it's actually email@example.com" which would pass validation with flying colours. The only real "solution" is to tell a user if the validation email has been sent yet (to deal with "well maybe I should wait 5 more minutes") and if it has and they don't have it allow them to change their email to their real email address. So many sites (incl. the one I manage) do not allow this, it's crazy.

<comment><USER10> >if it has and they don't have it allow them to change their email to their real email address

Couldn't an unscrupulous individual use that feature to take over non- activated accounts? An immediate use for that exploit doesn't spring to mind but this makes my spidey sense tingle. What sites allow this?

<comment><USER9> From my experience a user will almost always remember the password they've just entered, even if they got the email wrong. They should be able to login to a not-yet activated account and be presented with the option to correct the email for the activation email to be sent to. There's no potential for abuse there.

</comment></comment></comment></comment><comment><USER11> I worked in a lead-generation agency for some time. We were doing competitions that could produce 50-100K entries per day, where the end result was a marketing email encouraging you to buy something.

So we did lots of multivariate testing, with permutations of regex patterns, MX record validation, sending a confirmation email, client-side only, server- side only, etc.

What we found was that a decent regex pattern (we used \b[A-Z0-9._%+-]+@[A-Z0-9.-]+\\.[A-Z]{2,4}\b, taken from <http://www.regular- expressions.info/email.html>), with MX record validation and common junk domains blocked (e.g. mailinator.com) produced the largest conversion rates in the follow-up email.

In other words, less validation produced more entries, but they would have been lower quality, which affected our sender reputation and cost more. The confirmation email was awful for conversion. YMMV.

</comment><comment><USER12> Oh the irony. His suggested Regex is not even correct.

        /.+@.+\..+/i

A trailing dot is valid at the end of a domain name. These domains are said to be fully qualified.

<http://www.dns-sd.org/TrailingDotsInDomainNames.html>

This also potentially eschews internal deployment.

His other suggesiton, /@/, at least, is not harmful, but there are validators based on the RFC that do the job for most platforms.

Validating the address may provide useful feedback to users who accidentally mistyped something, invalidating the permise of his last paragraph.

.

/someone is wrong on the internet.

</comment><comment><USER13> Amen! Anyone else here use firstname.lastname@example.com when they have to register with their email to find out who is selling them out and to make spam filters easier?

It still amazes me that 70% of the places I attempt using firstname.lastname@example.com call it invalid. And that does not even begin to touch the myriad valid permutations that are "invalid" out there.

<comment><USER14> And likewise, it amazes me that people think that for all their efforts at combating filters, captchas and the like, that the most nefarious of spammers aren't stripping off "+token"s from email addresses.

<comment><USER15> Spammers tend to be stupid. When I post my email address as "email@example.com" on a certain popular, well-scraped website, I see lots of rejected traffic to "email@example.com".

</comment></comment></comment><comment><USER16> I wish OP had provided some actual A/B registration fall-off data. For me client-side validation is more for catching user error than to do any actual "validation". That's always been the job of confirmation email.

I think there is going to be a very low percentage of users who will register again if they don't receive a confirmation email, unless you're giving away free iPhones. Granted regex can not catch most of the user-generated errors, but it can catch a few which could still increase you registered users.

To that point a better UI/UX (font size, spacing, etc.) might do a better job in lowering typos in email.

<comment><USER17> I wish I'd done that too, in retrospect. I could obviously have done much more research around my opinions, and there's one use-case in which what I'm advocating simply does not work: when you are _paying_ to send those emails. In that case, yeah, you're gonna wanna do some validation.

</comment></comment><comment><USER18> My goto for email validation is /^.+?@.+?\\..+?$/

Incase I've typed it wrong, that should basically work for anything that contains at least one @ and one dot, in that order, as well as at least one character at beginning, middle and end. It's served me well thusfar.

Edit for clarification: The reason I prefer this over just checking for an @ is that if you're just checking for @ a common mistake like "me@hotmail,com" will be considered valid.

<comment><USER19> My favorite: /.\@.*\\../

It should be similar to your version, but only matches just enough parts that require for email validation (i.e. "firstname.lastname@example.com" part of email@example.com).

<comment><USER18> I like that, much more elegant! My only changes would be to make the middle .* into .+? as that way it requires at least one char, and the ? is for lazy repetition.

