Rustls: new, modern TLS library written in Rust - <AUTHOR> https://github.com/ctz/rustls <comment><USER2> I'm so happy to see something like this in development. Every time there's a discussion about OpenSSL vulnerabilities, the topic of a future replacement written in Rust comes up, but no one was stepping up to the plate. Now we have some real progress towards a safer future.

<comment><USER3> There is also Thrussh, a Rust library for SSH. Rust now begins to shine where it was designed for -- in security.

According to [https://doc.rust-lang.org/book/ffi.html](https://doc.rust- lang.org/book/ffi.html) it is possible to make callbacks from C code to Rust functions. This way other languages could take advantage of Rust's safe libraries.

<comment><USER4> Language having safety features does not guarantee code free of vulnerabilities.

<comment><USER5> Related reading: [https://tonyarcieri.com/would-rust-have-prevented- heartbleed...](https://tonyarcieri.com/would-rust-have-prevented-heartbleed- another-look)

<comment><USER4> Ted comments on this post in the article that it critiques. I do know that rust has important tools for writing secure programmes but using them is not really enforced (ie unsafe {}), thus it's possible to write exploitable bug in it. I want to note that I never used it though.

<comment><USER6> In the end it's possible in any language to produce exploitable bug (apart from maybe Erlang VM?). The point is about 1) how hard (probable) it is, 2) how popular are error checking tools (C static analyzers, Google Thread Sanitizer, etc), and 3) how fast can the culprit code be found and fixed.

In that regard Rust has reduced both 1) and 3) by only exposing dangerous features in unsafe {}, and greatly improved 2) since the compiler itself is checking those errors.

</comment></comment></comment></comment></comment></comment><comment><USER7> I'm developing a twitch whenever I see the word "modern" in a software description. It doesn't actually say anything about what you're doing.

<comment><USER8> It does. There are distinct properties attached to Modernism and Modern. (I'm architect, hence I'm very much attached to these terms. Unlike SW people who didn't grow up with that).

First of all, it's the opposite of Post-Modern, to the perl style do it all in myriads of ways, everything is allowed, OpenSSL style. With Modern, only the best API and implementation is allowed. API's are Stanford style well-planned ahead of time, and not adhoc added New-Jersey style. Changes to the API need a rename, not just a major version bump. Hand-waving simplified development models are okay for a post-modern everything is allowed world, whilst modernism aims for long-term goals, making it easier for the user, not the developer.

Modernism is based on "Form Follows Function", and not the other way round. Reduce it, abstract it. Functionalism is everything, marketing is less important.

And to avoid popular misconceptions, in our current era "Modern" doesn't mean "New" at all. Modern is more old Stanford-style development. Check the Unix Haters handbook e.g. Rust is new, but this choice alone doesn't allow the use of Modern. Rust is better, because of its superior semantics and guarantees, whilst still adhering to the C ABI. It's a library for everybody afterall, and not comparable to the latest ocaml, haskell or lisp TLS library, which only adheres to their ABI and needs wrappers to be useful for projects in other languages.

<comment><USER9> Why are you conflating building architecture and software architecture. I'm pretty sure no software developer has every thought of their project in terms of "post-modern."

New Jersey style? The PERL style? I've never heard of "New Jersey style." Are you joking? I'm almost positive that Perl didn't influence openssl development at all.

"Modern is more old Stanford-style development." I think you've read way to much into this. And sorry citing the "The UNIX Hater's Handbook" doesn't do much for the credibility of your odd argument.

<comment><USER10> Look into "New Jersey vs. MIT" and "worse is better". The idea more or less is that AT&T (in Jersey) cared more about software that shipped whereas MIT cared about more about good design. MIT produced Lisp and Lisp machines, Bell Labs produced C and Unix. Who won?

<comment><USER11> The mainframes and OpenVMS (though its clone, Windows). They're produced closer to the MIT and cathedral styles with a practical focus. The mainframes still run the backends of our financial system, logistics, big retailers, and so on. Most _stuff_ that people consume requires one of them. If a desktop is involved, it's usually Windows based with 90+% of the market share despite UNIX workstations and Linux desktops existing for a long time.

So, who won? Nobody. Both had success. Most successful, though, was combining a little bit of MIT method, cathedral, and ship fast from "worse is better." That's IBM and Microsoft's approach. A hybrid worthy of another Gabriel essay.

<comment><USER10> Thanks for the additional perspective there. I'll have to keep that in mind.

<comment><USER11> Sure thing. :) And here's the OpenVMS & Windows connection in case you weren't aware of it:

[http://windowsitpro.com/windows-client/windows-nt-and-vms- re...](http://windowsitpro.com/windows-client/windows-nt-and-vms-rest-story)

Bill robbing Apple of GUI is well-known. Less known is he stole a more robust and secure architecture from OpenVMS that was most rock-solid of OS's. They managed to show what would happen if OpenVMS had no QA process during development. Yet, recent efforts have gotten Windows Server reliable enough that the connection is more believable. :)

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> > The following things are broken, obsolete, badly designed, underspecified, > dangerous and/or insane. Rustls does not support:

> Client authentication.

> Kerberos.

From a complexity perspective I understand why these things would not be the first choice to implement in a new library. What I don't understand is why they're on the "will never implement" list. Public-key client authentication is to this day one of the strongest methods of authentication that can be used, and not having that available in a library greatly limits its usages in high-security applications, exactly the places where someone might want to stop using OpenSSL and its broken peers.

Kerberos... well... Kerberos is a cluster-fuck. I think everyone knows that. But there are specific applications where Kerberos (or something similar) is exceptionally useful and maybe even necessary. I will acknowledge though that if Kerberos is missing its not a world-ender, because you can implement your own token-based authentication on top of normal TLS without using Kerberos, which in some cases might even be easier because Kerberos is a cluster-fuck. Despite this, though, if configured properly Kerberos is still one of the best methods for doing secure authentication between multiple servers/services via a central authentication mechanism.

If the justification here is simply implementation complexity that might cloud the codebase or otherwise make it harder to audit for security, I do understand that reasoning. I'm just curious specifically in these two cases because they stood out from the list as things that I don't consider "insane", unlike most of the rest of the list.

As an aside, thanks for not implementing RC4. RC4 needs to die die die die. I don't know why anyone is still using it, but nonetheless I see it in the wild still sometimes :(

<comment><USER13> Odd to see "PSK" on the possible future feature list, with "client authentication" on the "never" list.

Other than that, looks like a nice and sane subset they've picked.

Real shame if they end up avoiding cert-based authentication, though. All other options for authentication are strictly worse, from a security perspective - and leaves more room for implementors to shoot themselves in the foot. For passwords that are intended for human users, for example, you really need some form of rate-limiting. Not to mention the problem of setting up a session first, and then later binding to a user (if authentication succeeds) rather than the simpler "only valid client can connect".

</comment></comment><comment><USER14> Can anyone comment on how this implementation of TLS compares to the recent ocaml/mirageOS version?

How much does formal verification matter/increase confidence?

Is the rust version easier to integrate with other stacks?

[https://mirage.io/blog/why-ocaml-tls](https://mirage.io/blog/why-ocaml-tls)

<comment><USER15> Neither ocaml-tls nor this new one do formal verification. The only TLS library that does so is miTLS.

<comment><USER11> Let's not forget the security kernel in Guttman's cryptlib. It's like a lightweight variant of formal verification that justs makes sure things interface correctly.

</comment></comment></comment><comment><USER16> Rustls use ring for crypto, and it seems most of the crypto algorithm code of ring is written in C/assembly. Kind of destroy the purpose?

<comment><USER17> Rust is not a good language for low level crypto implementation because it offers no facilities for side channel resistant algorithims. Ring uses the extensively reviewed implementation from BoringSSL and considerable expertise from the author. Ring has a goal of moving as much code that does not need side channel resistant to Rust.

By moving the protocol logic to Rust, the amount of code that needs to be reviewed for memory safety in a TLS library is drastically reduced.

<comment><USER18> What does Rust the language have to provide in order to achieve side channel resistant algorithms? That doesn't sound right to me. There are primitives in other languages that are needed? Or Rust doesn't abstract at the right level?

edit: thanks for the explanations!

<comment><USER19> Most high-level languages don't provide guaranteed-constant-time behavior at all. That's a big reason why _ring_ uses lots of BoringSSL's/OpenSSL's assembly language code.

Also, one of my goals with the _ring_ project is to identify exactly what constant-time utilities are needed for a crypto library, so that I can draft a proposal for improving the Rust language and libraries to provide such features.

<comment><USER20> > Most high-level languages don't provide guaranteed-constant-time behavior at > all.

Does even C provide such guarantees? Isn't the compiler free to rewrite the code it's compiling in whatever way it wishes as long as the output is the same?

<comment><USER21> C doesn't and even Assembler doesn't entirely. DJB has pushed and is still pushing(?) Intel to publish more information about these things.

</comment></comment></comment></comment></comment></comment><comment><USER22> My application needs RFC 6091, i.e. using OpenPGP keys instead of the usual X.509 certificates. (Why not X.509? Ask Peter Gutmann¹). This feature is not listed as something they don't support, nor as something they won't support, which is odd. Likewise for DTLS (RFC 6347). These omissions are strange.

① _Everything you Never Wanted to Know about PKI but were Forced to Find Out_ ([https://www.cs.auckland.ac.nz/~pgut001/pubs/pkitutorial.pdf](https://www.cs.auckland.ac.nz/~pgut001/pubs/pkitutorial.pdf))

<comment><USER23> This is exactly the sort of cruft that's quite rarely used and should be omitted from a lean implementation.

I'm not aware of any serious use of RFC 6091. GnuTLS supports it, but I don't think any other implementations do.

<comment><USER22> > _I 'm not aware of any serious use of RFC 6091._

Was it really your intention to dismiss my application¹ as not serious?

① [https://www.recompile.se/mandos](https://www.recompile.se/mandos)

<comment><USER23> It may be serious but I wasn't aware of it.

