Two top Equifax execs to retire after security breach - <AUTHOR> https://www.wsj.com/articles/two-top-equifax-executives-to-retire-1505510863 <comment><USER2> I was pretty sure it was true that the CISO had no experience at all after listening to the first two or three minutes of the video interviews that were available here[1], but apparently they don't want anyone to see interviews with the CISO from before the breach (as they have been scrubbed from the internet.) I have never seen anybody say cloud so many times in two minutes.

By the end of the interview, I felt sorry for her. I have no idea if she had relevant experience or not, she just sounded like someone who has been conditioned to argue that delays in new development are unacceptable, and that the cloud is inevitable, and if it costs more to do it right then you'll have to make do with less, and cetera and so forth. I'm not terribly shocked that they've taken down these interviews, but I am very sorry I didn't save a copy when I found them.

The interviews were still available for viewing as of 12:31pm Eastern Time on Sept 10, and there are transcripts that you can find following the links in the article, which has been updated to note the videos were scrubbed from the internet.

[1]: [https://www.hollywoodlanews.com/equifax-chief-security- offic...](https://www.hollywoodlanews.com/equifax-chief-security-officer/)

"The full interview videos went far in explaining what may have been the eventual cause of the massive leak of information now gravely affecting 143 million Americans."

Serious question, is there any way this might actually count as destroying evidence?

It says the interviews were removed by user, but I saw them and they were briefly still playable after they were first reported on. Someone must have been keen enough to snag a copy. They were _eye opening._

The transcript does not include the quote that really brought it home for me, "resistance to the cloud is futile" – I wonder what else it does not include...

[https://archive.is/Je7Yi](https://archive.is/Je7Yi)

[https://archive.is/6M8mg](https://archive.is/6M8mg)

</comment><comment><USER3> I think we're looking at this all wrong. It doesn't matter what the technical details are. If you're controlling something dangerous it's your responsibility to ensure it doesn't do damage or hurt anyone.

Take a car for example. If you're driving and you allow the car to hit someone and they die, you are charged with manslaughter. It's your responsibility to operate it safely. It doesn't matter if the conditions were difficult. In fact it's worse - you shouldn't have operated the car.

It's the same concept here. They were operating something dangerous and did not take the necessary steps to ensure our safety.

They should go to jail.

<comment><USER4> Agreed.

Though I think it's debatable whether leaking SSNs is comparable to manslaughter.

<comment><USER5> It might be worse. But I dont know how anyone can weigh destruction of one life vs ruining thousands of people's lives (or at the very least increasing the general angst among society at large).

</comment></comment></comment><comment><USER6> Ah deploy those golden parachutes and sail off to the Bahamas while giving 140M American a big fat middle finger.

I can see the justification for those large compensation packages for CxO only when something like this happens they would bear the corresponding responsibility - maybe even forced to sell a few yachts or a few summer homes here and there maybe to offset the investigation costs even.

</comment><comment><USER7> I wonder how much they get in their retirement package ?

</comment><comment><USER8> They need to take a look at their software development area as well.

[https://www.fastcompany.com/40468811/heres-why-equifax- yanke...](https://www.fastcompany.com/40468811/heres-why-equifax-yanked-its- apps-from-apple-and-google-last-week)

<comment><USER9> Do they not get their apps security scanned? In my experience checking all requests go over HTTPS is the first thing that the security teams check. You'd think since Equifax works with banks they'd force them to adhere to some kind of security testing.

<comment><USER8> Exactly! This is so bad. Way worse IMHO than a failed patch or default admin/admin password in terms of showing a lack of competence. Those are ops issues. This showed core issues in their ability to architect and develop secure code. This wasn't a missed patch or config file, it was flat out not knowing how to write an even remotely secure (on the wire) application.

</comment></comment></comment><comment><USER10> If the credit history data of many people have been copied from Equifax, then the effectiveness and value of credit identity verification measures using the exact same data from the other two agencies and any company relying on those services severely drops. One wonders how that aspect of the industry will change going forward...

</comment><comment><USER11> Perhaps with enough heat they'll start clawing back some of that money.

</comment><comment><USER12> Only in jail as far as I am concerned, why would be the only one to suffer.

</comment><comment><USER13> I think it's important to take a step back, take a breath, and look at this rationally.

Look at what actually happened. Equifax was using the Struts framework. This is a very safe, popular choice. They were using what everybody else uses.

There was a critical vuln in the framework, and they failed to update their box for N months. But we're talking only a few months. N is very small -- maybe four? And yeah, you can argue that four months is an absurdly long time to have a known critical vuln in production. But I guarantee you that most people reading this work at companies that are similarly vulnerable. Attacks are simply rare.

Whatever company you work for, if you do not have regular pentests, you are no better off. And even if you do, it's overwhelmingly likely that you've overlooked some lonely outdated server that's still running on your network because Bob set it up a year ago and forgot about it and oh look now you have a pivot into your whole network.

It seems very strange to choose this one company and crucify them just because they lost your data. Everybody is insecure everywhere always, and we've learned to tolerate this by pretending it's not true or that it doesn't exist or that it's not a big deal. But you know what? It is true. That truth will continue to manifest itself in the years to come. No matter how much you'd like it not to be true, your stuff will still get stolen. Usually you just don't hear about it.

Yes, it was stupid for them to have everybody's PII attached to that one webserver. A single point of failure should never result in compromising the whole system. But think about how that architecture would work in practice. A customer service rep still needs to get at most of your data. It's a credit bureau. Where would the data be stored in a way that a remote code exec wouldn't be able to snag it?

Equifax's crime boils down to "they failed to run the equivalent of sudo apt- get upgrade on their framework." When you're managing a fleet of hundreds or thousands of machines, this is a situation that almost all of us have wound up in. If we can't get it right, why do you want the execs' heads to roll? Are you sure you won't be next on the chopping block?

Think about it this way: the time between "someone discovered a vuln in Spring" and "the attackers stole 150M credit reports" was just a few months. Are you sure Equifax wasn't a victim here? Someone threw a cinderblock through their window and made off with their trove of data.

Except of course, it wasn't a cinderblock through a window. It was completely silent. Even if your firewall is great, you can still smuggle data out of a network using DNS alone.

Food for thought.

<comment><USER14> _> But I guarantee you that most people reading this work at companies that are similarly vulnerable._

We hold Equifax to a higher standard because of the nature of the data that it collects.

 _> Everybody is insecure everywhere always_

Some of us think that's neither necessary nor inevitable.

 _> If we can't get it right, why do you want the execs' heads to roll? Are you sure you won't be next on the chopping block?_

In some professions, including many engineering ones, gross negligence is punished with the removal of one's ability to practice professionally. It's imaginable that if there were consequences for one's actions, things wouldn't be "insecure everywhere always".

Really, how am I still finding people taking time out to defend the incredible ineptitude of a privacy-oblivious company in a hated industry?

<comment><USER13> The point is, you can hold them to whatever standard you want to. We collectively have not figured out _any techniques_ to achieve the goal: to be impervious, always. And that's what you demand (or "require," as patio is fond of saying).

You can disagree with that, but you'd be hard-pressed to justify that position. Six decades of computing history would contradict you. And as someone who saw the landscape of real-world codebases and deployments at nearly a hundred companies, there is almost always a way in. People are smug thinking their code is great till you show them an SQL injection that works, or pop up an alert(1) on their favorite front end framework.

The moment the world freaks out about this lack of security, we've all lost. Imagine a dystopian future where the only way to write consequential software is to have it approved by three committees. You might think that's how it already is, but we can move way farther in that direction. Just look at how hard it is to run a simple medical study.

<comment><USER14> _> We collectively have not figured out any techniques to achieve the goal: to be impervious, always._

What? It takes vigilance, training, competence, and a culture of security. Oh, and lots and lots of money backing it up. If your company isn't willing to make that commitment, then your company shouldn't legally be allowed to handle any sensitive data at all. The legal consequences of a leak will be moderated if it is proven, by fellow professionals, that a company took every standard precaution necessary based upon the sensitivity of the data in question. Nobody (except for perhaps yourself) seems to be claiming that Equifax's technical chops were anything but inept.

 _> Six decades of computing history would contradict you._

Feel free to actually cite anything at all supporting your position, rather than glibly appealing to inevitability.

 _> The moment the world freaks out about this lack of security, we've all lost._

As if we haven't already lost? The Equifiax leak is a privacy disaster of the highest order.

 _> Imagine a dystopian future where the only way to write consequential software is to have it approved by three committees._

I welcome this dystopia with open arms, if it means it can save us from defeatists who have given up on the idea that software doesn't have to be completely terrible.

<comment><USER13> _What? It takes vigilance, training, competence, and a culture of security. Oh, and lots and lots of money backing it up. If your company isn 't willing to make that commitment, then your company shouldn't legally be allowed to handle any sensitive data at all._

I have personally breached companies that fit this description. That was my job, and it's why I was hopefully the last person to breach that particular facet of their landscape.

But pentests can't catch everything. That's the dirty secret that is also somehow not a secret. The very next commit could make that pentest obsolete. Ditto for spinning up a server.

 _As if we haven 't already lost? The Equifiax leak is a privacy disaster of the highest order._

Well, what do you think will happen from this? That may be true, yet the world will go on. We've been trained to accept the current system as inevitable, but SSNs aren't a security mechanism. The underlying absurdity is that we view leaking them as a disaster rather than recognizing and replacing the fact that we all rely on their secrecy.

If someone wants to impersonate your identity, they can usually find a way. This breach will certainly make that easier, but I'm not sure it will affect the actual fraud rate. Time will tell.

(I'm aware far more than SSNs were leaked. The point is that it was a bad idea to have this central point of failure in the first place. If it wasn't Equifax, it would've been someone else.)

<comment><USER14> _> The very next commit could make that pentest obsolete. Ditto for spinning up a server._

This is addressed by "vigilance". And no, we still aren't asking for perfect security. Even on human-scale timeframes, the odds of a single exploitable vulnerability being introduced in any aspect of the software, for even a moment, are 100%. But if it takes only a single vulnerability to completely exfiltrate the whole of a company's sensitive data, then you're going to be hard-pressed to find anyone calling that a securely-designed system. I'm sincerely sorry that a career spent in the trenches has left you so jaded and cynical, but we _can_ do better, and hopefully we as an industry do so before the government looks at our inability to self-regulate and imposes double- secret-hyper-SOX on all of us.

