Attempt to Reverse a $55 Million Ether Heist - <AUTHOR> https://www.bloomberg.com/features/2017-the-ether-thief/ <comment><USER3> Thief?

He strictly followed the terms of a contract by people who were very clear that "code is law" and who did not want institutions were the result is decided by human judgement.

<comment><USER4> Can we do an experiment and use 'she' for anonymous players in these stories? Would be kinda cool. The article uses 'he' throughout, and only acknowledges the possibility of it being either/or/group in the final paragraphs.

<comment><USER5> What's wrong with he? I think one can choose one or the other, and the author chose he. There's also the alternative of using he/she every time, but I think that would just be annoying.

<comment><USER6> Attempting to expand on context that I think the parent left implicit:

\- Women are underrepresented — in STEM fields at large and in the cryptocurrency space in particular — relative to a fairer world with less sexism, outmoded notions of gender roles, etc.

\- This underrepresentation self-perpetuates partly because well-meaning men in these fields don't realize it's happening: it always feels better to believe a happier story about the world being more fair, and such men have less data about what keeps women out than they would have in a fairer world where women were more present to tell their stories.

\- Erring on the side of feminine or gender-neutral pronouns — against this backdrop of under-representation — is a lightweight way to signal basic awareness of these issues and avoid the appearance of reinforcing them or believing they should be reinforced. As such, it informs my general model about the writer's thoughtfulness/sensitivity, which has some bearing on how compelling I find their argument to be.

It also bears noting that while I can mostly shrug and move on if a writer is implying apathy (or worse) about this issue, it is a more acute and even threatening signal for some women whose careers/lives have been damaged by these playing fields' having never been level, and it is morally fraught to participate in and benefit from discussions/community/resources that are effectively/unfairly off-limits to under-represented groups.

tl;dr:

\- default-masculine-pronouns are not neutral,

\- we've all been tacitly made to think that they are,

\- some work to counter that makes sense, and

\- it's good to push conversations/awareness about them because the default perpetuates them.

<comment><USER7> I discovered this article a while ago:

Avoiding Sexism in Legal Writing—The Pronoun Problem

[https://lawyerist.com/49433/avoiding-sexism-in-legal- writing...](https://lawyerist.com/49433/avoiding-sexism-in-legal-writing-the- pronoun-problem/)

It has some solid advice, but it also notes that the use of "he" in sex- indeterminate situations was codified by Ann Fisher, "an 18th-Century schoolteacher and the first woman to write an English grammar book." Now, every time I see "he," I think of her.

<comment><USER5> Good article! As a result I am now aware there are various techniques writers could employ to adopt a gender neutral language. Thanks for sharing!

</comment></comment></comment></comment></comment></comment><comment><USER8> If R2-D2 used Ethereum.

C-3PO: He made a perfectly legal move.

Han: Let him have it. It's not wise to upset a Wookiee (The Ethereum founders).

C-3PO: But sir. Nobody worries about upsetting a droid (a regular contract user without influence). Han: That's cause a droid (regular contract user) don't pull people's arms out of their sockets (hard fork the entire crypto currency and call you a thief) when they lose. Wookiees (The Ethereum founders) are known to do that.

C-3PO: I see your point, sir. I suggest a new strategy, R2. Let the Wookiee (Ethereum founders) win.

With Chewbacca's and the Ethereum founders' behavior, you would be a fool to play their game again thinking that they follow the rules.

<comment><USER9> isn't it a bit disingenuous to say it was just the position of Ethereum founders? People wanted their money back.

It's almost as if some recourse for actions done in bad faith is a useful tool to have as a society...

<comment><USER10> That's not what says [https://www.ethereum.org/](https://www.ethereum.org/)

> _Ethereum is a decentralized platform that runs smart contracts: > applications that run exactly as programmed without any possibility of > downtime, censorship, fraud or third party interference._

<comment><USER11> Among those of us who see some value in smart contracts, there are two camps: those who are realistic about their limits and challenges, and those who have bought in to a massive delusion. This quote epitomizes the latter.

For example, how does 'run exactly as programmed' rule out fraud? Fraud is as programmable as legitimate activity.

For example, if fraud is not possible, then what was the justification for the hard fork?

People who have bought into a delusion find it hard to evaluate evidence - <USER2> example "Van de Sande is eager to move on. "It was really just a blip," he says." So what was all the fuss about? After all, it was just two lines of code, so simple in retrospect, and now it has been fixed, so there's nothing to worry about, right?

Perhaps my favorite quote is ""I'm absolutely amazed. Why has no one traced this back and found out who did it?" asks Stephan Tual, the third co-founder of Slock.it." He is amazed that in one respect, this digital currency lived up to one of their major claimed benefits?

I am also not at all surprised by the 'shoot the messenger' complaints about Sirer's involvement.

The reality is that the verification of software, especially at this scale, is a really difficult problem, and everyone who has bought into the delusion seems to think that someone else is going to do it for them - I doubt that even 1% know how to do it themselves. So much for 'trustless'.

</comment></comment></comment></comment><comment><USER12> "Just as the global WannaCry ransomware attack in May laid bare weaknesses in computer operating systems, the DAO hack exposed the early frailties of smart- contract security and left many in the community shaken because they hadn't found the bug in time. "

This seems like a tenuous connection at best.

</comment><comment><USER13> This case feels so closely to the very interesting case of Aviva France[1], where a not "well-futureproofed" life insurance contract is making a person very rich by the day.

Unfortunately for Aviva, their contracts are actually law in contrast to Ethereum where if the devs feel like it, they can do/revert anything.

[1]: [https://ftalphaville.ft.com/2015/02/27/2120422/meet-the- man-...](https://ftalphaville.ft.com/2015/02/27/2120422/meet-the-man-who- could-own-aviva-france/)

<comment><USER14> Am I missing something? I thought the devs had to have everyone agree to do a hard fork. If the devs were in complete control, that wouldn't have been necessary.

<comment><USER15> If the devs "just reverted anything if they felt like it", people would quickly move to a different fork.

</comment></comment></comment><comment><USER16> > Another decision he made when he had no idea of the bug shows how quirky and > unforgiving code can be. "If the capital 'T' in line 666 had been a small > 't,' that would also have prevented the hack," he says.

Can someone familiar with this explain how something financially based can have a capitalization flaw? I would expect a smart contract language to have very strict type and variable linking. Humans make many mistakes in coding but most of the time it doesn't cost $55m. A transaction language should be very strict so either the smart contract language is flawed or the author of this article is overstating something for dramatic effect.

EDIT: Found this: [https://github.com/slockit/DAO/blob/v1.0/DAO.sol#L666](https://github.com/slockit/DAO/blob/v1.0/DAO.sol#L666)

on a deeper dive: [http://hackingdistributed.com/2016/06/18/analysis-of-the- dao...](http://hackingdistributed.com/2016/06/18/analysis-of-the-dao-exploit/)

<comment><USER17> That's primarily because Ethereum is pure amateur hour. When Bitcoin had built in checksums on addresses, Eth Dev's just said "watch where you send money". They ended up having to later add in a capitalization scheme to serve as a hash.

I have no clue how they managed to fool so many people with poor and shoddy work. But they have so far. And they've fooled everyone that this is a 'hack' even after saying time and again "The code is the contract, and the contract is the code"... Unless lead devs lose money.

<comment><USER18> The 't' vs 'T' has _nothing_ to do with checksums.

`Transfer` and `transfer` are two different functions, one creating an "event" (think a signal on the blockchain) and the other actually transfering tokens.

The true flaw lies in the reentrant attack on `.send()`

<comment><USER19> jesus christ, who the fuck would make two identical symbols differentiated by only capitalisation? (Other than these guys obviously)

<comment><USER20> What, you mean apart from every Unix ever?

(All right, all right, excluding Mac OS X. But it's weird.)

<comment><USER21> That's filesystems, not the OS. There are some extremely good reasons to treat filenames as bags of bytes, which is why Apple got rid of case folding in APFS. Think performance, locale issues, etc.

(And before someone says it, yes, of course performance matters for filenames. Every single stat shouldn't need to worry about case folding.)

</comment></comment></comment></comment></comment></comment><comment><USER22> Is it even illegal to hack Ethereum? Some purists would say the smart contract was behaving as written.

<comment><USER23> The principle of Ethereum is that code is law, the "hacker" followed the law to the letter and acted in a prescribed manner. What's the crime here exactly?

<comment><USER24> The ethereum foundations reaction to the DAO hack proved that the "code is the contract" is not true. Which questions the very value of smart contracts on the ethereum blockchain because it's proven that they're immutable now

This is a good discussion: [https://www.bloomberg.com/view/articles/2016-06-17/blockchai...](https://www.bloomberg.com/view/articles/2016-06-17/blockchain- company-s-smart-contracts-were-dumb)

<comment><USER25> > The ethereum foundations reaction to the DAO hack proved that the "code is > the contract" is not true.

I disagree. The code must also refer to the implementation of the Ethereum clients, and the collective will of the network participants. Those are _implicit_ provisions of the contract, specified in advance. The Ethereum Classic chain still exists, and the thief is welcome to use it. People have simply voted with their feet and prefer a world without the theft. There is no breach of contract, anyone is free to fork the Ethereum network in any way, at any time. It is up to the users to decide how much value to ascribe each fork.

<comment><USER26> I thought the whole point was to do away with "implicit" or "everybody knows" or other human-interpretation/subjective factors?

If the premise is "the code is the contract, period, except we reserve the right to change the contract at any time or even to cause the contract retroactively never to have existed, based on implicit or subjective factors decided by humans and not by code", then it's a very different beast.

<comment><USER14> Except no one reserved that right. The majority of the users agreed to basically create a new currency with the same history, minus the theft /unethical taking of money (if you insist on calling it legal).