</comment></comment></comment><comment><USER20> This has been an issue since the day I started programming for the web, back somewhere in '95.

It has regularly come up on HN, and pretty much any programming related forum I've used since the mid-90's.

As an industry at the heart of the information society you have to wonder what the hell we are doing wrong if we cannot stop this constant regression into well known bad practices.

<comment><USER21> I understand the argument re validating email addresses passively (regex, no regex, etc.) vs actively (send an email by SMTP).

What I don't understand with this ever-repeating discussion is why the complexity has to be visible. e.g.

        > <LARGE REGEX>
        > Yeesh. Is something that complex really necessary?

Many functions are complex - we put those in libraries, pushing them under the hood, and move on.

What is so special about parsing email addresses that makes everyone invent their own solution - regex or otherwise?

<comment><USER22> Plus a Large Regex for mail validation is not supposed to be heavily used. It's supposed to be used once at registration for example. So why would it matter if it's slow/heavy/...

<comment><USER23> Maybe it is less resource-intensive to actually send an email rather than use a heavy regex to validate the email?

<comment><USER22> I really don't think so since you're soliciting an email server while a regex is just some code that has to be run, and they are run on a tiny string (a mail is never really long).

Also it's bothering for the user, if you need mail confirmation then do it, but otherwise it should be a RULE OF THUMB to always avoid annoying user. Thus avoid mail confirmation.

This article is actually a really bad advice. I don't know why it's upvoted so much.

<comment><USER23> I'm not completely sure that I get annoyed when a web site sends me a confirmation email. It helps me know that the site indeed knows my correct email.

</comment></comment></comment></comment></comment></comment><comment><USER24> Don't bother even reading it. His solution is to "Just send your users an email. The activation email is a practice that's been in use for years, but it's often paired with complex validations that the email is formatted correctly. If you're going to send an activation email to users, why bother using a gigantic regular expression?"

Want to know why it's not more common than the regex "method"? His method has its own host of problems - what if your mail server is down for six hours - will people come back to your site six hours later when they get the email? What flags will get set on your sender account when Gmail gets 100,000 bogus email sends? Do you force your users to "Look in your inbox and click the activation link" for every email address change also? There are others but I've made my point. There's a finite amount of "stuff like this" that users will put up with - you can either put the onus to "get it right" on the user (regex validation for emails), or you can put that onus on your system.

An argument for another is always, "If a user can't get their email address entered correctly, I don't want them as a customer". And you can take that multiple ways - technical difficult entering emails, "challenging" email addresses, etc.

<comment><USER25> People are _far_ _far_ more likely to get their email address wrong by misspelling their own name or putting @hotmail.com when they meant to put @gmail.com; regex will not protect you from either of these things.

We actually had an email list of ~50k people that had been validated within nothing other than "check there are at least 3 characters in the string" and when we looked at which addresses were bouncing when we sent to them there were approximately zero that failed because they had ommited the @ or because they were using some weird invalid unicode.

Even the spam bots were submitting valid email addresses.

<comment><USER24> Spam bots, if there was no check in place to slow them down, would dwarf real people registrations in all systems always. So let's not confuse these two topics - they are different. One part of a system that allows users to register needs to ensure that you have an identifier for a customer and a way to contact that customer, and other techniques try to ensure that you aren't allowing the spammers in the door. Whether you use regex or sending an activation email - neither of those can tell you whether this email address is or is not a spammer.

<comment><USER25> That's true, but I would posit that you need a registration email anyway (assuming you even care if the email is valid) because even if your regex is perfect there's no way to detect people simply mistyping their email address in a way that is technically valid.

This is going to your dominant type of failure.

</comment></comment></comment></comment><comment><USER22> In PHP you have default functions that can verify emails :

filter_var('firstname.lastname@example.com', FILTER_VALIDATE_EMAIL)

more info here : <http://php.net/manual/en/function.filter-var.php>

<comment><USER17> And that uses a giant regex.

<comment><USER26> At least it's a standardized way of doing it. If it turns out to contain an error, it can be fixed for all websites with an update.