</comment></comment></comment></comment></comment></comment><comment><USER15> This isn't enough.

</comment><comment><USER16> Retire is the new fire

</comment><comment><USER17> "Retire?" Do they mean like retire to a federal prison?

<comment><USER18> no, that's where the poor and disadvantaged retire to. and the occasional disgraced public servant.

</comment></comment><comment><USER19> "Why did you leave your last job?"

<comment><USER20> "I felt I had contributed all I could and felt undervalued so I'm seeking a new opportunity"

</comment></comment><comment><USER21> paywall:

[http://www.facebook.com/l.php?u=https://www.wsj.com/articles...](http://www.facebook.com/l.php?u=https://www.wsj.com/articles/two- top-equifax-executives-to-retire-1505510863)

</comment><comment><USER22> TIL their Chief Security Officer is a music major...

<comment><USER23> Some of the best engineers that I worked with have been Linguists, Music/Composition majors or Physicists.

<comment><USER24> name three

</comment></comment></comment><comment><USER25> NOT SO FAST!!1

</comment><comment><USER26> If you retire, how do the dynamics of a criminal prosecution change?

What is the chance that these executives flee to a non-extradition country such as Russia or China for a bit, "just in case"?

Some people flee to the EU because they can make a plea against extradition based on the appalling human rights abuses in the US prisons.

I hope Lauri Love wins on that front.

<comment><USER27> The EU is way more serious than the US is about consumer privacy though. Might not help them in this case.</comment></comment>


Rats love driving tiny cars, even when they don't get treats - <AUTHOR> https://arstechnica.com/science/2019/11/these-rats-learned-to-drive-tiny-cars-for-science/ <comment><USER2> I want to know how well they handle traffic and being stuck in a rat car for hours driving the same routes every day.

I know that's not the point but I'm curious at what point their newly learned driving skill becomes a chore.</comment>


Inside the Scene-Stealing 3-D Technology Behind James Cameron's Avatar - <AUTHOR> http://www.popsci.com/technology/article/2009-12/feature-3-d-revolution

<comment><USER2> Also <http://news.ycombinator.com/item?id=994075></comment>


Alain Badiou Is Making a Movie About Plato with Brad Pitt and Sean Connery - <AUTHOR> http://www.critical-theory.com/alain-badiou-writing-script-movie-plato-brad-pitt-sean-connery/

<comment><USER2> Um, no, he's not. He's writing a screenplay and dreaming about a cast that will never happen.</comment>


Is an event discovery app in India a good idea? - <AUTHOR> https://play.google.com/store/apps/details?id=com.townista&hl=en&referrer=hackernews

<comment><AUTHOR> I would love to know the views from around the world on event discovery apps. What is their future? Would you like to keep one in your phone?</comment>


Obama tells tech community to solve encryption problem now or pay later - <AUTHOR> http://www.theverge.com/2016/3/11/11207480/obama-sxsw-2016-fbi-apple-encryption <comment><USER2> Obama has relinquished his role in talking about "balance", when he's even now pushing for legalizing the illegal sharing of NSA's mass surveillance data with civil law enforcement. Where's the balance then? Oh, that's right. Obama is for _no balance_ \- just complete government control.

<comment><USER3> George Orwell was right about 1984 and Big Brother, he just got the year wrong and instead of TVs spying on you it is phones, tablets, computers, smart phones and other devices. Any encrypted device like an iPhone the government wants a backdoor into it.

Our privacy rights are going to be violated so they can catch more criminals and terrorists. The government wants encryption gone or a backdoor in it that makes it weak.</comment></comment>


Maximizing Profits Doesn't Mean Screwing Your Customers - <AUTHOR> http://techdirt.com/articles/20080904/0248552163.shtml <comment><USER2> This submission kind of reaffirms the idea (from a slightly different angle) that it is good to start with a good, free service and monetize it later. In the provided example, an online world purposely capped spending in hopes of getting a better public perception. Consider also that simply in doing so, they have generated some positive awareness of their company.

It's nice to see "Do good" being exercised in business and being successful; I think that's the approach that leads to the most happiness for everyone.

<comment><USER3> Disagree. More likely they realized that sustainable revenues from teenagers was a better bet than being the online equivalent of a 1-900 number, then having parents pull the plug and dispute charges.

Save the general concept of a long-term play, I see very little here that implies anything about the free service -> monetize later path.

<comment><USER2> The free -> monetize angle I was referring to was their reference to craigslist. I agree with you on the sustainable revenues part, that's basically what I was trying to get at.

<comment><USER3> With regards to craigslist -- I don't think that they ran with a high burn rate or took much (if any) VC money. Today, they are certainly profitable, although probably not making as much money as they could be. I think the key is to make sure you know how you will be making your long-term money before ofering stuff for free.

</comment></comment></comment></comment><comment><USER4> RoI = Revenue - Expenditure / Investment</comment>


Git integrity - <AUTHOR> https://groups.google.com/forum/#!topic/binary-transparency/f-BI4o8HZW0 <comment><USER2> Note that it's not only a problem of the SHA-1s not being checked, but also a problem of consistency of the pack not being checked. That is, you can be given new commits with missing objects and Git won't notice. Worse, you can push a pack with missing objects, and the server won't notice (by default). Many guides will tell you to enable fsckObjects on servers.

It's also not a Git-only issue. Mercurial has the exact same problem., defaulting to trust everything it's given, both on the client and the server. And while the server.validate option allows to enable consistency checking (no missing object), I don't think there is a setting to enforce SHA-1 validation. OTOH, on a repository the size of mozilla-central, this would have noticeable consequences because file lists (manifests) are flat (but that's changing thanks to the work for narrow clones).

<comment><USER3> Mercurial verifies SHA-1 on every read and write. The code is in revlog.py in revision() and _addrevision() (search for "checkhash"). This is a lower level than changegroup processing, which is where exchange occurs. Since you aren't using revlogs from git-cinnabar, you should probably re-implement hash checking in git-cinnabar if you haven't already.

server.validate ensures that all referenced revisions from changegroups are in fact present. It prevents repos from becoming "corrupt" (in the sense that `hg verify` will complain) due to missing data.

<comment><USER2> I stand corrected, unbundling, which happens during transfer, does seem to check SHA-1. Which surprises me, because I would expect SHA-1 hashing on all the manifests on mozilla-central to take a lot more time than what a clone takes (250k+ manifests of more than 5MB each on average (most recent ones are larger than 10MB), even with a SHA-1function doing 1GB/s (and I think we barely reach half that), that should take more than 20 minutes). But maybe a clone does take longer than that these days?

That said, while it doesn't during transfer, Git does check sha1s when objects are accessed. The code is in object.c in parse_object(), which calls check_sha1_signature(). But disappointingly not everything is going through that code path.

$ git init

$ echo a > a ; echo b > b

$ git add a b

$ git cat-file blob 78981922613b2afb6025042ff6bd878ac1994e85

a

$ cp -f .git/objects/61/780798228d17af2d34fce4cfbdf35556832472 .git/objects/78/981922613b2afb6025042ff6bd878ac1994e85

$ git cat-file blob 78981922613b2afb6025042ff6bd878ac1994e85

b

$ git show 78981922613b2afb6025042ff6bd878ac1994e85

error: sha1 mismatch 78981922613b2afb6025042ff6bd878ac1994e85

fatal: bad object 78981922613b2afb6025042ff6bd878ac1994e85

<comment><USER2> So, it turns out that there's nothing to see under the sun. When pulling, what you get is a pack, and not its index. The index is created locally after retrieval. Packs don't contain the SHA-1s, so the process of creating the pack index does, in fact, compute the SHA-1s. So if a pack is altered somehow to contain objects with a different SHA-1 than the advertised one as in the parent comment, what happens is that the connectivity check that happens after all that will complain about the missing commits, trees or blobs.

In the altered repository in the parent, actually doing a commit and then cloning (non-local, because local clones cheat) will yield an error about the missing 78981922613b2afb6025042ff6bd878ac1994e85.</comment></comment></comment></comment>


General availability on SQL Server 2016 with deep R integration - <AUTHOR> http://venturebeat.com/2016/06/01/microsofts-sql-server-2016-becomes-available-to-everyone/ <comment><USER2> Is there any improvement on the installer. SQL Server 2014 express was 30 step nightmare the same ghastly thing they had for SQL Server 2008, I should of bailed and recommended a winadmin at the point people were making parody sites about how to find the downloader [http://www.hanselman.com/blog/DownloadSqlServerExpress.aspx](http://www.hanselman.com/blog/DownloadSqlServerExpress.aspx). Then unresolved .Net dependencies (sure I'll go find them myself), followed by the #clicknext arthritis, and after about hr of gods know what it was installed. Oh wait tools.. I need the tools too..

I hope the version they release for linux is add-apt-respository microsoft/linuxsql and apt-get install mssql-server

I wouldn't actually care for MS SQL Server but for a client third party software depends on a SQL server instance and hence a Windows server in the population.</comment>


Giotto – A Python library for topological data analysis - <AUTHOR> https://giotto.ai/ <comment><USER2> Lovely website, simply gorgeous.

No idea what the package does. I'm busy, no time to excavate speculatively.

Closed ... things to do.

 _Edit:_ Re-reading this, there will be people thinking "That's Harsh". But readers are busy people, there's always more to read, there's always more to do, and if you don't make the cost/benefit balance clear, people will just walk away.

Make the benefits clear, make the benefits obvious, connect with your reader, draw them in, make them start to think of how this would be useful.

And having said all that, I need to re-write my most recent post to take my own advice.</comment>


Using Immutable Caching to Speed Up the Web - <AUTHOR> https://hacks.mozilla.org/2017/01/using-immutable-caching-to-speed-up-the-web/ <comment><USER2> Maybe it's time for browsers to go beyond the cache concept and implement a common standard package manager. Download once, stay forever. True immutable.

As developers, we try everyday to squeeze till the last byte and optimize things. We all know how performance is important.

So why download for every website the same asset: React, jQuery, libraries, CSS utils, you-name-it? What a waste!

