How to destroy the earth - <AUTHOR> http://qntm.org/?destroy

<comment><USER2> I loved this. If someone created a geeky analogue to Maxim magazine and filled it with articles like this on a monthly basis, it'd be a real hit.

<comment><USER3> wired?

<comment><USER2> You know, I was thinking about that as I was typing my original comment. But no, not _Wired._

I think it's close, but there's some difference in tone that'd be needed, though I can't quite put my finger on it at the moment.

<comment><USER4> Swagger.

<comment><USER2> I think you're right. :)

</comment></comment></comment></comment></comment><comment><USER5> Reminds me of one of George Carlin's show where he talks about how humans destroy planet earth. The earth is built to last, and will be there _even if_ humanity is long gone.

<comment><USER6> The problem with that entertaining quip is that when people talk about protecting mother earth they don't actually believe we're going to _kill it_.

They're specifically talking about preserving things we like about its current state: things we are perfectly capable of utterly destroying; places we've demonstrated our ability to render inhospitable.

So you don't really refute the argument by pointing out that the Earth will endure, or that some degenerate mutant strain of humanity might be able to scratch a pre-civilization existence out of radioactive slag.

<comment><USER7> _The problem with that entertaining quip is that when people talk about protecting mother earth they don't actually believe we're going to kill it._

Sure, but then we aren't really talking about saving the earth at all - we're talking about saving ourselves and the things we happen to like, need, or find aesthetically pleasing. It's a purely selfish motivation which is why we like to anthropomorphize the planet itself and pretend we're concerned for something more than just ourselves. "Mother earth" couldn't care less about being saved because "she" is a big rock in space, which doesn't have feelings[1].

 _that some degenerate mutant strain of humanity might be able to scratch a pre-civilization existence_

Hey now, we were just a degenerate mutant strain at one point too. There's no reason to think that some other mutation that survives our eventual extinction would not mature over a few million years to become a much more intelligent, peaceful and benign civilization.

1\. I guess it's possible the earth does have feelings, but if so it doesn't seem likely it would care one way or the other about us.

<comment><USER8> Not if there are certain things that are truly beautiful and good and will never occur again if we destroy them. Those things are worth saving, and that's not being anthropomorphic.

<comment><USER9> By definition, if you think they are truly beautiful and good, you have made a judjgement, and thus are being self serving in attempting to save them.

<comment><USER8> Hmm, why must all judgments be self serving? For instance, if a soldier thinks it is the right/good/noble/beautiful thing to jump on a grenade, I fail to see how that is self serving by any normal definition.

Plus, many artists and other geniuses live horrible lives by evolutionary standards, all for the sake of something they consider beautiful and transcendent.

Finally, most people will report a subjective sense of self-transcendence when contemplating beauty and moral goodness. If we want to fly in the face of common experience we can say this is all selfish, but at that point it looks more like you're bending the data to fit your worldview instead of letting the data change your worldview.

</comment></comment></comment></comment></comment></comment><comment><USER10> From the section, "Things which will not destroy the earth":

Gay marriage.

<comment><USER11> Well, theoretically this could result in destruction by less-plausible method number eight: "Destroyed by God".

(Of course, so could anything else, what with the ways of God being impenetrable to Man and so forth, so it's probably safest to just keep doing whatever it was you were already doing since apparently He was cool with that.)

</comment></comment><comment><USER12> Step 1: Procure an Iludium Q-36 Explosive Space Modulator.

Step 2: Make sure there are no meddlesome rabbits on your planet...

</comment><comment><USER13> If you follow the link to the advisory board you will see they confirmed the earth was destroyed last year.

There's a comments section to discuss the topic.

</comment><comment><USER14> His fictional methods disappointingly lacked the Vogon method.

<comment><USER15> No they didn't. You just didn't read far enough down the page. <http://qntm.org/?fictional#sec2>, second item listed.

<comment><USER14> Weird. I swear I ctrl-F'ed that page for Vogon.

</comment></comment></comment><comment><USER16> "Number of times the Earth has been destroyed: 1"

I was expecting this to reference the event that created the moon. <http://en.wikipedia.org/wiki/Giant_impact_hypothesis>

</comment><comment><USER17> Check out Episode 50 of 'The Universe' -- [http://en.wikipedia.org/wiki/The_Universe_%28TV_series%29#Se...](http://en.wikipedia.org/wiki/The_Universe_%28TV_series%29#Season_4:_2009)

</comment><comment><USER18> I'm pretty sure my cat has a plan for this. Good thing I keep him in the house.

</comment><comment><USER19> i love this guy's scifi, too.

<http://qntm.org/?fiction>

i first found the ed stories through scifi.reddit.com

</comment><comment><USER20> For some possible solutions to Fermi's paradox, this can easily be solved. We just build e.g. radar stations which output lots of MWs and get someone's attention... :-)

<comment><USER21> That's listed as item 9 in this section: <http://qntm.org/?destroy#sec5>

<comment><USER20> Right you are (it was without a title line, so I missed it).

Also, my way of putting it was much scarier, since we have already built lots of radar stations. :-)

</comment></comment></comment><comment><USER22> Meh. You could roast everything on the surface with the energy of several large impactors. This would use orders of magnitude less energy than most of the methods described, and still kill every living thing on the surface. (As in everything on the surface is engulfed by molten rock, tidal waves, pressure blasts, and everyone dies in the space of a few hours.)

Lesson: leave the Earth's orbit alone, and just massively disrupt the biosphere.

<comment><USER23> The objective here is to _destroy_ the Earth, as specified in the article. Sure, there are lots of ways to kill everything on the planet, but it'll still be there when you're done.

<comment><USER22> If I've already roasted/pulverized/drowned everyone, who's going to complain?

<comment><USER24> And if a tree falls in the forest, will anyone hear it? As has been said the goal is destroy the earth. Not to leave no witnesses to confirm if the deed has been done.</comment></comment></comment></comment>


HoneyInsured's 'Hipmunk for insurance' launches to help you get healthcare - <AUTHOR> http://venturebeat.com/2015/11/02/honeyinsureds-hipmunk-for-insurance-service-aims-to-help-you-get-healthcare-easier/ <comment><USER2> Hi HN, Eugene and I co-founded HoneyInsured after graduating from college. Today we're launching from the YC Fellowship! Happy to answer questions about HoneyInsured or YC Fellowship.</comment>


Google Wallet Announced: Use Your Phone for Mobile Payments - <AUTHOR> http://www.technobolt.com/2011/05/26/google-wallet-announced-use-your-phone-for-mobile-payments/

<comment><USER2> One thing that would be interesting with NFC & mobile payments, is that as there will no longer be any privacy surrounding payment activity -- a meta payment system would be interesting. Like a swiss bank account.

Here is how it works:

You sign up for meta-wallet.com NFC proxy payments. And link your account.

You get an NFC chip that is registered to that account.

Your bank account is linked to meta-wallet.

You make a payment, using the meta-wallet NFC device. Meta-wallet is charged and then meta-wallet charges your account.

For added security, meta-wallet could bundle transactions that you make and then divide the transactions by a random number and charge your account several varying charges that add up to the total balance (plus their fee) but do not equal the exact amount of any given individual charges.

This way you could not know which charges made with the meta-wallet equate to which customers actual bank statements.</comment>


North America to Drown in Oil as Mexico Ends Monopoly - <AUTHOR> http://www.bloomberg.com/news/2013-12-16/north-america-to-drown-in-oil-as-mexico-ends-monopoly.html

<comment><USER2> So is it time to end the oil company subsidies, now, or is it still not the right time?</comment>


Ask HN: Who is responsible for fending off DoS attacks? - <AUTHOR>

Posterous, who uses Rackspace for hosting, was recently the target of a DoS attack. I got an email from them stating that they were addressing it and also offered some workarounds.<p>In a situation like this, who is responsible for fixing/addressing/getting sites back up? I'd imagine it would be the host but I'm curious as to the work done by Posterous. <comment><USER2> That depends on the scope and size of the attack.

If the attack is small, which the vast majority of attacks are, (either in bandwidth, packets per second, or both) then the responsibility is on the dedicated server owner to fix it via a software fix. (iptables with perl scripts to ban offending ips, etc..). If you have a managed host, they will obviously help with that.

If the attack is larger than that, but still not epic (say, 2gbps attack) then the responsibility is on the host/datacenter, who will most likely null route your server. What that means, is they will tell their upstream providers not to send any more traffic to your IP address and NOBODY will be able to access your site. This is done until the attack ends. If they dont null route your server, they will attempt to filter the traffic coming in themselves through a in house solution.

If the attack is of epic scale, it becomes less of a issue for the datacenter you are hosted in and more of a issue for the upstream providers to filter it on their end. A average datacenter can only do so much when 50gbps is coming in when they normally only see 10.

</comment><comment><USER3> the hosting company is the only one /able/ to respond, (well, depending on the attack type. the nastier attack types fill your pipe and/or overwhelm your router's pps capacity... your upstream is the only one who /can/ address that.)

however, standard practice in the hosting industry is to disconnect the target, temporarily or permanently.

the thing is, cleaning up this shit gets expensive fast. And there is plenty of 'splash damage' to your fellow customers.

I was taken out a few months back by a DDos. Fourteen thousand dollars in SLA credits I paid out. The customer? was paying me one hundred fifty a month, and this was the second time he got hit with a major attack. I asked him to leave or help me pay for the damage. Obviously, he picked the former option.

but yeah. my upstreams wanted me to get rid of the guy after the first attack. 'finishing the job' really is standard practice, if the attack is sufficiently large.

Personally, I think this fact is one of the reasons why the problem isn't going away. Service providers, the only people who /can/ do anything about it, well, they can spend a whole lot of time and effort tracking down the source (being as most DDos traffic is spoofed, this is quite difficult) or alternately, we can just take the target offline.

the economics of the situation are all wrong... but I don't know how to fix it.

</comment><comment><USER4> It has to be a combined effort. The hosting company is like the fire department - when your house is on fire they come through with axes and hoses because their focus is saving lives, not property. When your site is being attacked, the hosting company focuses on stopping the attack, but you'll end up fixing a lot of security holes and patching code afterwards.