</comment></comment></comment><comment><USER27> The driving force is that you want to correct an invalid email ASAP, preferably in the client with live feedback coloring, etc.. Most email services I know don't give you any immediate feedback, and some only give you a basic check that can bounce later. So claiming you just have to check for an @ sign and try sending means there is going to be a huge delay before you know about the error.

Saying the user will just come back and register again is not good. That's like saying if your page is very slow to load, users will just wait for it to load. They don't. They leave and never come back most of the time.

If you can't afford to write the code to help the users fill out the form in a way that will work, fine, that's something you didn't have time for considering the percentage of users it will help/retain. But don't claim it is useless.

<comment><USER28> Not useless, but validation of the presence of a valid email does not validate the accuracy of the email. It may be valid and still wrong. Therefore the return on investment, and the possible exclusions of valid email doesn't justify the time in most cases. So not useless, but certainly a poor investment of time.

</comment></comment><comment><USER29> A basic regex is more than enough and you don't even need to deliver a message, just connect to the MX for their domain and check that A) The domain resolves an MX and B) That you can handshake for a 250 OK on the rcpt to header only, then drop the socket. Done! It's not that slow and you're leveraging the one thing an SMTP server does really well - be RFC822 compliant. It's something that can be delegated out of process anyway (as a promise or RPC etc) as soon as the email is entered, and resolved when they submit the form. Problem with the email? Then raise it for correction or pass- through... its probably the same amount of code and half the time for end-to- end delivery testing than crafting a bunch of edge case regexes and praying it works.

<comment><USER30> How can you validate the MX record for their domain programmatically?

</comment></comment><comment><USER31> _If you really want to do checking of email addresses right on the signup page, include a confirmation field so they have to type it twice._

No. This puts the burden of checking email validity on _every user_ , even perfectly capable valid users. If you're validating for edge cases (mistakes or otherwise invalid addresses), treat it as an edge case and don't annoy users who can type.

<comment><USER32> > This puts the burden of checking email validity on every user, even > perfectly capable valid users.

? Whenever I hit a form which wants me to retype my address, I just triple- click to select the entire address, then middle-click to paste it into the confirmation field.

<comment><USER33> Meet the airline I booked with yesterday: two email fields, with paste disallowed _only on the second one_.

:(

<comment><USER34> How do you even prevent that? You need some seriously broken code to catch a system wide short-cut.

</comment></comment></comment></comment><comment><USER35> Assuming that running the regex is much faster than sending an email, it would probably be much less server load to check the regex and never send X% of emails, unless X is extremely small.

(Looking up and implementing a regex) * 1 + (running the regex) * (every email) + (sending email) * (every valid email) < (sending email * every email)

Also, this post only considers the signup/activation use case. If you're getting an email for ecommerce to send an order confirmation, you want to know if the email might be invalid before the user completes the order and you try to send it.

<comment><USER36> This assumes that you get the regex 100% right and never lose a user by rejecting a valid email address. This is _much_ harder than it seems ( <http://www.ex-parrot.com/~pdw/Mail-RFC822-Address.html> ), and is no guarantee an valid email address that is in use, as the article makes clear.

After some very basic checks, e.g. "contains at at least 3 chars, one of which is an @", you should _Just. Send. The. Email._

Who bothers to type in a complex but invalid email address? The overwhelmingly common failure modes are:

1) Nothing entered at all. The basic check catches this.

2) Deliberate invalid email address. e.g. email@example.com_ \- a regex will not catch this.

3) Typo in email address. e.g. email@example.com_ \- a regex will not catch this either.

The regex has downsides and complexity, but essentially no benefit.

<comment><USER5> Please don't quote that RFC-822 regexp when arguing this. That's for the contents of mail headers (which can include comments and so on), not an actual valid email address.

A regexp for validating RFC-2821 email addresses is actually fairly simple.

<comment><USER36> Whichever RFC it is, it is not so simple that everyone gets it right. For innstance, a significant percentage of websites don't let you register email addresses containing a plus sign in the name, e.g. firstname.lastname@example.com_

</comment></comment></comment></comment><comment><USER37> The OP and a lot of posters here don't seem to understand the problem or the purpose of the solution. The whole point of this is to avoid an unrecoverable error, a bricked account.

You are only trying to catch email addresses that are entered in error at account creation time so that a user will actually get the confirmation email.