<comment><USER3> We don't need to have anything as complex as package manager. It would be much easier to just link to these libraries (and any other resource) by the hash of their content. If you do that you would just have to link to resources by their content hash.

I'm not really sure why this isn't already in place.

edit: The reason I'm not sure why because it sure seems to me that multiple threads on the post are all suggesting basically the same simple idea, the ability to serve a file by it's hash (either just by it's hash alone, or by a url + the hash). Personally, I think whatever form these url's take i think it ought to be backward compatible which I think is possible.

<comment><USER4> > I'm not really sure why this isn't already in place.

Everything we need _is_ already in place, except for a tweak in the caching strategy of the browsers[1]. With Subresource Integrity [2] you provide a cryptographic hash for the file you include, e.g.

      <script src="https://example.com/example-framework.js"
              integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC"
              crossorigin="anonymous"></script>

As it is, browsers first download the file and then verify it. But you can also switch this around and build a content addressable cache in the browser where it retrieves files by their hash and only issue a request to the network as a fallback option, should the file not already be in cache. Combine this with a CDN which also serves their files via [https://domain.com/$hash.js](https://domain.com/$hash.js) [3] and you have everything you need for a pretty nice browserify alternative, without any new web standardization necessary.

[1] And lot's of optimization to minimize cache eviction and handle privacy concerns, but that are different questions.

[2] [https://developer.mozilla.org/en- US/docs/Web/Security/Subres...](https://developer.mozilla.org/en- US/docs/Web/Security/Subresource_Integrity)

[3] Imagine if some CDN would work together with NPM, so every package in NPM would already be present in the CDN.

<comment><USER5> Folks in W3C webappsec are interested, but the cross-origin security problems are hard. We'd love feedback from developers as to what is still useful without breaking the web. Read this doc and reach out! [https://hillbrad.github.io/sri-addressable-caching/sri- addre...](https://hillbrad.github.io/sri-addressable-caching/sri-addressable- caching.html)

<comment><USER6> These problems are really hairy. Thankfully, all the privacy issues are only one-bit leakages (and there are TONS of one-bit leakages in web browsers), but the CSP bypass with SRI attack is really cool.

One thing that I've found incredibly disappointing about SRI is that it requires CORS. There's some more information here: [https://github.com/w3c/webappsec/issues/418](https://github.com/w3c/webappsec/issues/418) but it essentially means that you can't SRI-pin content on a sketchy/untrustworthy CDN without them putting in work to enable CORS (which, if they're sketchy and untrustworthy, they probably won't do).

The attack that the authors lay out for SRI requiring CORS is legitimate, but incredibly silly - a site could use SRI as an oracle to check the hash value of cross-domain content. You could theoretically use this to brute force secrets on pages, but this is kind of silly because SRI only works with CSS and JavaScript anyway.

<comment><USER5> I, as someone who worked on the SRI spec find this incredibly disappointing as well. We've tried to reduce this to "must be publicly cachable", but attacks have proven us wrong.

And unfortunately, there are too many hosts that make the attack you mention _credibly_ silly:

It is not uncommon that the JavaScript served by home routers contains dynamically inserted credentials. And the JSON response from your API is valid JavaScript.

</comment></comment></comment></comment></comment></comment><comment><USER7> What I really want is the exact opposite. I'd like to see a flush-before header to have a particular web page NOT pull older static resources.

The reason is simple. Websites have lots of static content that seldom changes. But you don't know in advance when it is going to change. However after the fact you know that it did. So you either set long expiry times and deal with weird behavior and obscure bugs after a website update, or set short ones and generate extra load and slowness for yourself.

Instead I'd like to have the main request send information that it does not want static resources older than a certain age. That header can be set on the server to the last time you did a code release, and a wide variety of problems involving new code and stale JS, CSS, etc go away.

<comment><USER8> Then you should do what Facebook does ([https://code.facebook.com/posts/557147474482256/this- browser...](https://code.facebook.com/posts/557147474482256/this-browser- tweak-saved-60-of-requests-to-facebook)): content-addressed resources. Have a resource be available not at /resources/something.js, but at /resources/<sha1(something.js)>; whenever there is a new version of something.js, the sha1 changes and is put in your root document, and the browser will never again try to reach the older version, which you know is invalid now.

<comment><USER9> But what happens when you need to cache the actual page not just static resources? That's what the content-addressed resources trick doesn't address.

<comment><USER10> You cache the actual page with a much shorter cache timeout.

</comment></comment></comment></comment><comment><USER11> I'd be very wary of using any HTTP headers with permanent effects. They seem like a way to get easily burned by accident. For immutable caching in particular, I'd probably try to utilize some variation of content-based addressing, eg having the url have the hash of the content.

See also: [http://jacquesmattheij.com/301-redirects-a-dangerous-one- way...](http://jacquesmattheij.com/301-redirects-a-dangerous-one-way-street) and the related HN thread with good discussion

<comment><USER12> It's not permanent if you don't make it permanent - like the other cache- control headers, you can specify the amount of time that a resource is considered immutable. All this does is change the time period in which the browser avoids sending 304s.

<comment><USER13> This might be considered similar to the DoS vector that was also present in the HTTP Public Key Pinning proposal [1]; an adversary seizing temporary control over the server can convince clients to not request a response from the server for a certain period, or in the case of HPKP request a response that cannot possibly be fulfilled.

Its seems much more mundane in this Cache-Control case, but it is the same vector nevertheless.

[1] [https://blog.qualys.com/ssllabs/2016/09/06/is-http-public- ke...](https://blog.qualys.com/ssllabs/2016/09/06/is-http-public-key-pinning- dead)

</comment></comment></comment><comment><USER14> The concept of immutable assets and links is at the core of IPFS, a distributed alternative to HTTP. Since Firefox inplements the concept of immutable assets now, it would be totally reasonable to load these assets in the browser peer to peer (see WebRTC and webtorrent). I think this would be a great way to retrofit some decentralization into webpages!

<comment><USER15> I'm not sure it would be reasonable. To do that without deanonymising people would be an awful lot of work, and at the end if it lead to faster results, that would seem to be ripe for timing attacks to I.e. Figure out if anyone is browsing stonewall.org on your LAN

<comment><USER16> OpenBazaar are using IPFS over a Tor transport.

You could have a fast lane direct from the (http) server, then a slow P2P lane over Tor, both using the same content addressed protocol, and caching the results locally for instant reloads.

</comment></comment></comment><comment><USER17> Sorry if this is a dumb question. How is immutable caching any different from cache-control headers with a max age of 100 years?

<comment><AUTHOR> When you click refresh, your browser will revalidate those 100yr lifespan resources. If they are immutable, it won't revalidate.

<comment><USER17> According to this link, the browser won't perform any revalidation for the duration of the max-age?

[https://developers.google.com/web/fundamentals/performance/o...](https://developers.google.com/web/fundamentals/performance/optimizing- content-efficiency/http-caching#max-age)

 _However, what if you want to update or invalidate a cached response? For example, suppose you 've told your visitors to cache a CSS stylesheet for up to 24 hours (max-age=86400), but your designer has just committed an update that you'd like to make available to all users. How do you notify all the visitors who have what is now a "stale" cached copy of your CSS to update their caches? You can't, at least not without changing the URL of the resource.

After the browser caches the response, the cached version is used until it's no longer fresh, as determined by max-age or expires, or until it is evicted from cache for some other reason— for example, the user clearing their browser cache. As a result, different users might end up using different versions of the file when the page is constructed: users who just fetched the resource use the new version, while users who cached an earlier (but still valid) copy use an older version of its response._

<comment><USER18> That's all true, but it applies to regular page loads, not the case where the user explicitly presses the reload button.

</comment></comment></comment></comment><comment><USER19> As an engineer, I've always resented the unnecessary time I spend waiting for data in web browsers, so the bad state of caching in web browsers is an issue that's been on my mind for a long time.

There are a few ways to improve things:

1\. Predictive modelling user resource demand in the browser (eg. preloading data) Very very easy to do nowadays with great accuracy.

2\. Better cache control / eviction algorithms to keep the cache ultra hot.

3\. (This). Immutable caching is one of the major ways we could improve things. I'm not a fan of the parent articles' way of doing it though, because if widely implemented it will break the web in subtle ways, especially for small companies and people that don't have Facebooks resources and engineering talent. It doesn't take into account usability issues and therefore leaves too much room for user error.

I've written up a very simple 11 line spec here that addresses this issue. [https://gist.github.com/ericbets/5c1569856c2ad050771ec0c866f...](https://gist.github.com/ericbets/5c1569856c2ad050771ec0c866f531f3)

I'll throw out a challenge to HN. If someone here knows chromium internals well enough to expose the cache and assetloader to electron, within a few months I'll release an open source ML powered browser that speeds up their web browsing experience by something between 10X-100X. Because I feel like this should have been part of the web 10 years ago.

<comment><USER20> The size of your URLs will be an issue for pages with lots of assets. So much so that I bet if everything's warm in the cache except the page itself, then this proposal would be slower.

I'd rather see stale-while-revalidate implemented in browsers.

<comment><USER19> Publishers could simply use regular urls for their tiny files.

<comment><USER20> If everything's warm in the cache they're effectively all tiny files.

</comment></comment></comment></comment><comment><USER21> What is the difference between an immutable resource and setting the resource to expire in 10 years?

Many websites already do that, they change the URL each time the content changes.

<comment><USER22> I'm not sure if this is in-use anywhere, but it may lead to better "cache eviction" policies. Saying something is immutable has different implications than saying "I want it cached for 10 years".

The former would allow a browser to apply some heuristics and say for example evict something from the cache when it hasn't been referenced on a page for the last 5 times you went there (the assumption being that it was changed and the new resource is taking over in it's place).

That can lead to things being held in the cache for longer without having to use a straight "oldest evicted first" kind of method which can lead to thrashing if the cache size is too small or some resources are too big.

<comment><USER23> > Saying something is immutable has different implications than saying "I want > it cached for 10 years".

Only if you have a system that you keep for more than 10 years. If a browser dumps stuff that it was told it can keep for a decade that means it can also dump stuff that it was told will never change. If the cache is full of things that are immutable something still has to go.