It seems your project could use x509 client certs as well as gpg ones if you wanted to use a different TLS library that didn't support GPG.

<comment><USER22> That seems like a bit of circular reasoning.

We use RFC 6091 because it's the best fit for our problem, and allows us to avoid the needless complexity of X.509 certificates, which has caused many bugs in the past (in essentially all TLS libraries).

<comment><USER23> Using an obscure feature of one TLS library seems like a bad strategy for avoiding bugs.

If compatibility doesn't matter, I'd probably use something less crufty, like [http://noiseprotocol.org/](http://noiseprotocol.org/)

</comment></comment></comment></comment></comment></comment><comment><USER24> No support for TLS 1.3? Any reason for this, other than work?

<comment><USER25> It's listed in the "Possible future features" section...

Isn't TLS 1.3 currently still a draft? [1]

[1]: [https://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_1...](https://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_1.3_.28draft.29)

<comment><USER26> Yes, TLS 1.3 is still in draft[1]. Heard from a co-worker on Friday (@grittygrease) that draft 14 should be arriving very soon. We (CloudFlare) have implemented draft 13 in go and are actively testing it—try browsing [https://tls13.cloudflare.com](https://tls13.cloudflare.com) with Firefox nightly[2].

I think BoringSSL is also[3] working on their implementation and NSS (Firefox's SSL/TLS library) implemented[4] draft 11 in v3.23, but OpenSSL doesn't have plans to until after 1.1 ships[5]; I've heard the former is expected to land about 6 months prior to the latter as OpenSSL isn't starting until the RFC is finalized.

1 - [https://tools.ietf.org/html/draft-ietf-tls- tls13-11](https://tools.ietf.org/html/draft-ietf-tls-tls13-11) (draft 13) 2 - [https://nightly.mozilla.org/](https://nightly.mozilla.org/) 3 - [https://www.imperialviolet.org/2015/10/17/boringssl.html](https://www.imperialviolet.org/2015/10/17/boringssl.html) 4 - [https://developer.mozilla.org/en- US/docs/Mozilla/Projects/NS...](https://developer.mozilla.org/en- US/docs/Mozilla/Projects/NSS/NSS_3.23_release_notes) 5 - [https://www.openssl.org/policies/roadmap.html](https://www.openssl.org/policies/roadmap.html)

<comment><USER7> [http://i.imgur.com/hMqpkev.png](http://i.imgur.com/hMqpkev.png)

<comment><USER27> Pat missed one bit: you need to head to about:config and set "security.tls.version.max" to 4.

<comment><USER26> Good point. You'd figure I'd remember this after Nick put it on the monster video wall: [http://imgur.com/cf28rpt](http://imgur.com/cf28rpt) ;)

</comment></comment></comment></comment></comment></comment><comment><USER16> Memory safety issues are not the only vulnerabilities in a cryptography library. A simple example would be timing attacks.

Writing a cryptography library from scratch because the old one has too many security holes? Your implementation is likely to have even more.

We should really concentrate on making one implementation secure, instead of creating more libraries.

<comment><USER28> I hate so much this logic - it stops evolution. Humanity have enough programmers to write new libraries and patch existing code. Competition is better than stagnation.

<comment><USER29> It's also an argument against disruption in general. Great progress happens when people stop iterating and start rethinking stuff that hasn't been rethought for decades (and the "stuff" has seen only tiny improvements over the years following this strategy, too).

<comment><USER16> Don't get me wrong, I'm not against disruption at all. It's just there're cases where doing this doesn't make sense. Write a new text editor, invent a new programming language, sure. But writing a new cryptography library? You are throwing away decades of effort that went into to harden and secure the existing library, and your gain is pretty small.

Making things even worse is that you can't really write a crypto library without using C/assembly. So why write a new crypto library?

<comment><USER11> "You are throwing away decades of effort that went into to harden and secure the existing library, and your gain is pretty small."

 _If_ that were true, then it would be a good counterpoint worthy of long thought. The _reality_ of crypto libraries is that popular ones often had preventable errors due to bad coding and/or unsafe language that also took entirely too long to notice.

"you can't really write a crypto library without using C/assembly"

I'd argue you can't write a crypto library using C by default unless you're a _really_ good coder. C is just an accident of two team's bad hardware:

[http://pastebin.com/UAQaWuWG](http://pastebin.com/UAQaWuWG)

Languages like Modula-3, Free Pascal, and even Fortran were easier to analyze to ascertain the program's properties. It's why Modula-3 had first, standard library verified free of specific types of errors. Also took years to make a certified compiler for C which had been done in other, simpler languages. Finally, the top performer in secure, systems code is SPARK as illustrated when re-implementing C crypto in it caught a problem.

[http://www.adacore.com/press/spark- skein/](http://www.adacore.com/press/spark-skein/)

Note: The portability result was also impressive given it's one of C's strengths and difficulties.

</comment></comment></comment></comment></comment><comment><USER28> Glad to see zero "unsafe" and "panic" :)

</comment><comment><USER30> I wonder, will Servo use this?

<comment><USER31> Probably not. With security sensitive things, the security of the logic itself needs to be good too.

Attacks like downgrade attacks, for example, are not memory unsafety issues.

Servo would need a library that is battle-tested and has a vulnerability policy. The Rust libraries could be in this category in the future, but not right now. Using something like nss or boringssl, like other browsers, would be our best bet.

<comment><USER19> > Attacks like downgrade attacks, for example, are not memory unsafety issues.

First, this library only implements TLS 1.2 with AEAD cipher suites (AES-128-GCM, AES-256-GCM, and ChaCha20-Poly1305) and perfect forward secrecy (using ECDHE with the X25519, P-256, and P-384 curves, and RSA and ECDSA signatures). Thus, downgrade to something worse than what NSS or OpenSSL or BoringSSL consider to be the very best crypto is avoided at a very fundamental level.

Second, I and other people have been advocating strongly against design decisions that force implementations to add downgrade vectors. In particular, there is a version number field in the TLS ClientHello that we know causes problems. People have proposed solutions to avoid this version number causing compatibility problems for TLS 1.3, but Mozilla's TLS people have not supported making this improvement. Thus, we're likely going to have downgrade issues _by design_ in TLS 1.3 that would be completely avoidable, due in large part to the people making NSS and other C crypto libraries.

<comment><USER31> This is good. However, I mentioned downgrade attacks as an example of the kind of bug Rust can't solve. Most likely new TLS stacks will not be prone to downgrade attacks. They might be prone to other logic errors. So will established TLS stacks, but those are more battle tested. The rust ones will be too, but eventually, not now.

It's a tradeoff.

<comment><USER19> Out of curiousity, what sort of evidence of safety is the Servo team using to evaluate crypto libraries? I'd love to see the criteria.

<comment><USER32> As we mentioned in the recent Security meetings notes ([https://github.com/servo/servo/wiki/London- Security](https://github.com/servo/servo/wiki/London-Security) ), there will be a blog post on blog.servo.org in the coming weeks from the folks on the team who are making these decisions.

</comment></comment></comment></comment></comment></comment><comment><USER17> I can see this being immensely beneficial to environments that rely heavily of calling out openssl for TLS like node and python.</comment>


Ask HN: How do HFT systems store position and order data? - <AUTHOR> HFT systems are really sensitive in latency. Which means it can't actually use traditional databases like MySQL, PostgreSQL, or etc. But then, how do we actually persist order and position data that the algorithms make? Would we just print it in the screen like application logs? I'm not sure that will be viable since logs can actually get lost. Maybe write on local files as CSV or HDF5? And perhaps make a cron or something to read those files and persist it into somewhere else? Or is there a solution that runs in memory but persists to disk? <comment><USER2> The hot path involves the network card, the CPU, RAM and nothing else. The trading algorithm will keep various data structures in memory to keep track of current position and position limits.

Outside of the hot path/thread, you can do pretty much whatever you want. You typically broadcast your trades on the network for other systems to pick them (and put that data into SQL databases, typically). The databases used for risk and compliance, etc. will most likely get their data directly from the exchange.

The idea is that you don't need to query a central system for every single trade you want to make. HFT systems have some limits set up at the beginning of the trading session, telling they can take a position of up to X in security Y.

<comment><AUTHOR> Thank you very much for your kind reply. So does that mean the algorithm, which is in the hot path will just broadcast via a messaging system like ZeroMQ or Kafka to another subscriber that'll just save the order and position data to the database right? Plus the messaging system will be nonblocking and just do a fire and forget style.

<comment><USER2> The hot path is the time between receiving market data from the network, and reacting to it by potentially sending an order. It's typically a thread constantly polling events from the network card.

In that path the rest of the world does not exist: you are interacting with an exchange, possibly multiple exchanges, and that's it. The rest of the world doesn't exist. No ZeroMQ or Kafka or whatever.

After you send an event, you can set a flag or copy some data structures for another thread of lower priority to do some house keeping. This might include sending an update on some messaging system, yes. This can be something like TIBCO RV, or a proprietary equivalent, or perhaps the ones you mentioned.

But the bottom line is: when doing low-latency, high-frequency trading you don't want to do anything that is not strictly required in the hot path. You must read the message coming from the market, very quickly decide how you want to react (i.e. send a new order or update an order, at which price point, etc.) and that's it. You will in fact even avoid computing too much stuff here; you would have pre-computed as much stuff as possible to be ready to very quickly do a lookup and maybe some trivial computation before making your decision.</comment></comment></comment>


Discouragement for future Entrepreneurs - <AUTHOR> http://mayankja.in/post/58897512800/discouragement-for-future-entrepreneurs

<comment><USER2> This sounds frighteningly like my life already. As a salaried employee in a stable organization.</comment>


SLO Adoption at Twitter - <AUTHOR> https://www.blameless.com/blog/slo-adoption-twitter <comment><USER2> At Uber, we are also adopting a lot more SLOs and SLIs. It's a long and painful process. We started implementing error budgets as well, on an area-by- area basis. There's a lot of learning, and a lot of trial-and-error.