<comment><USER26> So "the code is the contract" until enough people decide to unilaterally change the code because they don't like the contract. Which is right back to what I said.

There's no way of framing this that preserves the philosophical purity.

<comment><USER27> There is.

It's the same thing with Communism/Socialism. Communism is the pure end state, utopia, etc.

Socialism is the ugly road there.

Now, of course we know Socialism usually does a 5 minute walk in the park then turns 90 degree at that big pine tree, and when no one's watching puts on the evil hat, and by the end of the hour it's a totalitarian state! No iteration on ideas, criticism is met with GULAG, no education, teachers and thinkers are decadent freeloaders, enemies of Communism, internment, execution, mass murder! You know the drill.

Etherum and other code is law experiments are trying to find the best expression of that "common sense" platform, they are trying to craft the best Constitution for this. "And no true Scotsman claimed that Etherum/DAO is perfect." (This is the part where semantics is fuzzy, as it really depends on who said what, when, how, why, and to whom. But realistically, anyone who claimed to get it right the first time, was too optimistic, _and_ of course, it was "reviewed", [http://piratepad.net/theDAOreview](http://piratepad.net/theDAOreview) [ [https://www.reddit.com/r/ethereum/comments/4hkgsz/a_summary_...](https://www.reddit.com/r/ethereum/comments/4hkgsz/a_summary_of_the_dao_contract_review/) ] and see .. but never audited - [https://www.reddit.com/r/ethereum/comments/4ota1q/the_truth_...](https://www.reddit.com/r/ethereum/comments/4ota1q/the_truth_about_the_security_audit_stephen_tual/) .)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> One thing not mentioned in this article is that the hard fork was only feasible because there was not much else in the way of contracts on Ethereum at the time, other than the DAO itself. If there had been vast networks of interdependent, concurrent contracts and their obligations, as envisioned by many of the most vociferous proponents of smart contracts, I think a rollback would have been impossible, at least in practice. Next time, they may not be so lucky.

<comment><USER28> The success of the DAO performing a 51% attack on Ethereum virtually ensures that Ethereum is useless for other contracts. Your contracts hold no value of they can be rolled back at the whim of the holders of the largest contract in the system for reasons that have nothing to do with your contract.

</comment></comment><comment><USER29> Etherium's fundamental premise -- "code is law" \-- presupposes a general solution to the formal verification of program correctness. This is an unsolved problem (and is likely unsolvable in the complete case).

Put simply, all code has bugs. How can Etherium ever work in practice at scale?

<comment><USER30> > How can Etherium ever work in practice at scale?

Aren't there a to of Bitcoin organizations with hundreds of millions of dollars flowing through them? If these companies found a way to operate safely with manageable risk, through things like cold storage and encryption schemes, than how is it much different from Ethereum?

It's fun to say things like "code is law" and imagine everything happens within this self-contained bubble but this stuff still operates in the real world and there are risks and consequences for actions as well as real world security mechanisms regardless.

<comment><USER11> It works because Bitcoin is only the ledger - the accounting part. All the contractual aspects of the business activity are external to the blockchain, and are handled in the traditional way - through civil law and procedures.

</comment></comment></comment><comment><USER31> Part of the problem is they based this language off of JavaScript _on purpose_ no less. It should be hard to make mistakes like this yet a single capitalization would change the semantic meaning enough to prevent this! Terrible design choices for a financial banking language.

<comment><USER32> SolarNet what makes you think it's based on js

<comment><USER33> Solidity is a contract-oriented, high-level language whose syntax is similar to that of JavaScript and it is designed to target the Ethereum Virtual Machine (EVM).

[http://solidity.readthedocs.io/en/develop/](http://solidity.readthedocs.io/en/develop/)

<comment><USER34> Syntax being similar is not the same as being based on it.

<comment><USER35> For only one specific interpretation of "based on".

</comment></comment></comment></comment></comment><comment><USER36> He was a thief, in the spirit that the money invested in the DAO was never intended to go directly to one individual (i.e. him). It was an error in the contract, as outed by numerous individuals.

Code as law is right, but laws can (and should) change, because the effect they can have can be devastating if loopholes do the opposite of the intention behind the law.

The fallacy here is that we have one immutable law that governs everything, that is set at one time and never changed - how ridiculous. This is utter nonsense.

The DAO was a beautiful experiment that went badly wrong. In the grand scheme of things, if this was a heist in the traditional sense - everyone would have lost out. But as it stands, it's probably the biggest bug bounty in history.

Hopefully no one got hurt. We learn and move on.

</comment><comment><USER37> I don't understand why people keep complaining it was an "injustice" to reverse the transaction. Most people followed the hard fork the reversed the effects of the heist. If it was that unjust, Ethereum Classic would be the major Ethereum fork now.

</comment><comment><USER38> This Post Title Needs Sentence Case, More Words

Ether thief remains a mystery, one year after $55m digital heist

</comment><comment><USER39> This story really needs an ELI5

<comment><USER40> A guy came up with an idea of digital money that doesn't require contracts using "smart contracts", where the code is the law.

The guy went to a bunch of people with the idea and they liked it.

The people talked about it a lot and many more people joined in.

They all pooled their money together to launch this cool money.

Some other guy came over, saw all of this, looked at the code, and used the code to transfer $55M to his wallet.

Arguments about law and contracts ensued.

<comment><USER41> That's all stuff leading up to he hard fork and rollback...

</comment></comment></comment><comment><USER42> So I'm assuming the fork, Ethereum isn't at risk?

At least as far as we're aware.

<comment><USER33> It still and will always be. They have set a dangerous precedence. If another group of large developers decide to revert a certain transaction. They could. The one platform that still has its integrity is ethereum classic

<comment><USER28> But Ethereum classic is still subject to the problems of Ethereum main's amateurish codebase.

<comment><USER33> but the core difference here is there is no precedence set. Especially since classics core belief is immutable transactions. As long as the community has that integrity. Then its safe. but ultimately. It is a consensus based system. So its not to say its not impossible

</comment></comment></comment></comment><comment><USER43> Is Etherium not formally proven? One would think that would be a check box among many things for a financial interchange system...

<comment><USER11> It is not even close. Nor is any other financial interchange system, but they have external checks, balances, and a formalized way to correct errors.

</comment></comment><comment><USER44> That page is virtually unreadable. Why the fancy CSS, Javascript and fonts?

</comment><comment><USER45> Are there any terse explanations out there of the DAO bug?

</comment><comment><USER46> Isn't Bruce Wanker the hacker? [https://youtu.be/_O5fdMFKEC0](https://youtu.be/_O5fdMFKEC0)

</comment><comment><USER47> > ". Over email, he said, "We might be up the creek ;)." Later, when Gün > pointed to the error in line 666, Daian replied, "Don't think so."

well, isn't the financial law against this kind of incompetence in the first place?

I don't think the thieves would be guiltier than the team behind DAO.

ps: and line 666??? who the hell keeps a single source-code file that big? no wonder bugs are around...

<comment><USER48> > who the hell keeps a single source-code file that big

Me. SQLlite. .NET's garbage collector. CPython's eval. Lua's lexer. xinit. dwm. These are off the top of my head that I've seen

[https://raw.githubusercontent.com/dotnet/coreclr/master/src/...](https://raw.githubusercontent.com/dotnet/coreclr/master/src/gc/gc.cpp)

[https://github.com/catseye/Befunge-93/blob/master/src/bef.c](https://github.com/catseye/Befunge-93/blob/master/src/bef.c)

[https://github.com/rust- lang/rust/blob/master/src/liballoc/v...](https://github.com/rust- lang/rust/blob/master/src/liballoc/vec.rs)

[https://github.com/oxyc/luaparse/blob/master/luaparse.js](https://github.com/oxyc/luaparse/blob/master/luaparse.js)

Yep. Pretty troll comment. Felt like taking the bite today. I'm going to get back to getting my lexer past 1000 lines today: [https://github.com/serprex/luwa/blob/master/rt/lex.wawa](https://github.com/serprex/luwa/blob/master/rt/lex.wawa)

<comment><USER49> I think big source files have their place. Single procedure view is about the only thing I miss in today's Visual Studio (was a thing in VS6).</comment></comment></comment>


GUIDs are globally unique, but substrings of GUIDs aren't (2008) - <AUTHOR> https://devblogs.microsoft.com/oldnewthing/20080627-00/?p=21823 <comment><USER2> Note that this is about the old version that leaked your mac address, the new version is mostly random. Anyway, truncating it is not a good idea.</comment>


Ask HN: Which skills do you think a front-end developer should have? - Ocho-Bits

I'm starting my developer career in this area, I'll love to hear some opinions from you guys.  What should I learn? Know?<p>Thanks. <comment><AUTHOR> Designing w/ Web Standards, 3rd edition by Jeffrey Zeldman

Dom Scripting by Jeremy Keith

Eloquent Javascript by Marijn Haverbeke - <http://eloquentjavascript.net/>

Learning JQuery by Jonathan Chaffer

"Dive into HTML5" by Mark Pilgrim - <http://diveintohtml5.org/>

"CSS - The Definitive Guide" by Eric Meyer

"Javascript - The Good Parts" by Douglas Crockford

</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>

Those should pretty much cover everything you must know if you are starting now. Start with Zeldman's book first and end with Crockford's book, besides that go ahead and choose your own adventure by reading the rest in any order you want.

While you will probably get more practical usage out of reading Learning JQuery before DOM Scripting, I think you will get more value out of Learning JQuery if you read DOM Scripting first.

<comment> Ocho-Bits Great suggestions. Thanks!

</comment></comment><comment><USER2> Write a video game using JavaScript/Canvas. Game programming is the fast track to becoming a great developer because of the mix of skills it requires (math/algebra, animation, graphics, sound, resource management, testing and debugging).