For example, when I worked at Internet Brands, when several of our sites were attacked last year, our hosting company installed a Palo Alto firewall in front of our load balancer. It stopped the attacks overnight, but some sites became unbearably slow or unresponsive. It turns out that it was blocking some legitimate traffic (e.g. requests for RSS feeds for vBulletin forums, curl API requests). We had to go through hundreds of sites to look for things like this to patch.</comment>


Apple's Website Ad Placement - Why? - <AUTHOR>

Any web designer want to chime in on why apple placed ads across the entire width of the screen, outside of the menu bar container? Maybe its just me, but the styling doesn't seem to match Apple's streamlined minimalism.
Screen-shot of their website: http://i.imgur.com/LZoOp0D.png
With the ads 'fixed': http://i.imgur.com/8XTv8y9.png <comment><AUTHOR> \--Reposted so you can simple 'click' the links--

Screen-shot of their website: [http://i.imgur.com/LZoOp0D.png](http://i.imgur.com/LZoOp0D.png)

With the ads 'fixed': [http://i.imgur.com/8XTv8y9.png](http://i.imgur.com/8XTv8y9.png)

</comment><comment><USER2> [http://www.apple.com/uk/](http://www.apple.com/uk/) is similar to the fixed version: [http://imgur.com/rILJD18](http://imgur.com/rILJD18)

<comment><AUTHOR> Thanks for the link, weird the US site is different in that regard.</comment></comment>


Apple's stunningly huge opportunity - steal Android market share. - <AUTHOR> It's an old theme, and has always been rejected firmly by Apple, but image if iOS was totally free for all phone manufacturers to put on their own phones.
Ruthlessly quality controlled by Apple to ensure binary compatibility across all iOS compatible phones.
Ruthlessly legally controlled by Apple to ensure manufacturers cannot install their own customizations and crapware.
Ruthlessly controlled by Apple to ensure it retains control over the operating system update process.
Ruthlessly controlled by Apple to ensure there continues to be one and only one Apple app store.
Surely for Apple growth into the future comes from owning the customer and selling services via iTunes and the app store.  The only way to do this is through greater market share.  The easiest and perhaps only way to steal market share from Android is to give iOS away free to the Android manufacturers.
People don't need new phone hardware so often these days so why should Apple be so stuck on selling the hardware?  Time for Tim to start stealing the Android market share. <comment><USER2> One big reason Apple is so much larger and more profitable than other tech companies (hell, all companies!) is that they are vertically integrated. This is an expensive business model and it leaves a lot of near-term opportunity (like seizing Android market share through OS licensing) on the table. If you want to build a bullet-proof business, follow Apple's lead.

</comment><comment><USER3> Looks like someone wasn't around for the PowerPC clone idea of the 90s! :D

<comment><AUTHOR> Indeed I was but it ain't the 90's any more.

In the 90's there was not a huge revenue stream to be had from selling services such as music, games and apps.

It's a different world.

<comment><USER4> Huge compared to selling phones? No. That's not the case for the App Store or Google Play. Hell even selling physical media can't compete with what Apple makes in hardware. Just look at Sony.

</comment></comment></comment><comment><USER5> It seems to me that it would make a lot more sense for Apple to allow other companies to buy Ax chips, assuming that they priced them well (somewhat higher than Qualcomm etc.).

</comment><comment><USER6> Apple is a hardware company... why would they want to be in the software business?</comment>


Second-year salary for early employees? - <AUTHOR>

If an early employee takes a deal involving salary and equity, what is their second year's salary? Is it a repeat take on that equity, or just the salary? What if the salary was cut to increase the equity, does it revert to the non-cut state? How long does the equity take to vest? What are the standards here? <comment><USER2> _How long does the equity take to vest?_

I have no direct experience here, but I've always heard 4 years cited as the norm.

</comment><comment><USER3> Generally speaking, when you're allotted options (equity), let's say 100,000, those options will vest equally over a three or four year period. The salary is market rate with a raise commensurate on the company's desire to keep/reward the employee or you get the old song and dance about no raises/bonuses as management wants to keep reinvesting as much as possible into operations while they take as much money off the table for themselves as possible.

I haven't seen many cases where early employees were rewarded with substantial raises over their peers as this would be counterintuitive to management retention and recruitment goals.</comment>


JQuery File Upload – Multiple File Upload Plugin for jQuery - <AUTHOR> http://blogfreakz.com/jquery/jquery-file-upload-multiple-file-upload-plugin-for-jquery/

<comment><USER2> The application page: <http://aquantum-demo.appspot.com/file-upload>

</comment><comment><USER3> this blog is sketchy, flooded with ads and obviously trying to drive traffic to it. Why not just post the github link?

</comment><comment><USER4> The setup for this plugin is too complicated. See:

<https://github.com/blueimp/jQuery-File-Upload/wiki/Setup>

I think the API and abstraction should be better thought out to be just 1 js file include instead.

Other comments:

Good use of FileData and multipart builder for handling multiple browsers. However I thought Firefox also supported sending files with FileData() object, so why is xhr.sendAsBinary necessary? As far as I know, xhr.sendAsBinary is not in the w3 draft and is being deprecated by Firefox, as it's a FF proprietary method. Perhaps that part of the code could be removed?

</comment><comment><USER5> Even though _MSIE and Opera have no support for Drag & Drop, multiple file selection or upload progress indication_, I'm really pleased to see such a well thought-out file upload plugin that doesn't require the use of Flash.</comment>


Prime Number Spiral - <AUTHOR> http://www.numberspiral.com/index.html <comment><USER2> Fascinating. And dangerous.

If you see a pattern and you search a explanation for it, you can get wrapped up in the hunt and end up investing a lot of time into a wild goose chase.

Our math profs warned us to do this, because if you zoom out wide enough, there is a pattern in every noise. As a undergrad, i got obsessed with the idea of creating a meaningful divide by zero operation.

The result, if i remember correctly, was a "fractal" cave, interconnected, the walls defined by aggregated infinitys reseeded by the "echos" of all previous caves until the next "digit" of the original seed number is reached. What a useless operation, one might think- but i got obsessed with it, because it generated sequences. 1/0 = |1|0/0=1|2|3|5

Some of the results started to look like the fibonacci-sequence(its basically a algorithm mapped to infinity echoing back and forth along the cave-walls after all) and i lost a semester chasing this numeric day dream. :(

Shame on me, i woke up when my math prof zoomed out over some random pattern revealing "patterns". The Truth is, we humans want to see patterns. Desperately. So desperatly it can eat lives.

Still a fascinating read, can fully recommend. But wake up if you what you find eats you.

PS: To double my shame, i did never publish this. So if you venture down the rabbit sinkhole, put a warning sign up.

<comment><USER3> In high school, I created the number _b_ , whose absolute value is zero. I discovered the following additional interesting facts about it: ∅

<comment><USER4> You (re)discovered dual numbers!

[https://en.m.wikipedia.org/wiki/Dual_number](https://en.m.wikipedia.org/wiki/Dual_number)

<comment><USER5> Non mobile link for the lazy

[https://en.wikipedia.org/wiki/Dual_number](https://en.wikipedia.org/wiki/Dual_number)

</comment></comment></comment></comment><comment><USER6> Also known as the "Ulam Spiral" for Stanislaw Ulam who discovered it by accident in 1963, supposedly while doodling during a boring presentation.

This page is great, but the wikipedia page is too and provides other related work and coincidences. [https://en.wikipedia.org/wiki/Ulam_spiral](https://en.wikipedia.org/wiki/Ulam_spiral)

<comment><USER7> No, actually the Ulam Spiral is something else, a simpler spiral to create. Still, I too recommend the Wikipedia page.

</comment></comment><comment><USER8> P+41 spiral is absolutely fascinating. [1] I really want to know why they cluster there.

[http://www.numberspiral.com/art/14.gif](http://www.numberspiral.com/art/14.gif)

<comment><USER9> There is a prime generating formula n^2 + n + 41 for n=0 to 39. Maybe this is related?

[http://mathworld.wolfram.com/Prime- GeneratingPolynomial.html](http://mathworld.wolfram.com/Prime- GeneratingPolynomial.html)

<comment><USER10> Yes it is, it is a bit hidden on the left side on the page in a details box.

</comment></comment></comment><comment><USER11> Somewhere and someday, there is an AI which is reading this and deciding to let humanity live because we apparently can have some inkling of real beauty :)

</comment><comment><USER12> I enjoy exploring these patterns, not just for primes, but for factors as well. I made a little JavaScript app for creating "Number Mandellas" that my kids and I use to enjoy different patterns:

[http://ideonexus.github.io/Explorable- Explanations/math/numb...](http://ideonexus.github.io/Explorable- Explanations/math/numbermandala/)

Our favorite thing to do is set the Preset to "Randomized" and click "Render Preset" over and over again to see what comes up. Sorry for the clunky interface, but the source is on github if anyone wants it.

[https://github.com/ideonexus/Explorable- Explanations/tree/ma...](https://github.com/ideonexus/Explorable- Explanations/tree/master/math/numbermandala)

</comment><comment><USER13> My friend discovered an interesting way to visualize prime numbers on an integer grid a while back. I whipped up a quick visualizer for it: [https://codepen.io/joshumax/full/rOrBPz/](https://codepen.io/joshumax/full/rOrBPz/)

</comment><comment><USER14> Might be useless, but I got some pictures for primes too [http://jiyinyiyong.blog.163.com/blog/static/6469987620111311...](http://jiyinyiyong.blog.163.com/blog/static/6469987620111311312374/)

</comment><comment><USER15> I wonder if those lines he mentions are anything like the ones I found in my visualization a while back: [http://chrisdavies.github.io/primepattern/](http://chrisdavies.github.io/primepattern/)

This never led me anywhere, for the record.

<comment><USER16> You get the lines because you're lining up all numbers divisible by 2, 3, 5 and 7. You get a very similar pattern with 210, and a sparser one with, for example, 30030.