As someone who is working in this space, I found this article to be quite vague, and couldn't take too much out of it. It would be great to see specifics on one SLO, the associated error budget and what graphs Twitter uses to track this.

And while SLOs are a good start - I assume this will be SLOs across services on latency and availability - the next step is measuring key user journeys. "What % of users get stuck on a page, getting the same error message over and over?". "Where can we see a sharp increase from p95 to p99 on success or latency on a user journey, that we can click into?"

I have a feeling Twitter is still at the first level, as most companies I know are. Clearing this one, the next step is what is even more interesting.

<comment><USER3> Same at Webex. And yes, coming up with meaningful indicators and objectives is the tricky part. But it's a work of refinement, and over time (with enough persistence), the measurements can converge to cover what really represents the experience of users.

<comment><USER4> You and GP are lucky you work at a company that's moved past an "SLA" being something that's made up on the spot by some manager who has just decided they're not happy about something, and has heard of that acronym.

I recently discovered from the QA manager that I have an "SLA" with him on how long I can take to tell him there's some new stuff to test (yes, we're still at the stage of "send me an email to tell me what to test, because I don't believe in automating this stuff").

Must be nice living in your world :)

EDIT: I realised my comment contributes nothing to this discussion, and is just noise. I'd be interested if you could expand on what you've learned at Webex.</comment></comment></comment>


Ask HN: Did Facebook/CA receive outsized response in comparison to Experian - <AUTHOR> <comment><USER2> The story for Equifax was the personal data breach, which has implications for individuals' financial outlook.

The story for Facebook is the interference with elections and the political process, which has implications for everything from taxing sodas to the potential for nuclear war.

The reactions are different because the events are not really directly comparable.

</comment><comment><AUTHOR> I feel like the Facebook/CA affair has had more attention from the media than the Experian beach. Additionally, I don't believe Experian received as many legal and Congressional probes as Facebook is receiving. Why is this? Is Experian great at lobbying Congress?

<comment><USER3> Yes, they are. Like most firms in the financial industry, they've developed deeply entrenched lobbying connections, as well as being generous with campaign donations. For instance, Mick Mulvaney, now head of the CFPB and the guy who gets to decide if there's going to be an investigation, has been the recipient of their generosity.

Whereas the Facebook story has been driven in part by the fact that Cambridge Analytica is using the data for the purpose of manipulating political campaigns (possibly illegally for US politicians, since they're a foreign interest).

Also, note that for all the noise, Facebook has yet to suffer any significant legislative consequence.

</comment></comment><comment><USER4> Do you mean Equifax?

For me the difference is that I feel like Equifax was just negligent carelessness, while the Facebook situation was more intentional on their part.</comment>


Why I link to Wayback Machine instead of original web content - <AUTHOR> https://hawaiigentech.com/post/commentary/why-i-link-to-waybackmachine-instead/ <comment><USER3> I'm not sure I'm a fan of this because it just turns WayBackMachine into another content silo. It's called the world wide web for a reason, and this isn't helping.

I can see it for corporate sites where they change content, remove pages, and break links without a moment's consideration.

But for my personal site, for example, I'd much rather you link to me directly rather than content in WayBackMachine. Apart from anything else linking to WayBackMachine only drives traffic to WayBackMachine, not my site. Similarly, when I link to other content, I want to show its creators the same courtesy by linking directly to their content rather than WayBackMachine.

What I can see, and I don't know if it exists yet (a quick search suggests perhaps not), is some build task that will check all links and replace those that are broken with links to WayBackMachine, or (perhaps better) generate a report of broken links and allow me to update them manually just in case a site or two happen to be down when my build runs.

I think it would probably need to treat redirects like broken links given the prevalence of corporate sites where content is simply removed and redirected to the homepage, or geo-locked and redirected to the homepage in other locales (I'm looking at you and your international warranty, and access to tutorials, Fender. Grr.).

I also probably wouldn't run it on every build because it would take a while, but once a week or once a month would probably do it.

<comment><USER4> > But for my personal site, for example, I'd much rather you link to me > directly rather than content in WayBackMachine.

That would make sense if users were archiving your site for your benefit, but they're probably not. If I were to archive your site, it's because I want my own bookmarks/backups/etc to be more reliable than just a link, not because I'm looking out to preserve your website. Otherwise, I'm just gambling that you won't one day change your content, design, etc on a whim.

Hence I'm in a similar boat as the blog author. If there's a webpage I really like, I download and archive it myself. If it's not worth going through that process, I use the wayback machine. If it's not worth that, then I just keep a bookmark.

<comment><USER5> The issue is that if this becomes widespread then we're going to get into copyright claims against the wayback machine. When I write content it is mine. I don't even let Facebook crawlers index it because I don't want it appearing on their platform. I'm happy to have wayback machine archive it, but that's with the understanding that it is a backup, not an authoritative or primary source.

Ideally, links would be able to handle 404s and fallback. Like we can do with images and srcset in html. That way if my content goes away we have a backup. I can still write updates to a blog piece or add translations that people send in and everyone benefits from the dynamic nature of content, while still being able to either fallback or verify content at the time it was publish via the wayback machine.

<comment><USER6> But it's also not guaranteed to be consistent. What if you don't delete the content but just change it? (I.e. what if your opinions change or you're pressured to edit information by a third party?).

<comment><USER5> I addressed this.

> I can still write updates to a blog piece or add translations that people > send in and everyone benefits from the dynamic nature of content, while > still being able to either fallback or verify content at the time it was > publish via the wayback machine.

Updates are usually good. Sometimes you need to verify what was said though, and for that wayback machine works. I agree it would be nice if there was a technical way to support both, but for the average web request it's better to link to the source.

</comment></comment></comment></comment></comment><comment><USER7> We suggest/encourage people link to original URLs but ALSO (as opposed to instead of) provide Wayback Machine URLs so that if/when the original URLs go bad (link rot) the archive URL is available, or to give people a way to compare the content associated with a given URL over time (content drift)

BTW, we archive all outlinks from all Wikipedia articles from all Wikipedia sites, in near-real-time... so that we are able to fix them if/when they break. We have rescued more than 10 million so far from more than 30 Wikipedia sites. We are now working to have Wayback Machine URLs added IN ADDITION to Live Web links when any new outlinks are added... so that those references are "born archived" and inherently persistent.

Note, I manage the Wayback Machine team at the Internet Archive. We appreciate all your support, advice, suggestions and requests.

<comment><USER8> It's interesting to think about how HTML could be modified to fix the issue. Initial thought: along with HREF, provide AREF- a list of archive links. The browser could automatically try a backup if the main one fails. The user should be able to right-click the link to select a specific backup. Another idea is to allow the web-page author to provide a rewrite rule to automatically generate wayback machine (or whatever) links from the original. This seems less error prone and browsers could provide a default that authors could override.

Anyway, the fix should work even with plain HTML. I'm sure there are a bunch of corner cases and security issues involved..

Well as mentioned by others, there is a browser extension. It's interesting to read the issues people have with it:

[https://addons.mozilla.org/en-US/firefox/addon/wayback- machi...](https://addons.mozilla.org/en-US/firefox/addon/wayback- machine_new/reviews/)

<comment><USER9> So this is a little indirect, but it does avoid the case where the Wayback machine goes down (or is subverted): include a HASHREF which is a hash of the state of the content when linked. Then you could find the resource using the content-addressable system of your choice. (Including, it must be said, the wayback machine itself).

<comment><USER10> I've found that web pages have so much dynamic content these days that even something that feels relatively static generates two different hashes almost on every pageload.

<comment><USER9> Indeed. I don't think you could or should hash the DOM - not least of which because it is, in general, the structured output of a program. Ideally you could hash the source. This might be a huge problem for single page applications, except you can always pre-render a SPA at any given URL, which solves the problem. (This is done all the time - the most elegant way is to run e.g. React on the server to pre-render, but you can also use another templating system in an arbitrary language, although you end up doing all features maybe not twice, but about 1.5x).

</comment></comment></comment></comment></comment><comment><USER11> Here, I fixed your link: [https://web.archive.org/web/20200908090515/https://hawaiigen...](https://web.archive.org/web/20200908090515/https://hawaiigentech.com/post/commentary/why- i-link-to-waybackmachine-instead/)

<comment><USER12> Came here for this. Have my upvote.

</comment></comment><comment><USER13> This is a bad idea...

In the worst case one might write a cool article and get two hits, one noticing it exists, and the other from the archive service. After that it might go viral, but the author may have given up by then.

The author is losing out on inbound links so google thinks their site is irrelevant and gives it a bad pagerank.

All you need to do is get archive.org to take a copy at the time, you can always adjust your link to point to that if the original is dead.

<comment><USER14> Google shouldn't be the center of the Web. They could also easily determine where the archive link is pointing to and not penalize. But I guess making sure we align with Google's incentives is more important than just using the Web.

<comment><USER3> > Google shouldn't be the center of the Web.

I agree, but are you suggesting it's going to be better if WayBackMachine is?

<comment><USER14> That's a strawman because I never said they should be. There's room for better alternatives.

We as a community need to think bigger rather than resigning ourselves to our fate.

<comment><USER3> It's not a strawman because (a) I agreed with you, (b) context, and (c) I asked a question based on what you seemed to be implying in that context: a question to which you still haven't provided an answer.

Let me put it another way: what specifically are you suggesting as an alternative?

<comment><USER14> If I had to pick a solution from what's available right now technology wise I'd pick something that links based on content hashes. And then pulls the content from decentralized hosting.

I don't think I like IPFS as an organization, but tech wise it's probably what I'd go with.

</comment></comment></comment></comment></comment></comment><comment><USER15> So, this is the problem of persistence of URL's always referencing the original content, regardless of where it is hosted, in an authoritative way.

It's an okay idea to link to WB, because (a) it's de facto assumed to be authoritative by the wider global community and (b) as an archive it provides a promise that it's URL's will keep pointing to the archived content come what may.