And don't cheat by using some fancy pants game engine.

<comment> Ocho-Bits Great idea! I'll always wanted to write a video game and also learn canvas.

</comment></comment><comment><USER3> Start with basic HTML/CSS knowledge, understand the CSS/DOM rendering differences between browsers. Learn jQuery, and JavaScript in general.

Understand the DOM, and how traversing in jQuery/JS works. Understand and learn how to debug JavaScript, and CSS rendering.

</comment><comment><USER4> A scripting language (PHP,ASP,Python,etc), sql, html, js, css. And the best way to start learning is to start doing projects, smaller at first, then bigger and bigger. You can try doing some project with something that you need.</comment>


Which color best represents an entrepreneur? - <AUTHOR>

A friend of mine, who is a designer asked me this question.
Actually we are trying to make a universal icon/logo to represent entrepreneurship or e.g a CEO's blog.
So this question just came out. <comment><USER2> Good entrepreneurs need to stand out and attract attention, but they need to do it in a way that holds attention and interest. Maybe sky blue, but I think you need to look beyond a single color

</comment><comment><USER3> This may be unhelpful, but I think the color that best fits the question is plaid.

Just as you may say plaid is not a color, you may tell an entrepreneur he can't do "that", but he will.</comment>


Show HN: Codeless API Integration Testing on Travis CI Using Assertible - <AUTHOR> https://github.com/assertible/python-example <comment><AUTHOR> Blog post: [https://assertible.com/blog/how-to-run-api-integration- tests...](https://assertible.com/blog/how-to-run-api-integration-tests-on-ci)

The "Codeless" part is of course referring to the tests themselves, which are defined in Assertible.

Basically, ngrok is used to create a dynamic localhost tunnel to the web app which is built and run on CI. The dynamic ngrok URL is passed to an Assertible trigger which will run the API tests when executed.

Using this method allows you to reuse the same tests for monitoring and testing deployments.</comment>


The Billion Dollar HTML Tag - <AUTHOR> http://www.datacenterknowledge.com/archives/2009/06/24/the-billion-dollar-html-tag/

<comment><USER2> I always find this peculiar when google says they found users were doing fewer searches when they increased the # of results on the serp to 20 or 30. Maybe when a user sees more results they find what they were looking for more quickly, and so don't have to do another search. Yet google always turns this around and says this is bad because users do fewer searches. I guess from google's perspective, revenue-wise, it's bad. But from a user's perspective, it's good. Do no evil?

<comment><USER3> I don't think that hitting the 'next page of results' counts as a search. And whether they display 10 results initially forcing the user to hit 'next' twice to see all 30 results instead of just displaying 30 results outright... the search result set is still the same. If those 30 results don't contain what the user is looking for, they will still have to perform another search.

I guess this is assuming that people don't just re-search with different terms if what they are looking for isn't right there on the first page.

<comment><USER4> > I guess this is assuming that people don't just re-search with different > terms if what they are looking for isn't right there on the first page.

Which I do all the time. I don't dispute that faster=better, but I have always been skeptical of Google's claim of just how much better.

</comment></comment></comment><comment> brown9-2 "Mayer consulted the W3C HTML specs and found a tag (the align=right table attribute) that would allow the right-hand table to load before the search results, adding a revenue stream that has been critical to Google's financial success."

Is there any way to independently confirm that she was the one who consulted the spec and made this discovery? Because otherwise it sounds an awful lot like an executive taking credit for the work of someone underneath them.

<comment><USER5> It could also be a journalist sloppily attributing the work of someone underneath her. Also, though, she's pretty technically deep; she was doing AI before she started doing usability at the big G, and it wouldn't be at all surprising for her to come up with an idea like that, especially given that we're talking about a time when Google was a small company (this was when they were first adding AdWords; would have been in 2000 or 2001?)

Under some circumstances you might argue that there's more leverage in an executive like Marissa delegating work like this to someone else. But maybe sometimes the raw brainpower you bring to bear on a technical problem can really make a billion-dollar difference.

</comment></comment><comment><USER6> _They actually found a way to draw the Google checkout cart using HTML_ \- how would they do that?

<comment><USER7> The solution this article references was basically a table with 1x1 cells that had their background colors set via CSS classes. I was on the team with the guy who did the hack when I was an intern. That was about three years ago.

At some between then and now, Google actually went back to using a real image for it, and now it looks like it's just a CSS sprite.

</comment></comment><comment><USER8> /me waits for PB to tell us how it really happened.

</comment><comment><USER9> A similar example is how Google renders the histograms on the Google Stock Screener - they use tables instead of an image.

<http://www.google.com/finance/stockscreener>

</comment><comment><USER10> I don't believe Google would have been out a _billion dollars_ if the ads had been on the left instead of the right.

<comment><USER11> Tell that to any AdSense publisher who has increased revenue 20-30% by moving ads a few pixels left or right, or by swapping the link color from one shade of blue to another. There are plenty. And Google is the ultimate AdSense publisher :)

<comment><USER12> There are plenty? Please cite sources. 20-30% improvements sound too good to be true for such minor alterations.

<comment><USER11> It's pretty much universal with AdSense. If you know anyone who makes a significant amount of money, ask them about it. Or just browse the AdSense board on WebmasterWorld.

I have personally increased revenue by over 100% by making small color and positioning changes, and this is also fairly common (I cited 20-30% because I wanted to be super-conservative in my claim).

But here are some examples:

From Google's official blog: Removing a border from an ad doubled revenue to $650/day:

[http://adsense.blogspot.com/2006/05/unobtrusive-ads-can- boos...](http://adsense.blogspot.com/2006/05/unobtrusive-ads-can-boost- revenue.html)

Palette swap doubled clickthrough: [http://www.cyberindian.com/web- marketing/article.php?article...](http://www.cyberindian.com/web- marketing/article.php?article_id=82)

Webmasterworld thread: Most people did not disclose percentage, but some did (85% increase, 100% increase, etc)..

<http://www.webmasterworld.com/forum89/14556.htm>

There are endless examples.. just Google it.

</comment></comment></comment></comment><comment><USER13> The billion dollar tag should be <resources>

A way to include external resources in html (images, audio, video, etc) in order to make a single file, which can be downloaded as a single file (same as MHTML, MAFF, etc but without the hacks)

I hope it gets considered and included in HTML6

Implementation:

\- place it after the html closing tag to unclutter the file:

\- use it from any html tag <img src="url(#myimg)"/>

      </html>
      <resources>
        <resource id="myimg" content-type="image/jpeg" encoding="base64">...</resource>
        <resource id="x0" type="stylesheet" content-type="text/css">...</resource>
        <resource id="x1" type="script">...</resource>
        <resource id="x2" type="font">...</resource>
        <resource id="x3" type="audio">...</resource>
        <resource id="x4" type="video">...</resource>
        <resource id="x5" type="object">...</resource>
        <resource id="x6" type="embed">...</resource>
      </resources>

<comment><USER14> That's a horrible idea and totally destroys the scalability of the web because it destroys effective caching.

That every resource has it's own url and is downloaded separately is not a mistake that needs corrected, it's what makes the web scale and it was done that way on purpose.

<comment><USER13> I am talking about "Save As..." one html file.

Take a look at your browser's File menu, and save this page as one single html file.

Open that file in any editor and take a look inside it.

Do the same for every browser out there, and then, only then, you'll understand my point.

<comment><USER14> Ah, you weren't very clear then, that's not at all what it looks like you're saying.</comment></comment></comment></comment>


Using the Chrome OS Graphics Stack on Intel-Based Linux Desktops - <AUTHOR> https://01.org/blogs/joone/2018/using-chrome-os-graphics-stack-intel-based-linux-desktops <comment><USER2> The title doesn't give justice to the content: it's about zero-copy texture upload in Chromium's Ozone-GBM when used on Intel integrated GPUs.

<comment><USER3> I'd be curious if having to upload textures is just a feature that's a hold- over from a history discrete desktop GPUs.

Videogame consoles have been doing "zero-copy" textures since they existed(except if you're on the PS3, but we won't go there). You also have things like EGL_image_external[1][2] that get you the same thing in OpenGL ES.

[1] [https://www.khronos.org/registry/OpenGL/extensions/OES/OES_E...](https://www.khronos.org/registry/OpenGL/extensions/OES/OES_EGL_image_external.txt)

[2] [https://community.arm.com/graphics/b/blog/posts/eglimage--- u...](https://community.arm.com/graphics/b/blog/posts/eglimage---updating-a- texture-without-copying-memory-under-android)

<comment><USER4> Note that even if you share DRAM with the graphic chip, you may take an extra step anyway to rearrange the texture in a tiled format since it's more efficient for sampling.

If you really care about load time you can decode the image directly in a tiled layout in software but that's more annoying.

<comment><USER3> Yup, in games we used to call this "asset cooking" where you target the platform specific texture compression in addition to tiling that you get as a part of that format.

You get a nice 3-6x memory savings plus put less pressure on the texture samplers as memory bandwidth drops as well.

</comment></comment></comment></comment><comment><USER5> Off topic: Wow, that domain name.. I wonder how long Intel has been holding on to that one? (No pun intended... Well, sorta).

<comment><USER6> Also off topic: I spy a Leopold FC660! Been interested but couldn't justify the price.

<comment><USER7> Totally worth it if you like Topre.

</comment></comment></comment><comment><USER8> Are there any performance benchmarks comparing ozone-gbm vs ozone-wayland ? It seems that the implementation that the article talks about is moot if the Wayland implementation has near equivalent performance..since the hardware layers are abstracted out.

In which case, this is only relevant for architecture that Wayland does not target. Most Intel desktops are supported by Wayland.

</comment><comment><USER9> > Hardware overlay is not only for video, but also for rendering Android > applications that run on a hardware overlay plane, such as the Wayland > client of Chrome OS.