The actual problem is that if they enter an email address incorrectly they will crate a dead account that they can never log into again. In addition if they used their favorite user name, or a referral code or any other important consumable when creating the account then you've effectively blocked that user from even creating a second account.

The real solution is to use validation email to confirm an email address, but to allow them to login to the account even if the email is not yet validated. You won't even have to make them type it in twice. Simply limit them to only being able to edit account information and settings.

Email is validated, users have a window to correct any issues and you've eliminated the unrecoverable error altogether... oh and no regex.

</comment><comment><USER38> HTML5 has you covered. You can use HTML5 input verification with the following:

       <input type="email">

Of course, if your user is not using an HTML5 compliant browser, then this will be ignored.

</comment><comment><USER39> When the regex is not RFC complaint is the worst case, for example, I want to use . or + on my mail address and the website don't allow me.

<comment><USER40> ... And remember, the password can only be 8-16 characters [A-Za-z0-9] because we wouldn't want to do accidentally cut yourself on some other 'weird' character like a space or underscore or something. ;-)

</comment></comment><comment><USER41> Yeah, and then you wind up sending mail to "joe@hotmailcom" or "firstname.lastname@example.com", and your users don't get your messages and are sad. Don't validate the local part, do validate the domain.

<comment><USER7> Especially since this is extremely easy to do, it's just three DNS queries away (plus one in case of CNAMEs).

</comment></comment><comment><USER42> So what's wrong if you do a full validation (<http://www.ex- parrot.com/pdw/Mail-RFC822-Address.html>) ? You as developer or site owner or user don't need to do it by hand or in your head. It is done in a fraction of a second by the computer even if benefits are not the greatest like validating the strength of a password but still. Complaining about it because you don't like it and telling other people not to do it because of your reasons and spending time writing a blog post about it is overkill - like validating the email address with a regexp :)

<comment><USER5> There's nothing wrong with doing full validation. Just don't use that regexp - it's for RFC822 email addresses, which is how you might see them in an email header, including things like comments.

You want an RFC821 (or more specifically RFC5321 now) email address regexp. See my post here about the email validator I wrote: <https://www.emailitin.com/email_validator>

</comment></comment><comment><USER43> You'll hurt your email reputation if you send too many emails that bounce. It's worth checking everything you can before firing off an email. This includes using a decent regex and doing a lookup on the domain to make sure they have an MX record. While technically you can have a mail server with no MX record (it falls back to sending to the A record), you won't find too many mail servers configured that way in the wild. In many cases such as email marketing, protecting your email reputation is far more important than handling the 1 in a million user with an unusual email address or mail server configuration.

<comment><USER44> Also, instead of just failing to allow the email address, you could warn the user that what they entered doesn't appear to be valid, and that they should double check the address.

</comment></comment><comment><USER45> Glad I'm not the only one just checking for an '@'. I wouldn't want to prevent users from registering with my sites just because I didn't foresee some funky email address formatting with my regular expression.

<comment><USER46> So you're forcing me to write @localhost :-(

Edit: Oh wait, on your own sites :-) I'm just slightly annoyed that I have to add a fqdn when doing local development with some apps...

</comment></comment><comment><USER47> Discussion from previous post <https://news.ycombinator.com/item?id=4486108>

</comment><comment><USER48> IF I were to validate by regex, I would put a confirmation for emails that I couldn't validate that read "We are very sorry but your email doesn't appear to be valid, however validating emails is very difficult so it may be our mistake. Can you confirm your email is correct?" And if they don't modify it, accept it as valid. It is an extra step but seems more friendly.

</comment><comment><USER49> If you want to maintain a high reputation for your MTA's deliverability, ignore this post. Attempting to send hundreds, thousands, or tens of thousands of malformed addresses to domains (some of which will be well-formed) will result in a higher spam score that will ultimately create more work for whoever is managing your mail platform.

</comment><comment><USER50> I would rather lose a few users through a faulty regexp than lose double digit percentage through an email activation step.

<comment><USER51> No regexp in the world will tell you if an email address is real.

<comment><USER52> Of course - I doubt anyone (smart) has ever claimed that to be the case.

However, they can, if implemented correctly, tell you if the email address is syntactically valid.