Though, such promises are just that: promises. Over a long period of time, no one can truly guarantee the persistence of a relationship between an URI and the resource it references to. That's not something technology itself solves.

The "original" URI still does carry the most authority, as that's the domain on which the content was first published. Moreover, the author can explicitly point to the original URI as the "canonical" URI in the HTML head of the document.

Moreover, when you link to the WB machine, what do you link to? A specific archived version? Or the overview page with many different archived versions? Which of those versions is currently endorsed by the original publisher, and which are deprecated? How do you know this?

Part of ensuring persistence is the responsibility of original publisher. That's where solutions such as URL resolving come into play. In the academic world, DOI or handle.net are trying to solve this problem. Protocols such as ORE or Memento further try to cater to this issue. It's a rabbit hole, really, when you start to think about this.

<comment><USER16> > Moreover, when you link to the WB machine, what do you link to? A specific > archived version? Or the overview page with many different archived > versions? Which of those versions is currently endorsed by the original > publisher, and which are deprecated? How do you know this?

WB also supports linking to the very latest version. If the archive is updated frequently enough I would say it is reasonable to link to that if you use WB just as a mirror. In some cases I've seen error pages being archived after the original page has been moved or removed though but that is probably just a technical issue caused by some website misconfiguration or bad error handling.

</comment></comment><comment><USER17> You can create a bookmark in Firefox to save a link quickly.

Bookmark Location- [https://web.archive.org/save/%s](https://web.archive.org/save/%s)

Keyword - <USER2>

So searching 'save [https://news.ycombinator.com/item?id=24406193](https://news.ycombinator.com/item?id=24406193)' archives this post.

You can use any Keyword instead of 'save'.

You can also search with [https://web.archive.org/*/%s](https://web.archive.org/*/%s)

<comment><USER18> Does that `save` keyword work?

The problem is %s gets escaped, so Firefox generates this URL, which seems to be invalid:

[https://web.archive.org/save/https%3A%2F%2Fnews.ycombinator....](https://web.archive.org/save/https%3A%2F%2Fnews.ycombinator.com%2Fitem%3Fid%3D24406193)

<comment><USER19> Uppercase %S for unescaped, e.g.:

[https://web.archive.org/web/*/%S](https://web.archive.org/web/*/%S)

<comment><USER17> TIL. Thanks for the info.

</comment></comment></comment></comment><comment><USER20> Can we update this link to point to the archive version?

<comment><USER21> Brilliant

</comment></comment><comment><USER22> This is building yet another silo and point of failure. We can't pass the entire Internet traffic thru WayBackMachine as its resources are limited.

Most preserving solutions are like that and at the end the funding or business priorities (google groups) become a serious problem.

I think we need something like web - distributed and dumb easy to participate and contribute a preservation space.

Look, there are Torrents available for 17 years [0]. Sure, there are some unintresting long gone but there is always a little chance somebody still has the file and someday becomes online with it.

I know about IPFS/Dat/SBB, but still that stuff, like Bitcoin, is too complex for a layman contributor with a plain altruistic motivation. It should be like SETI@Home - fire and forget. Eventually integrated with a browser to cache content you star/bookmark and share when it is offline.

[0] [https://torrentfreak.com/worlds-oldest-torrent-still- alive-a...](https://torrentfreak.com/worlds-oldest-torrent-still-alive- after-15-years-180929/)

</comment><comment><USER23> Link rot has convinced me that the web is not good for its ostensible purpose. I used to roll my eyes reading how academic researchers and librarians would discourage using webpages as resources. Many years later, it's obvious that the web is pretty bad for anything that isn't ephemeral.

<comment><USER24> >I used to roll my eyes reading how academic researchers and librarians would discourage using webpages as resources.

While this is true in general, I am amused that this is _not_ true for citing wikipedia. Wikipedia can be trusted to remain online for many more years to come. And it has a built-in wayback machine in the form of Revision History.

<comment><USER23> Try following the references on big Wiki pages and you will see why Wikipedia pages are nightmarish for any kind of research. This is important when you are trying to drill down to the sources of various claims. Many major pages relating to significant events and concepts are riddled with rotted links.

The page can be completely correct and accurate, but if you cannot trace the references then it cannot be verified and you cannot make the claims in a new work as a result. The whole point of references is to make it so that the claims can be independently verified. Even when there isn't a link rot problem you will often find junk references that cannot be verified.

Wikipedia isn't a bad starting point and sometimes you can find good references. But it is not anywhere close to reliable: just trace the references in the next 20 Wiki articles you read and your faith will be shaken.

</comment></comment></comment><comment><USER25> By that reasoning, shouldn't you be be using WayBack Machine links when posting your own content to HN, instead of posting direct links?

</comment><comment><USER26> But how certain is the future of WayBackMachine, when disaster strikes, all your links are dead. On the other hand, the original links can still be read from the url, so the original reference is not completely gone.

<comment><USER27> Yeah, my thoughts were more of the way Waybackmachine is funded.

I don't feel comfortable sending a bunch of web traffic to them for no reason other than it being convenient. The wayback machine is a web archival project, not your personal content proxy to make sure your links don't go stale.

They need our help both in funding and in action, one simple action is not to abuse their service.

<comment><USER28> Precisely my first thoughts, too. It's an archive, not a free CDN.

I hope the author of this piece considers donating and promoting donation to their readers: [https://archive.org/donate/](https://archive.org/donate/)

</comment></comment></comment><comment><USER29> Good idea, by why not both (i.e. link to a webpage, _and_ to the Archive)?

Linking to Archive only makes Archive a single point of failure.

<comment><USER30> Yes, this makes the most sense in my opinion:

Check out [this link]([https://...](https://...)) ([archived]([https://...)](https://...\)))

This can also help in the event of a "hug of death"

<comment><USER31> This is what I do on my blog, with some additional metadata:

            Aeroglyphs

            [archived]

          is an ongoing series of photos of nature with superimposed geometrical shapes drawn by drones.

</comment></comment></comment><comment><USER32> I understand where the author is coming from, but I think the best approach is to write your content with direct links to the canonical versions of articles.

Have a link checking process you run regularly against your site, using some of the standard tools I've mentioned elsewhere in this thread:

[https://www.npmjs.com/package/broken-link-checker- local](https://www.npmjs.com/package/broken-link-checker-local)

[https://linkchecker.github.io/linkchecker/](https://linkchecker.github.io/linkchecker/)

When you run the link check (which should be regularly, perhaps at least weekly), also run a process that harvests the non-local links from your site and 1) adds any new links' content to your own local, unpublished archive of external content, and 2) submits those new links to archive.org.

This keeps canonical URLs canonical, makes sure content you've linked to is backed up on archive.org so a reasonably trustworthy source is available should the canonical one die out, and gives you your own backup in case archive.org and the original both vanish.

I don't currently do this with my own sites, but now I'm questioning why not. I already have the regular link checks, and the second half seems pretty straightforward to add (for static sites, anyway).

</comment><comment><USER33> I think the fundamental problem here is that URLs locate resources. We find the desired content by finding its location given by an address. Now what server or content lives on that address may change from time to time or may even disappear. This leads to broken links.

The problem with linking to Wayback Machine is that we are still writing archive.org URLs still linking to Wayback Machine servers. What guarantee is there that those archive.org links will not break in future?

It would have been nice if the web were designed to be content-addressable. That is, the identifier or string we use to access a content addresses the content directly, not a location where the content lives. There is good effort going on in this area in the InterPlanetary File System (IPFS) project but I don't think the mainstream content providers on the Internet are going to move to IPFS anytime soon.

</comment><comment><USER34> I'm all for Archive.org. However, using it in this way — setting up a mirror of some content and purposefuly diverting traffic to said mirror — is copyright infringement (freebooting), as it competes with the original source.

</comment><comment><USER35> This is a bad idea for the reasons that other commenters have already stated. If WayBackMachine falls, all links would fall. Actually the "Web" would stop being one, if all links are all within the same service.

For docs and other texts, I just link to the original site and add an (Archive) suffix, e.g. the "Sources" section in [https://doc- kurento.readthedocs.io/en/latest/knowledge/nat.h...](https://doc- kurento.readthedocs.io/en/latest/knowledge/nat.html#nat-types-and-nat- traversal)

That is a simple and effective solution, yes it is a bit more cumbersome, but it does not bother me.

</comment><comment><USER36> > So in Feb 14 2019 your users would have seen the content you intended. > However in Sep 07 2020, your users are being asked to support independent > Journalism instead.

Can you believe it? Yesterday, I tried to walk out of the grocery store with a head of lettuce for free, and they instead were more interested in making me pay money to support the grocery and agricultural business!

<comment><USER37> Right. I thought it was pretty bad form for him to call this "spam," as though they're the ones wronging _him._

</comment></comment><comment><USER38> This seems like a problem that would be better solved by something like:

1\. Browsers build in a system whereby if a link appears dead, they first check against the Wayback Machine to see if a backup exists.

2\. If it does, they go there instead.

3\. In return for this service, and to offset costs associated with increased traffic, they jointly agree to financially support the Internet Archive in perpetuity.

</comment><comment><USER39> Here's a WayBackMachine Link to this article. :)

[https://web.archive.org/web/20200908090515/https://hawaiigen...](https://web.archive.org/web/20200908090515/https://hawaiigentech.com/post/commentary/why- i-link-to-waybackmachine-instead/)

</comment><comment><USER40> Take a look at _Robustify Your Links_.[1] It is an API and a snippet of JavaScript that saves your target HREF in one of the web archiving services and adds a decorator to the link display that offers the option to the user to view the web archive.

[1] [https://robustlinks.mementoweb.org/about/](https://robustlinks.mementoweb.org/about/)

</comment><comment><USER41> No one touched on this but the experience of viewing through the waybackmachine is awful.

Media many times will not be saved so pages look broken. The iframe and the iframe breakers on original sites can kill any navigating.

The waybackmachine is okay for researching but a poor replacement as a perm link.

<comment><USER42> > Media many times will not be saved so pages look broken.