What?

What is a "Wayland client of Chrome OS" and how is it an Android application??

<comment><USER10> That sentence is quite confusing, to my knowledge a better explanation would be:

"The Android compatibility layer of Chrome OS implements a Wayland client to run on a hardware overlay plane."

based on information from [https://www.phoronix.com/scan.php?page=news_item&px=XDC2016-...](https://www.phoronix.com/scan.php?page=news_item&px=XDC2016-ARC- Wayland)

<comment><USER9> Ah, so the Chrome OS UI, which is running directly on GBM/KMS, became a Wayland compositor just for the Android compatibility layer?

(Oh, and for the recently announced Linux desktop apps support maybe?)

<comment><USER11> The Wayland compositor was added to the Chrome OS UI to support Android, but it was very convenient for us to glob onto that for the Linux desktop apps support.

[https://chromium.googlesource.com/chromiumos/docs/+/HEAD/con...](https://chromium.googlesource.com/chromiumos/docs/+/HEAD/containers_and_vms.md#Can- I-run-Wayland-programs)

</comment></comment></comment></comment><comment><USER12> Awesome! I had played around with this code as well on Rockchip systems. Great to see the stack running on Intel.

<comment><USER13> How far did you get with Rockchip. I consistently ran into kernel/userspace driver version mismatches.

<comment><USER12> Google has all their code open, but the rockchip and MALI drivers must match Kernel version. Not much is out there, but hav you checker this?

[https://github.com/rockchip-linux/libmali](https://github.com/rockchip- linux/libmali)

<comment><USER13> Yes, those are the userspace drivers I was using. r1300 and r1400 are older than either the gru or mainstream kernels. It's a moving target, and rock chip hasn't been keeping up.

<comment><USER13> [https://github.com/rockchip- linux/libmali/issues/20](https://github.com/rockchip-linux/libmali/issues/20) was my ticket

</comment></comment></comment></comment></comment><comment><USER14> How is this compare to Mozilla's Servo approach?

[https://servo.org/](https://servo.org/)

From the simple block diagram and benchmark, servo seems to be better?

Servo claims 500 fps.

This only shows 22-48 fps.

Anyone have good technical explanation on the difference?

<comment><USER15> You're comparing apples and tigers.

Intel's work is focused on the lower layers of the graphics stack, and removing the inefficiencies of older (X11 for example) architectures.

Servo is for rendering HTML, that is, taking HTML markup, and displaying the paragraphs, tables and whatnot graphically. So it is operating at a higher level.</comment></comment>


AWS just proved why standards drive technology platforms - <AUTHOR> https://techcrunch.com/2017/08/09/aws-just-proved-why-standards-drive-technology-platforms/ <comment><USER2> We've come a long way if Linux-only features are considered a standard. I'm all for container standardization, but was rather expecting to hear about how AWS/AMI basically implementing POSIX.</comment>


The Canadian Mincome Experiment of 1974-79 - <AUTHOR> http://www.huffingtonpost.ca/2014/12/23/mincome-in-dauphin-manitoba_n_6335682.html?utm_hp_ref=canada-business <comment><USER2> This seems very different from basic income discussed today. What they essentially describe is an expanded need-based assistance program. US provides a tax credit for very low income that essentially results in negative tax.

The Swiss referendum called for unconditional payment. To me, the unconditional nature is the preserving factor that incentivizes people to earn more, while knowing they are protected. A needs based system results in fear of losing what little you have. Low income housing in extremely desirable areas works in similar manner and traps people, instead of incentivizing them to seek higher paid employment because that higher pay will make them not qualified for the subsidy, yet not able to afford the area.

<comment><USER3> The idea of unconditional payment is interesting, and I'm almost on board, but...

1\. Is it tax free? If not then it's not equal right?

2\. How do you avoid it simply translating into inflation / lower dollar?

3\. Does it save money elsewhere to pay for itself, or are taxes increased?

<comment><USER4> Most suggestions involve increased taxes.

<comment><AUTHOR> Yes, although generally up to at least mid middle class, the basic income would offset the increased taxes, so you would end up with at least as much take-home. High-income earners would most likely end up paying more though. (I would argue that the societal benefits would be well worth it.)

</comment></comment></comment></comment><comment><USER5> Not shocking because this is HuffPo, but this isn't a good article, and I suspect it's because Mincome (minimum income) did not really provably work (I'm not saying it didn't work, I'm saying there isn't data showing it did).

The article is filled with anecdotes of people who appreciated having extra money given to them by the government (shocking). The only time it actually get's close to examining the big picture is here:

 _In 2011, Forget released a paper distilling how Mincome affected people's health using census data. She found overall hospitalization rates (for accidents, injuries, and mental health diagnoses) dropped in the group who received basic income supplements._

AFAICT it did not examine whether or not this made the Mincome project "worth it."

So there's nothing here really, or maybe there is, but not in this article.

<comment><USER6> This seems to come up now and again, so there is actually many articles about this topic floating around. Wikipedia has a pretty good overview [1, 2], for something little more in-depth check out the University of Manitoba's TOWN WITH NO POVERTY report [3], even Al Jazeera actually has a nice piece with interview from several recipients [4]. If you search Google there is countless good pieces about this experiment [5, 6, ..].

[1] [http://en.wikipedia.org/wiki/Guaranteed_Annual_Income](http://en.wikipedia.org/wiki/Guaranteed_Annual_Income)

[2] [http://en.wikipedia.org/wiki/Mincome](http://en.wikipedia.org/wiki/Mincome)

[3] [http://public.econ.duke.edu/~erw/197/forget- cea%20%282%29.pd...](http://public.econ.duke.edu/~erw/197/forget- cea%20%282%29.pdf)

[4] [http://america.aljazeera.com/articles/2014/8/26/dauphin- cana...](http://america.aljazeera.com/articles/2014/8/26/dauphin-canada- cash.html)

[5] [http://www.cbc.ca/news/canada/manitoba/1970s-manitoba- povert...](http://www.cbc.ca/news/canada/manitoba/1970s-manitoba-poverty- experiment-called-a-success-1.868562)

[6] [http://www.winnipegfreepress.com/opinion/columnists/dauphins...](http://www.winnipegfreepress.com/opinion/columnists/dauphins- great-experiment.html)

<comment><USER7> That's kind of the OP's point though: these articles, including the academic one, are all rich in anecdotes and poor in anything resembling hard analysis. We learn that people are warmly nostalgic bout experiments which gave their community more money from outside, that Dauphin residents saw improvements to their general health relative to other areas, _which admittedly may have been helped by a relatively new hospital_ , and that withdrawals from the labour market were small, though people knew the programme was a temporary experiment, the payments weren't that big and labour market conditions were very different then. Major hypothesized downsides to universal BI such as effects on local inflation (of housing costs in particular) _weren 't recorded_ as part of the original study.

I've always found it strange that Hacker News, a site populated by mathematically-inclined people responsible for all kinds of ingenious micro- optimizations to maximise customer lifetime value by market segment or optimise the ads displayed to demographic X, has so much love for the idea that the optimal formula for distributing benefits intended to tackle poverty is as simple as $WELFARE_BUDGET / $POPULATION_SIZE. Especially based on evidence as thin as these articles

<comment><USER8> Woah, wait a second - I hadn't thought of it until I read your "move money from outside", but it sounds like a fundamental part of this scheme that it was financed from outside the region it took place in. IMHO, that makes it basically worthless for any kind of analysis on doing this on a national scale.

Getting a ton of money from an outside source dumped into a region will pretty much always improve things for people there. That hardly seems worth analyzing. Exactly what you do with that money is a minor detail compared to the fact that it's coming in from the outside. This allows them to completely ignore the essential factor of how to go about taxing the population to get the money to give to those deemed in need, and what the impacts of those taxes and the mincome scheme as a whole will have on the mindset of people in the region.

<comment><USER9> > Getting a ton of money from an outside source dumped into a region will > pretty much always improve things for people there. That hardly seems worth > analyzing.

Does it not? Your statement is completely wrong so it may well be worth analysing. Google "Dutch Disease" for an example. Check out the "McCrone Report" for ways to avoid this happening.

</comment></comment></comment></comment></comment><comment><USER10> I've noticed the number of articles on "mincome" or "basic income" ramping up quite a bit in places like reddit, and to a lesser extent on HN. I don't necessarily have a problem with this, but are there groups actively trying to get this idea out on social media, hence all of the articles that I'm seeing? It may be that the idea is gaining organic momentum, on top of that, but I've been wondering about this of late.

<comment><USER11> I'm wondering who will be sponsoring / supporting this mincome? Won't it be coming out of government taxes - and thus a higher tax rate?

<comment><USER12> I also rarely even see back of a napkin calculations on how much money will be given away, what will be the source of the money, etc.

<comment><USER13> If you see one that doesn't account for labor dropout under a UBI scheme, ignore it. It won't be a realistic model.

<comment><USER9> So you keep claiming, but actual trials of mincome/BI/whatever haven't shown a significant dropout of labour. Do you have any evidence for this other than your gut feeling?

<comment><USER13> _sigh_ this is absolutely exhausting

[https://news.ycombinator.com/item?id=8793466](https://news.ycombinator.com/item?id=8793466)

[https://news.ycombinator.com/item?id=8793453](https://news.ycombinator.com/item?id=8793453)

<comment><USER9> I read those comments. They're exactly what I meant by "you keep claiming this". Claiming it's so is not evidence. Perhaps you missed that in your weariness.

My question stands: Do you have any evidence for this other than your gut feeling?

<comment><USER13> You can read the Mincome reports yourself. They aren't exactly glowing and most of the reported effects are well within the margin for error in the measurements.