<comment><USER15> Yes, that's right. I wonder if it's a similar thing showing up in the spiral. Just a simple consequence like the one that causes the lines.

</comment></comment></comment><comment><USER17> since there are a few math experts here : it just occured to me that number factorization may be similar to compression ( saying 8 is 4 times two feels a bit like compressing a data by composing smaller elements). are there any theory approaching the prime number problems using tools from information theory (shannon and co) ?

<comment><USER18> It is a different representation of a number, but it achieves compression only for some numbers like 2^n for n>13\. Primes and products where each prime factor is only once will be generally longer than ordinary notation.

</comment></comment><comment><USER19> I remember reading Martin Gardner writing about this.

Has anyone found an explanation since then?

</comment><comment><USER20> Looks a little bit an ASCII-art Deathstar. I think I see where a direct hit could set off a chain reaction....

<comment><USER21> I see a fingerprint. Whose finger it is, is left as an exercise to the dreamer.

</comment></comment><comment><USER22> How does this look with numbering in base 8 instead of 10?

<comment><USER23> The base has nothing to do with it. The "pattern" (it never looked like much of a pattern to me) arises from putting it on a grid, not from the choice of base. You can pick different sorts of grids and get different versions of "patterns":

[https://en.wikipedia.org/wiki/Ulam_spiral#Variants](https://en.wikipedia.org/wiki/Ulam_spiral#Variants)

</comment></comment><comment><USER24> Fascinating.</comment>


DHS Asserting Unconstitutional Authority to Search Travelers' Phones and Laptops - <AUTHOR> https://www.eff.org/press/releases/new-documents-reveal-dhs-asserting-broad-unconstitutional-authority-search-travelers <comment><USER2> Whether this is "unconstitutional" is, of course, a hotly contested legal issue. While EFF asserts that the "border is not a lawless place" the fact is that border searches are where personal property rights and the right of a sovereign to police its borders intersect, and the former has historically given way to the latter. One of the very first things Congress did in 1789 was create customs enforcement, empowered to conduct warrantless searches for contraband or dutiable goods.

What the EFF's motion for summary judgment actually does is ask the court to extend _Riley_. There, the Supreme Court held that a search of electronic data on a phone was a fourth amendment violation, even where a search was otherwise permissible without a warrant because it was a search incident to arrest. The idea was that an electronic search did not serve the purposes of a search incident to arrest, which focuses more on ensuring officer safety. A more honest reporting of the article therefore would be "EFF asks court to extend the reasoning of the Supreme Court's recent decision in _Riley_ to hold that the Fourth Amendment protects travelers from searches of electronic data on phones and laptops when such searches are not reasonably related to the purposes of finding contraband and dutiable goods." But that wouldn't bring in all the donor dollars!

I think the EFF actually has a good argument. Possibly the correct argument, at least taking _Riley_ as a given. But man do I hate the press release. (Of course, the EFF's legal filing omits the crap.)

<comment><USER3> Although stored data can be contraband and the court may not see it as different from a drug search. I think it's unlikely we'll see this succeed but I'm hopeful.

<comment><USER4> How can data possibly be contraband? Data is data - it is neutral.

<comment><USER5> Stolen classified material, data used to commit/coordinate criminal activity, child pornography off the top of my head.

<comment><USER6> > Stolen classified material, data used to commit/coordinate criminal > activity, child pornography off the top of my head.

Conversely, data could be attorney client privileged, HIPPA protected, or classified. Many situations would require a traveler _not_ disclose their encryption password.

The government is free to examine these devices, have fingers pressed to keypads, but IMHO they are _not_ free to compel disclosure of the password.

</comment></comment></comment></comment></comment><comment><USER7> I am an Australian national who lives overseas and recently I was going through the airport going into Australia to visit. Turns out we have something similar going on, but backed by law and without constitutional protection.

I was told to hand over the passwords for my laptop and phone, lest they seize them "until they can be opened" (see: forever). This was a mind-bending experience for me and I was further interrogated since apparently I must have "something to hide" if I don't want to hand over passwords to my devices to just any person who works in an airport. They even started asking me things like "What are you doing in Australia?", "Who are you visiting?", "Where are you going?" (I am a citizen, it's absolutely no business of "Border Force" who I visit or where I go) and when I was abrasive about those questions they even asked "Have you been in trouble with the law in Australia?"

At the end I did ask what the reason was for them searching me, their answer was simply that they don't need to have suspicion of anything specific.

<comment><USER8> If you want extra attention all over the world, keep your clothes in Pelican cases. Customs always thinks I'm bringing something in - just my clothes, thanks, take a look.

<comment><USER9> I imagine they don't x-ray well. Also, you probably get all kinds of attention from theives - they would expect camera equipment, not clothes.

Of course, it would all lead to memorable international travel experiences!

<comment><USER10> They're just plastic. They x-ray just fine.

<comment><USER9> I was thinking of the aluminum ridged cases. Maybe I'm confusing it with another manufaturer.

<comment><USER10> Those are called Rimowa, and they also x-ray fine. :)

</comment></comment></comment></comment></comment></comment><comment><USER11> Years ago, when this sort of thing started to become common, I decided I couldn't afford the risk involved in having important electronics subjected to this sort of search. By "risk", I don't really mean disclosure of data (although that, too), but the risk of having the device seized or damaged.

My solution was to stop carrying these devices when I travel. I ship them ahead to my destination through a parcel service, and carry a burner phone (for emergencies) during my actual trip.

<comment><USER12> I fail to see how that actually reduces risks. Mail/Packages across international borders are routinely searched without warrant. It's _explicitly_ allowed by law: [https://www.law.cornell.edu/uscode/text/19/1583](https://www.law.cornell.edu/uscode/text/19/1583)

"For purposes of ensuring compliance with the Customs laws of the United States and other laws enforced by the Customs Service, including the provisions of law described in paragraph (2), a Customs officer may, subject to the provisions of this section, stop and search at the border, _without a search warrant_ , mail of domestic origin transmitted for export by the United States Postal Service and foreign mail transiting the United States that is being imported or exported by the United States Postal Service."

And I think most other countries have similar rules.

And depending on what kind of parcel service you use, you'd not even have protections against warrant-less searches in US domestic context. I'm not remembering the details, but IIRC only First-Class type mail / parcels are protected. Most packages aren't.

<comment><USER11> The risk is reduced in two ways -- first, a smaller percentage of such packages are actually searched. In practice, the searching happens if there's something overtly suspicious about the package, or if you happen to already be of interest to authorities. If any of my packages have ever been searched, it was done well enough that I didn't notice.

Second, should my devices get damaged then the parcel carrier is on the hook to make me good.

<comment><USER13> Plus there's no (or very little) risk of the courier service employing rubber- hose cryptanalysis.

<comment><USER14> Do you have any proof of this?

<comment><USER15> FedEx is awful, but not "hunt me down wherever I'm at, kidnap me, and beat me until I type in a passphrase for a laptop I shipped via Next Day Air" awful.

</comment></comment></comment></comment></comment></comment><comment><USER16> Reminder to fellow travelers: disable biometric-based device access when crossing the US border. It may not prevent your stuff from being cloned, but it may matter down the road as more case law is established.

<comment><USER17> If I use an electronic boarding pass, I temporarily make that my wallpaper so it is usable at the gate without unlocking my phone.

<comment><USER10> Or just print a paper one when you arrive at the airport. You can check in online in app, and still reprint at a kiosk on arrival.

The idea of handing my phone to an agent of the government without physical compulsion is abhorrent to me, and is something I hope to never engage in. For this reason, mobile boarding passes are a non-starter. (see also: wireless keyboards)

</comment></comment></comment><comment><USER18> I think the course of this is that much like the border separation policy, they want the circuits to disagree on the interpretation, and the Supreme Court to get involved. Of course, "someone" could pass a law to clarify the issue.</comment>


Ask HN: How to market this sync platform? - <AUTHOR> Hello there, I have just lunched an OSX utility called SharedClipboard that solved my problems when copy and pasting during editing or coding between computers. Other solutions didn't really work for me as I needed something really fast and also for small files without the need of a storage solution like Dropbox. I know there are other competitors but they don't focus on the clipboard specifically. In my pipeline there is also a windows desktop application and mobile apps . I am wondering what sort of marketing strategy I should adopt to encourage usage . Any help is appreciated.<p>App store link: https://itunes.apple.com/us/app/sharedclipboard/id1061461813?mt=12 <comment><USER2> Open source and provide value add services that are worth paying for when the app is used in a business setting but matter little for individual users?

A common problem with marketing many software products is that they fall into the category of things that aren't worth paying for if I paid for them all. I mean if I pay $10 for every little utility, suddenly I am spending $1000 for my 100 utilities and so I am better served by a habit of not paying for any of them.

Good luck.

<comment><AUTHOR> Hello, thanks for the comment, I totally get the Freemium business model and the current app is free . There will be no point for me to make it open source ( I don't think anybody will really do anything with it) but maybe add the ability to load plugins. So for instance I am going to write one for PasteBin. My question is more about how do I find the users like me that will find it useful mostly developers, editors and similar profiles. Should I start spending money on google adwords for instance? Should I start by talking about it on forums?

<comment><USER2> My suggestion to open source is based on the idea that for other developers to be like in regard to the app, those developers need to be able to:

1\. Control the stack (same as you)

2\. Extend the application to meet their needs (same as you)</comment></comment></comment>


Former UT Supreme Court Justice & religious leader on religion & civil rights - <AUTHOR> http://newsroom.lds.org/ldsnewsroom/eng/news-releases-stories/religious-freedom

<comment><AUTHOR> Why am I posting this on HN? First, because Oaks is a brilliant Professor of Law, and second because I wanted to expose the community to an elegant expression of a different point of view than what they might be used to hearing on the issues of Church and State. I want to hear your thoughts on what Dallin H. Oaks has set forth.

<comment><USER2> > Why am I posting this on HN?

Beats me.

> An active member of The Church of Jesus Christ of Latter-day Saints, a > disciple of Jesus Christ.

Ah, now I get it.