<comment><USER22> Oh definitely, I meant more in the sense of being able to evict things more "intelligently".

If stuff needs to go, it needs to go. It's going to happen. But if you have to choose between a file which was told to be cached for 10 years, and one which was labeled "immutable" but hasn't been referenced on the page it was previously for the last 10 loads, it might be a better choice to evict the immutable one.

<comment><USER24> So I can build a site that stuffs your cache full of "immutable" content, and all your frequently used "cache for 10 years" stuff gets evicted?

<comment><USER22> You can already do that...

Generally browser caches are "last used first out". So if you start stuffing the cache with a bunch of stuff you can already push the oldest out. And if you fill the whole thing you'll remove everything else.

It was actually quite a problem on mobile browsers for a while. IIRC iOS had something like a 10MB cache for the longest time. A few heavy websites and your whole cache would cycle through. Android had a 5MB cache at one point as well! A shitty news site can already fill that single handedly.

But my idea here (which I gave about 5 minutes of thought...) Was that immutable content would be evicted _before_ the "10 year" stuff. The idea being that if something replaced an immutable "thing" it could be evicted much sooner.

I'm not sure if it would really help at all, just kind of throwing out some ideas.

</comment></comment></comment></comment></comment></comment><comment><USER25> This is related to the Chrome caching update; as discussed here: [https://news.ycombinator.com/item?id=13492483](https://news.ycombinator.com/item?id=13492483)

Two wholly different strategies, which has ultimately split how the browsers handle caching.

</comment><comment><USER26> I just realized that until http is completely replaced with https, private mode should be always used to browse the Internet on a not trusted wifi network. Otherwise malicious content injected on such a network can be cached and reused by the browser forever.

<comment><USER27> > In Firefox, immutable is only honored on [https://](https://) transactions.

[https://developer.mozilla.org/en- US/docs/Web/HTTP/Headers/Ca...](https://developer.mozilla.org/en- US/docs/Web/HTTP/Headers/Cache-Control)

> Clients should ignore immutable for resources that are not part of a secure > context

[https://tools.ietf.org/html/draft-mcmanus- immutable-00](https://tools.ietf.org/html/draft-mcmanus-immutable-00)

</comment></comment><comment><USER9> With WiFi hotspots dropping connections more often than not, how many people would know they need to CTRL-F5 to "fix" a broken page/image/JS/CSS?

I just hope the draft as-is expires and never makes it to an RFC.

<comment><USER28> Could you clarify your objection? Presumably clients would never immutably cache a resource they couldn't validate.

<comment><USER9> How does validation work in the case of a 200 status and no Content-Length header?

<comment><USER29> I'd also like to know. I hope subresource integrity can be implemented alongside the cache control and prevent caching a bad file.

[https://developer.mozilla.org/en- US/docs/Web/Security/Subres...](https://developer.mozilla.org/en- US/docs/Web/Security/Subresource_Integrity)

</comment></comment></comment></comment><comment><USER30> HTTP caching is a mess. I wonder why no one proposed a properly redesigned and negotiable protocol that covers all the edge cases. (And maybe supports partial caching/partial re-validation of pages.)

<comment><USER31> On my phone, so unfortunately no reference, but there is a HTTP 2 spec underway that allows a client to send a cache manifest frame. A server can then push the resources that are newer. Pretty much exactly what's needed.

<comment><USER30> Unless we're talking about different things, cache manifest is an HTML 5 feature designed to enable websites to work offline. That's quite different from HTTP-level caching, which would be applicable to any files/resources and designed primarily with performance and bandwidth savings in mind. I might be unaware of some relevant HTTP 2 features, though.

<comment><USER31> Definitely a different thing. This is a HTTP 2 frame, sent by a client

<comment><USER30> Could you post a link to the relevant part of the spec or some article dealing with this feature?

</comment></comment></comment></comment></comment><comment><USER32> What happens if the immutable file is borked in transfer, leading to a partial file sitting in cache? Will this lead to a new class of problem that can only be solved by nuking the entire browser cache? It seems to me the way to do this right would have included a checksum of the content.

<comment><USER33> A hard refresh (Ctrl+F5) of the page will refresh immutable resources too, so you won't need to clear the whole browser cache.

</comment></comment><comment><USER34> I wonder if this will bring back the "hard refresh".

<comment><USER35> I'm curious, too. The blog post says refreshing the page won't revalidate the immutable resources, but doesn't say what happens for a CTRL+SHIFT+R hard refresh.

The Firefox bug mention hard refresh, but don't say what was implemented:

[https://bugzilla.mozilla.org/show_bug.cgi?id=1267474](https://bugzilla.mozilla.org/show_bug.cgi?id=1267474)

<comment><USER35> Patrick McManus, the Firefox developer of this feature, confirmed that hard reload will load immutable resources from scratch, so the user always has a nuclear option for fixing cache corruption. :)

</comment></comment></comment><comment><USER36> What a mess, but perhaps a happy ending. I made two other comments prior to this one in this thread, but then I read the Bugzilla thread [1] opened by Facebook that laid out the issue and Mozilla's defense. It's a _highly_ enlightening read; I can't recommend it enough.

To summarize, the issue is that Facebook was seeing a higher rate of cache validation requests than they'd expect, and looked into it. Chrome produced an updated chart documenting different refresh behaviors [2], which is the spiritual successor of this now-outdated stackoverflow answer from 2010 [3], and in response to Facebook's requests, and have re-evaluated some of their refresh logic.

In this thread, Firefox was being asked to do the same, but they pushed back on adding yet another heuristic and in turn proposed a cache-control extension. Meanwhile, Facebook proposed the same thing on the IETF httpbis list, where the response not enthusiastic [4], largely feeling that that this is metadata about the content and not a prescriptive cache behavior, and that the HTTP spec already accounted for freshness with age. One of Mark Nottingham's responses [5]:

 _(...) From time to time, we 've had people ask for "Cache-Control: Infinity- I-really-will-never-change-this." I suspect that often they don't understand how caches work, and that assigning a one-year lifetime is more than adequate for this purpose, but nevertheless, we could define that so that it worked and gave you the semantics you want too.

To keep it backwards compatible, you'd need something like:

Cache-Control: max-age=31536000, static

(or whatever we call it)_

[1] [https://bugzilla.mozilla.org/show_bug.cgi?id=1267474](https://bugzilla.mozilla.org/show_bug.cgi?id=1267474) [2] [https://docs.google.com/document/d/1vwx8WiUASKyC2I-j2smNhaJa...](https://docs.google.com/document/d/1vwx8WiUASKyC2I-j2smNhaJaQQhcWREh7PC3HiIAQCo/edit) [3] [http://stackoverflow.com/questions/385367/what-requests- do-b...](http://stackoverflow.com/questions/385367/what-requests-do- browsers-f5-and-ctrl-f5-refreshes-generate) [4] [https://www.ietf.org/mail- archive/web/httpbisa/current/msg25...](https://www.ietf.org/mail- archive/web/httpbisa/current/msg25463.html) [5] [https://www.ietf.org/mail- archive/web/httpbisa/current/msg25...](https://www.ietf.org/mail- archive/web/httpbisa/current/msg25505.html)

</comment><comment><USER37> We should really try to integrate something like [https://ipfs.io/](https://ipfs.io/) in browsers

</comment><comment><USER38> From what I understand, the browsers don't really adhere to far-future expiry headers when the user manually reloads a page, instead they re-request every resource to see if it's really not expired. For resources that the server flags as immutable (upon first request), the browser won't make further requests, but instead instantly reloads the elements out of its local cache.

</comment><comment><USER39> This should be done using subresource integrity. Then, you _know_ it hasn't changed. There should be some convention for encoding the hash into the URL, so that any later change to an "immutable" resource will be detected.

With subresource integrity hashes, you don't have to encrypt public content. Less time wasted in TLS handshakes.

</comment><comment><USER40> The last image about Squid proxy is included too small in the post, here it is in a readable way: [https://hacks.mozilla.org/files/2016/12/sq.png](https://hacks.mozilla.org/files/2016/12/sq.png)

</comment><comment><USER41> A very creditable action, cheers to Mozilla!

This increases the democratization of the web and allows small fries to have a disproportionately larger footprint.

</comment><comment><USER42> How do you update the URL and everywhere its used once an asset (image or script) is changed ? Automatic script or manually ?

</comment><comment><USER43> > The page's javascript, fonts, and stylesheets do not change between reloads

So is this like Rails' Turbolink but built into the browser?

</comment><comment><USER44> Wow I'm out of touch with front end dev. Someone please explain to me why this hasn't been standard already.

</comment><comment><USER45> What's the difference between Cache-Control: Immutable and setting expires headers really far in to the future?

<comment><USER46> When you do a hard refresh (Ctrl + F5 / Apple + R), your cache gets invalidated. The immutable parts don't need to be reloaded, because they are immutable.

<comment><USER47> Oh, interesting. Is that the only difference?

How often people actually do a hard refresh? I would guess most people don't know about that key combination.</comment></comment></comment>


Some Blizzard employees are dreading BlizzCon - <AUTHOR> https://www.latimes.com/business/story/2019-10-31/blizzard-employees-blizzcon-protests <comment><USER2> Corporations being tone deaf is a regular thing, but the evoking of "Every Voice Matters" so often after shutting down, and punishing, champions of their tournaments (it has happened twice! remember) for supporting a good cause is of historic levels.

Many people seem to think you can't be professional and allow things like this, but you absolutely can. You can let someone who wins a tournament have a few seconds to say something personal, we see this all the time in sports. Lance Armstrong was allowed to lie while disparaging all of the people who were correctly accusing him, Peter Sagan was allowed to make a wonderful political message.

When sports bodies crack down on this in the name of 'professionalism', history does not judge them kindly:

[https://en.wikipedia.org/wiki/1968_Olympics_Black_Power_salu...](https://en.wikipedia.org/wiki/1968_Olympics_Black_Power_salute)

<comment><USER3> It's the difference between a Walmart, which everyone expects to be pretty low ethically, and Blizzard, which has been using things like LGBT in their marketing (showing their lead Overwatch character as gay [outside of China at least]).

You can't have it both ways. You're either progressive in marketing and action, or you're a hypocrite and deserve the market's backlash when you show your greed over ethics. It's why Lebron got pummeled so hard for his HK remarks.