BI and UBI has never been tried anywhere in a fully form because it requires everybody on the planet to do it at the same time. The closest we have are economic analogs. For example, resource rich locations that produce wealth at multiples of the labor input. You can study the economics of these places yourself and look at the outcomes. But they basically sum to: people stop working, people collect their money, labor supply needs to be imported from outside the local economy, the people who've stopped working don't exactly spend this new free-time self-actualizing themselves into discovering cures for cancer or unifying the fundamental forces of the universe.

If you want evidence, I suggest you open a high-school level history book and start on page 1. If you aren't aware of these cases on your own, but willing to promote nonsense like UBI, you're just being willfully ignorant of history and basic economics.

No amount of handwaivery and ignoring poor outcomes based on this or that technicality or goal post move will make cause and effect bend towards making these schemes work.

So here's your test: find somebody who's working poor, offer to put them up in your house and feed and clothe them no strings attached. How long before they self-actualize into a high-paid white-collar degree? Repeat this experiment 10,000 times. How many people, given this options, would rather just sit at home all day and surf the internet/watch TV/gossip vs. going out and challenging themselves into a better life?

I don't have to answer this, BI advocates do. And they need to present the outcome of this experiment as a real economic model that accurately predicts labor participation and real-world situations. This has _never_ been done and anything outside of this is hand waivy nonsense built on fairy dreams.

<comment><USER9> > You can read the Mincome reports yourself.

I have. And the Namibian ones. And the Indian ones. None of them saw a significant dropoff in labour.

> For example, resource rich locations that produce wealth at multiples of the > labor input. You can study the economics of these places yourself and look > at the outcomes. But they basically sum to: people stop working, people > collect their money, labor supply needs to be imported from outside the > local economy

Like Norway, you mean?

> If you want evidence, I suggest you open a high-school level history book > and start on page 1.

How will a history book help me if "BI and UBI has never been tried anywhere in a fully form"?

> And they need to present the outcome of this experiment as a real economic > model that accurately predicts labor participation and real-world > situations.

These were "real-world" situations. They actually occurred in the real world. That's generally considered more "real-world" than economic models are.

I think I'll stop here. I'm starting to get too amused with this conversation.

Have a Merry Christmas and a Happy New Year!

<comment><USER14> When you say "Indian ones" do you mean the experiments with distributing casino revenues unconditionally amongst a Native American tribe, or something that happened in India that I missed.

Not trying to nitpick labels, just want to be clear as to the referents.

<comment><USER9> I meant in the country India. I didn't even think about the Native American situation, though now I consider it, it does seem to illustrate the dangers of making payments that are socially exclusive (similar to the problems Australia has faced with its aboriginal people).

I think the following links has more details on India, but I've not read through it as it's late on Christmas Eve for me and I'm worried about collapsing the Santa wave-function so I won't get any presents!

[http://isa-global-dialogue.net/indias-great-experiment-the-t...](http://isa- global-dialogue.net/indias-great-experiment-the-transformative-potential-of- basic-income-grants/)

<comment><USER14> The Native American case I was thinking of seems to be this one:

[http://www.demos.org/blog/1/19/14/cherokee-tribes-basic- inco...](http://www.demos.org/blog/1/19/14/cherokee-tribes-basic-income- success-story)

 _" Children who were moved out of poverty by the UBI saw their behavioral problems decline by 40 percent. Minor crimes declined. On-time high school graduation rates increased. Children who started receiving the UBI earlier in life had better mental health in early adulthood than those who started receiving it later in life. In particular, they were 33% less likely to develop substance abuse or psychiatric problems."_

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> There may be a good case to be made for a minimum basic income ( _portmanteaus_ notwithstanding), but one is not to be found in this article.

</comment><comment><USER16> A basic income without accounting for the Law of Rent cannot create any sustainable solution. That is why a Citizen's Dividend, funded by a Land Value Tax, is necessary.

<comment><USER17> For those unversed in economic theory, care to explain why a basic income-- analogous to the one presented in the article or otherwise--is not a sustainable solution?

<comment><USER18> The concern is, on the whole, those receiving & relying on a basic income find a right to the fruits of the labors of others, without any incentive toward their own productivity. Many people find that with a little care, they can live nicely on little - and if that little is just given to them, then they can occupy their time just fine with mundane leisure (eating, mating, entertaining) and ongoing demand for more. Why contribute to national productivity when idleness is encouraged & funded?

Many will contend that having the basics covered will encourage the poor to be more productive by not limiting their efforts to mere existence (a la "might one take time to learn programming if not obligated to a 16-hour-a-day job just to pay rent & buy food?"). Many contend this is absurd, as those not inclined toward productivity are not going to become inclined without any reason to. Reality is a complex mix of these, the overall expectation being grounded in one's faith (or lack thereof) in human productivity sans motivation.

Basic income also risks devaluing money. The purpose of currency is representation of value; if someone is not creating value, their money has no value to represent. Money taken from someone and given to others (taxation for BI distribution) gives workers nothing in exchange for their efforts; money received for zero productivity may be squandered a la "easy come, easy go". Concern is akin to minimum wage: a gallon of gas will always be worth about 20 minutes of clerking at a gas station, regardless of the number placed upon the currency used to pay for the work and buy the gas. Basic income would skew low-number pricing: higher prices may continue to represent greater value accurately, but pricing of mundane goods/services would inflate as those purchasing have done nothing to acquire the currency buying them.

Basic needs have a cost to fulfill. Making it easy to fulfill those needs without social contribution reduces overall societal productivity, rewarding idleness and punishing productivity, lowering national GDP. Requiring people to work (true welfare cases aside) encourages productivity, including in work people would rather not do but for need to provide for one's own basic needs.

Reverse question is worth asking: how can basic income possibly be sustainable?

<comment><USER17> > Many people find that with a little care, they can live nicely on little

I believe this is the crux of your argument, and I would say that it is a postulate that cannot be assumed. If the "basic income" were $1k, few people would find they could live on it and thus the motivation to work would remain. On the other hand, who would work if they received $1 million per year? What if it's somewhere in the middle? I would argue that the incentive for work would remain if the benefit only brought people up to the poverty line.

Who wants to at live at the poverty line? $20k for a family of 4 affords very little luxury.

> Basic income also risks devaluing money

Do foodstamps make food significantly more expensive for everybody? What is the percentage of all food revenue bought with food stamps?

If 14% of US citizens live below the poverty line, the vast amount of GDP, productivity, taxes and whatever else you want to measure are generated above that line.

I've heard some arguments that a flat livable wage, without eligibility requirements beyond income would obviate the need and overhead for a whole slew of expensive social programs, including social security, welfare, food stamps, and the minimum wage.

Then there are small scale experiments like the one in the original article, though limited in actionable data did not produce behaviors like you described.

So, to answer your question, it can be sustainable because it can replace some expensive and hard-to-administer social programs with a relatively easier to distribute system. There are tangible incentives to earn more than "basic" income, and training to do so becomes easier. Lastly, the bulk of GDP and the tax base are generated by those far above the poverty line.

<comment><USER14> As I mentioned elsewhere, it's worth noting that $20k/yr goes a lot further when you're working 60hrs/wk at _stretching_ it than when you're working 60hrs/wk at _making_ it.

I don't mean this to play any particular role on either side of the debate - I'm not sure of all the ramifications - I just think it's probably an important point.

</comment></comment></comment></comment></comment><comment><USER19> I posted an article about a guaranteed basic income a bit more than a year ago,[1] and my posting of the article was prompted by noticing that other Hacker News participants had commented about such policies before, followed by my reading some articles that summarized Charles Murray's book about a guaranteed basic income. Ideologically, Murray would probably be even more in favor of no government welfare payments at all (but ask him directly for his current view), but when he wrote his book _In Our Hands: A Plan to Replace the Welfare State_ ,[2] Murray's basic argument was that governments are already spending billions and billions of dollars derived from taxpayers for means- tested welfare programs or other income transfer programs that are more complicated administratively than a guaranteed basic income, and a nationwide guaranteed basic income covers everyone at less administrative expense.

Murray's book goes into detail about how much a program of guaranteed income for everyone would cost in the United States, and suggests some probable effects that would have on everyone's everyday behavior. I read the book a year or two after it was published.

Murray's own summary of his argument[3] and reviews of his book[4] may inform the discussion here. Big public policy proposals are not easy to discuss, but the big public policy proposal of a guaranteed basic income for all is a response to existing policy of supposedly targeted social welfare programs that are just about equally expensive in the benefits they provide, but much more costly to administer.

As a matter of personal opinion, I am still thinking about whether or not a basic income guarantee is a good idea, but I definitely want to figure out if spending no more in total for social welfare by directly transferring cash to all citizens would simplify administration of welfare programs and allow more individual choice about how to use the money.

[1] [https://news.ycombinator.com/item?id=6309882](https://news.ycombinator.com/item?id=6309882)

[2] [http://www.amazon.com/books/dp/0844742236](http://www.amazon.com/books/dp/0844742236)

[3] [http://www.irp.wisc.edu/publications/focus/pdfs/foc242a.pdf](http://www.irp.wisc.edu/publications/focus/pdfs/foc242a.pdf)

[4] [http://www.aei.org/article/society-and-culture/poverty/in- ou...](http://www.aei.org/article/society-and-culture/poverty/in-our-hands-a- plan-to-replace-the-welfare-state-article/)

[http://www.conallboyle.com/BasicIncomeNewEcon/MurrayReview.p...](http://www.conallboyle.com/BasicIncomeNewEcon/MurrayReview.pdf)

[http://www.richmondfed.org/publications/research/region_focu...](http://www.richmondfed.org/publications/research/region_focus/2006/fall/pdf/book_review.pdf)

[http://mises.org/misesreview_detail.aspx?control=296](http://mises.org/misesreview_detail.aspx?control=296)

</comment><comment><USER20> A basic income guaranteed as long as you stay on birth control makes sense to me. Start paying a small amount at puberty. As soon as you have a child you lose access to it until your children are adults. This will work for men once we have reversible sterilization.