<comment><AUTHOR> Glad you got it, I actually thought it was a sound legal argument. I don't expect many of my fellow HN readers to agree, but I thought they might find it interesting.</comment></comment></comment>


The Beauty of Nature Seen Through Creepy Webcams - <AUTHOR> https://www.wired.com/2017/02/surveillance-cams-everywhere-even-wilderness <comment><USER2> Another cool cam site people end up using for scenery:

[http://avcams.faa.gov](http://avcams.faa.gov)

This is set up for pilots and has reduced weather related fatalities by 50%. I know it's not pretty, A whole new site is about to get rolled out along with a mobile app.

<comment><USER3> Why is there no clickable content in the continental US?

<comment><USER2> Also because people can drive from place to place in the lower 48. most of the spots that are clickable in AK and canada are only accessable via airplane.

</comment></comment></comment><comment><USER4> You can go straight to [http://www.marcusdesieno.com/surveillance- landscapes/](http://www.marcusdesieno.com/surveillance-landscapes/) to see those images. But I lack more information, like the url from those cameras, for example, to check how they look like right now.

</comment><comment><USER5> I'm no photographer but it from reading the article it seems like most of the look of the images comes from how he photographs them?

From my interpretation of the headline I expected the webcams to be producing creepy images but it seems like it is meant to indicate that the fact that these webcams exist/are open to the public are creepy?

<comment><USER6> Well the images were printed in a special media to enhance their supposedly creepy origins. I suspect that the originals looks a lot more boring because they remind us of mundane CCTV footage.

</comment></comment><comment><USER7> "creeepy"</comment>


Putting the MOVE framework in proper perspective   - <AUTHOR> http://blog.appfog.com/putting-the-move-framework-in-proper-perspective/

<comment><USER2> I like this idea of abstracting out the operations and keeping them 'composable'. I'd be interested to see some sample apps utilizing this pattern. My concern is that it may add more complexity than its worth for small apps. It seems like this would be an evolutionary move you make when your codebase is swelling and more stringent organization is needed to keep things tidy.

<comment><AUTHOR> That's a good point. I hadn't seen things quite this way. But you're absolutely right about complexity being a potential problem. For basic CRUD apps, it seems to me like traditional MVC is absolutely the way to go, hence my bristling at the "MVC is dead" claim, which is really just overblown rhetoric. I can see where move would have its place in "thick" client-side architectures, where you have all kinds of events that are supposed to trigger all kinds of functionality in your view. But I'm not convinced that we need to call that another "framework." MOVE strikes me as little more than a potentially useful abstraction.</comment></comment>


iPhone/iPod Touch Multi-touch CAD Remote - feedback? - <AUTHOR> http://blog.maideinc.com/iphoneipod-touch-multi-touch-cad-remote

<comment><USER2> Very nice. I wish we could see the actual UI to get a better sense of how it works - can you post a screenshot?

If you paired this with a Kinect or similar multi-camera system you could allow the other hand to interact with the the model/model elements (when not busy doing extravagant gestures of course). Pretty amazing no matter how you slice it, nice job!

<comment><AUTHOR> I don't have the final assets with me, but here's an old image of the help menu: <http://imgur.com/yWzI4,h5cwO>

And the ui: <http://imgur.com/yWzI4,h5cwO#1>

The ui is pretty simple for now. Gyro controls orbit, one finger controls pan, and zoom is on a scroll on the side. A lot of this is ported over from the iPad version.

</comment></comment><comment><USER3> I have been using this for a project at work - simply as a remote keyboard & mouse for multiple PCs/Macs in the same room. Could you add arrow keys to the keyboard?

<comment><AUTHOR> You've been using which?

<comment><USER3> Maide.

</comment></comment></comment><comment><USER4> It looks stunning.

It hadn't occurred to me that phones could be used as sophisticated remote controllers. What technology do you use for real-time communication?

</comment><comment><USER5> cool

</comment><comment><USER6> that's amazing.</comment>


GWT just got a new look - florian-f http://www.gwtproject.org/

<comment><AUTHOR> Gah! Again! People not explaining what something is on the landing page!

> GWT is used by many products at Google, including Google AdWords and Google > Wallet. It's open source, completely free, and used by thousands of > enthusiastic developers around the world.

Any amount of things fit that description. Beer? Air? Clicking "Learn about GWT" gets you this:

> GWT is a development toolkit for building and optimizing complex browser- > based applications.

That's all it takes! Can we _please_ start seeing these kinds of descriptions on landing pages. You're not selling a clothing brand, you are selling a toolkit to developers: I care first and foremost what the thing does, not how fashionable it is.

<comment><USER2> I agree but GWT is such a well-known project that it's almost OK in this case.

<comment><USER3> I still don't quite grok GWT, even having known about it for something like a decade. Is it a web application frontend thing that compiles Java to JavaScript?

<comment><USER4> Basically yes, you write in Java and it compiles it full-client side JavaScript application. But it also has a lot of goodies, like "templating" or rather binding DOM to code, internationalization, code splitting (so not everything is loaded upfront), client-server communication and other things needed in front development. You typically develop one-page applications with it (fully client side).

<comment><USER5> Thank you. This is the kind of explanation that should be on the landing page.

</comment></comment></comment></comment></comment><comment> ezequiel-garzon Grammar question from this non-native English speaker: does it sound right to say "you can quickly develop _performance AJAX applications_ "? Wouldn't you say something like "high-performance AJAX applications" or "highly performant AJAX applications" (or just "performant AJAX applications")? It seems to be missing something.

<comment><USER6> "Performant" actually isn't a dictionary word, there is sort of a debate about it's use:

[http://english.stackexchange.com/questions/38945/what-is- wro...](http://english.stackexchange.com/questions/38945/what-is-wrong-with- the-word-performant)

the way they are using it seems like their spell checker just changed the word from "performant" to "performance"

</comment></comment><comment><USER7> Been using GWT for almost a decade. It makes it easy to develop and maintain enormous and complex web applications, which would otherwise be difficult if you had to rely only on JavaScript (both the language and the toolchain).

Being able to write the entire application, from the client and the domain model on down to the backend, in the same language, re-using classes across the entire application, is a big advantage.

In addition, being a very mature toolkit by now, GWT has A LOT of features to make life easier. Transparent RPC/serialization, code obfuscation/deobfuscation, IDE integrated debugging, i18n, resource bundling, code splitting, JavaScript interoperability, and a lot of other stuff.

Current project: Real-time multiplayer GTA-style game based on HTML5 canvas:

[http://www.webworks.dk/html5engine](http://www.webworks.dk/html5engine)

<comment><USER8> > * GWT has A LOT of features ... and a lot of other stuff.*

Yep, that's the problem. I had to learn GWT for a project last year and I don't share your enthusiasm. The learning curve is steep, integration with "the rest" of a Java EE application messy (but doable) and you still need a CSS expert. GWT is now a 'grown' framework. Many concepts have changed during the years and therefore many previous recommendations are obsolete nowadays. Documentation is meager. After a while I spent most of the time searching for the _right_ code snippets on Stack Overflow.

<comment><USER9> > and you still need a CSS expert.

Like any decent project.

</comment></comment></comment><comment><USER10> I've never used GWT, but it looks a lot like ASP.NET (all the button declarations in code, heavy page lifecycle in code, etc.). Can anyone with ASP.NET knowledge comment on that? ASP.NET has many problems, there are valid reasons why most developers are moving towards ASP.NET MVC so I wonder what is the place for GWT in modern web dev.

<comment><USER4> First difference is that ASP.NET is running on the server side. GWT is fully compiled to JavaScript and runs in browser. The server doesn't even need to be Java, can be even plain web server without server side code. With GWT you typically develop one-page web applications.

As of doing everything in code - not necessary. As of now GWT has UiBinder - it is a kind of template or DOM + widgets, where you then bind code to it. But in upcoming 3.0 it will use web components standard ([http://www.w3.org/TR/components-intro/](http://www.w3.org/TR/components- intro/))

<comment><USER10> Thanks for clarification. Does GWT assist in storing component state on the server?

<comment><USER4> No, not at all. There is no concept of a component on the server side in GWT. For GWT server is like a second tier, similar as you would write in JavaScript. Though, GWT gives you few ways to communicate with server:

1\. RPC, which is in a way similar to RMI. It supports polymorphism, so you can get an interface in response and GWT will create correct implementation. Java is required on server.

2\. RequestFactory, which is more focused on data transfer than implementation. It also allows to transfer data model, which in server is not compatible with GWT. Sends only delta of changes when sending back to server. Also requires Java on server.

3\. REST. It is not maybe advertised that mutch, but GWT can work with any REST endpoint. It has built in JSON (de)serialization with AutoBeans; or you could also use Overlay types. There also some third party libraries for REST. This time server can be anything, just to return JSON.

But if you really want to have sibling component on the server side, then there is Vaadin - a framework built on top of GWT which has server-side components which synchronize with client-side counterparts. But then, all handlers are on server, rather than client as with GWT.

</comment></comment></comment></comment><comment><USER11> GWT pronounced «gwit»

Seriously? First I've heard this is how you pronounce it. And how does one pronounce gwit? I think I'll continue to call it: G.W.T.

<comment><USER12> First I've heard of this too.

Obviously "gwit" is pronounced as "jwit", right?

<comment><USER13> jw? In english?

<comment><USER14> reference to the gif vs jif debate.

</comment></comment></comment></comment><comment><USER15> I think the word 'resource' is not well spelled ('ressource').

</comment><comment><USER16> I'm looking for a toolbox that can give me:

1\. client-side (javascript) database access

2\. automatic updates to the client's view of the database

And also:

3\. automatic optimal re-execution of javascript code whenever something changes in the input (e.g., the database). Note the word "optimal", e.g., no glitches, and no (or minimal) unnecessary work done.

Of course, it should be fast :) Does anybody know where to find such a toolbox, or libraries that allow me to accomplish the above? Any pointers are greatly appreciated!

<comment><USER17> Take a look at [https://www.meteor.com](https://www.meteor.com)

<comment><USER16> Thanks for that link. I did a bit of reading, and found this [1].