</comment></comment></comment><comment><USER53> That seems terrible when combined to a username which needs to be unique. User registers with username, email and whatever else. Email is incorrect, they never receive the activation email and cannot register a new account using their preferred username.

Of course there's plenty of ways around that, but this seems to be the most common pattern.

</comment><comment><USER5> This has come up so often on Hacker News that I decided to create a very simple JSON API for checking email addresses. Free to use for anyone. Performs the right regexp check for email addresses based on RFC-5321 rules (not the oft-quoted but incorrect RFC-822 rules, which are for mail headers), performs MX lookups to ensure mail can be delivered, and performs the same "did you mean" type checks that kicksend's mailcheck performs.

I've included both jQuery and server side example code on the site.

<https://www.emailitin.com/email_validator>

<comment><USER54> If I type firstname.lastname@example.com instead of firstname.lastname@example.com, it says the email is valid - when in fact it is not.

<comment><USER5> The domain outlok.com has an A record which points to 18.104.22.168 which I can even connect to on port 25 (though I don't perform that test). Until you actually mail that address there's no way to distinguish this from a valid email.

</comment></comment></comment><comment><USER55> You collect their email because you wish to send email to them at some point.

Thus, you must send a confirmation email, with a "click to confirm" link in it.

This keeps your email address list clean; it also validates all the email addresses.

</comment><comment><USER56> I would think the following would be best practice:

1) use LPeg or something similar to validate the actual text of the email (here's some LPeg that parses the headers of an email, certain one can pull out the email address portion: <https://github.com/spc476/LPeg- Parsers/blob/master/email.lua>).

2) Take the domain part and do a DNS MX lookup on it (to be pedantic, if that fails, then one should do a DNS A lookup). That will check if the domain is at least valid.

</comment><comment><USER57> It's an interesting intellectual exercise to build THE email validation regex, but it's shortsighted to inflict your experiment on the public.

While I definitely enjoyed how Friedl's book (<http://regex.info/book.html>) builds over several chapters to an ever more complex solution, maybe a page long, my takeaway was: don't bother. A friendly UI will help users avoid an obvious mistake, but as other posters have pointed out, the only real validation is, does an email get there?

</comment><comment><USER58> I wish more sites would use a validation email. I get a good number of emails for people that have my (real) name but use my email address on gmail (since I have the same name) to sign up when they don't want to recieve emails from the site. Thus I get to enjoy them. When the site sends a validation email I just ignore it and never hear from them again.

As a side note, be cautious of using such a tactic. I have recieved their logins, CC and Physcial Address information because of this.

</comment><comment><USER59> How about this: Add a mailto link that sets the subject to some type of token, they click the link, hit send, app catches the email, sets the correct address accordingly.

<comment><USER42> This is actually a very good idea. But most users have a throw away email address for registrations and one for personal use. And for me for example, if i click a mailto link it will open the mail client with my personal email so I'll have to copy paste all that into my gmail throwaway email that may not even be opened. So I'll have to open the browser, click on........ But is indeed a good workflow alternative to consider for email verification.

<comment><USER59> Valid points. I hate mailto links in general, and can totally see the workflow getting messed up by not having your default mail client set to what you actually want.

However, I think most people know how to at least access their email (always logged in), so provided you could get them into their client, with a token, quickly, with a small number of clicks, might be interesting. Of course, it could be spam central.

</comment></comment></comment><comment><USER60> A good reason to validate email addresses is to prevent SMTP injection.

Depending on how you're sending the mail, it may be possible to insert arbitrary headers and body after a \r\n in the email address field. I know I've built at least one system that is vulnerable to this. Then you can put the body after your special headers and hide the rest of the message (either as an attachment or an HTML comment).

This then makes your signup form into what is effectively an open relay.

</comment><comment><USER61> I'm against all of the complex regex as well, having learned through trial and error that it is usually way more trouble than it's worth. That being said, there are many cases where the email address being verified is not the user's email, but maybe someone they are doing business with, and they don't want the system sending a verification email to every email address they are saving with your software.

</comment><comment><USER62> Is a decent regex with dynamic yellow field coloration (and bolding for accessibility) accompanied by a message like "Your email address is of an unfamiliar format or may contain a typo" too intrusive? Then just allow the user to submit with that email without any automated validation.