This would solve so many problems in this world.

<comment><USER21> Honest question, what problems do you think this would solve?

Is it that you don't want people to have children until they are financially capable of supporting them?

It is indeed a grave responsibility to provide for one's offspring while they are still in the brood. But the upside of the situation, even in the unfortunate circumstance where one cannot make such financial provision, _is no less than the creation of a brand new, fully conscious member of the human species, capable of experiencing the full wonder and surprise of being, who otherwise would have no chance of ever existing at all._

Furthermore, and here I risk delving into platitudes, children are quite literally the future of society. The continued production of children at a healthy clip is absolutely essential to the continuation of all the things we, as humans, value highest.

Hence it seems deranged to me to be so afraid of any monetary hardship that one should seek to positively disincentivize childbearing with such a broad and punitive measure. You are tampering with processes of infinite value and you do so at infinite risk.

As a smaller, more concrete objection, what about those who are initially of sound bank account, but then fall into hardship sometime after they've commenced in their procreative endeavours? Are they to be punished as well? In light of this possibility, why not take the opposite tack, and instead reward every new human life with a large gift to help pay for the cost of the upbringing?</comment></comment>


How HTTPS Works - <AUTHOR> https://howhttps.works/ <comment><USER2> I love seeing comics like this that aim to show concepts in simple ways. Kudos!

Worth noting that "The Handshake" episode [0] covers the key exchange using RSA. This has the downside that it doesn't support forward secrecy, meaning if an attacker ever compromises the server's private key they can retroactively decrypt traffic they previously captured.

It's more common these days to use an ECDHE exchange in which the client and server exchange keys that are generated just for this session (or at least, they should be [1]) and use those to generate the "shared secret".

In fact, in TLS 1.3 ECDHE is the only key exchange mechanism. [2]

The server then uses its long term keypair corresponding to the certificate to sign all the handshake messages that were seen previously [3].

[0] [https://howhttps.works/the-handshake/](https://howhttps.works/the- handshake/)

[1] [https://raccoon-attack.com/](https://raccoon-attack.com/)

[2] [https://blog.cloudflare.com/rfc-8446-aka- tls-1-3/](https://blog.cloudflare.com/rfc-8446-aka-tls-1-3/)

[3] [https://tools.ietf.org/html/rfc8446#section-4.4.3](https://tools.ietf.org/html/rfc8446#section-4.4.3)

<comment><USER3> Yeah, it's a bit of a pet peeve of mine to complain that so many people who start "easy crypto explanations" basically explain things that are outdated or sometimes simply wrong.

This is not how HTTPS works, it's how HTTPS used to work long ago. What makes it even more frustrating is that they do mention that there are different versions and the very latest version is 1.3, but don't mention that what they just explained is a variant of TLS 1.2 that most people have deprecated long ago.

<comment><USER4> > variant of TLS 1.2 that most people have deprecated long ago.

I agree with most of your post, but not this part. 1.2 is still out there on a large number of sites, but even worse 1.0 and 1.1 are there on many of the most popular sites. Google.com for example, despite all major browsers now having deprecated 1.0 and 1.1.

<comment><USER5> It's true that most sites support TLS 1.2, but between clients and servers the no-FS RSA kex is rarely negotiated. Any vaguely modern browser can do better given the opportunity and only a very small fraction of sites that do TLS 1.2 (and so would actually talk to a modern browser out of the box) don't prefer ECDHE.

My guess is that we're a year or three, or one major related security incident from browsers either removing RSA kex or gating it behind default-off enterprise feature switches. We know it's a bad idea, but a bunch of organisations that lay people think of as "secure" (like banks) do it anyway, mostly for really stupid reasons. If an incident makes it necessary to pick between real security versus imagined, the browsers are going to pick real as they have before, even if that means First Bank of Springfield doesn't work in your browser. Normal churn means the banks are slowly adopting Forward secret capable upgrades anyway, so that's where my other timeline comes from. Three years from now products that once treated RSA kex as the bees knees will have aged out, capex justification to replace them is just "it's rusted" rather than explaining to somebody who control your budget that you picked a deliberately poor key exchange method because you're bad at your job and trusted a sales person.

</comment></comment></comment></comment><comment><USER6> Unsolicited constructive criticism is that I think the comic could do with a bit more spacing between the panels, it gets easier to read feels less dense that way - that's what I think.

<comment><USER7> I have some different constructive criticism. I felt like the cartoons made it seem like they were treating me like a 5 year old. Is this for adults or children? I had to click away, it was a little bit insulting honestly.

<comment><USER8> While I don't like to be overly harsh to submissions, I'm afraid I agree. For contrast, check out the original comic that announced the Chrome browser [1]. I was amazed by it's effectiveness in telling a detailed story, but I never felt talked down to. I felt this comic lived in a different kind of uncanny valley, where the verbiage felt Barney/Sesame Street-esque but the topic was clearly geared toward adults.

[1] [https://www.google.com/googlebooks/chrome/](https://www.google.com/googlebooks/chrome/)

<comment><USER9> Same here, it omits some of the basic principles of comics. Outlines, contrast, spacing, context. It overly introduces some characters (certificat, compugter, browserbird), but then suddenly there is a regular crab. If you'd look at the Oatmeal[1], even though his style is absolutely chaotic it's still a lot easier on my eyes/mind to focus. I also don't want to be harsh and I love the initiative and the effort, but if it would be a bit easier to read I'd bookmark it and show it to every new trainee.

[1] [https://theoatmeal.com/comics/mantis_shrimp](https://theoatmeal.com/comics/mantis_shrimp)

</comment></comment></comment></comment><comment><USER10> A pointlessly unnecessary nitpick that doesn't invalidate anything:

The comic uses the more common term _privacy_ when the more appropriate term _confidentiality_ is more appropriate. Privacy is more a legal term than a term of technical control. The distinction is not frequently appreciated because there is a massive ton of overlap, but the distinction is important in the authoring of policy guidance and legislation as the enforcement actions can greatly differ.

[https://en.wikipedia.org/wiki/Privacy](https://en.wikipedia.org/wiki/Privacy)

<comment><USER11> Privacy is a social norm; it happens to have some not-exactly-matching instantiations in law. Mistaking the two is dangerous.

</comment></comment><comment><USER12> If you enjoyed this, check out [https://howdns.works/](https://howdns.works/) by the same authors.

<comment><USER13> their site footer only links the howdns.works not howhttps.work ?

<comment><USER14> Thanks for pointing that out, we'll put a link to howhttps.works in the footer on dnsimple today.

<comment><USER14> Added.

</comment></comment></comment></comment><comment><USER15> I found this comic very good and useful, but I'm a bit disappointed by two things:

1) the fact that it doesn't spend much time explaining what happens after the client generates a pre-master key. Diffie Hellman seems to be pretty standard, but it's nowhere to be seen here. Also, how do the client and server agree on a shared key if the secure communication only goes one way at this point? How can the server securely answer to the client, if the client hasn't sent an actual public key? In other words, how could they do the DH step (not explained itself in the comic) if a MITM attack is possible at this stage? I always assumed the client generates a temporary public key for itself and sends it (encrypted with the server's public key) to the server, but I'm not sure at all.

2) I was glad to see a quiz, but sadly most questions are too easy, with 1 serious answer and 3 completely ludicrous ones. Doesn't really challenge your knowledge.

Excellent work however.

<comment><USER5> Actually ordinarily today we do DH first and there is no step where the Pre Master Secret is actually sent at all - unlike this comic. Magic! DH allows them to agree a _random_ secret and since we wanted a random secret anyway that's fine.

The server ends up with no assurance as to who the client is in typical day- to-day HTTPS. You could be anybody, which is why web servers use technologies like passwords. TLS can be used in a mutually authenticated mode where both sides present certificates, but that's not how HTTPS is ordinarily done.

So why is this any help? Well after DH _neither_ side knows who the other is _but_ whoever they both are they now have a secret in common. This is enough to send messages back and forth that nobody else can eavesdrop or tamper with. Now the server can use this secure channel to show a certificate for its identity and present a proof bound to this session, in the form of a signature over the transcript of the handshake so far. The client examines the certificate, the certificate should be satisfactory (e.g. for [https://www.google.com/](https://www.google.com/) the certificate with SAN dnsName www.google.com issued by a CA you trust seems satisfactory) and then the transcript signature can be verified with the public key listed in the certificate. So now the client is satisfied that this is, in fact, www.google.com it is talking to.

</comment></comment><comment><USER16> Thanks for sharing, I found it really cool and informative.

Also, just a great example of an innovative marketing strategy: provide legitimate value to people who are part of your target market.

</comment><comment><USER17> >Crab is listening on the communication capturing the message.

Can we stop here and have a discussion about this? Every example I have ever seen of interception is either "coffee shop Wi-Fi" or government surveillance. Are those the main threats?

"Coffee shop Wi-Fi" seems like less of a threat each year. AFAIK WPA 3 means you get an ephemeral encryption key when you connect. Additionally, tethering seems to be more and more common these days. Both solve this problem, no?

Government surveillance is a different topic, but given how prevalent TLS termination is (any website using CloudFlare, for a start), I'm not so sure it helps - the NSA probably still have all your data.

Who is crab nowadays? Is he still a threat? Do we still need TLS even with WPA 3?

<comment><USER5> > Are those the main threats?

Maybe? Your threat model may vary. If you're very focused on happy news, most people's network use is not tampered with in a way that directly interferes with their enjoyment most of the time. If that's _really_ all you wanted then you can reason TLS is unnecessary for you†

 _If_ the coffee shop uses WPA3 and not any older version (do you check?) and _if_ you have your own secret password for the coffee shop WiFi not shared with anybody else (do you?) then WPA3 means crab probably cannot impersonate your coffee shop's WiFi router by hanging out in the coffee shop, although there are plenty of problems in practice with WPA3 implementations.