> These are the main bottlenecks when scaling Meteor, and they introduce two > main issues: 1. The polling and comparing logic takes a lot of CPU power and > network I/O. 2. After a write operation, there is no way to propagate > changes to other Meteor instances in real-time. Changes will only be noticed > the next time Meteor polls (~10 seconds).

This seems like quite a limitation. So I wonder if there are any libraries out there that successfully solved this?

[1] [https://meteorhacks.com/does-meteor- scale.html](https://meteorhacks.com/does-meteor-scale.html)

<comment><USER18> Specifically about this issue, see the section about the MongoDB oplog further down in the article. This removes the polling interval/overhead, so should significantly improve performance and responsiveness.

<comment><USER16> Ok. It indeed seems to be the case that the polling delay can be eliminated. But I'm wondering, if db-changes are written to the client directly, is it still possible to apply security rules to that? Evidently, I don't want all my db-changes to be written to all clients, and, preferably, a security-filter should be able to determine which clients receive which updates.

<comment><USER18> Yeah - the very earliest preview versions of Meteor had this obvious gap where reads and writes were basically a free for all. However, it's changed a lot since then. As a development crutch the aptly-named 'insecure' package is installed by default (which maintains the free for all), but you're expected to remove it and able to apply fine-grained control to which clients can C/R/U/D which data.

These two steps of the Meteor tutorial probably describe it best: [https://www.meteor.com/try/10](https://www.meteor.com/try/10) [https://www.meteor.com/try/11](https://www.meteor.com/try/11)

</comment></comment></comment></comment></comment></comment><comment><USER19> I'm surprised GWT is still used out there. It's slow as hell to compile and JS libraries are so much better and more response nowadays.

<comment><USER20> GWT 2.7 has incremental compilation. During development, recompile takes less than a second.

<comment><USER21> Thanks for that information. I used GWT on two personal projects years ago and for customer work three years ago. The only thing that I didn't like we're the long build times.

I like web dev environments that use the same language on both client and server sides: Meteor, Clojure + ClojureScript, and GWT. I need to use several programming languages and there is always a small overhead for me when switching languages.

</comment></comment></comment><comment><USER22> This [http://www.gwtproject.org/doc/latest/DevGuideCodingBasicsCom...](http://www.gwtproject.org/doc/latest/DevGuideCodingBasicsCompatibility.html) seems to indicate that GWT still supports only Java 1.5. Is this true or simply outdated documentation?

<comment> florian-f No, currently it's 1.7 (with gwt2.7.0) and soon (when gwt 3.0.0 is released) it will support java 8.

Parts of the page are still rather outdated and haven't really been touched since 2010/ 2012.

This is why it's so great that the site got a new look now, it indicates that things are moving again and I'm sure the outdated parts are going to be removed soon.

</comment></comment><comment><USER23> Could not easily find what version GWT is on now and OMG those showcases look like they are from previous century.

</comment><comment><USER24> I've never knowingly seen GWT used in practice. Does anyone have any examples of (semi) notable websites utilising it?

<comment><USER25> I used it for about 8 months, Hated it. Its like a big wall between you and the DOM.

I guess its good of you hate html and javascript. But once you grow up and realise your making a web page and need to control the DOM in a particular way, it just gets in your way.

<comment><USER26> Would you recommend it for some one who doesn't know the DOM well?

</comment></comment></comment><comment><USER27> Is it just me, or do the pagination blobs on the right really not work at all?

</comment><comment><USER28> carousel switching buttons on the right hand side are not working, even in chrome.

</comment><comment><USER29> It makes sense in the enterprise world where everyone love Java and Eclipse (at least as far as I can see). It doesn't make sense on HN, not at all.

<comment><USER26> When does something "make sense on HN"? When it is a reinvention of the wheel done in JavaScript?

</comment></comment><comment><USER30> Seems to me the textbook example of Java people trying to make everything Java (and failing at it, as usual)

While it's funny (and sometimes silly) to see a huge amount of .js libraries popping up, they're not adding a big block between the programmer and the browser.

And js may have its quirks, but it's _not java_ and I'm thankful for that. I'd rather use js over java anyday, unless there's something really dependent on it.</comment>


Jeff Jarvis on Google Vs. the EU and the New Anti-Googlism - <AUTHOR> http://thefastertimes.com/mediaandtech/2010/11/30/google-vs-the-eu/

<comment><USER2> tl;dr summary: American known for writing positive things about Google makes disparaging remarks about Europeans for having different views than he does, equates anti-Googlism with anti-Americanism and anti-capitalism.</comment>


MySQL.com compromised via (guess what?) SQL injection - <AUTHOR> http://blog.sucuri.net/2011/03/mysql-com-compromised.html

<comment><USER2> Actual information with more details, minus zero-content blog:

[http://seclists.org/fulldisclosure/2011/Mar/309?utm_source=t...](http://seclists.org/fulldisclosure/2011/Mar/309?utm_source=twitterfeed&utm_medium=twitter)

<http://pastebin.com/BayvYdcP>

<comment><USER3> I really don't understand why people are upvoting this meaningless blog crap, instead of upvoting the HN entry of the original publication:

<http://news.ycombinator.com/item?id=2377013>

<comment><USER4> Because it was submitted ~10 hours prior to the link you posted.

</comment></comment></comment><comment><USER5> Same guys hit Sun.com via SQL Injection as well - [http://tinkode27.baywords.com/sun-com-sun-mycrosystems- vulne...](http://tinkode27.baywords.com/sun-com-sun-mycrosystems-vulnerable- sql-injection/)

 _Shameless self plug:_ Netsparker ( My startup: <http://www.netsparker.com/> ) could have identified both of these vulnerabilities.

<comment><USER6> That product looks awfully similar to Metasploit ( <http://www.metasploit.com/> ) , no?

How is it different? I watched the demo video and couldn't really tell.

<comment><USER5> Metasploit mostly focuses on Infrastructure and exploiting known vulnerabilities.

Netsparker is solely focused on web application security (detection & exploitation). For example Netsparker can crawl AJAX/Javascript apps, support form authentication etc. Metasploit on the other hand possibly will never do that kind of stuff.

<comment><USER7> You are comparing a $1000 commercial product to open source Ruby code. Metasploit is sponsored by Rapid7, which does in fact have a product that is competitive with your offering.

Do we need to get into a detailed discussion of why I think the plug for your scanner is inappropriate for this thread? Or can we just let it suffice to say that HN isn't a great place to promote products on random threads?

<comment><USER5> I'm not comparing, I'm telling the difference. Just like Netsparker will not do port scanning, possibly Metasploit will not do full web app stuff. You can talk with someone from Rapid7 and they'll tell you the same thing. And for the record I love Metasploit, it's a fantastic tool.

We have a good relationship with Rapid7 guys, they even has a module to import Netsparker results into Metasploit and we keep getting synced with them in new updates.

> Or can we just let it suffice to say that HN isn't a great place to promote > products on random threads?

Personally I love seeing other HNers to send their relative products, projects, startups, commercial ideas, job ads in HN threads, I don't think there is anything wrong with that. You might think otherwise, that's why there is one upvote and one downvote button.

<comment><USER7> Metasploit isn't web application penetration tool. W3af, the other open source security tool Rapid7 sponsors, is. Meanwhile, Rapid7's commercial offering, Nexpose, also crawls Ajax applications and, if this flaw is as simple as people seem to think it is, would likely have found it... as would OWASP WebScarab or Burp (a tool that costs a fraction of what your tool does and belongs in the back pocket of every web developer).

I'm responding harshly because I do not agree with your logic (to wit: any thread involving security is a great place to plug your scanner) and because I found your comparison of Netsparker to Metasploit disingenuous: Metasploit simply isn't Rapid7's web app offering.

<comment><USER8> _I found your comparison of Netsparker to Metasploit disingenuous_

I have no position on whether he should mention his product in a news thread about SQLI, but he was responding directly to bjg, who said:

 _That product looks awfully similar to Metasploit (<http://www.metasploit.com/> ) , no?

How is it different?_

So, his "comparison" was just responding to someone saying "Hos is it different?", literally.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Here's some background info on Blind SQL Injection:

<http://www.owasp.org/index.php/Blind_SQL_Injection>

<comment><USER10> Thanks, great read (and interesting eye opener!)

</comment></comment><comment><USER11> while I understand that sql injection is mostly a fault of the host programming language/developer (php in this case) and not of the dbms/dba, couldn't the latter have avoided this in part by limiting user privileges so that it was impossible to "list the internal databases, tables and password dump" e.g. "REVOKE SHOW DATABASES, SHOW VIEW" ?

(I'm aware this may make impossible to use some web frameworks which rely on rdbms reflection, but I have the feeling this is not the case)

<comment><USER12> Sorry, but how is PHP at fault? You can shoot yourself in the foot with _ANY_ programming language.

<comment><USER13> PHP has been known to provide convenient footguns in the past (e.g. register_globals, mercifully depreciated), so it's not surprising that security-minded people give it a hard time.

Think of it as the difference between the language keeping loaded footguns under its pillow with the safety off and keeping unloaded footguns in a locked gun safe. One is a lot less likely to get used than the other, even if either one will shoot your foot just as well.

<comment><USER12> Rehashing old design floors is not an excuse to blame PHP for programmer error.

<comment><USER14> It doesn't seem fair to call a defect "old" if it wasn't seriously addressed between then and now. I had to pick up PHP (presumably because of heinous sins in a past life) and every tutorial I saw was _still_ pasting user input into non-parameterized queries. There are apparently several different MySQL clients, and our production boxes still had the original (inexplicably still in existence) which didn't even _support_ parameterized queries. And that was in 2007!

<comment><USER15> Just hit the same issue here in 2011. Plesk, a popular package for managing shared hosting used by hosting companies, doesn't include the MySQL drivers for PDO (what's meant to be PHP's "standard" database library).

Last week I had to rewrite an import script to use mysql_query(), with mysql_real_escape_string() and quotes for every query variable.

</comment></comment></comment></comment></comment></comment><comment><USER16> Oracle's security team bear full responsibility for this breach. MySQL's founder Monty Widenius left Sun in 2005. Sun declined, Oracle bought them as a strategic buy and the portal has been neglected to the point of being compromised.