It's not 100% idiot-proof, but I'd imagine it would be pretty effective for laypeople and hackers alike.

</comment><comment><USER63> I don't understand why sites don't just warn the user with a confirmation dialog if their regex doesn't match (e.g. "Your email address looks wrong, are you sure") and allow users to use their potentially invalid email anyway. This avoids the problem of users making obvious mistakes and the problem of users with strange RFC-compliant email addresses being denied.

</comment><comment><USER64> OP is right about not using regex, but wrong about the "just send it" solution (for reasons outlined by several other posters).

We use this clever (and well-explained) solution from [http://my.rails- royce.org/2010/07/21/email-validation-in-rub...](http://my.rails- royce.org/2010/07/21/email-validation-in-ruby-on-rails-without-regexp/)

</comment><comment><USER65> I believe that he is right that you should not rely on regexps to validate emails, but I disagree that you should stop it completely.

First of all - less incorrect emails sent - less chances to get marked as spam host. Second - it is very easy to catch obvious errors user can do on front end and ask user to correct it. These two is big ones imho

</comment><comment><USER66> I don't validate emails at all. If you want to enter 'a' that's fine but you won't get any emails.

<comment><USER67> I'm the same. An email address isn't an identity.

Some people use many email addresses and so could create many accounts. With one email address they can still use the '+blahblah' method to sign up unlimited times, unless you prevent that which would annoy people who use it legitimately for filtering.

Some people have a garbage or throwaway email account that they sign up for everything with, and only ever look at to find the confirmation emails.

If people don't want to give you a valid email then there's no reason to be sending them anything.

<comment><USER67> If you own any domain you can forward <anything>@yourdomain.com to the same inbox. Then sign up for unlimited accounts that way.´

</comment></comment></comment><comment><USER68> For those that use PHP, use the following: filter_var($email, FILTER_VALIDATE_EMAIL);

Regex from the source: [https://github.com/php/php- src/blob/master/ext/filter/logica...](https://github.com/php/php- src/blob/master/ext/filter/logical_filters.c#L533)

<comment><USER69> yes, there's a good page here about the different regexs:

[http://fightingforalostcause.net/misc/2006/compare-email- reg...](http://fightingforalostcause.net/misc/2006/compare-email-regex.php)

</comment></comment><comment><USER70> Indeed. I was installing Crunchbang. Our local proxy knows to route our local username to our email addresses in our VPN. Yet, the validation required an @ symbol. It is against our standards to use our @ email internally. Sigh.

</comment><comment><USER71> In PHP land you can use this handy built in function ( <http://php.net/manual/en/filter.examples.validation.php> ) which works well enough.

</comment><comment><USER72> So we should be using a recursive descent parser? The email address format is a context-free grammar, so the "regexes" that would work are using features not included in true regular expressions anyway.

</comment><comment><USER73> I like the "don't regex emails" but don't like the "unnecessary email validation emails". If you're requiring email validation unnecessarily (ie, you're not PayPal), you're losing a lot of business.

</comment><comment><USER74> I agree with the author of this blog, but he doesn't address the problem where you want to scrap all the email addresses in a text file. For this situation, I don't see what to use except regexp.

<comment><USER75> First you verify the email, then you process the emails. What good is a list of email addresses if you haven't verified their authenticity?

<comment><USER74> Yeah, but it you want to get all the emails in a text like "Please contact me at firstname.lastname@example.com. I already sent an email to firstname.lastname@example.com, but no one replied...", then you would have to use regexp.

</comment></comment></comment><comment><USER76> I would like to make a plea to anybody coding email verifications to please include the ip address of the request, this way we get a sort of warning somebody is trying to impersonate us.

</comment><comment><USER77> "Feeling ambitious? Then check for the dot too: /.+@.+\\..+/i. Anything more is overkill."

I personally prefer: /[^@]+@[^@]+\\.[^@]+/

Basically the same except that it will throw an error if someone enters an extra at sign.

<comment><USER78> Yeah, I basically check for one @ sign and some very basic sanity checking on the right side.