But what if crab runs the coffee shop WiFi anyway? Do you interview coffee shop owners about who provides their WiFi? It's just a cheap way to keep customers in the shop (if it's the sort of coffee shop that wants to do that) and who provides it and why isn't top of the owner's mind.

Maybe the family owned coffee shop just uses the stock ISP WiFi router and they're paying $50 per month like everybody else in the neighbourhood for Internet access. But, is that ISP the most scrupulous business? They can make money if they inject advertisements into your browsing, or if they can at least associate your address to specific browsing activity so that can be monetized. Perhaps even if the ISP itself is high-minded enough to turn these opportunities down an individual ISP employee is not, network engineers can certainly _choose_ to eavesdrop easily enough.

† But you aren't using TLS just for you. We must all hang together or most assuredly we shall all hang separately. If only a relative minority of people use protocols which provide them with features like confidentiality, those people stand out more easily to be attacked. _Don 't Stand Out_ is an increasingly important property to protect us all by sheer numbers.

<comment><USER18> > most people's network use is not tampered with in a way that directly > interferes with their enjoyment most of the time. If that's really all you > wanted then you can reason TLS is unnecessary for you

I would go beyond that and say that the reason most networks people use do not tamper with the traffic is _because_ most people use TLS nowadays. Not too long ago, it was very common for networks to use a "transparent HTTP proxy", intercepting all TCP port 80 traffic and redirecting it to a separate box with a caching HTTP proxy like Squid, in an attempt to reduce the traffic. This sucked whenever the HTTP proxy misbehaved (which was not uncommon; many operators seemed to configure it to cache more than it should). Since nowadays most HTTP traffic is protected by TLS, transparent caching HTTP proxies no longer provide a relevant reduction in the bandwidth use, and so they became less common.

</comment></comment></comment><comment><USER6> I'm wondering how the integrity part of HTTPS works.

It seems it's an authenticated encryption mode that does it, for example AES- GCM or a MAC as in ChaCha20 + Poly1305

<comment><USER19> Yes, but note TLS records were explicitly authenticated with HMAC before the adoption of AEAD modes.

</comment></comment><comment><USER20> I see a lot of love for this, but there always has to be the other side.

I found this to make it SO MUCH MORE CONFUSING than just explaining how HTTPS works using words like Computer, Browser, Certificate.

My brain could not wrap around the concept of a ComPUGtor or whatever.

But I'm sure this works for some people - just think the site should have a "lose the comics" format.

</comment><comment><USER21> Great demonstration!

I wrote a bit on it few days back- [https://lafolle.ca/blog/broken- resolution/](https://lafolle.ca/blog/broken-resolution/)

</comment><comment><USER22> In [https://howhttps.works/the-keys/](https://howhttps.works/the-keys/)

The public key is represented by a blue key but… wouldn't it be more simple to say the public key is an open padlock the sender closes on the box after putting their message in it? Padlocks can only be open by one key, the private one.

</comment><comment><USER23> I really enjoyed reading this, but I felt like the characters used throughout the comic weren't particularly representative of the things they're trying to represent (mainly attacking Browserbird here). This made it slightly harder for me to digest.

All the same, informative and fun. I enjoyed it! :-)

</comment><comment><USER24> Funny. But confusing - to me at least - is the naming of browserbird and compugter. Half of the time (I think?) browserbird is not a browser but a person; same with compugter. Alice and Bob would make things clearer.

</comment><comment><USER25> Plain awesomeness! had a good laugh and learnt a good deal about https. Thanks OP.

</comment><comment><USER26> I commend you for taking the time to translate the material to different languages. We really lack good learning material in languages like Portuguese. This helps a lot.

<comment><AUTHOR> From what I heard the translations actually came from customers who read the comic in English and then wanted it to be available in their language.

</comment></comment><comment><USER27> This is a really cute and informative page. Bravo

</comment><comment><USER28> I'm getting an SSL negotiation error. I don't think it works. They might want to have their SSL checked out.

<comment><USER14> Could you provide some details so we can look into this. Specifically what browser and OS you are using, and any customizations you've made in your browser.

FWIW, the site is hosted on Cloudfront using an Amazon issued certificate. Here's some debug output I show using curl which shows successful negotiation:

      *   Trying 184.108.40.206...
      * TCP_NODELAY set
      * Connected to howhttps.works (18.104.22.168) port 443 (#0)
      * ALPN, offering h2
      * ALPN, offering http/1.1
      * successfully set certificate verify locations:
      *   CAfile: /etc/ssl/cert.pem
        CApath: none
      * TLSv1.2 (OUT), TLS handshake, Client hello (1):
      * TLSv1.2 (IN), TLS handshake, Server hello (2):
      * TLSv1.2 (IN), TLS handshake, Certificate (11):
      * TLSv1.2 (IN), TLS handshake, Server key exchange (12):
      * TLSv1.2 (IN), TLS handshake, Server finished (14):
      * TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
      * TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
      * TLSv1.2 (OUT), TLS handshake, Finished (20):
      * TLSv1.2 (IN), TLS change cipher, Change cipher spec (1):
      * TLSv1.2 (IN), TLS handshake, Finished (20):
      * SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
      * ALPN, server accepted to use h2
      * Server certificate:
      *  subject: CN=howhttps.works
      *  start date: Feb 14 00:00:00 2020 GMT
      *  expire date: Mar 14 12:00:00 2021 GMT
      *  subjectAltName: host "howhttps.works" matched cert's "howhttps.works"
      *  issuer: C=US; O=Amazon; OU=Server CA 1B; CN=Amazon
      *  SSL certificate verify ok.

<comment><USER28> Check your SSL score. If you've got an A or A+ or such, it means many people can't connect to your site. Not every browser has TLSv1.2. The maximum score is something like A- nowadays.

NH works, your site doesn't.</comment></comment></comment>


The map of the Pennsylvania tech startup community - <AUTHOR> http://representpa.com/index.php

<comment><USER2> I see my hometown of Harrisburg isn't getting startup love. Kind of surprising; I've heard from friends and family still there that their economy is prettty strong. The cost of doing business there is probably a lot cheaper than the Philly area too.

<comment><AUTHOR> This just went live less than 24 hours ago. Feel free to reach out to them and see if they would like to add a pin!

</comment></comment><comment><USER3> If you have any interest in populating this with data from the <http://weworkinphilly.com> API, drop me a line. Email in profile.

</comment><comment><USER4> Can we add other people's companies/accelerators etc...? I could probably populate a lot of the Pittsburgh area quickly, but it looks like you have an approval process.

<comment><AUTHOR> I don't feel comfortable personally adding other peoples companies without their permission, so I don't advocate it; but the "approval process" is just me clicking "Approve".

So, that being said, if you'd like to add companies of friends/contacts, and feel ok signing up "for" them, feel free!

<comment><USER4> Awesome thanks, also you might want to start not zoomed in on the Philly area so you don't offend us westerners ;) Just noticed there actually are some other locations outside of Philly on the map already. Cool idea!

<comment><AUTHOR> Something I knew would eventually happen! What do you think of it now? It shows the whole state.

</comment></comment></comment></comment><comment><USER5> There are numerous startups that have been spun off from PSU in the State College area.

<comment><AUTHOR> I hope to capture every single one of them, eventually, on this map!

I am debating seeding it with startups without their knowledge. Fortunately, of the 19 who are signed up, every single one has done it themselves (with exception of Gabe from DuckDuckGo, he tweeted me "permission"!)

<comment><USER6> There were lot of startups who attended the latest phg tech meetup. I added mine(from pittsburgh) to the map but if you want a full picture I would recommend adding them yourself or let others add them. What harm does it do to the startup by listing here. I guess you can have a disclaimer at the bottom saying if you want to remove your startup from the list..do it here.. or email ..

<comment><AUTHOR> I'm not saying I won't do that. I've got lots of ideas on the table right now, but I don't want to change much right in the middle of this HN spurt- I need to collect what I can with this rush.

<comment><USER7> You could add some data for Pittsburgh from this link: <http://alphalab.org/companies/browse-by-cycle>

</comment></comment></comment></comment></comment><comment><USER8> What's up Appsters? I'm reppin Bristol Borough.

Not gonna disclose what I'm working on, I'll just say it's marketing related.

</comment><comment><USER9> Looks like Philly is missing a lot still, DreamIt Ventures and Independents Hall come to mind

</comment><comment><USER10> Your "Add Something" form does not allow apostrophes in the Company Name.</comment>


A Simple Path to Success  - <AUTHOR> http://www.markevanstech.com/2008/03/23/a-simple-path-to-success/ <comment><USER2> Quote: "In fact, as life gets busier with more choices than ever before, simplicity could rule the day."

That's exactly the point (also true for many pseudo-techies). Most people hate to read manuals. And an increasing "instant gratification-mentality" might add to it.</comment>


How the Shinkansen bullet train made Tokyo into the monster it is today - <AUTHOR> http://www.theguardian.com/cities/2014/sep/30/-sp-shinkansen-bullet-train-tokyo-rail-japan-50-years <comment><USER2> Note that the Tokaido shinkansen is only profitable in terms of OpEx -- paying drivers, running stations, buying legendarily bad coffee, paying for electricity and car maintenance, etc. It relies on government-provided CapEx -- laying thousands of miles of earthquake-resistant track, in some cases requiring drilling through mountains to get from A to B because curving is difficult.

The CapEx cost, which the government essentially wrote off when they privatized JR, was north of half a trillion dollars.