In my experience, this has gotten much, much better in the last few years. I haven't explored enough to know if this is part of the archival process or not, but I've noticed on a few occasions that assets will suddenly appear some time after archiving a page. For instance, when I first archived this page ([https://web.archive.org/web/20180928051336/https://www.intel...](https://web.archive.org/web/20180928051336/https://www.intelfuturequiz.com/)), none of the stylesheets, scripts, fonts or images were present. However, after some amount of time (days/weeks) they suddenly appeared and I was able to use the site as it originally appeared.

</comment></comment><comment><USER43> This man's entire argument is completely terrible for two reasons:

1) The example he uses is The Epoch Times, a questionable source even on the best of days.

2) What he refers to as "spam" is a paywall. He is literally taking away from business opportunities for this outlet that produced a piece of content he wants to draw attention to, but he does not want to otherwise support.

He's a taker. And while the Wayback Machine is very useful for sharing archived information, that's not what this guy is doing. He's trying to undermine the business model of the outlets he's reading.

The Epoch Times is one thing—it's an outlet that is essentially propaganda—but when he does this to a local newspaper or an actual independent media outlet, what happens?

<comment><USER44> > 2) What he refers to as "spam" is a paywall. He is literally taking away > from business opportunities for this outlet that produced a piece of content > he wants to draw attention to, but he does not want to otherwise support.

For the destination site, this is all of the downsides of AMP with none of the upsides.

</comment></comment><comment><USER45> Is there any WordPress plugin that adds a link to the WayBack Machine next to the original link? I would use something like that.

<comment><USER46> Look at the format of the wayback machine URL. It's trivial to generate.

Where a WP plugin would add value is by saving to the archive whenever WP publishes a new or edited article.

</comment></comment><comment><USER47> The idea of being able to access the URL once it is gone is good. However this also means that any updates made to the original page are no longer seen.

Not all updates are about "begging for money" as the example in the article.

</comment><comment><USER48> Or link to your own archive of the content with ArchiveBox!

That way we're not all completely reliant on a central system. (ArchiveBox submits your links to Archive.org in addition to saving them locally).

[https://github.com/pirate/ArchiveBox](https://github.com/pirate/ArchiveBox)

Also many other tools that can do this too:

[https://github.com/pirate/ArchiveBox/wiki/Web-Archiving- Comm...](https://github.com/pirate/ArchiveBox/wiki/Web-Archiving- Community#other-archivebox-alternatives)

</comment><comment><USER49> Just FYI, archive.org is banned in a few countries, including the UAE, where I cannot open any links from there.

<comment><USER50> Huh I wonder if they are also blocking mirrors. Also, in countries with restrictions to internet access you probably want to make using TOR a general habit.

</comment></comment><comment><USER51> Apropos of nothing but I added the ability to archive links in Anarki a few months back[0]. If dang or someone wants to take it for HN they're welcome to. Excuse the crappy quality of my code and pr format, though.

It might be useful as a backup if the original site starts getting hugged to death.

[0][https://github.com/arclanguage/anarki/pull/179](https://github.com/arclanguage/anarki/pull/179)

</comment><comment><USER52> > _Now it's spam from a site suffering financial need._ Well, yeah!

Of course, linking to WBM is not the main reason why a site might be in this situation but it piles up.

</comment><comment><USER53> Awesome. Hey, mods... Can you change the link on this post to [http://web.archive.org/web/20200908090515/https://hawaiigent...](http://web.archive.org/web/20200908090515/https://hawaiigentech.com/post/commentary/why- i-link-to-waybackmachine-instead/)

</comment><comment><USER54> I link to WayBackMachine as Ive built a great many greenfield applications for startups as a freelancer, which only existed for about 6-8 months before hitting their burn rate. If I linked to their original domains, my portfolio would be a list of 404s.

</comment><comment><USER55> I once discovered an information leak of German public broadcasting organization ARD which leaked real mobile numbers on their CI/CD page where they showed the business card designs (lol).

All records of this page on Archive.org were deleted after a couple of days, a twitter account posting the details with a screenshot and link was reported and my account temporarily suspended.

I assume it must be very easy to remove inconvenient content from archive.org.

(in German) [https://blog.rolandmoriz.de/2019/04/25/sind-die-leute-von- de...](https://blog.rolandmoriz.de/2019/04/25/sind-die-leute-von-der-ard-so- doof/)

</comment><comment><USER56> While I certainly wouldn't do this with every page and also not every time, I got so anxious of link rot lately I save out of reflex any good content I come across to the Waybackmachine.

The use of the bookmarklet makes this really convenient.

</comment><comment><USER57> WayBackMachine is slow (slower than many bloated websites). So it's not a good enough experience for the person clicking on that link.

Secondly, I personally don't like the fact that WayBackMachine doesn't provide an easy way to get content removed and to stop indexing and caching content (the only way I know is to email them, with delayed responses or responses that don't help). It's far easier to get content de-indexed in the major search engines. I know that the team running it have some reasons to archive anything and everything (as) permanently (as possible), but it doesn't serve everybody's needs.

</comment><comment><USER58> This is both good and scary idea: for the good part, I'm frustrated enough that some unscrupulous websites (even some news outlets) secretly alter their contents without mentioning the change. I want a mechanism that holds the publisher responsible. At the same time, this is scary because we're basically using one private organization a single arbitrator. (I know it's a nonprofit, but they're probably not as public as a government entity.) Maybe it's good for the time being, but we should be aware that this is a solution that's far from perfect.

<comment><USER59> Public "or" a government entity.

</comment></comment><comment><USER60> This seems like a risky strategy, what with the pending lawsuit against archive.org over their National Emergency Library: I am fully expecting that web.archive.org will go away permanently within a few years.

</comment><comment><USER61> I link to the original, but archive it in both WayBackMachine and Archive.is.

</comment><comment><USER62> Yeah, that's another problem with the design of the web, and kind of a significant one! Somewhat pointless to link to external documents when half of them won't be around next year.

</comment><comment><USER63> While I generally disagree because I'd rather my site was the one getting the hits—and I would rather give the same courtesy to other authors—this does give me the idea of checking (or creating if none exists) an archive link of whatever I reference, and include that archive link in the metadata of every link I include.

Users will find the archive link if they really want to, and it will make it easier for me to replace broken links in the future.

</comment><comment><USER64> As others mentioned, it is a good habit to request the page to be archived. You don't have to link to the archive, but you would have the option to if the page were to disappear in the future.

I wish I had done this 15 years ago for a small project/website. Nowadays, my website is there, with all of its content, but most of the awesome references which I had linked to are unavailable. I wrote "most", but it is close to all of them.

</comment><comment><USER65> Gotta completely agree ... for anything you need to be stable and available.

I've been building lists of -reference- URLs for over a decade ... and the ones aimed at Archive.org (are slower to load, but) are much more reliable.

Saved Wayback URLs contain the original site URL. It's really easy to check it to see if the site has deteriorated (usually it has). If it's gotten better ... it's easy to update your saved WB link.

</comment><comment><USER66> If it's not distributed, it is going to disappear.

The waybackmachine is backed by WARC files. It's perhaps the only thing on archive.org that cant be downloaded... well except the original mpg files for 911 news footage.

[https://news.ycombinator.com/item?id=20623177](https://news.ycombinator.com/item?id=20623177)

</comment><comment><USER67> This is such a fundamental problem that I'd like to be able to solve it at the HTML level.

An anchor type which allows several URLs, to be tried in order, would go a long way. Then we could add automatic archiving and backup links to a CMS.

It isn't real content-centric networking, which is a pity, but it's achievable with what we have.

</comment><comment><USER17> The wayback machine has helps me on a daily basis. So many old links are dead.

The other day, I noticed that even old links from the front page of Google and Youtube are dead now. Internet Archive still has them. These were links on the front page of YT. Was very disappointed that even Google has dead links.

</comment><comment><USER68> I wrote a link checker[1] to detect outbound links and mark dead links, so that, I can replace them manually with archive.org links.

1 - [https://github.com/ashishb/outbound-link- checker](https://github.com/ashishb/outbound-link-checker)

</comment><comment><USER69> I made a chrome extension called Capsule that works perfectly for this use case. With just a click, you can create a publically shareable link that preserves the webpage exactly as you see it in your browser.

[https://capsule.click](https://capsule.click)

<comment><USER48> Does it use SingleFile under-the-hood? What storage format does this use, is it portable? e.g. WARC/memento/zim/etc?

</comment></comment><comment><USER70> I experienced this just the other day.

I was browsing an old HN post from 2018, with lots of what seemed like useful links to their blog

Upon visiting it the site had been rebranded and the blog entries had disappeared

Waybackmachine saved me in this cass, but a link to it originally would have saved me a few clicks

</comment><comment><USER71> If it's to actually reference a third party source, it's probably better to make a self-hosted copy of the page. You can print it to a PDF file for example. I don't believe archive.org is eternal, or that its pages will remain the same.

</comment><comment> m-p-3 I still link to the original URL because the author deserves the ad revenue and traffic, but I archive a copy to the Wayback Machine just in case the website can't handle the load, so there is an alternative way of getting the content.

</comment><comment><USER72> The proper way is for a site to expose a canonical link to an article via a meta-link (rel=canonical) if necessary, and then have a browser plugin to automatically try archive.org with an URL generated from the canonical one if it is down.

</comment><comment><USER73> Thank you! I've only been using the labor-intensive trust-issues version of this: paraphrasing things in my own words and linking to THAT.

I think I've been curating about 200 essays so far like that. You're now making me rethink my flow.

</comment><comment><USER74> I maintain a Fork of a program that does exactly this! You can check it out here

[https://github.com/Lifesgood123/prevent-link- rot](https://github.com/Lifesgood123/prevent-link-rot)

</comment><comment><USER10> What would be even cooler is if there was an easy way to turn your own server into a Wayback machine, so that when your server rendered a webpage, it would use the original link if available, or its own cached version if not.