One wonders what internal neglect MySQL is suffering behind the corporate veil.

<comment><USER17> Do you really think Monty had anything to do with coding the website anyway?

The guys that write the actual database have _nothing_ to with the web team. They didn't in MySQL days, they don't now.

</comment></comment><comment><USER18> I wonder a bit that there isn't a real binary protocol for SQL.

Edit: It seems there are ways to work around server-side SQL parsing: [http://www.xarg.org/2011/01/is-it-possible-to-avoid-query- pa...](http://www.xarg.org/2011/01/is-it-possible-to-avoid-query-parsing- inside-of-mysql/)

I was thinking more about why it is allowed at all to send text-like SQL queries to a server. A binary protocol would both be simpler to handle and would have saved us from a lot of trouble.

Edit: If all client-side libs (for PHP, Python, etc.) would just use those [prepared statements]([http://dev.mysql.com/doc/refman/5.0/en/c-api-prepared- statem...](http://dev.mysql.com/doc/refman/5.0/en/c-api-prepared- statements.html)), it would be like what I mean.

Edit: Ah, I was wrong (as I hoped): For Python: <https://launchpad.net/oursql>

<comment><USER12> Reply to your further edit (let't hope this is the last one ;)

Prepared statements _should_ afford you a clean conscience because the values never make up part of the SQL query .. unless you are using a library that emulates it, and there are libraries out there that do, so don't assume anything.

<comment><USER7> Prepared statements _do not_ afford you a "clean conscience". You still need to be careful with your inputs in parameterized queries, because not every input to every query can be bound as a variable. Some operations do require dynamic query construction.

<comment><USER12> " _Prepared statements do not afford you a "clean conscience"_ " erm, that was the point I was trying to make.

" _because not every input to every query can be bound as a variable_ " Can you give me an example?

" _Some operations do require dynamic query construction._ " what does that have to do with prepared queries?

<comment><USER19> _"because not every input to every query can be bound as a variable" Can you give me an example?_

var sql = "select * from User where UserType=@ut order by ModificationDate " + sort_order;

In this case, if sort_order directly comes from a 'asc'/'desc' radio button then you have an injection attack.

The correct way to do it would be:

var sql = "select * from User where UserType=@ut order by ModificationDate " + (sort_order=="asc"?"asc":"desc");

The point was that there are some parts of sql that can't be parameterized like sort order or limits on the resultant recordset. Although, ideally support for those things should be coming from your database vendor (if it isn't already there).

For example, SqlServer supports using variables in top expressions: select top(@max) * from ....

</comment></comment></comment></comment></comment><comment><USER20> I can't believe that all these 'BIG names' are getting hacked by group of 2. What is next? Google.com goes down?

</comment><comment><USER21> Doesn't really seem responsible to post the vulnerability details to the public list like that, all necessary shaming on weak passwords aside.

I wonder if the timing on this has anything to do with Oracle's continued dismantling of the useful parts of the MySQL website.

</comment><comment><USER22> What really pisses me off about this is that you _had_ to register just to be able to download the files.

So they unnecessarily had a lot of people's username/passwords for absolutely no good reason.

<comment><USER23> Not entirely true. There is a "No thanks, take me to download" link at the bottom of the form you get after clicking the download link.

<comment><USER24> It's not in a very obvious place. Downloading the mysql source is one of the most annoying experiences I've had on an OSS site. Iframes, select boxes, login forms! Just give me a list!

</comment></comment></comment><comment><USER25> 6661, is that his ATM pin as well?

<comment><USER26> Or the combination on his luggage.

<comment><USER27> Or the code to his garage door.

<comment><USER28> Or his iPhone unlock code.</comment></comment></comment></comment>


Key duplication from photographs - <AUTHOR> http://www.physorg.com/news144519246.html

<comment><USER2> Haven't read it, but on a similiar theme, I found (high-quality) images of G8 ID cards on Google Images (with special embossed string). It wouldn't be hard to make one and get into the summit.</comment>


Universal Forfeit License - <AUTHOR> http://geekwagon.net/ufl/license.txt

<comment><USER2> Is there a particular use case that an existing license does not cover? Why yet another license?

<comment><USER3> It's the same concept as a number of established licenses, like CC0 ([http://creativecommons.org/publicdomain/zero/1.0/](http://creativecommons.org/publicdomain/zero/1.0/)), except with sillier wording. I doubt there's any real purpose to it.

<comment><USER4> I'm quite curious whether all that additional text in CC0 would be likely to truly make a difference in any type of court case.</comment></comment></comment>


YouTube down? - <AUTHOR> Getting server error <comment><USER2> I was getting: ` 500 Internal Server Error Sorry, something went wrong. A team of highly trained monkeys has been dispatched to deal with this situation. If you see them, send them this information as text (screenshots frighten them): <SOMETHING> `

However, they are back up for me.

<comment><USER3> I was seeing that same thing. The headline was "500 Internal Server Error" but the response code was actually 200.

</comment></comment><comment><USER4> The productivity of the whole tech industry has just increased!

<comment><USER5> it is because of China cyber attack. Guowengui(郭文贵) will expose Chinese govement corruption on youtube today

<comment><USER6> Its live now, but no translation. [https://www.pscp.tv/w/1lPKqyoqkrQKb](https://www.pscp.tv/w/1lPKqyoqkrQKb)

</comment></comment></comment><comment><USER7> [http://downdetector.com/status/youtube](http://downdetector.com/status/youtube) Youtube was down for 30 minutes due to DOS attack launched by Chinese communist government to disrupt the live broadcast event of Chinese billionaire in exile Guo Wengui. He planned to expose the evidence of the corruption of top Chinese government officials, but Youtube was brought down 1 and half minutes after the live broadcast began. Here is a report for another episode involving Voice of America(VOA): [http://www.cnbc.com/2017/06/09/interview-with-guo-wengui- thr...](http://www.cnbc.com/2017/06/09/interview-with-guo-wengui-throws-voice- of-america-into-turmoil.html)

</comment><comment><USER8> Yup, I've gotten it a couple of times this morning. I bet they're quite aware and are working on fixing it.

</comment><comment><USER9> I like to watch videos before going to work and them being down has my morning in a funk.

</comment><comment><USER10> I didn't expect the outage to last this long. Neither did they, I'm sure.

</comment><comment><USER11> I'm in the process of uploading a video, and that is still working properly. However, trying to playback some of the videos I just uploaded is hitting an error.

Seems to be a partial outage.

</comment><comment><USER12> Is youtube.com Down?

It's just you. youtube.com is up.

[https://isup.pro/youtube.com](https://isup.pro/youtube.com)

<comment><USER13> Yup. Looks like they just came back online.

</comment></comment><comment><USER14> [http://isup.me/youtube.com](http://isup.me/youtube.com)

</comment><comment><USER5> it is because of China cyber attack. Guowengui(郭文贵) will expose Chinese govement corruption on youtube today

<comment><USER6> [https://en.wikipedia.org/wiki/Guo_Wengui](https://en.wikipedia.org/wiki/Guo_Wengui)

</comment></comment><comment><USER15> maybe only in USA? in Netherlands there were no issues in the last hour

</comment><comment><USER16> because of guowengui's live

<comment><USER16> [https://twitter.com/KwokMiles](https://twitter.com/KwokMiles)

</comment></comment><comment><USER17> This is Hacker News?

<comment><USER18> Confirmed: [https://news.ycombinator.com/item?id=14568693](https://news.ycombinator.com/item?id=14568693)

</comment></comment><comment><USER19> Looks like they were hacked. Not sure what the hash represents but i am sure someone will decode it shortly

<comment><USER11> It's probably correlation information that allows them to pull further diagnostic information.

Mind sharing what information you have which makes you think they were hacked? :)</comment></comment>


Show HN: TestBeacon: UI tests in the browser; we run them and email the results - <AUTHOR> Hey HN, I wanted to show and get feedback on TestBeacon (https://testbeacon.com/), a project I've been working on for about a year and a half.
TestBeacon allows users to write automated tests and workflows for their webapps without ever leaving the browser, using a new language called Flytrap (http://docs.flytrap.io).  TestBeacon will in turn run these tests in the background on your schedule and email your team a report of the results, complete with screenshots and console/error logs.  This allows for an easy way to pre-empt hidden UI & javascript issues before they surface after deployment; it's an added layer of security so you can be confident you won't be playing firefighter today.
TestBeacon also provides a Chrome Extension (https://chrome.google.com/webstore/detail/testbeacon/iboncccoifgbjimboiphmlcbnnllodkn) to make it simpler to automate any website with Flytrap.  It is especially helpful during the development process for quickly writing and running Flytrap scripts.
TestBeacon is moving to an open Beta today, so if you think we can help you, please sign up and give us feedback on your impressions of the product!
Full environment: TestBeacon (https://testbeacon.com and https://app.testbeacon.com) - Run automations for your webapp in an iframe using Flytrap. Flytrap (http://docs.flytrap.io) - Javascript library used to interpret Flytrap scripts and run automations for your webapp TestBeacon Chrome Extension (https://chrome.google.com/webstore/detail/testbeacon/iboncccoifgbjimboiphmlcbnnllodkn) - Extension to simplify automating your SPA during the development process. <comment><AUTHOR> An attempt at clickable links:

[https://testbeacon.com](https://testbeacon.com)

[https://app.testbeacon.com](https://app.testbeacon.com)

[http://docs.flytrap.io](http://docs.flytrap.io)

[https://chrome.google.com/webstore/detail/testbeacon/ibonccc...](https://chrome.google.com/webstore/detail/testbeacon/iboncccoifgbjimboiphmlcbnnllodkn)

</comment><comment><USER2> Nice concept, but even as a developer, not easy to kickstart to try out this product. Some simple walkthough or guide for Flytrap language will be useful</comment>


ZType – typing game - <AUTHOR> http://zty.pe <comment><USER2> I like the design choice of chilled music and graphics which contrasts with the game objective of typing fast. Makes me want to type as fast as I can while remaining perfectly relaxed.