<comment><USER3> Well, in all countries with popular train networks, the profitability/cost index is totally opaque. It's fairly obvious that it can't be as profitable as having a fleet of planes. The sheer maintenance of high speed trains + their kilometers of tracks render them very costly per mile.

<comment><USER4> Airports and Air Traffic systems also cost money. Several tens of billions of dollars were spent on SFO+LAX+SJC+OAK+SAN upgrades in California in the last few decades. If you add up the CapEx, it's on par with the CapEx for high speed rail. Operationally, the FAA budget is $15 billion a year, the TSA is $7 billion per year, so minimally, $22 billion in government subsidy.

<comment><USER5> Air traffic systems aren't a good analogy - for the most part, they're funded through user fees. Eighty percent of the FAA budget [1] is funded through the Airport and Airway Trust Fund, which is based on taxes and service fees levied on operators and passengers. This was designed to allow the agency to grow with the size of the industry, without taking over the federal budget. It's also more progressive, since air travelers are generally wealthier, it makes it so you don't have to subsidize travel for the rich with taxes on the poor and middle class.

Airport construction follows a similar system. Most airports in the United States are public-private partnerships. They issue Airport Revenue Bonds, which are similar to municipal bonds from a tax perspective, but they're backed by airport revenues, not municipal tax revenue.[2] The airport authority has to pay back the debt through the fees they collect from operators or concessions. The latter is why everything from bottled water to rental cars is more expensive in an airport. It's not just that they have a captive audience, it's that concession sales actually pay for the operation and expansion of the facility.

In both cases - the FAA and capital expenditures - it's mostly paid for by the users, not the taxpayer.

[1] - [https://www.faa.gov/about/office_org/headquarters_offices/ap...](https://www.faa.gov/about/office_org/headquarters_offices/apl/aatf/media/AATF_Fact_Sheet.pdf) [2] - [http://www.nap.edu/openbook.php?record_id=14041&page=12](http://www.nap.edu/openbook.php?record_id=14041&page=12)

<comment><USER4> Well, the same excuses have been made about the road system, that it's funded by gas taxes, but when people crunched the numbers, it turned out it's only about 50%.

Since the subsidy you link to, varied between 70% and 80%, it could still be the case that the Airport system in California got subsidies within a small multiplicative factor over it's entire lifespan compared to the proposed costs of the high speed rail system.

The objections to high speed rail IMHO, aren't 100% based on economics or funding, because other things have gotten massive subsidies, they're also based on a kind of weird political tribe association people have against trains.

Let me quote George Will as an example: "To progressives, the best thing about railroads is that people riding them are not in automobiles, which are subversive of the deference on which progressivism depends. Automobiles go hither and yon, wherever and whenever the driver desires, without timetables. Automobiles encourage people to think they—unsupervised, untutored, and unscripted—are masters of their fates. The automobile encourages people in delusions of adequacy, which make them resistant to government by experts who know what choices people should make.

Time was, the progressive cry was "Workers of the world unite!" or "Power to the people!" Now it is less resonant: "All aboard!""

So, to some people, trains are a Euro-socialist kind of thing, anti-freedom.

</comment></comment></comment></comment></comment><comment><USER6> This article is somewhat confused. The author seems to be asserting that Tokyo is so populous because more people commute by Shinkansen than by other means, but that would be totally false. The number of people commuting by non- Shinkansen trains is much, much higher. And how can the long-term shift of business from Osaka to Tokyo be explained by the Shinkansen? There are far more people living west of Tokyo (i.e., in the direction of Osaka) than north of it, so I don't see how the Shinkansen, on its own, shifts the center of gravity toward Tokyo. Or what about the growth of the west side of the Yamanotesen (i.e. Ikebukuro, Shinjuku, and Shibuya), which the Shinkansen doesn't even serve? The Shinkansen is great and all, but this article doesn't make any sense to me.

</comment><comment><USER7> > The Shinkansen is expensive; with the rise of low-cost carriers, any train > trip that takes more than two hours from Tokyo is less cost-effective than > flying.

Nonsense. Narita airport is about an hour away from central Tokyo (by one of two express trains, probably longer by car), and Haneda about 30-40 minutes (by monorail, probably longer by car). Then you get to deal with being in an airport. Both run more smoothly than the ones in the US, but still require early arrival for boarding. Flights are _far_ more likely to have delays. Then you get to deal with another airport again after landing, especially if you checked luggage.

Contrast with the shinkansen: trains leave every 10-15 minutes from the center of the city, have better seats (and green or first-class costs a fraction of a first-class plane ticket), and no dealing with airport security or lines at all.

It would take a 4-5 hour trip minimum for me to fly rather than take a train in Japan.

<comment><USER8> I agree with your conclusion, but the first-hand experience of taking a local flight in Japan is pretty sureal. There are flights almost every 10 minutes between Tokyo and Fukuoka, for example. I wasn't even asked for id before getting on the plane.

It feels a lot like a train except it flies and it's a lot harder to bring a gun onto it.

</comment></comment><comment><USER9> While Japan continues to build and push the boundaries of train travel (regardless of the cost), other countries (USA, Australia) get mired in cost benefit analysis and special interest morass on any big nation building train works. It is interesting to note that the original lines are now considered 'super profitable'. It would be fascinating to see the original cost benefit analysis (if any was done) when they started their journey 50 years ago.

<comment><USER10> Outside of the northeast, train travel isn't that feasible, and Japan had the right population densities before they built the first shinkansen (it helps that the country is mostly mountainous with limited areas for population that are quite close to each other). And even the northeast lacks much of the population concentrations of Japan. The density problem could be much worse in Australia.

Even in a place like China the benefits are dubious. It is still often more cost effective to fly from Beijing to Shanghai than take the bullet train.

<comment><USER11> It's more cost effective in Japan to fly from Tokyo to Osaka than to take the Shinkansen too (Shinkansen costs ~140USD, flights 120USD).

However flying is a lot more time consuming and inconvenient. The Shinkansen system integrates well with the regular train/subway system. And of course serves locations without airports.

<comment><USER12> It costs a bit to get to/from the airport too, whereas with shinkansen you have all-you-can-ride JR within the city you arrive at, until you exit the final gate. I'd say there comparable in price.

<comment><USER11> It depends where you are. In areas not well served by the JR you can end up spending quite a bit on the Metro. But you're right the costs are comparable.

However given that, I think convenience is the deciding factor in the Shinkansen's favor.</comment></comment></comment></comment></comment>


Ask HN: Feedback and CoFounder - privatetransit.org - <AUTHOR>

I'm almost ready to open this site up...  http://www.privatetransit.org .   It's a site where you can post your commute/route.  Then riders can request to ride..  It's like carpooling, but more business-like.  Payment is paypal, reports can be printed for employer reimbursement.  There is feedback/ratings...  email status alerts, account info... etc   What do you think - thumbs up or down? (also... btw, the site is not functional... even pre-alpha still)<p>And I'd like to find a cofounder by rollout time who can market and hopefully has avenues to find funding. <comment><USER2> Is it working yet? What's with the map screenshot on the front page, is that supposed to be something? Also, don't repeat the menu in any screen shots, it confuses people into thinking they're clickable and do something. Remove the tabs from screenshots.

Your marketing on the front page needs a lot of work. I didn't know there was a tour until I clicked next. It also seems very small, why aren't you using your screen real estate? Is it supposed to be a mobile site?

I also clicked on "my transit" and got more tabs to show up, but then I couldn't get back to the homepage, I was stuck there no matter how many times I clicked on the home tab. .

You should have more descriptive text on the tour instead of repeating those two lines about public and private transit. I expected them to be descriptive and relevant to the picture being shown on the tour. Their graphical hierarchy made me expect that was where my eyes should look first, and instead it was just lines from the home page. I've read those two lines, no need to repeat them on every tour page.

I don't mean to be harsh, just asking a lot of questions.

<comment><AUTHOR> Thanks... No it isn't working yet. I'll clean those bugs up and post again when I ask for private beta folks.

Good points about the marketing and tour. I really want it to convey this is the solution to outrageous gas prices, global warming, dependence on foreign oil. It's also the right time with wireless laptops and mobile phones to give up driving. and that these web technologies are the right product.

What do you think of the idea?

<comment><USER2> Well, I think its an idea. I don't know too much about it because its not explained very well. You might want to look at how other web 2.0 companies are mixing selling and explaining on their homepages, because they do it really well. You want to make people want to start using it, but also explain what it is very quickly. there are some great websites out there that make great use of the available space and use color really well. So part of the problem is you need to work on that.

Even the stuff you just said in the comment above can be used to promote your app, you've just got to use it. "Want to save gas?" "Think more people should drive together?" "With Private Transit you can do both." "Just map out your route and see if it matches up with others. Organize a pool and you're on your way to saving money and the world. Your co-riders can chip in with cash or pay their share using PayPal through the website." "You can even keep track of miles, print out reports or get email updates to your mobile phone if someone can't make it."

I mention all this is that no matter how good the back-end coding might be, if people don't understand it or are encouraged to use it, it won't take off. Coding was the tough part, but now design and marketing is the next tough part. It really needs to be almost as important as all the work that you've put in already.

</comment></comment></comment><comment><USER3> 1) Where do you live? You probably want your cofounder to live in the same urban area.

2) You want a good hacker to be your cofounder. How to find a good hacker. Paul Graham gives some advice about this:

<http://www.paulgraham.com/start.html>

"What you should do in college is work on your own projects. Hackers should do this even if they don't plan to start startups, because it's the only real way to learn how to program. In some cases you may collaborate with other students, and this is the best way to get to know good hackers. The project may even grow into a startup. But once again, I wouldn't aim too directly at either target. Don't force things; just work on stuff you like with people you like."

What if you are not in school? I would welcome an article in HN about how to find a cofounder for a startup. You might want to go to startup events and take part in an open source project.</comment>