</comment><comment><USER75> In the past I would fall back to WBM when something is no longer online. Though recently I've been bookmarking interesting content very rigorously and just rely on the archival feature of my bookmarking software.

</comment><comment><USER76> Just another reason to have content-adressable storage everywhere, then at least if it changed you'll know it changed, and if you can't get the original content anymore then the change is probably malicious.

</comment><comment><USER21> For anything important you can't beat a good save to pdf feature in the browser. You can then upload the pdf and link to that instead. Someone should make a wordpress plugin to do this automatically.

</comment><comment><USER77> You could link to the original web url and also do a print version of the web content as PDF. That's how i archive howtos and write-ups of interesting content. Print view and create a PDF version.

</comment><comment><USER78> Maybe the solution isn't technical and we should look at other fields that have relied on referencing credible sources for a long time? I can think of research, news and perhaps law.

</comment><comment><USER79> It's probably better to link to both. If a site corrects a story, you readers will want to see the correction, but if the page disappears, it's good to have the backup.

</comment><comment><USER80> It would be good to create a distributed, consensus version (to help stop edits) of the content rather than have a single point of failure...

</comment><comment><USER81> So it can be deleted too?

Or so there is no engagement at the source?

</comment><comment><USER82> There's some subtle irony in that the linked site is not in fact a WayBackMachine link, but instead a direct link to the site.

</comment><comment><USER83> On the same topic, I wish I could link with highlights in the page. Having a spec for highlights in URLS would be neat.

<comment><USER84> Chrome 80 supports this: [https://www.chromestatus.com/feature/4733392803332096](https://www.chromestatus.com/feature/4733392803332096)

</comment></comment><comment><USER85> I think a good solution might be to host the archive version yourself (archive.org is slow, and always using it centralizes everything there).

Let's say you write an article on your site, [https://yoursite.com/my- article](https://yoursite.com/my-article), and from it you want to link to an article [https://example.com/some-article](https://example.com/some-article)

You then create a mirror of [https://example.com/some- article](https://example.com/some-article) to be served from your site at [https://yoursite.com/mirror/2019-09-08/some- article](https://yoursite.com/mirror/2019-09-08/some-article) (put /mirror/ in robots.txt and set to noindex (or maybe even better to put a rel="canonical" towards the original article?)) and on the top of this mirrored page you add a header bar thingy containing a link to the original article, as well as one to archive.org if you so want.

tl;dr instead of linking to [https://example.com/some- article](https://example.com/some-article) you link to [https://yoursite.com/mirror/2019-09-08/some- article](https://yoursite.com/mirror/2019-09-08/some-article) (which has links to the original)

</comment><comment><USER86> I find that web archive pages always appear broken —- perhaps a lot of js or css is not properly archived?

</comment><comment><USER87> Everyone should be doing this in my opinion, articles get pulled all the time

</comment><comment><USER88> Clever way to make the reference immutable.

Some blockchain will end up taking care of this.

</comment><comment><USER89> Is there a chrome app that utilises waybackmachine?

</comment><comment><USER90> has waybackmachine stopped retroactively applying robots?

if not link to that are one misconfiguration or one parked domain from being wiped.

</comment><comment><USER91> WBM is like a content snapshot. You can't go back in time and change anything. That's why it is better than linking to the original.

</comment><comment><USER92> Hmm. is there a place for a service that makes a permanent copy of content, available at the original url at the time of posting?

</comment><comment><USER93> I stopped reading after the part where they describe the paywall gated version of the journalism website as "Now it's spam from a site suffering financial need."

That website spends money creating content for commercial viability, it doesn't have to bow to you and make sure you can consume it for free, and the Wayback Machine isn't a tool for you to bypass premium content.

</comment><comment><USER94> This behaviour should be reported to the WayBackMachine as abuse.

</comment><comment><USER50> He is actually showcasing a very nice technique to get around paywalls: turn off JS. Often enough that's enough to get around the paywall. I believe the archives also disable JS when grabbing the content.

<comment><USER95> That is changing. I've noticed over the past couple of years that sites that could be accessed with JS turned off are now showing a "Please enable Javascript to continue" (Quora) or just hiding the content entirely (Business Insider).

I'm sure there are other examples as well.

<comment><USER50> Not surprised. When paywalls started becoming a thing most of them could be circumvented simply by removing a DOM element and some CSS classes. Nowadays this is basically not possible anywhere anymore.

</comment></comment></comment><comment><USER96> In practice however, archive.org did censor content based on political preference.

<comment><USER97> Sounds plausible, but I sure would like a citation for that claim.

<comment><USER98> They exclude Snopes and I think Salon from archiving.

<comment><USER99> Do you have any source on that? Sites can request archive.org to stop archiving them and to delete what is currently archived. They can do it for any reason; concealing changes of article contents might be one of them.

<comment><USER98> [https://web.archive.org/web/*/snopes.com](https://web.archive.org/web/*/snopes.com)

> Sorry.

> This URL has been excluded from the Wayback Machine.

They also do not exclude the archive.org bot in [https://www.snopes.com/robots.txt](https://www.snopes.com/robots.txt)

<comment><USER99> That only shows that it's excluded, not for what reason. In 2017 Internet Archive announced it will start to ignore robots.txt in the future. When I tried to archive random facebook page (it was not allowed in robots.txt), it archived it happily. Afaik current way to exclude you site requires contacting email@example.com and proving that the site is your.

</comment></comment></comment></comment></comment></comment><comment><USER100> I think this a good idea, but especially because the WayBackMachine uses good content security policies to prevent some of the intrusive JS ad-dependent sites like to push on people. So you're not only protecting from future 404 scenarios, but also protecting your visitors' privacy from unscrupulous ad- tech which seems to be everywhere now.

The example provided in the article, showing how a site looked cleaner before, could simply be the content security policies at the WayBackMachine preventing the clutter from getting loaded, rather than any specific changes on the site - although I haven't checked that particular site.</comment>


Sorting Algorithm Animations - <AUTHOR> http://www.sorting-algorithms.com <comment><USER2> This is great resource for exploring sorting algorithms.

I think it would be beneficial if there was a way to determine the order in which each sort finishes.

</comment><comment><USER3> I really want an animation like this for Batcher's method. That already exist somewhere and I just can't find it? Would be amusing/interesting to see something showing 100 items sorted in essentially 7 "steps."

</comment><comment><USER4> I enjoy these [http://panthema.net/2013/sound-of- sorting/](http://panthema.net/2013/sound-of-sorting/)

</comment><comment><USER5> Here is another cool visualization of classic sort algorithms [http://sorting.at](http://sorting.at)

</comment><comment><USER6> It bugs me that Shellsort is almost everywhere the seemingly fastest algorithm.

<comment><USER7> Same here. I hit replay 5 times just to make sure. I even tried the highest problem size and Shellsort still beat both Quicksorts handily.</comment></comment>


Murder in the Lucky Holiday Hotel - <AUTHOR> http://www.bbc.co.uk/news/resources/idt-sh/Murder_lucky_hotel <comment><USER2> Who makes these hateful websites? For the love of god at least provide a "printer friendly" version. It's like reading a roll of toilet paper that randomly jerks and spins. You're supposed to be _more_ convenient than a paper magazine!

I do recommend the radio programme broadcast on BBC radio 4 (still up on iPlayer).

<comment><USER3> I was expecting to see something terrible, instead I saw a really basic parallax site without any gimicks beyond fixed images.

To be honest the whole thing just reminded me of a paper magazine, not anything 'hateful'.

<comment><USER4> I kept getting weird jumps on Chrome mobile, like ads were appearing at different sizes.

</comment></comment></comment><comment><USER5> This is the kind of story that raises far more questions than it answers. There is way too much murkiness and innuendo to discern fact from speculation, opinion and fiction.

I mean was the whole thing a setup to frame Bo? Because it seems right from the beginning he had tremendous support and clout to get away with what he did, you just can't run a city the way you want and take down powerful interests without top level support. He was part of the 25 member party politburo all the way through and minister of commerce. So this is one of the top guys in China. At the end it looks more like political intrigue than something personal.

<comment><USER4> It's as crazy as medieval English history.

</comment></comment><comment><USER6> There's also the podcast with the same name for those who'd rather listen to that than to read this ... presentation of it.

</comment><comment><USER7> I didn't expect to wake up and read a John Le Carre novel first thing in the morning.

How interesting that the author is named 'Carrie Gracie', solely for the Carre vs. Carrie name reference.

Life imitates art.

</comment><comment><USER8> Perhaps this is just gratuitous bike-shedding, but somewhere between the font [1], the line-height, the general layout (narrow columns shifting about, sometimes transparently on top of imagery), I found this article quite unpleasant to read. Given they have clearly made an effort with the layout and appearance of these long-form pieces, this surely must be a rather disappointing result.

[1] Basically the default sans-serif, depending on your operating system: "Helmet, Freesans, Helvetica, Arial, sans-serif". If you turn this off, you get PT Serif, which feels considerably easier on the eye, frankly.

<comment><USER9> There's some equally off-putting gimmickry in the podcast series too. I think they're trying to compensate for the lack of on the record interviews. Should have just hired Adam Curtis...</comment></comment>


Ask HN: Is it worthwhile for a startup to use a professional designer? - <AUTHOR> A potential client recently asked me this question and I'm interested in the community's opinions on this.<p>Also, this is not really a yes/no question; it's a discussion prompt. :) <comment><USER2> I think the better strategy is to infuse your organization with design thinking. AirBnB has been one of YC's best recent performers and 2/3 of their founding team are designers. To quote Steve Jobs:

 _In most people's vocabularies, design means veneer. It's interior decorating. It's the fabric of the curtains of the sofa. But to me, nothing could be further from the meaning of design. Design is the fundamental soul of a human-made creation that ends up expressing itself in successive outer layers of the product or service._

So if your goal is to make something consumer facing or where the user is key in your thinking don't use a professional designer, make one a co-founder.