/^[^@]+@[^@]+\\.[^@.]+$/

<comment><USER7> As I just noticed, @ is valid in the local part of an email, too, it just has to be properly quoted (using \ or " "). You can send me email at

        "a# b.@c"@[IPv6:2001:4dd0:fc8c::1]
        a#\ b.\@c@[IPv6:2001:4dd0:fc8c::1]

now :-)

</comment></comment></comment><comment><USER79> For what it's worth, sending a confirmation email is a great way to stop bots as well, skirting the whole Captcha thing.

</comment><comment><USER80> Out of curiousity, why would you not use input type="email" instead?

</comment><comment><USER81> I'd rather let the Regex do the job than the email server .

That's just me.

<comment><USER26> Good point considering security, but I still disagree. You're much more likely to get it wrong by validating than a mailserver is.

</comment></comment><comment><USER82> Agree, but this is not an example of a regex problem.

</comment><comment><USER83> my favorite is google chrome built in email check which is enabled with a required tag.

</comment><comment><USER84> Proof is in the pudding...

</comment><comment><USER85> Actually monolithic regex are bad in general.

</comment><comment><USER86> I read sections about email validation in 1998 in moldy thrift store PHP hardcovers. Why is an article that is slightly worse than these historic artifacts on the front page?</comment>


How we can use light to see deep inside our bodies and brains - <AUTHOR> https://youtube.com/watch?v=awADEuv5vWY <comment><AUTHOR> Holographic imaging of the human brain using lasers.

It seems this was announced at the TED talk, I don't think journalists have picked up on it.

The PR is refreshingly low key at conveying how impressive this is. Or maybe it's because I studied lasers

To quote the aliens "6EQUJ5"</comment>


NPM Enterprise - <AUTHOR> https://www.npmjs.com/products/enterprise <comment><USER2> Congratulations on the launch Isaac Z. Schlueter.

Although, I'm curious to know what companies would choose an enterprise version of a software that's so fragile like NPM.</comment>


Settle for less than $1 Billion Market Potential? - <AUTHOR>

<comment><AUTHOR> The most interesting aspect of the Sequoia criteria seems to be

"Address existing markets poised for rapid growth or change. A market on the path to a $1B potential allows for error and time for real margins to develop."

Would you start a startup that doesn't seem poised for $1B?

<comment><USER2> Why Not? I don't need a $1B return, the VC does!

It's critical not to confuse what a VC considers successful to what a founder would consider successful. The two are not one and the same.

Getting a VC to fund you is a means to an end, and you do it when you think (as they say) that you have a $1B idea, since you'll need all that cash to make it worth anyone's time.

Bootstrapping a company though doesn't have those issues. You should use this approach when you have an idea that may be profitable and good to you, but isn't going to change the world. (Note that this definition classifies 95% of startups out there today)

You only get into trouble when you're looking for VC money for something that isn't likely to pay off. VC's don't care, because they leverage you as a 1/10 chance already.</comment></comment>


What do you think of this name for a data company? - <AUTHOR> The name is p-y-t-r-e-e without the(-).
Thanks <comment><USER2> Pronounced "pie tree" or "pee tree"? as in "pitri dish"?

As @arkitaip said... it doesn't say anything to me, but that isn't a bad thing. Depending on how it's pronounced, it may not be very phonetic in spelling, so if you plan on using the internet, people will need to know how to spell your company to find your website.

</comment><comment><USER3> It says nothing but that doesn't have to be a bad thing. My only worry is if it's easy to spell and how it's pronounced.</comment>


Ask HN: Beginner lost in modular airthmetic division - <AUTHOR> i can't wrap my head around why 3 % 4 =3. Why? somebody please provide explanation that beginner can understand? <comment><USER2> 3 / 4 = 0, remainder = 3. This is essentially where the 3 comes from

<comment><AUTHOR> so 5 % 6 = 5?

<comment><USER3> Yup. The modulo operator simply always returns the remainder after division.