</comment><comment><USER3> I'd love to be able to start at higher levels. Depending on your WPM, the first few minutes are somewhat boring... but if you keep grinding for long enough, it's quite challenging.

Especially when the capital ships start shooting!

</comment><comment><USER4> The "load your own text" option is a really fun way to read articles and blogposts. Check out [http://zty.pe/?url=https://en.wikipedia.org/wiki/R-Type](http://zty.pe/?url=https://en.wikipedia.org/wiki/R-Type)

</comment><comment><USER5> It's fine... but I have to ask: is it really good to have another game in which you can't win?

You can complete a level -- but then a new, faster one starts. Change the semantics to "You won Level N!" and add an optional cookie to remember your high-scores, and this becomes a much more positive game.

</comment><comment><USER6> This is not meant as saying "old news", but merely asking, is this new? I remember seeing something like this as the first HTML5 game I encountered a few years ago. Not sure if it was specifically this or just same concept.

Nevertheless, good fun! I had Typing of the Dead for Dreamcast with a keyboard and played the crap out of that. Even more so than the regular House of the Dead which I also had.

<comment><USER7> According to the website [http://phoboslab.org/#games](http://phoboslab.org/#games) it is from 2011. I remember playing and enjoying it around that time, too.

</comment></comment><comment><USER8> I played this game years ago and enjoyed it.

To make my life more interesting, I tried making a bot to play a game. I noticed the game ignores wrong keystrokes and there is no penalty.

So my bot cyclically types the letters A through Z at a few hundred keys per second. It really does the trick!

<comment><USER9> I bet sorting the letters by frequency in the English alphabet would make it faster.

</comment></comment><comment><USER10> I actually had some fun. I love how the shooting sound adapts to your typing!

</comment><comment><USER11> I used to play the first version of this game [1]. This seems to be more intense and faster. Oh, and you can get the music here [2].

[1]: [http://phoboslab.org/ztype/v1.html](http://phoboslab.org/ztype/v1.html)

[2]: [http://nofatenetmusic.bandcamp.com/album/the-phoboslab- works](http://nofatenetmusic.bandcamp.com/album/the-phoboslab-works)

</comment><comment><USER12> Doesn't work with vimium, or probably any browser extensions with single key shortcuts - pressing T opens a new tab and so on.

<comment><USER13> Press i in Vimium, ctrl-z in Pentadactyl, or shift+esc in Vimperator, and they will pass everything except esc (shift+esc in vimperator) to the page.

<comment><USER12> Thanks! I did read vimium's readme years ago, but in the meantime I had totally forgotten about insert mode.

</comment></comment></comment><comment><USER14> Missing Dvorak support in the phone

</comment><comment><USER15> As a non-touch typist, what is a good score or wave to reach if you are a fast touch typist?

<comment><USER16> I'm not sure if I'm a fast touch typist, but I reliably make it to round 24 with around 95% accuracy. I've never passed round 26

<comment><USER17> That seems really fast. I topped out at level 22. However in the "load text mode" (link on this) it's easier; my laptop died in level 28.

</comment></comment></comment><comment><USER18> and then you press backspace and you are back in hackernews!

</comment><comment><USER19> fun little game, gets quite hard after a few min

</comment><comment><USER20> 1400 at 7am, I call that pretty good.

<comment><USER21> 1200 after three game. I tend to mistype sometimes and it hitches onto some word I am not noticing and looses me precious few seconds :(

<comment><USER20> Yeah I noticed that too. I wax assuming that it would target the word nearest the bottom that starts with the letter I start with, but I don't think that is the case. Not sure, but not def tripped me up a couple times. No excuses though, definitely need to get faster.</comment></comment></comment>


Transactional analysis - <AUTHOR> https://en.wikipedia.org/wiki/Transactional_analysis <comment><USER2> I can recommend Eric Berne's book "Games People Play", which covers transational analysis and shows how it builds up into lifestyle 'games' such as alcoholism, dysfunctional relationships, etc. Might be useful for online discussion forums. Just sayin.

I'd also recommend another book of his "What Do You Say After You Say Hello?" which covers the kinds of scripts that appear to govern a lot of what we think we want out of life.

Regardless of whether you buy into the theories, they're fascinating to read about.

</comment><comment><AUTHOR> In particular, it was interesting to read about the theory of taking over social interactions by changing one's ego-state.

A: '"Is your room tidy yet?' (Parent to Child)

B: 'I'm just going to do it, actually.' (Adult to Adult)</comment>


A change thousands want made to Google+ circles - <AUTHOR> https://plus.google.com/116872576248355504859/posts/gn3uQfCFyRs

<comment><USER2> I've seen multiple variations of similar requests. It seems that there's two separate problems that need to be addressed. There's the broadcasters problem where people want to broadcast information only to select groups of people. Facebook has taken a stab at this, Google+ has done it much better, and the concept is merely Public/Private for Twitter.

Then there's the subscriber problem where people want to read relevant information on a specific topic. This problem only seems to exist when connections only need to go in one direction, i.e. following. Here users want to be able to view posts on specific subjects by those with "celebrity" type persona's. Twitter solves this (IMO, poorly) with the use of hashtags and multiple accounts. The hashtags don't solve this problem completely because you can't subscribe to a specific user's hashtag. I don't personally care that @pydanny is drunk at a wedding with Audrey, but I'm super interested in his DjangoCon talk. I also don't care about Joe Schmoe learned the power of decorators in his #django views.

To me, tags don't seem like the right approach because of the reasons above. I personally like the concept of "Channels". Users can create any number of channels for whatever they want to post about. When you are adding a user to your circle, you can select which channels you'd like to subscribe to. Then when they post they can select which channel the post is relevant to. Now, some of you may say: Whats the difference between this and tagging? Well, the distinguishing factor is that you need to create channels prior to posting to them. It forces users to categorize their subjects consistently, and it allows subscribers specific choices on what they'd like to see.

<comment><AUTHOR> How is a "channel" different from what I'm describing as a "public group"? It seems to me to just be a different name for the same thing.

In particular they both appear together in the autocomplete for who you're going to send your new post to.

<comment><USER3> It sounds to me like "channels" are defined by the poster, but "public group" (which I don't see you talking about anywhere on this discussion) would be taken from a global namespace. The way I choose to carve up reality is going to be slightly different from someone else's, and that difference is important.

(...and, in fact, the way I'm now reading the original poster's concept of "public circles" also seems like it is defined per-poster; but the mechanism on Flickr for "public groups" that mc32 is talking about is quite different: it requires a bunch of shared coordination over what that group means.)

(...and now I've skimmed through a bunch of your history on HN, and found that you talk about "public circles" occasionally, but do not mention "public groups", so I'm just confused. You do, however, compare them to Facebook Groups, which to me have that same global namespace problem. It is useful and important that my public circle might be called "Android Bytecode Manipulation" whereas someone else's might be called "General Instruction Manipulation", as these aren't even hierarchically related; "Sneaky Programming Hi-jinx" from someone else may be relevant and interesting to you as well; once you force things to be maintained in a public namespace it becomes a lot less personal and a lot less social in the particular "sharing is what it means to you" way that Google+ is all about.)

<comment><AUTHOR> Read more carefully. I was not the one to compare it with Facebook Groups. We're both talking about the exact same concept. The user says, "These are groups of people that I want to send information to" and anyone who wants can add themselves to those groups.

</comment></comment></comment></comment><comment><USER4> Usability case #1: Guido creates a 'python' circle for his occasional musings, marks it as public soapbox and done. He can't add but can invite. Starts posting and all his followers get the tidbits. Twitter is dead.

Usability case #2: Guido creates a 'python' soapbox, which is a reference to his blogger account. Starts posting from G+ and automatically updates blogger where all his followers get the tidbits. Twitter is dead. Also posterous and wordpress.

<comment><USER5> If Google's retirement of the Blogger name is evidence of something else, it would be case #2.

</comment></comment><comment><USER6> The issue is that circles need configuration themselves. They serve two purposes: targeted sending and receiving from people. The receiving bit needs the ability to add filtering.

Facebook has this same issue. I want to get updates from my "friends" but I don't want everything they send. Just whatever is relevant to the context I added them for in the first place.

</comment><comment><USER7> He should just stick to a reddit subgroup or facebook or twitter or something. I kinda like the privacy and simplicity of circles. And in this realm there is no one size fits all. Google+ can be more small, closed group oriented, someone else can fill your broadcasting desires. Emphasis on everything is emphasis on nothing, and google circles fills a void between email and broadcast (twittter/FB feed) that I love. Keep it that way.

<comment><USER8> Agreed, the whole point of something like Twitter is to have a default public broadcast medium for short messages. Why not just use it for that and leave Google+'s circles to what they do (best)?

<comment><USER9> Because the presence of public circles (channels, topics, columns) need in no way dilute the current functionality of (private) circles.

G+ is where the audience is at, so that's where Notch would like to broadcast. Obviously a large number of fans are already following him for the purpose of getting this specific information, not noise on other subjects. If we don't enable that category of user, they're going to depart for greener pastures completely (rather than alienate their fans with a poor experience).

</comment></comment></comment><comment><USER10> It seems like people want Reddit more than they want another social networking site.

<comment><USER11> I want them both. And a blog. And something like Twitter but with better ability to follow a conversation (something like the way identi.ca works).

I have only briefly played with Google+, but with some tweaks and some enhancements to the publishing aspect of one's outgoing stream of posts and some way to follow subsets of people's public posts (maybe integrate with Blogger?), I think they could make a serious run at ALL current services that are based on organizing and presenting user-generated content.

That would be a very ambitious project, though. I wonder if Google has the cojones for something that big?

</comment></comment><comment><USER12> There's dozens of existing ways to have public posts that people can subscribe to (twitter, blogs, mailing lists, etc). In contrast there's not many places that let you share information the way Circles does. Kinda lame that as soon as people jump on Circles, they just want a rehash of the same features you can find anywhere else.

<comment><USER13> I'm not so sure you get it. Yes.. you can subscribe to a lot of different mediums. But unless I use one medium for each audience, there will be overlap.