I think design is wildly underutilized and 1 good design hire can be worth 5-10 engineers at the early stage. This may sound heretical, but a good designer can make UX decisions that have massive impact across a site, but piggy back on pre-existing engineering tasks. This doesn't scale though. 10 designers aren't equal to 10 engineers.

That said, if you are creating some B2B product that doesn't have a lot of meaningful user interaction, the value exchange is simple, or there aren't a lot of competitive solutions (web or otherwise) then piece something together via woothemes and 99 designs, or make friends with a good designer.

<comment><USER3> well said

</comment></comment><comment><USER4> Yes.

I'm a programmer by night / business type by day. I have a website soon to be released in beta and I hired a designer I trusted (and could afford) from a previous job. She worked wonders for the project -- seeing the new design also reinvigorated me.

A few tips: Hire a friend if possible (you'll probably get a friend-rate), if not work by referral. You want someone you can sit with face to face. Avoid 99Designs and the like if you can. Pay your invoices immediately and you'll find the designer will likely continue to be super helpful. Also, get an hourly rate up front since you'll probably find things that need to be adjusted. Lastly, I wouldn't use the designer for HTML, just have them hand off PSDs, the markup tends to be not so good. Insist on PSDs, not flattened images.

By the way, I'm happy to give a refferal for a trusted friend. Just email me at juliuss at gmail.

<comment><USER5> Any reasons on why to avoid 99designs and ilk?

<comment><USER4> If you're looking for a logo or page that will fit in with your existing look and feel, those sites are pretty good. But for me personally, I got a lot more traction by being able to sit with the designer and really give them a sense for what I'm trying to accomplish. So, it really depends on what you need.

</comment></comment></comment><comment><USER6> Am also a designer.

v1? Just get the damn thing out. Don't worry about whether it has the perfect design or interactions at this point since the hardest part is simply launching (and you're going to change your idea/design once you get feedback anyways). After that, I believe a designer is invaluable, for taking user feedback and results and crafting the product into something that promotes more sales/views.

</comment><comment><USER7> I am a programmer starting my own business. I pretend to be a designer, but when it comes down to it, I'm really lost. I've tried the ThemeForest/WooThemes route for nice templates. While they have some beautiful templates, they'll still need customization that I can't do.

Suck it up, find a good designer and pay them well. I'm glad I did.

</comment><comment><USER8> It depends.

Firstly, what stage of a startup are we talking about? Are we talking a guy building just a landing page? Are we talking a 20-person team with VC? The answer is different for each case, both because of the money available, but also because of how much that design will end up being used. A landing page that might never lead to a product shouldn't cost you $1,000.

I haven't had much experience on the later stages of a startup, but I have built a few products to the beginning stages. Early on, I made the mistake of building the product without a design first thing. I figured, if it gets good feedback, I can alway redesign it. Instead, what I would do today if I were building _any_ product is go buy a template for $50, and work off that. Saves a lot of redesign time (which is harder to do, since you've already got legacy code). Also, gets you the "good design first impression" right off the bat, which will lead to more accurate results when you need them the most (since you really don't know if the product will be a success or not).

For a landing page, which you should do before building a product (unless the product is _really_ simple), I've recently learned the best way. Go to WooThemes.com or ThemeForest.com, buy a WordPress template for $70, and it will make setting up your landing page a Wysiwyg experience, which is much better. Even if you're a programmer like me, trust me on this, using WordPress will make things smoother, and the design will be better for it.

As for an actual startup with an actual product (and money in the bank), I wouldn't even think twice: hire a designer.

</comment><comment><USER9> No.

...assuming the startup is bootstrapping. Why?

1) Ugly designs are often very effective. 2) You can polish it later when you're making money.

Your site might look amazing. Your site might look crappy. If no one knows about your site or no one cares, then it doesn't matter either way.

Focus on traction for the product or service you're providing, then worry about the design of your letterhead, business cards, shiny web 2.0 logo, etc.

<comment><USER10> Can you explain number 1 please?

I'm hoping it's true because I'm bootstrapping an app that's on the ugly side. I've been told the product and workflow are solid but that the amateur design will hurt conversions. It's a B2B product. Personally I think the ugly design will filter out some tire-kickers (which is good because the product is somewhat compute-intensive) but anyone who knows they need the product will not be deterred. Of course I could be biased.

I'd like to add that I don't intend to keep it ugly, but I'm hoping to see some revenue first.

<comment><USER11> examples of #1 - craigslist and plentyoffish

<comment><USER12> Anecdotes do not equal proof. I agree that ugly design can help certain businesses (think landing pages) but wouldn't use a couple of examples as proof of this (mainly because the opposite is likely to be more accurate).

</comment></comment></comment></comment><comment><USER13> "Worthwhile", I don't know. I guess it depends on what your product is supposed to do.

My product is <http://smallpayroll.ca>, it's a do it yourself payroll site made for people who don't know anything about payroll. I freely admit it looks like crap. But of the handful of people that have tried it out and paid for it, I haven't heard "this looks like crap". What I hear is "this product makes my life so much easier"

Could I get more conversions with a better design? Maybe... But I know for my product it's not preventing me from getting paying customers.

(As an aside, I've often thought there should be a place for people like us to find designers that know how to work with applications instead of just designing web pages.)

<comment><AUTHOR> Your design definitely doesn't fall into the "looks like crap" category. These sites fall into the "crap" category:

<http://www.mylanguageexchange.com/>

<http://www.sporcle.com/>

Your site strikes me as in the "good enough" category. The design isn't anything special, either good or bad. This means that there is nothing bad about the design to bring your product down and I think it also means that the law of diminishing returns may apply to putting resources into making the design better.

</comment></comment><comment><USER14> Yes, definitely. A well-designed and aesthetically pleasing site adds instant credibility, especially for people who are non-technical (i.e., the people who often make the final buy/no-buy decision).

And it's rare for a strong systems or web back-end programmer to also have a good design sense and to be versed in the various rendering quirks and workarounds for the common browsers.

Note that it doesn't mean you have to hire a full-time designer. A lot of designers are freelancers, and like it that way.

37signals' Sortfolio (<http://www.sortfolio.com/>) lists a lot of independent designers for a range of budgets.

</comment><comment><USER15> Yes. Shop around just like anything else.

But, you'll be even better off if you have someone with good design skills working for you if you plan to be able to do revisions, ongoing changes.

I worked for a small company that outsourced some design for logo, but ended up hiring someone full-time to do photography and design. It was a bold step since they were a telecom company, but the polish and sheer amount of the work by having someone in-house differentiate them from their competitor.

At first I thought they were foolish (for years actually), but now that he is still working there, and seeing where they are, it was sheer genius to have hired him.

</comment><comment><USER16> I think finding a good designer willing to work on your project is the most difficult part of the whole project.

Focusing on what you do best (programming) and subcontracting what you do worst (design) leads to a great product imho. If you end up doing both, you'll eventually lose motivation because you'll never get satisfied with your own designs (you are not a designer after all). Not to mention that you'll be shifting focus back and forth between design/programming, and each one requires a different kind of focus and way of thinking. The end product if it sees the light? Mediocre at best.

</comment><comment><USER17> well you do need a good design, the web has matured...if your site looks like crap people will leave.

but you don't need a designer for that.

1\. istockphoto gets you a ton of illustrations that you can use to spice up your pages.

2\. 99designs gets you a good logo or any other custom work you need. Some people will knock 99designs...and yes the quality may be worse than one you'd get from a top of the line designer. But it'll be miles ahead of what you can achieve on your own, and you'll get to avoid paying thousands for a logo.

from my experience, a single illustration can turn a boring and bland page into something that's decent.

<comment><USER18> The real issue with sites like 99designs isn't the quality (though it IS mostly terrible), it's the _consistency_. If you're getting a bunch of different designers to design you something over their lunch break with no interest in or knowledge of your company/goals, you're gonna get something different every time.

Seriously, skip the kids at 99designs and hire a local freelance designer. Maybe you can get lucky and guarantee them [X] number of hours a month in exchange for a lower rate.

<comment><USER17> you are forgetting that we are talking about a startup here...they can't afford $12K for a designer.

And who cares about consistency..it's just something to use for a few months until the site gets profitable to get someone good. You just don't want something that looks like crap. And you can always just use the one person whose design you picked for more work.

And it's not like you are guaranteed good stuff from a local designer...plenty of them are worse than the "kids" at 99 designs.

<comment><USER19> I think if you actually screen who you hire you will find someone who cares about their work, is talented, and will understand you are a start up and charge accordingly.

</comment></comment></comment></comment><comment><USER20> If you're building a search engine, better get a UX guy.

If you're building a photo sharing site, better get a UX guy.

If you're building a social app, then hell yes, get a UX guy AND a designer.

<comment><AUTHOR> Thanks. Would you mind elaborating more on the difference between UX and design? And how each can help a startup achieve its business goals?

<comment><USER2> We have both roles in our company -

A UX designer is largely focused on how things work. If I press "X" button what happens? Should the input method for this app be a number pad or a scroll wheel? etc.

A graphic/visual designer is focused on how the app looks. What are the feelings this app is trying to evoke? Does it have a rough "hacker" look or is this something Martha Stewart devotees would like?

These are rough generalizations along a spectrum. Some UX designers are more product manager types, interested in specifying features and high level behaviors leaving implementation level wireframes to a designer or engineer. Some graphic designers also like to get involved in the feature selection/design. It really varies by person, but its important to understand what you need before you hire. Nothing worse than trying to get slick graphics from someone whose passion is task analysis or strategic input from someone who loves polishing pixels.

</comment></comment></comment><comment><USER21> I'm a designer myself, but I'm confused at what the question is asking.

A designer can be many things. You can hire an interaction designer. You can hire an interface designer. You can hire a website designer.

I am going to assume you are speaking about an interface/web designer. Yes is the answer. When it comes down to it, your end users are probably going to avoid your service if they don't think it looks good. The amount of traffic you'd gain with a good design easily justifies the price of hiring a good designer.