5 % 6 = 5

11 % 6 = 5

12 % 6 = 0

13 % 6 = 1

837 % 6 = 3

It's especially useful for repeating sequences:

> for x in [0, 1, 2, 3, 4]:

          print("odd" if (x % 2) else "even")

     even

     odd

     even

     odd

     even

> for x in [0, 1, 2, 3, 4, 5]:

          print("pah" if (x % 3) else "oom")

     oom

     pah

     pah

     oom

     pah

     pah</comment></comment></comment>


Show HN: ThreeAbout.me - Three things you want to be known for - <AUTHOR>

Hi HN,
My friend and I created ThreeAbout.me this weekend as a great way to condense your accomplishments into three easy to understand sentences.  An online resume or business card of sorts that you can be proud of and is easy to consume.
The inspiration for the service came from our experiences networking with people that we didn't know anything about.  What if they just told us the three things we should know them for?
We also wanted to experiment with reducing signup investment (no passwords, for example).
On the technical side, ThreeAbout.me was written in Python and Django.  We use Postgresql for storing aggregated signups but everything else is stored in Redis.  Would I use redis again as a replacement for an RDBMS?  Probably not, so I'm curious to hear if others had different experiences.
We hope you enjoy it!
(I've linked to our two profiles as examples in the comments.) <comment><USER2> Interesting. I like the idea about condensing the accomplishments to bite size chunks. How does the "Recommend this" function work?

<comment><AUTHOR> Thanks! The recommend this function right now is just to get positive feedback on one of your "things." We plan on letting you share each thing on twitter/facebook.

<comment><USER2> OK, cool. So in other words like the "like" button that Facebook has, right? If so, I think the wording "Recommend this" may be a bit confusing.

Interested in seeing more.

</comment></comment></comment><comment><AUTHOR> Clickable: <http://threeabout.me> <http://threeabout.me/max> <http://threeabout.me/ben></comment>


Offer HN: Three useful functions for async javascript - <AUTHOR>

Javascript has always given you a nice, event-driven, single-threaded environment to write code, and now with Node.js, it's become even more useful.
But sometimes we need to do things with async and writing the same code over and over gets cumbersome. It can drive a person nuts (http://news.ycombinator.com/item?id=2101210) ... until you decide to just grab a couple functions that help you express yourself.
That's what I wanted to offer HN. These are the functions that I use all the time in Javascript applications.
The first one is called "pipe" and it basically lets you express yourself simply by saying "wait until objects X and Y are available, and then do something)

  var p = Q.pipe(['user', 'stream], function (params, subjects) {
      // arguments that were passed are in params.user, params.stream
      // this objects that were passed are in subjects.user, subjects.stream
      mysql("SELECT * FROM subscription WHERE user.id = " + params.user.id +
          " AND stream.id = " + params.stream.id, this.fill('subscription');
  }, ['user', 'stream', 'subscription'], function (params, subjects) {
      // now we have all three objects ready to be used
  }, function () {
      // execute this function every time something is piped
  });
  mysql("SELECT * FROM user WHERE user_id = 2", p.fill('user'));
  mysql("SELECT * FROM stream WHERE publisher_id = 2", p.fill('stream'));
 and the Q.getter function takes a regular getter and enhances it with queue support, throttling, and batching.
All you have to do is do:

  Users.get = Q.getter(Users.get);
 and now you can use it from anywhere like this:

  Users.get(29381, function (user) {
     // do something with the user
  });
 without having to worry about who else has requested the same user. If the user is cached, the tail call occurs right away. Otherwise, the function calls the "real" getter to fetch it. If someone else requests the same user, they are placed in a waiting queue. When the user is finally fetched, ALL the callbacks are invoked. Not only that, but you can also tell it to throttle on a resource. Just use a string or an object for the throttle. And it will make sure there are only 10 open requests at a time. And also you can implement batching.
https://gist.github.com/778822 <-- here it is
Anyway, check it out. I think it will help you with your javascript coding Greg <comment><USER2> Thanks for sharing. These might be useful to contribute to underscore.js (or similar project)</comment>


Hotmail is up. Nobody cares - <AUTHOR> http://hotmail.com/

<comment><USER2> Haven't we started referring to it as Outlook.com now?

</comment><comment><USER3> Nobody knows whether it was down and when!

</comment><comment><USER4> If a tree falls in a forest, does it make a sound?

Joking aside, why _should_ I care? Does it offer me much better privacy than Gmail? I don't think so. I'm actually predicting I'll be moving away from Gmail after many years of using it, but it certainly won't be for Hotmail or Yahoo mail or any like this. They're all relatively similar from a security and privacy standpoint.

I'll probably switch to MailPile or whatever e-mail service looks great, is free, and uses the DarkMail protocol</comment>