<comment><USER4> If a streamer had said something, for example, anti-LGBT, Blizzard would have shut them down the same way and everyone would be applauding.

Depending on your personal politics, any given corporate action is either 'brave, standing up for principles' or 'obviously a sellout to the corrupt bad guys'.

<comment><USER5> "If they had done something good instead of bad, I bet you'd be cheering them on!"

Yes, brilliant catch there, you really got us.

<comment><USER4> 'Good' and 'bad' in your sentence are subjective. Millions of mainland Chinese Blizzard customers feel differently on the HK issue than you do.

You can think that they're totally, obviously wrong, but that's politics.

<comment><USER6> I think it's instructive to realize that mainland Chinese people are being fed state propaganda about "rioters" destroying HK and demanding independence, thus their opinions should be weighted lesser on the issue accordingly.

The sparse examples I've seen of Chinese people actually being exposed to the reality in HK and being surprised, tells me the state media is being effective in its Ministry of Truth role.

<comment><USER7> Honest question: have you personally seen the "propaganda" of the other side? If you've only seen one side, how are you so completely sure you know which one is right?

<comment><USER8> As a general rule, if millions of people are upset enough about something to take to the streets and risk being injured or killed by the police, it's a pretty safe bet that something in their government is fucked and in need of fixing.

<comment><USER7> If you apply this consistently, you should also be sure that Brexiteers, the yellow vest protestors, and the Catalonian independent movement show that European government is fucked. (If you do, I respect that, but if you don't, consider why you think some mass anti-government protests are more sympathetic than others.)

<comment><USER9> >you should also be sure that Brexiteers, the yellow vest protestors, and the Catalonian independent movement show that European government is fucked.

That's exactly what they show.

Whether these groups favored solutions to the fuck-ness are the correct solutions totally tangential to that. When people take to the streets something ain't right.

<comment><USER8> > Whether these groups favored solutions to the fuck-ness are the correct > solutions totally tangential to that. When people take to the streets > something ain't right.

This, exactly. It takes a lot to get people to resort to civil unrest. I wish it was respected as being that, the last resort of a populace losing faith in it's leadership, and not derided as it is so often as just people who disagree with something. Protests should be a sign of not just disagreement but profound disgust not just for what is being done, but for the processes and the system that _permitted it to happen in the first place_.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> When I worked at Blizzard at the beginning of the decade, it was the first "corporation" I'd worked at where I sincerely felt and believed that the espoused values were authentically reflected in decisions and actions. The edges were starting to fray a little bit around 2012-13, as veterans of the original Blizzard slowly began moving on to other things (or retiring altogether).

There followed a steady trickle of Activision staff into the holes left by the departed, which IMHO was also reflected in gradual shifts in recruiting practices. Morhaime's departure was the final farewell. I can't say what Blizzard's culture is today, but I'm confident that Every Voice Matters isn't what it used to be.

<comment><USER11> Yeah, as an ex-gamedev as well there's a large divide between the values a devshop tends to hold and the publisher that finances your project. I've yet to see a studio acqui-hire that doesn't eventually head south as the publishing culture seeps into the previously independent company.

<comment><USER12> You say that as if that is always a top down transformation, and not the result of entrepreneurial founders losing motivation or leaving after a lockup period. Regardless of cultural differences or how the transition is handled, the fact that a studio is no longer an independent entity affects how you view your work and how much value you can extract from a commercial success.

There are some high profile examples of studio acquisitions I've had insight into where the publisher has been blamed for perceived changes in a studio's output post-acquisition. The reality on the ground was almost the inverse: the publisher gave the acquired studio a great amount of autonomy and runway, even more than than internal studios, and the acquired studio struggled in an environment where they had relatively more freedom than they did pre- acquisition. It let bad habits fester and poor managers calcify in roles they never could have survived in during scrappier times.

<comment><USER11> Transitions are hard, and I'm sure there's definitely that failure case.

However if you look at EA and the acquire/in-house cycle they go through every 4-5 years, there's no way you can hope to be stable under those circumstances. Ditto Microsoft and the 2-3 cycles they went through with similar disasters.

Fundamentally the two types of companies have different goals which drive their culture. Publishers exist to make money, pure and simple. They diversify risk by supporting multiple developers but at the end of the day they want to see growth and cash. A developer on the other hand may be happy staying mostly cash-neutral as long as it keeps them afloat to keep creating the art/experience that drives them.

I'd argue that those two cultures are at distinct odds(based on what I saw play out when I was in the industry) and trying to merge them leads to disaster.

</comment></comment></comment></comment><comment><USER13> They should be dreading it. For an American company, or really any non-Chinese company to bow down to China's censorship regime is unacceptable. I hope Congress doesn't let the issue die. It's an increasing trend that will be harder to curtail the longer it persists.

<comment><USER14> It's a private company. How is it unacceptable for them to run the company whichever way they want?

<comment><USER15> You're confusing what is _legally_ acceptable versus what is _morally_ acceptable.

<comment><USER14> the parent asks for congress to intervene.

why is it immoral to play by the rules of a country in order to access that country's population? the country's people should decide for themselves how they should be governed. or do you think you know better?

<comment><USER15> Again, you're continuing to insist that morality and legality are equivalent.

In some countries, beating your wife is completely legal. Certainly you wouldn't argue that it's moral.

Laws aren't written by average people, they're written by politicians who do immoral things and get away with it. They allow immorality for their own benefits.

</comment></comment></comment></comment></comment><comment><USER16> I must say that because of Blizzard actions there was x50 more coverage for the people of HK, so in some strange way, I'm glad they did it

<comment><USER17> The Streisand effect strikes again!

</comment></comment><comment><USER18> How did Blizzard fail in PR where Apple succeeded?

They both were anti Hong Kong, but few remember and care Apple's actions.

Asking in case I ever F up and need to go damage control.

<comment><USER19> Key differences:

* Apple's decision hurts vast groups of people, not individuals. People have problems emphasizing with huge groups (e.g. Hong Kongers, Ulghurs, Muslims, Catholics) but are very good as emphasizing with individuals. This is why propaganda aimed at appealing to emotion always focus on individuals: especially children/women. Blizzard went after not just individuals, but tournament winners/players.

* Apple's product is less liquid than Blizzard's. I can stop playing instantly. I can unsubscribe from WoW instantly. Selling my phone and moving to another platform is much harder. The alternative offerings are also all extremely pro-Chinese Party, so even if I went off-Apple for HK reasons, I am just making the problem worst. With games, there is competition and there is no lack of good games in each category (save perhaps RTS, but SC2 is tiny for Blizzard).

<comment><USER20> I think you meant to write empathizing rather than emphasizing.

</comment></comment></comment><comment><USER21> >"BlizzCon is sort of like the Christmas of Blizzard," one staffer said.

More like the Singles Day of Blizzard now.

</comment><comment><USER22> Blizzard has a problem.

World of Warcraft is growing stale and they seem to not have a replacement (as far as zero leaks).

Overwatch has been a big success and leaks suggest Overwatch 2 with more PVE.

That's fine and all but that's not going to be the cash-cow that WoW was for them. I was a dedicated player since launch but left after Legion and won't be returning.

<comment><USER23> World of Warcraft just had a classic release, which I would hardly call stale.

[https://www.newsweek.com/world-warcraft-subscriptions- triple...](https://www.newsweek.com/world-warcraft-subscriptions-triple- classic-release-1461086)

<comment><USER24> Ironic we are calling not stale a company that rereleases a game after 15 years

</comment></comment></comment><comment><USER25> Ultimately this seems like a failure in leadership.

It took four days for a response and then it was sort of half a response.

Individual employees now go and suffer the consequences on the front lines.

<comment><USER26> This was a pretty standard corporate PR tactic.

* make deleting accounts hard due to "technical difficulties"

* Wait until late Friday night to put out a press release, so publications are less likely to pick it up.

* Have the release contain a meaningless non-apology

* wait for a bit until everyone moves on to the next thing

The outcry was largely contained to a small Reddit and hardcore fan bubble.

The stock didn't suffer at all.

Blizzcon could be interesting though.

<comment><USER27> > The outcry was largely contained to a small Reddit and hardcore fan bubble.

Didn't they cancel all their PR marketing for Overwatch coming to the switch ?

Aside from existing fan outcry, it seems to me having them quiet their PR moves while entering holiday season would be the bigger consequences.

I don't know for the small bubble, or we should at least include tech sites and youtube gaming channels in the bubble.

</comment></comment></comment><comment><USER28> I wonder how different this might have been if he'd instead shouted, "MAGA!". I imagine the next election will present some similar situations for companies to traverse.

</comment><comment><USER29> I'm hoping id Software works a potshot into whatever they're doing for Doom

<comment><USER30> Aaah, sweet, sweet Bethesda. I would look somewhere else, to be fair.

<comment><USER29> Wait got my wires crossed. I was thinking id was a subsidiary of Blizzard.

They're actually Bethesda/Zenimax.

Disregard the GP

<comment><USER31> At least with Zenimax there is no ambiguity about being evil.

</comment></comment></comment></comment><comment><USER32> Blizzcon 2019: Nothing is more entertaining than a train wreck

</comment><comment><USER33> And Blizz just can't stop stepping in it.

[https://www.invenglobal.com/articles/9488/wow-community- feel...](https://www.invenglobal.com/articles/9488/wow-community-feels-toyed- with-amid-blizzcon-prize-pools)

Before people chime in with "but they technically didn't say that they would add the toy revenue on top", that is exactly how it is typically done by other companies in the same situation. They made a ton of money and didn't have to put up a dime of their own.

Who exactly is working PR over there?

</comment><comment><USER34> I keep seeing job postings from Blizzard for software engineers. I hope people are ignoring them, just as I am.

</comment><comment><USER35> good and good.

a lot of the blizzard developer interactions with players at blizzcon has been the developers acting like condescending, down-talking jerks to players during q&a.

let's see those egos take what they like to dish out.

<comment><USER36> there's thousands of devs/staff at blizzard, not just the handful that interact with the public.

<comment><USER37> So why don't they walk out of work until Bizzard makes a change?