Now, the other thing is the word 'professional'. Professionals are very expensive. You're talking at least 10 thousand dollars for a decent project. If you go with someone who's a student or the like (cough), you'll get a better rate, but you won't get the timeline that a startup might need. There's the other issue. If it's not going to repay itself in traffic easily, then it's not worth it. In most cases, will it? Of course.

The other option is DIY. If you take some time and learn your shit, you can usually do something that doesn't look half-assed.

Now, moving on to the HTML bit. I do both. Many designers do both. Plain and simple: if you don't know markup, you shouldn't make mockups.

</comment><comment><USER22> Disclosure: I am a designer.

 _YES._ The value that a design has in a first impression helps with that first bit of traction so _so_ much. I've had projects fail because of crappy designs, and crappy projects succeed because of - subjectively - great ones.

Invest, it's not even that much compared to some of your other costs. Look into students (like me!) who may need the money and the recognition, though don't abuse them.

</comment><comment><USER23> Yes-ish. If it takes too much of your time to produce anything that looks/feel reasonable, then hire one. If you think you can get by doing it yourself, then make it so. If you have enough chops to get by, but don't know where to start, yes - then start tweeking stuff yourself.

try to stick to something simple and clear that lets users know what they're doing next.

</comment><comment><USER24> It depends on stage and context of product. In the earliest days, I think whoever owns "customer development" should also own the UX. It doesn't need to be beautiful, just good enough (that's where context of product comes in -- it defines "good enough" -- a product for engineers will have different requirements than one for grandparents).

The trouble with using free time from a friend is 1. by being free, it is harder to give blunt feedback; 2. by being a favor, you are beholden to their schedule, and can they really keep up with your pace of iteration and learning based on customer development? It can put strain on friendships.

So in the earliest days I say try to DIY unless you really don't have a design bone in your body. Use paper and Balsamiq to sketch, and examine what you like and dislike of comparable products.

You can always hire a professional designer later to come in and help once you feel confident that you are close to the right product for the right customer.

</comment><comment><USER25> Definitely.

A designer does more than just make pretty pictures.

Ugly or not (the art, not the designer), a designer actually will help design the usability of the site at the same time so that you _can_ grow.

A good designer knows where to put the little calls-to-action and the email signup forms and all that so that you can meet your business goals.

It's definitely worthwhile to get a professional designer.

</comment><comment><USER26> If you want people to start taking you seriously, then YES!

I have been turned off on a number of occasions by the lack of a professional design.

You could probably scrape by, by getting a free theme from the intertubes, but what about your logo/branding.

Go to your local college and post something for a design job. You will get a ton of replies and it probably won't cost you that much.

</comment><comment><USER27> <plug>I hired some pro designers for my site: <http://www.hobsonfiles.com> </plug>

One thing to keep in mind: No matter how good your design is, it is no match for an ugly site with a really useful feature..

</comment><comment><USER28> I'd like to know the answer to this also, but after reading the comments I'm still clueless.

Maybe this will help - Has anybody dared to do any A/B testing on professional vs "unprofessional" design?

<comment><USER29> This is a complicated question.

I know of a direct-response guy who had horribly ugly sales pages that literally included misspellings. He tells this story about how all kinds of marketing consultants and designers would come in and say, "Your sales page is so ugly! You need a redesign." He would laugh and say, "Everyone says that. But I have data from the last 5 years, and this is the single best-performing page of all." He made $25m last year.

Sophisticated direct marketers are not to be trifled with.

However, if you're building a company that depends on other non-direct factors like brand, you can't really A/B test that. You just have to make a decision.

A few years back, I met a guy whose girlfriend worked on the optimization team at Amazon. Now THEY are sophisticated. They knew how A/B tweaks would affect users several months later. But even still, Amazon often makes strategic decisions that can't always be justified with data.

Bottom line: It's important to know the advantages and disadvantages of various types of marketing, including direct/brand/etc. But you will have to make some tough choices.

Personally, on my sites, I've seen lots of interesting results with testing designs...but I finally told my staff to stop micro-testing since we'd optimized the hell out of some of our stuff and were only getting incremental gains (e.g., going from 35% opt-in rate to 39% is prohibitively difficult). The biggest results I've gotten have been from strategic changes like changing the offer, adding a new product, pricing changes, back-end offers, deeper customer research, etc.

<comment><USER30> Well said Ramit. There was a great interview of Jeff Bezos by the now defunct Portfolio Magazine in which they asked him how important A/B testing is to Amazon's success. He said it was important but that still many decisions, such as launching the Kindle, need to "come from the heart".

In this age of analytics, I think a lot of small startups are overlooking the gut decisions they need to make and focusing too much on optimization (e.g. this HN question).

<comment><USER31> This might not be the interview referenced above (kinda brief). Wired acquired Portfolio's content? Or was it their progeny?

"Portfolio: Are you always extremely methodical about major decisions?

Bezos: With business decisions, yes. With personal decisions, I find that my methodical nature can confuse me, and so I think more about personal decisions, like what job you really want to take or whom you want to marry. Although I did have criteria for that...

Portfolio: What's a gut call you made?

Bezos: Amazon Prime. It's an all-you-can-eat buffet, $79, that gives you free two-day shipping on everything you buy for a year. When you do the math on that, it always tells you not to do it.

Portfolio: One of your big initiatives, a search engine called A9, fell flat. What happened?

Bezos: If you decide that you're going to do only the things you know are going to work, you're going to leave a lot of opportunity on the table. Companies are rarely criticized for the things that they failed to try. But they are, many times, criticized for things they tried and failed at."

[http://www.wired.com/techbiz/people/news/2008/05/portfolio_0...](http://www.wired.com/techbiz/people/news/2008/05/portfolio_0522)

</comment></comment></comment></comment><comment><USER32> Yes, but get one you can trust. If you're just starting out, try to find someone local that you can work with. Look at what they've done before and try them out on something small. Most local designers will quite happily do a small project a month for you, which will ease your burn rate.

For web sites for a startup, Themeforest is the way to go. A small amount of cash gets you a theme that you can use for your MVP, redesign once you're profitable and know how much you can spend.

</comment><comment><USER33> Actual user review I once received - "Even though I could not start your program on my Windows 98, I still give it 4 out of 5 stars, because it looks awesome" (on screenshots).

So, yes, design matters :)</comment>


BMW refusing to abide by terms of GNU Public License - <AUTHOR> https://twitter.com/duncan_bayne/status/705244093702471680 <comment><USER2> I think you simply hit someone from [oversea] sales / customer relations who has no idea about licenses or probably software at all and thinks he does the right thing. I'm pretty sure there is someone at BMW who knows about it (the industry is aware of licensing issues in general) and that there should also be a process installed through which they can fulfill the license requirements. Usually this involves that the actual device manufacturer / software supplier is tasked with providing all the necessary information.

Getting the correct contact in large corporations is usually a nightmare - especially for individuals. Some companies in the industry have information about licenses or about ways to retrieve the necessary information on their websites, but I don't know about BMW.

Of course that shouldn't be an excuse and they clearly acted wrong on your request.

If you are more interested on the technical side and less on the legal side of the request then I think you won't miss much anyway. All of the GPLed software components will be used as much unmodified as possible (will probably be the Kernel, glibc and some open source daemons). And the actual car related parts will not be linked to them and stay closed source.

</comment><comment><AUTHOR> Sorry, I really should have included the text of BMW's refusal. It's here:

[https://gist.github.com/duncan- bayne/fc3213d4a0eabb70bb1e](https://gist.github.com/duncan- bayne/fc3213d4a0eabb70bb1e)

I've also replied to my own tweets with that link. Apologies for the communication fail on my part, and thanks to HN mods for resurrecting this submission.

</comment><comment><USER3> Actual article: [https://shkspr.mobi/blog/2016/02/bmw-are-sending-their- softw...](https://shkspr.mobi/blog/2016/02/bmw-are-sending-their-software- updates-unencrypted/)

<comment><USER4> the article is just about finding GPL licensed software. not about their refusal.

<comment><AUTHOR> Yes - I'm sorry for not linking the full text of the refusal that I received after contacting BMW about the software mentioned in the article.

The full refusal is here: [https://gist.github.com/duncan- bayne/fc3213d4a0eabb70bb1e](https://gist.github.com/duncan- bayne/fc3213d4a0eabb70bb1e)

<comment><USER5> The meaty part:

> I have confirmed with our technical department who advised that to access > the software download site the BMW Customer must provide the 7 digit VIN and > accept the usage rights agreement. Part of the usage rights agreement states > that the software is protected by copyright and BMW is the sole owner. So in > this case it is not subject to the requirements of a "Public" licence.

Which means that a user must prove they really are a user by inputting the digit code before getting to the code. Which is in line with the GPL.

There is a 2nd, more real problem though: "the software is protected by copyright and BMW is the sole owner". This is wrong, this is where BMW makes fraudulent claims. From the license text:

> You may copy and distribute verbatim copies of the Program's source code as > you receive it, in any medium, provided that you conspicuously and > appropriately publish on each copy an appropriate copyright notice [and > disclaimer of warranty]

</comment></comment></comment></comment><comment><AUTHOR> An update on this: a BMW staff member has emailed me to say that BMW understands Copyleft, and that he's looking into the matter. I've put him in touch the with the chap who made the initial discovery, and the Free Software Conservancy. Hopefully they'll sort it out between them.

</comment><comment><USER6> No offence, but a link to your own tweet, not something in writing from BMW is hardly worth discussing?

<comment><AUTHOR> My bad. Link posted, sorry for the very poor communication.

</comment></comment><comment><USER7> Where do they refuse? It seems at best they are just getting called out on it. Time to lawyer up.

<comment><AUTHOR> Called out and then they refused. I called the Melbourne head office, and they verbally refused, and at my request put the refusal in writing: [https://gist.github.com/duncan- bayne/fc3213d4a0eabb70bb1e](https://gist.github.com/duncan- bayne/fc3213d4a0eabb70bb1e)

Really not cool. I'd expected cluelessness (like Telstra with the T-Box) not arrogant refusal.</comment></comment>