For instance.. barrybe may be in a "Friends" circle and a "Programmers" circle. In a programmer to programmer relationship, I only want to hear relevant topics. As a friend though.. I may want to be subjected to your waves of pictures highlighting your 2nd childs 1st steps. There's no way to keep the kids crap out of my "Programmer" stream.

The same is true for your blog. Unless I can subscribe to particular tags, I can't keep our interaction focused. I may get a rant, a story, an educational post.. it could be anything.

So the next best thing is organize all content by topic (for me). And here we have it.. "Hacker News". Except.. this environment is far less personal and far more intimidating.

<comment><USER14> >>There's dozens of existing ways to have public posts that people can subscribe to (twitter, blogs, mailing lists, etc).

> _But unless I use one medium for each audience, there will be overlap._

No, that's what hashtags on twitter (surely twitter clients do filtering??) and topics on blogs and groups on Facebook and search wherever is for.

</comment></comment></comment><comment><USER15> Google definitely needs to do something about the public/private problem. Earlier today I blogged about why I think Google+ sharing is not revolutionary: <http://www.ajennings.net/blog/?p=41>

Google+ doesn't support the broadcast/subscribe model that well, and although it helps posters keep stuff private when they want, it ultimately leaves the decision of how much information is too much or too little about some person up to the sharer, when it should be dictated by the recipient.

<comment><USER16> > Google+ doesn't support the broadcast/subscribe model that well, and > although it helps posters keep stuff private when they want, it ultimately > leaves the decision of how much information is too much or too little about > some person up to the sharer, when it should be dictated by the recipient.

Social Networks are not supposed to be the same as a broadcast medium. What is being discussed in this thread is how to bridge the gap, but to suggest that information flow "should be dictated by the recipient" _instead_ of permitting fine-grained sharing misses the _entire point_ of Google+'s approach to sharing.

Allowing the recipient to dictate information flow is excellent for self- promotion, marketing, and news broadcast. It doesn't make sense for how people interact with friends, family, drinking buddies, and colleagues.

</comment></comment><comment><USER17> Circles work when I know what kind of posts my friends like and when they know what I like, but what about when we don't know what each other likes?

I want to share my posts with all my friends and have them decide what they want to see. I want to tag my posts or have my friends tag my posts. Then, they can follow my posts with certain tags or hide them from their stream. I want to see what they post in certain circles and join or subscribe. It's like twitter lists, but instead of lists of people, it would have a list of posts.

</comment><comment><USER18> Isn't that what the "Following" Circle is for? People who care about Minecraft add him to that Circle? Maybe I misunderstood the purpose of that Circle.

<comment><USER19> He wants a circle that he doesn't have to maintain, which the interested audience "subscribe" to. He can then post Minecraft updates to this. He wouldn't know who they are (even if they add him to a circle, he wouldn't know if they are interested in Minecraft and that would be a lot of work for a big circle) to add them himself.

I want this too, not necessarily as proposed, but at least the use case supported, somehow.

<comment><USER20> That's how the 'following' circle works. Notch makes a 'public' post, and everyone who has him in their following circle will receive the update.

<comment><USER19> No, Notch posts frequently about Minecraft. So everyone who follows him but don't care about Minecraft will get those posts. That's the problem. The only solution now is for him to not post Minecraft related material to Public, but to a particular circle, say "Minecraft" which, due to how Circles work now, he has to bear 100% of the effort to maintain the people in it, which is not feasible (as I described above).

</comment></comment></comment></comment><comment><USER21> Flickr has a pretty good solution to this. You can create public groups, private groups and invite-only groups.

</comment><comment><USER22> I bet there are thousands of people that want the voting scores on comments in HN to come back but that wont bring them back. Designing software is not a popularity contest. "If I had asked people what they wanted, they would have said faster horses." - Henry Ford

</comment><comment><USER23> Well, people most of the time fail to see that the universe does not turn around them. What percentage of users want it ? Minorities. Celebrities and mostly people who refer to a big audience of people.

But what will happen if Google will keep adding everything that will turn out useful for someone ? Those people who wanted to use those features will again say that Google+ is geeky.

Twitter has only one way follow, nothing more, facebook has either only one way follow (for pages) or the whole clutter (All you network).

Shut up and stop trying to make the world fit you, try to fit in yourself

</comment><comment><USER24> Awesome idea. It would be like a reddit, where only top +1ed articles/shares would pop to your stream. A selective algo

</comment><comment><USER25> Ashton Kutcher and Ryan Seacrest can't join G+ until they fix this. Well, they could, but they couldn't use it for personal stuff. Try sorting through ~5 million notifications looking for the thousand or so that you actually know.

<comment><USER26> <https://plus.google.com/100300281975626912157/posts>

<comment><USER27> Ashton Kutcher is an entrepreneur now and "makes stuff" ?

</comment></comment></comment><comment> john-n Sounds like a way for sparks to run. Also, I suspect the 3000+ +'s is the authors popularity (minecraft) as opposed to the popularity of the comment.

</comment><comment><USER28> Going to once again reinvent IRC? ^_^

</comment><comment><USER29> discussion forums + ?

</comment><comment><USER30> But that ruins the idea of a Circle. If I can join into a circle, the entire idea of a circle as it relates to privacy becomes ambiguous and you lose the clear distinction that probably already isn't terribly clear among more novice users.

There's a way to fix this, but it's not via public circles. There are lots of good ideas out there about how to use tagging, filtering, sparks or combinations of the three to provide a subreddit-esque layer on top of Google+ that would enable more content and options for users while still allowing my Mom to safely post her pictures to her Family circle without worrying about "Public circles".

<comment><AUTHOR> The key idea of a circle is that I have different kinds of content that I want to send to different audiences.

Google+ currently handles that fact when it comes to private content. It does not handle that fact with public content.

I agree that the whole public/private distinction is important to keep clear. But there are a lot of ways to do this. For instance make public circles blue when you add them, and private ones green. And add a tooltip to make it clear what the colors mean.

In short, I don't buy the idea that "grandma can't understand this" as a reason to deny a feature that a lot of people want. And that matters disproportionately to the top content producers.

<comment><USER31> _In short, I don't buy the idea that "grandma can't understand this" as a reason to deny a feature that a lot of people want._

Along those lines, what people are asking for here is pretty much the ability to make Google+ a bit more like Twitter.

From conversations with grandma and her ilk, grandma doesn't get Twitter, either, so I don't think you're losing very much.

Google+ seems to be positioning itself as the Android to Facebook's iPhone, for people that want more control and don't mind jumping through a few more hoops as long as they have it. I think they've still got some complexity to burn, especially if they continue to make the UI as easy to comprehend as it's been thus far.

</comment></comment></comment><comment><USER32> It seems like Sparks could be modified to support something like that. Maybe it already supports this exact thing.

<comment><USER33> Sparks looks like the preemptive avenue for sponsored content. Reminds me of an AOL suggested content sinkhole. It's an insult, really. At least back when people were dialing up there wasn't much in the form of federated content so it was in AOL's interest to prime the customer with bland reading matter to keep them interested. This Sparks thing, I dunno.

I think at this point since they have all the early adopters already locked in and providing feedback, they should think of suspending any new signups until they have the circle matrix figured out, like Twitter did.

<comment><USER34> If there's a place anywhere on G+ for a reddit-style up/downvote system, it is Sparks. Let me teach it what I am interested in.

<comment><USER35> That would be great. It seems like Google has the brainpower to figure out a way to use up and down votes to target ads better as well. I would love to see ads based on things that I am actually interested in.

</comment></comment></comment></comment><comment><USER36> I posted the same request. I run a Facebook page for a small special-interest community with a few hundred members. Members can meet each other, share relevant info, and there's some people with powers to moderate the inevitable borderline-commercial crap that pops up rarely. G+ doesn't have this.

Maybe Google Groups + G+ can have babies and make a superior opt-in, shared- community solution to Facebook pages.

The thing is, from Google's marketing perspective, this is also similar to LinkedIn and .. well .. it would just look way too much like "more of the same" for them to push it hard at launch. But the demand's clearly there, I think we'll see it added.

</comment><comment><USER37> What part of this nonsense hasn't been solved 10 times better by bulletin board systems and usenet groups? A stream of 1000 users is a stream of garbage.

</comment><comment><USER38> My curiosity with G+ increases. Anyone has an invite for me?

<comment><USER39> Sure, but there's no e-mail address in your profile.

</comment></comment><comment><USER40> is it the -1 button? oh, well, that looks cool too :P</comment>


Would you swap your country for America?  - <AUTHOR> http://www.telegraph.co.uk/expat/expatlife/8989245/Would-you-swap-your-country-for-America.html

<comment><USER2> Yes. I've lived in three nations.</comment>


Ask HN: Evaluate an offer for a startup advisor - <AUTHOR>

My co-founders and I just began searching for $1.5-2M of funding. We met with someone who has many contacts and friends who are angels or VCs.
After meeting with us, he surprised us by offering to:
* Be an independent director of our startup. He'd advise on the shareholders' agreement, business relationships, and business model design and strategy. In return, he's asking for $1500/mo plus $1500 for each Board meeting. This would be payable if we raise money or reach a certain amount of revenue.
* Be a consultant for raising funds. He'd advise us on our approach and pitch, and providing introductions via his commercial and personal network. In return, he's asking for 3% of the raised funds.
My co-founders and I are new to raising funds, and thus don't know how to evaluate this offer.
Assuming that he's experienced with startups and raising capital, and has an extensive network of personal and commerical contacts, is this offer fair? <comment><USER2> Asking for money, rather than equity, strikes me as a large red flag. If he doesn't believe in you enough to sign on for equity, how will he do a good job networking and putting together deals?

Investors like to see excitement. His connections are going to know that he doesn't believe in you long term (he's making a cash grab). How is that going to look?

</comment><comment><USER3> I'm concerned that he would rather have small amounts of cash than a small equity stake in the company.

<comment><USER4> Agreed.

</comment></comment><comment><AUTHOR> That's a good point, @HockeyPlayer and @Travis. Hrmm</comment>