<comment><USER36> put yourself in their shoes. you're in the games industry, so your pay isn't fantastic but you're doing what you love.

say this is the issue that makes you want to walk out. you'd have to accept that this might mean losing not only your dream job, but a job full-stop - games is a very competitive industry and you might have a long period of unemployment.

this would have to be a "I would give up my career in the games industry for this" issue. it is for some. it's not for others.

<comment><USER37> What's the alternative? It's not like Blizzard has given any meaningful apology or done anything to remedy the situation.

All customers can do is boycott and protest. Nothing else will cause any change in behavior. Unfortunately, employees will be hurt in the process.

Wouldn't it be better for employees to stage a big moment now, force Blizzard to backpedal, and resume being a game company sooner? A long, drawn out thing is worse for everyone.

<comment><USER36> > What's the alternative?

keep working, hope that blizzard reverses course.

this is the first seriously backwards move in 30 years of the company afaik. quitting immediately isn't the answer to your average employee.

and please reread what I wrote. I know many blizzard employees. as much as it hurts them to see what their company did, quitting simply can't be an option to them. not in a massive immediate show of support. not everyone can afford to be political.

<comment><USER37> A "walk out" is a form of protest that doesn't mean quitting. It does risk being fired, but the risk is pretty low in this case.

<comment><USER36> A walk out when half their colleagues got let go earlier this year is pretty risky.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER38> It all returns to nothing. It all comes tumbling down, tumbling down, tumbling down...

Blizzard had a good run. I don't doubt the company name itself will go on as a branding on a whole slew of rehashes and remakes, like a little label to be stuck on a reskin of an original idea from 15 years ago that's been crunched, mashed and reinterpreted as a mishmash of whatever individual elements are deemed popular and "the reason X was a success". But for me, it's over. Blizzard is no more. I would go so far as to say that the company should lose the Blizzard trademark given how far off they are from what that name originally stood for.

</comment><comment><USER39> I expect quite a bit of drama during this event. The actions since last Blizzcon have left a sour taste in many people's mouths.

<comment> GuB-42 And that includes last Blizzcon itself, when they announced Diablo Immortal.

</comment></comment><comment><USER40> I'm at the convention center now. So far I havent seen anything unusual. Not even a Hong Kong t-shirt.

Tickets were sold out long before the controversy hit. Obviously there are a lot of us die-hard fans that are upset, but I dont think there's many people here with the intention of causing trouble.

</comment><comment><USER41> Unfortunately it probably won't be too bad, most blizzard fans have already moved on and are back to giving blizzard/activision money.

</comment><comment><USER42> Major lesson: Don't put non-trained employees to do PR/client-facing soon after they were mentally drained by an action you took.

</comment><comment><USER43> Paywall workaround?

<comment><USER44> disable JS

it's in the Dev Tool options (F1) in Chrome

<comment><USER43> Cheers, thanks!

<comment><USER15> Alternatively, for Firefox users, switch to Reader mode.

</comment></comment></comment></comment><comment> w-j-w As someone who likes watching public events go horribly wrong, I have never been so excited for a videogame convention.

<comment><USER45> I just find it disappointing that gamers are far better at organizing and pressuring a company than other product users. Apple and Tesla both have gotten a near free pass with Apple only raising some ire when they knocked down an app but it blew right over very quickly. Perhaps gamers just have more time and more outlets to get attention?

What will be interesting is if these people even get in and how quickly they are put out when they do. If they are silent, just in costume, will that provoke a response as well?

<comment><USER46> See what a little competition buys you? Activision players can always go to Ubisoft or EA. But the dirty little secret that everyone's wising up to is that they all suck and indie games are better than AAA in ways that matter to many people.

When staring down an existential crisis your clients can and will push you around for misbehaving, even if that misbehaving is out of a desire to get out of said existential crisis.

Put shortly: fuck corporations.

<comment><USER47> I discovered about 12 years ago that WoW was essentially a slot machine in it's construction (reward schedules, rest XP, etc) designed to keep you engaged without entertaining you.

I've had far more fun playing _Battle for Wesnoth_ than I ever did playing WoW.</comment></comment></comment></comment>


PAWS – Perl SDK for AWS - <AUTHOR> https://www.capside.com/labs/paws-perl-sdk-for-aws/ <comment><AUTHOR> Links to github and metacpan:

[https://github.com/pplu/aws-sdk-perl](https://github.com/pplu/aws-sdk-perl)

[https://metacpan.org/pod/Paws](https://metacpan.org/pod/Paws)

</comment><comment><AUTHOR> It would be interesting to know if Paws is now considered production quality. It has been under development for quite some time with the "beta quality" disclaimer.

<comment><USER2> Still beta he says</comment></comment>


Show HN: Best-Books.dev, the best programming books, all in one place - <AUTHOR> https://www.best-books.dev <comment><AUTHOR> Hey everyone  Excited to be back here with my first no-code thing.

Best-Books.dev is a curated programming books recommendations from all the programming books list I was able to find on the web.

6 months ago, I wondered what was the most recommended programming books of all-time. So I asked Google about it and compiled all the results in one big list.

I shared the results on Twitter and on my blog and had many people asking me to do this for languages, frameworks, techno.

So I did

And this is how Best-Books.dev was born.

So far I compiled more than 7,000 recommendations from more than 500 lists but I don't plan to stop here.

So, what's next for Best-Books.dev?

\- Completing 1 recommendation list every week for the next 6 months

\- Writing other sorts of curated lists

\- Planning a weekly newsletter with recommendations and new interesting releases

</comment><comment><USER2> So which no-code method did you use?</comment>


Jeff Bezos at YC Startup School 2008 [video] - <AUTHOR> https://www.youtube.com/watch?v=6nKfFHuouzA <comment><USER2> One thing I think is so extraordinary about Jeff Bezos is his uncanny technical prescience despite not really being a technologist. For example, the famous Steve Yegge "platforms rant" blog post [1] about how Bezos basically made a company-wide edict for microservices was very much ahead of its time. Similarly, the vision of cloud computing was much more advanced and early than any of its competitors. Considering this came from a company that already had a huge business of selling things, I think this technical foresight is pretty remarkable.

[1] [https://plus.google.com/+RipRowan/posts/eVeouesvaVX](https://plus.google.com/+RipRowan/posts/eVeouesvaVX)

<comment><USER3> I believe the cloud computing vision came from Andy Jassy. In fact he wrote the original six pager for AWS.

Equally impressive since Jassy isn't really a technologist either.

<comment><USER4> I hate this language of "so and so isn't a technologist". You don't need to understand how a compiler works or grok segfaults to see the future.

It's obvious if you're running a big data center yourself that you'd rather pay someone else to do that, it's just that no one wanted to take on that operational burden because it's a pain. It doesn't take a technologist to realize that arbitraging pain is where you make money. Everything after that is execution.

There are plenty of people who see the future who aren't coders, they just usually can't execute.

<comment><USER3> I disagree with this. The vision wasn't a simple economic statement on why "we should rent out our unused server capacity". It was vastly more complex than that. It included technical details on how it should be approached and how to leverage and scale their existing infrastructure. It also laid down the ground for EC2 and S3 as foundational services.

Perhaps my error was saying that Jassy isn't a technologist. He is 100% a technologist and has an incredible ability to absorb and understand very complex technical topics. He just isn't a technologist by training or by trade. He simply has an innate technical ability to such extent that his first job at Amazon was being a technical liaison to Jeff Bezos.

<comment><USER5> Also VPC networking + patents show how advanced these guys are.

</comment></comment></comment></comment></comment><comment><USER6> Bezos quotes an article about AWS, "..in fact Amazon's real business down the line will be its cloud services. Amazon will be like a bookstore that sells cocaine out the back door. Book will just be a front."

<comment><USER7> Another point I recently heard, and I can't recall the exact quote off my head but it was along the lines of: "Amazon at this point is really just a cloud company that is using it's cloud earnings to subsidize its other business arms to grow to a big enough scale where it can choke out all other competitors."

</comment></comment><comment><USER8> I was lucky enough to be in the audience for this, and have long wondered (and generally believed) if the questions at [https://youtu.be/6nKfFHuouzA?t=2025](https://youtu.be/6nKfFHuouzA?t=2025) lead to reserved instances. The timing was right (reserved instances appeared in early 2009 [https://aws.amazon.com/blogs/aws/announcing-ec2-reserved- ins...](https://aws.amazon.com/blogs/aws/announcing-ec2-reserved-instances/)).

Jeff ruminates on the problem a bit, and you can all but see the model come out by the time Jeff finishes answering the followup question :-)

That he thinks it would be interesting to a "subset of users" is kind of amusing :-)

<comment><USER9> Wow, you're right! Definitely sounds like something that Bezos hadn't given much thought to (or enough to have had a response), this is a cool observation.

</comment></comment><comment><USER10> Side note, why don't these videos show the slide content? That's just as useful, if not moreso, than seeing a video of the person speaking. You can hear the person without seeing them, but you can't hear the slides without seeing them, even if they're being described. A simple split screen with slides on one side and video on the other would work. Or even a picture-in- picture with the speaker. The top comment on the YouTube video has some real snark in reference to what I thought was a legitimate criticism of what would make this video much better.

<comment><USER11> You usually have picture in picture solution in mind when recording. One view of the speaker and a second view of the slides.

Maybe the slides was meant to be shared along with the video, or they were shared, b ut only with YC attendants.

</comment></comment><comment><USER12> In Messy: How to Be Creative and Resilient in a Tidy-Minded World, Tim Harford describe the strategy of the initial period of Amazon, and compare Bezos with Erwin Rommel, the desert Fox.

</comment><comment><USER13> Wow, the memories. I joined AWS in 2008 as a tech evangelist (left in 2014), and many of these metrics I still remember to this day.

<comment><USER14> I am actually curious if what AWS does, to show relatively clear numbers on the business, is a common practice.</comment></comment>


My uncle's factorization algorithms - <AUTHOR> https://github.com/daoudclarke/wartonlegacy <comment><USER2> This is very interesting. Thank you for devoting your time to putting this on the web. Otherwise it might have rotted in your attic!

It's unclear to me whether there is anything theoretically new in here yet. The algorithms are all familiar to me except for the P^2 + 1 and P^2 + P + 1 algorithms. But don't read too much into that. They are probably well known.

What I can tell you is that there is an extraordinary amount of work in implementing all those algorithms. I do this stuff for a living and it is a tremendously impressive feat for a single individual over any span of time.

I'd be interested in hearing how fast the MPQS is. The state of the art for factoring a number like 840931001586212064794450601167289569811131781103613687750579 on a single core is probably around 6s or so on a modern 2GHz x86 processor.

UBASIC already had a 32 bit x86 assembly optimised MPQS in it, and it performed pretty well actually. So it would be interesting if your uncle improved on that, especially if he had theoretical improvements.

The state of the art for the number field sieve should factor the 79 digit number here: <http://www.loria.fr/~zimmerma/records/rsa.html> in around 10-20 minutes on a single core, though in general the GNFS is for much larger integers. It seems unlikely that a little UBASIC program could manage those, however.

Having said that, I am still in shock that your uncle actually implemented the GNFS. That is a staggering accomplishment and is something to be genuinely impressed by.

I don't know if you have a gold mine there or the cutting edge life's work of someone from yesteryear.

<comment><USER2> OK, after some effort I got the first of the MPQS programs to compile. Unfortunately it fails with a runtime error so I can't evaluate it.

The program itself requires two files to exist before it can operate. Then it asks for the input number in base 10000 as a set of digits separated by spaces or returns. This is pretty bizarre by today's standards.

It does succeed in factoring very tiny numbers, but it seems to have bugs which prevent it from working for large numbers.

The double large prime variant of the MPQS seems to allow numbers up to a pretty small bound. This strongly indicates that it is not competitive.

I'll see if I can get anywhere with the double large prime variant version (edit: I tried the second program and it fails with the same runtime error), but given the extremely poor state of the code (no comments, full of gotos, no indication of structure, no documentation, no test suite, buggy, very poor interface, etc.) I would say this code is not going to be particularly interesting to modern day researchers.

At the same time, it is a tremendously amazing accomplishment that one man essentially toiled away in secret and created a massive number theory library like this! When I google his name I find nothing. Was he associated with an institution? Did he publish any papers? I know he didn't use the web, so that explains why he doesn't have a web presence, but it is odd not to find him referred to anywhere. Or am I just looking in the wrong place?

<comment><AUTHOR> He didn't publish any papers that I'm aware of, and he wasn't associated with an institution. I'm hoping to write a short biography at some time.

<comment><USER3> Looking through the code I see a lot of references to a group of japanese researchers. See for example this file which references "A.KUDO & Y.KIDA" and is complete with japanese comments. [https://github.com/daoudclarke/wartonlegacy/blob/master/src/...](https://github.com/daoudclarke/wartonlegacy/blob/master/src/ubasic/REALQF4.UB)

Looks like K.Aoki (Kazumaro Aoki) A.KUDO & Y.KIDA used to post to academic factorization related mailing lists see: <http://www.loria.fr/~zimmerma/records/6353>

<comment><USER2> Kida wrote UBASIC I believe.

</comment></comment></comment></comment></comment><comment><USER4> We are finally coming to the era when the first amateurs who grew up with Personal Computers are starting to die of old age.

Stuff in BASIC coded by somebody in the anonymity of the pre-Internet. Maybe something truly novel in its time or even now. There's something extremely romantic to this, like a rescued roll from the Library of Alexandria.

Naturally, most of that anonymous work will be lost forever. Heck, most of my 8-bit era stuff stored in tapes and 5 1/4 floppies must be dead by now. I had some original Sountracker mod files from Amiga times and when I tried recovering those it was too late.

<comment><USER5>
      >> first amateurs who grew up with Personal Computers are starting to die of old age

There are few people older than early 50's who had a computer in high school. Although mortality starts to rise in the early 50's, I wouldn't call this dying of old age.

<comment><USER6> The error is in the phrase "grew up with", as it suggests they were kids in the early days of personal computers.

The adult amateurs who went from programmable calculators to early single- board microcomputers are the generation who are starting to die off.

My Dad is of that cohort. In his 40s he went from programmable calculators to building a simple computer with an octal keypad and a row of LEDs for output, to working on an AIM-65, coding in basic and (I think) machine code.

He worked in elevator maintenance, being in charge of service in much of Connecticut for one company. At one point he designed and built, with circuit boards he etched himself, some kind of electronic box which I think the company adopted? Maybe? For some kind of elevator-related purpose. I was never clear on what it did, and he probably doesn't remember now.

He didn't have an academic background that would have exposed him to computing, having joined the Navy at 15. He later took some radio repair/electronics night school classes.

He's 80 now, and has forgotten most of that stuff, and uses a MacBook and an iPad.

</comment></comment></comment><comment><USER7> The prime numbers group on yahoo is quite good. You might be able to entice someone to explore what your uncle has done.

<http://tech.groups.yahoo.com/group/primenumbers>

The group contains experts in this field that manage to do a commendable job of responding to questions at many levels.

It's a shame that your uncle didn't have a chance to connect with them.

Good luck.

<comment><AUTHOR> Thanks for the suggestion, I will explore this.

</comment></comment><comment><USER8> >Sadly, he was never able to benefit from this work himself, although he tried many times to sell the software developed here. Instead, he entrusted his work to me as his death neared, and he told me that he wanted it to benefit his family. Since there is little hope of me succeeding in selling this, instead, I hope that by releasing it under the GPL it may benefit mankind. I only ask that if you use it, you use it for good, not evil, to liberate and not oppress, and to educate and not to spread ignorance.

Thank you so much for this.

</comment><comment><USER9> This feels like the modern day equivalent of the secret to alchemy being found in some musty trunk in the attic. Does any of this actually advance the field?

<comment><AUTHOR> That's a good question, and I'm not entirely sure of the answer. I'm pretty sure my uncle believed it did, but I'm not sure how in touch he was with the state of the art, as he didn't use the internet. His idea of research was photocopying articles (and whole books, in particular I remember vol 2 of Knuth's TAOCP) from the British library.

My plan is to get some of these algorithms running and compare running times with the other open source ones available.

<comment><USER10> While perhaps not an advance, the algorithms implemented are state-of-the-art (GNFS, Pollard's p-1 test, Williams' p+1 test, cyclotomic polynomial test). But whatever the running times, it is an astounding artifact.

<comment><USER2> It's remarkable that we refer to algorithms invented as "late" as the 90's as state-of-the-art. But sadly, it is so.

<comment><USER10> Even more remarkable is that they build directly upon the 400-year-old method of Fermat (<http://en.wikipedia.org/wiki/Fermat%27s_factorization_method>).

<comment><USER11> Well, directly is a bit of a stretch. It's probably more fair to say they're directly based off the Powers-Lehmer-Morrison-Brilhart (also Kraitchik, for the discrete log) method, which introduced the concept of factor bases and combining relations to find a difference of squares.

</comment></comment></comment></comment></comment></comment><comment><USER12> I would love to have an uncle whom I could talk about cryptography with. You were very lucky!

<comment><AUTHOR> To be honest, most of the time I didn't have a clue what he was talking about, and I was by far the most mathematical of the family! He wasn't a great teacher, but he was certainly an inspiration. And apart from all this, he was a great uncle, and great company.

</comment></comment><comment><USER13> ...and somewhere out there, right now, P(=|!=)NP is probably solved on some 5 1/2" floppy, rotting away in an attic...

<comment><USER14> I doubt it.

EDIT (after down vote): I doubt it because back in the day this problem was not as widely recognized as it is today, and no expert in the field today (that I am aware of) thinks we are even close.

</comment></comment><comment><USER15> Daoud, did you add this _In the name of God, the Merciful, the Compassionate._ or did your uncle?

<comment><AUTHOR> I added this - my uncle was not religious.

<comment><USER16> Sad that someone would mod you down for having religious convictions.

Thank you for giving a portion of your inheritance to the world.

<comment><USER17> Sad that someone already forked it for the sole purpose of removing it [https://github.com/oscardelben/wartonlegacy/commit/bc528d4d7...](https://github.com/oscardelben/wartonlegacy/commit/bc528d4d7bfe411cdb6206ff5bc02d34ad007c7d)

Pathetic "contribution"

</comment></comment></comment></comment><comment><USER18> My fear is that this contains some sort of mathematical break through which is then copied and claimed by another person as their own work. Didn't something like this happen to Grigori Perelman where another man attempted to claim Perelman's work? This is really amazing, I hope something comes from it.

<comment><USER19> "Manifold Destiny" - <http://en.wikipedia.org/wiki/Manifold_Destiny>

</comment></comment><comment><USER20> I can't be of much help, but I'm extremely interested in how this all unfolds. Good luck.

</comment><comment><USER21> Language files blank comment code Fortran 90 224 50999 8235 315981 ubasic 248 ? ? 107383

</comment><comment><USER22> This is brilliant. Thank you.</comment>


Guide to Web Automation - <AUTHOR> https://github.com/peterdemin/web-automation-2017 <comment><USER2> im nex in this site can you help me</comment>


An Intro to Algorithmic Trading Models by Prof. Ahmad Namini - <AUTHOR> http://blog.quantopian.com/an-introduction-to-algorithmic-trading-models-from-professor-ahmad-namini/ <comment><USER2> After watching it, I can confirm this covers most of the important basic concepts.

<comment><AUTHOR> Great of you to take the time to watch and report back, thanks!</comment></comment>


How Amazon.com is thriving in a horrendous retail climate - <AUTHOR> http://www.slate.com/id/2210620/

<comment><USER2> Amazon anecdote: I bought a very expensive Canon 70-200mm lens for my camera on a Thursday afternoon. I had the lens shipped overnight so that I could use it for a weightlifting meet to be held that Sunday. Unfortunately, amazon.com informed me, the item did not ship until Friday, which meant I would not get my product until Monday - This, for obvious reasons, was unacceptable.

So I emailed amazon. Twenty minutes later I got a CALL from Executive Customer Relations and they spoke in great detail about how they would ASSURE me I would get my product with Saturday delivery. They canceled the existing order mid-shipment and sent out another one with Saturday delivery AND killed the exuberant shipping charge. I got my product in time to use that Sunday and I was a happy camper.

That, my friends, is how you kick ass at business.

<comment><USER3> Agreed, I'm always amazed that I order something _knowing_ it's going to take time. I ordered a couple of books, one of which was out of stock and was estimated to arrive in 1-2 weeks, so I was like sure whatever I'll just take the free delivery. I got a dispatch order at 8am the next morning and it arrived by the friday, it took a total of 4 days. This has happened to me multiple times and simply amazes me.

<comment><USER2> Absolutely. I mean, I was blown away. Blown away. They even called me the week after to make sure everything was OK and to ask how the photo taking went. You expect that sort of personalization and care from a smaller company but it TRULY is something when you see it from one with a $30 Bil market cap.

I haven't done business online with anyone else since (on big ticket items) and probably never will.

</comment></comment></comment><comment><USER4> Businesses thrive like Amazon by being efficient and well polished. Amazon is able to handle exceptions well because they do such a polished job of the majority of orders. When exceptions are such a minority, it's easy to give them the time and attention that they deserve. When exceptions are always popping up, you can't afford the labor to deal with them in a way that makes customers happy. When exceptions aren't usual, their added cost doesn't make that much of a difference to your bottom line.

Amazon automates their system well and runs a tight ship where most orders go through with no hassle, no interference, etc. That makes it easy for them to spend a little more on certain cases to make customers happy.

Part of it is just that other retailers aren't so efficient. If you're hiring store staff, most of the day people are in work and they have little to do. Even during busy times, they won't be able to move merchandise like Amazon where it can be made more assembly-line oriented.

So, Amazon is able to give people the experience that they want because all the easy things take no time for them.

<comment><USER5> There's part of that, sure. But they don't have to care that much. It means a lot that they still do.

</comment></comment><comment><AUTHOR> An excerpt illustrating the value of _underpromise, overdeliver_ :

"For a store that aims to give you a bargain, it also excels at customer service. Here's something that happens often: I'll buy an item on Monday afternoon and be told to expect it to arrive Wednesday. Then, sometime Tuesday, the UPS guy rings my door—amazingly, Amazon has moved the product from its shipping center in Nevada to my apartment in San Francisco in less than a day, for no extra charge."

Imagine what the author would have written had Amazon said the package would arrive Tuesday but the packaged didn't show up until Wednesday.

<comment><USER6> I once worked for the mail order arm of an office supply store which you all know. We have the same distribution-centers-across-country-situated-for- maximum-deliverability system that Amazon does.

All the company literature says something to the effect of "Order by 3 PM EST and your item will be shipped to you in two business days!"

This is, not to put to fine a point on it, a lie. 97% of orders put in by 5 PM EST will arrive the next business day. We expect that. We're '($# fanatical about achieving it -- if that number slipped to 95% heads would roll at several places in the company. But we never, ever tell customers that. Why? Because if we told them that we'd be pissing off 3% of our customers for forever. As it is we please 97% for forever. Much better deal!

This lie has some interesting consequences when a customer calls to expedite an order. (For example, "Oh crikey, I was supposed to have this order in days ago but I forgot, if it isn't here by Thursday I'll lose my job -- what can you do for me?") Our line representatives -- that was little $10 an hour me -- are given, have, and use the authority to upgrade customers' shipping at our discretion. So I could look at the big blinking count-down clock to 5:00 PM, note that there were 6 hours left to the cutoff, and say "Oh, no problem ma'am -- this will be there tomorrow". But that would spill the beans! So instead I'd say "I tell you what I'm going to do ma'am, I'll upgrade you to our fastest available shipping through FedEx at no extra charge." And then proceed to cost the company about a day's worth of my salary, just to avoid losing face in front of someone who I'm busy wowing the daylights out of.

I cost the company substantially more in "accommodations" than I did in salary for at least some of my tenure there. The computer flagged me for it twice. My line manager came to me and said "Hey Patrick, the computer has flagged you for being overly generous. Anything you want to tell me?" and said "I felt that accommodation was necessary knock the socks off of [customer name]" and my boss said "Right answer! Carry on."

Which is how you get a 99.X% customer satisfaction metric for the quite pedestrian business of selling paper and pens out of a catalog. (Quite profitably, I might add.)

I'll take the liberty of keeping the company anonymous and slightly altering the above internal metrics. They always treated me well and that buys a lot of loyalty. So if you need to buy your office staples, well, you'll just have to find your own preferred service provider.

</comment></comment><comment><USER7> My Anecdotal experience:

I need a new iPod cable and as I was at my local shopping center, I decided to check at Circuit City. I expected the price to be ~$10.00 but the prices was $24.99

I checked with amazon when I got home. I was able to buy a 3 pack, regular cable, car charger cable and 110v outlet cable for $8.00 including shipping.

It's not a mystery why retailers are suffering when you see price gouging like that.

</comment><comment><USER8> I am amazed "tax free" isn't anywhere in that article. Being tax free and having what is certainly a more affluent shopping base absolutely can't hurt in tight economic times.

I will say Prime is simply amazing. Amazon with it and Amazon without it are entirely different experience. With "super saver shipping" my entire order would need to group and be ready, which literally took months on some occasions. With Prime everything ships as soon as it is available and usually within the same day.

<comment><USER9> Actually, at least for me, for a while now the super saver shipping hasn't had the constraint of needing to group all your items. Indeed, they explicitly warn you that your items may ship separately (at no extra charge).

</comment></comment><comment><USER10> Amazon anecdote from today:

I was at a bookstore and saw a Vernor Vinge book that I didn't have already. Unfortunately it was $18 for the paperback. On my gphone I checked on Amazon and found a used-but-mint-condition copy for $3, plus $4 shipping. So I just ordered it from Amazon and left without buying anything.

I do feel bad for not helping out the bookstore, but it's hard to spend an extra $11 for nothing.

<comment><USER11> _I do feel bad for not helping out the bookstore_

Why would one want to help out a bricks-and-mortar bookstore?

<comment><USER12> Because bookstores form communities around them? I went to a book discussion club at Barnes & Noble for half a year when I was younger.

Or perhaps because the people who open non-chain bookstores are avid readers, often obsessed with helping out a community, and they love what they do, despite the fact that it's not exactly an easy business?

I know we're cool and new-wave but it's one thing to say Amazon's good. It's another to question why somebody would want to help out a business model that's _never_ been lucrative, whose practitioners more often than not do it for the joy of helping people find a good read.

<comment><USER13> >Because bookstores form communities around them? The same Waterstones/B+N who destroyed the small bookstores by voiding the net book price agreement are now complaining that Amazon are undercutting them. And small bookstores by selling used books on amazon are doing better than ever!

<comment><USER11> <http://news.ycombinator.com/formatdoc>

_Blank lines separate paragraphs._

</comment></comment></comment></comment></comment><comment><USER14> we launched our retail apparel site in October in the midst of the huge stock market loss days. on a suggestion from my cofounder we started listing on amazon in early December. Dec sales from amazon accounted for a 1/4 of sales, and more then 3/4 in Jan, as sales dipped on our site.

we get tons of sales on amazon from places in the midwest where on our site we get mostly right and left coast locations.

im actually lifting forecasts right now due to the strength of that channel. additionally we are often the low price on amazon, and the item is marked up from what is sells for on our site, so its not low margin dumping ground like eBay. horray for amazon.

</comment><comment><USER15> Here's a little story about Amazon's efficieny from another perspective.

When I applied to Microsoft for a summer internship, the process was: go to info session, submit resume, wait a couple weeks, be asked to schedule an on- campus interview, wait a few days, be invited up to Redmond, schedule flights, fly up to Seattle. Pretty standard, but...

When I applied to Amazon, the process was: Go to career fair, hand them my resume, have my resume looked at for ~20 seconds, be asked to write a C-string function on the back, wait a few days, and be invited for a final round interview on campus.

The point is that they cut out an enormous amount of overhead by recruiting this way. They probably wouldn't get much information out of a typical first round interview or phone screen that they didn't get by asking me to write that function on my resume and keeping an eye on how long it took me. And rather than fly people up to Seattle, they probably just fly 2-4 interviews down here. Amazon strikes me as a very shrewd company in some ways.

</comment><comment><USER16> At the business I work at, we have been thriving as well. We're not anywhere near as big as Amazon, infact we only have 5 employees (and one part time accountant)

Yet, we've had our 3 best months in a row since November, and February is shaping up to be pretty good

We sell outdoor and indoor recreation items, so no one needs them, but everything is below retail. We also sell through about 5 different channels (Our websites, Our small retail store, Pennysaver, Kijiji, eBay..)

We also make sure to ship everything same-day, answer every customer email within 12 hours, and run a super tight ship when it comes to inventory counts so we're not in a big mess.

Of course, I'm sure there is many guys like us but I thought it'd be ok to share some good news from a small retail business :)

</comment><comment><USER17> I really like Amazon as a company, I know their products, market and believe AWS, Kindle are great growth areas. I really wanted to buy their stock but I dollar cost avg my existing positions instead. AMZN has gone from ~$40 when I was looking to over $60 today. nharman is a sad panda.

</comment><comment><USER18> People who live off the beaten path love Amazon, and especially Amazon Prime. The big box retailers are still good for everyday stuff, but you really appreciate the convenience, price and selection Amazon offers when you have severely limited retail options.

</comment><comment><USER19> Retail stores are basically warehouses. The consumer has to waste some time looking through all the inventory and some of it may not be there, etc.

Amazon, on the other hand, hides its warehouses and gives you a clean interface to the inventory.</comment>


ALWAYS LAUNCH ON FRIDAY recounting my launch last week - <AUTHOR> http://screening.tumblr.com/post/1290638404/the-necessity-of-the-friday-launch

<comment><USER2> Funny how times have changed ... 10 years ago we'd have a 'no-release on friday' policy to allow everyone to have a nice weekend. Now that lots of weekend projects grow into 'startups' the opposite makes sense. Most calendar software has an option to make your work-week start on sunday or monday, but not on friday. Today it seems most work-weeks start on Friday at 17.00. Congrats on the launch!

</comment><comment><AUTHOR> this was my first post-launch blog post about printingfacebook... It's short and i dont know if people will agree, but i thought i would submit it here and see if anyone else has comments about launching... or advice. :-)

</comment><comment><USER3> Love the idea! Congratulations on the launch :)</comment>