Gotchas from Two Years with Node - <AUTHOR> https://segment.com/blog/gotchas-from-two-years-of-node/ <comment><USER2> The root of the eventloop issue is not Node-specific. The real underlying issue here is that one CPU core is given too much work while others are more or less idle. Offloading some of the work to another process naturally solves this issue - It doesn't really matter that this other process is a Go program or a Node.js one - Both approaches would have solved the problem. Attributing credit to Go itself for solving the issue is disingenuous.

If you ran Go as a single thread, you would also run into similar issues. The main advantage of Go is that it makes it easier to parallelize your code thanks to goroutines and channels (a single source file can encapsulate the logic of multiple concurrent processes).

That said, I find that this 'ease of concurrency' makes Go code less readable. In Node.js, it's really easy to identify process boundaries since the child_process module forces you to put code into different files and communicate via loosely coupled IPC channels.

Most of the Node.js vs Go arguments are weak. It's surprising that Node.js is still outpacing Go in popularity in spite of all this slander.

<comment><USER3> > _Most of the Node.js vs Go arguments are weak. It 's surprising that Node.js > is still outpacing Go in popularity in spite of all this slander._

Thats a rather defensive position for node in what is a very rare use case for the language. It's _unsurprising_ Node.js is still outpacing Go, given the large number of JS developers and the fact that Go is pretty much worthless for hosting front end web applications (you won't find your favorite asset pipeline in Go).

Its not surprising at all that they switched to a different language for data processing & pipelines, and its still somewhat surprising as that they chose Go, given that most teams in a situation like this would switch to the even more popular JVM/Spark/Storm/Kafka stack.

Finally, your statement that _The real underlying issue here is that one CPU core is given too much work while others are more or less idle._ isn't accurate - the issue is one _thread_ was has too much work - no modern OS built in the last 20 years would allow a single process to hog all the CPU time unless you explicitly turned off the kernel's scheduling. The root of the eventloop issue, is _eventloop_ specific and its even more Node-specific since the event loop is pretty much the only way to achieve concurrency in node. Other languages (like Go and Java) at least have options for other models of concurrency.

Consider the following - what if _both_ processes got tied up? Do you just start another process? Would it feasible or wise to run 1000 processes (no it wont)? However this is a problem that you won't come across in Go by using goroutines and taking advantage of its scheduler, as you can easily run 1000s of goroutines performantly.

That said - this is a rather narrow use case to make the judgement that one language is better than the other - its just the case that Go is likely better suited for these kind of services.

<comment><USER4> > the issue is one thread was has too much work

The underlying issue is that when you have a consumer-facing API which accepts HTTP requests with a body, the first thing you should think about is limits.

> Consider the following - what if both processes got tied up? Do you just > start another process? Would it feasible or wise to run 1000 processes (no > it wont)? However this is a problem that you won't come across in Go by > using goroutines and taking advantage of its scheduler, as you can easily > run 1000s of goroutines performantly.

I have no experience of go, but my understanding is that goroutines are green threads multiplexed over a small thread pool. If you get 5 MB of JSON in N different requests (N=number of cores) at the same time, I don't see go generating free CPU time out of thin air. The usual way to go about these things in a language without multithreading is to have a queue and a process pool, but this also won't magically solve the issue if all cores are busy.

<comment><USER3> > _If you get 5 MB of JSON in N different requests (N=number of cores) at the > same time, I don 't see go generating free CPU time out of thin air._

You don't, but the scheduler normally won't allow one thread to completely starve the cpu. Of course, its clear they should be using limits, however JVM, glibc threads scheduler or Go's green threads likely wouldn't allow a single thread to completely starve the CPU, eventually the scheduler will step in and divert resources to another thread.

Without limits in a threaded solution, you would see the latency increase, but you wouldn't see the application stop taking requests altogether.

However there are real benefits for having an event loop concurrency, so this shouldn't be taken as a reason one model is strictly better than another.

</comment></comment></comment></comment><comment><USER5> All these problems are solvable (streams by ditching built-in streams and replacing them with something decent, errors with promises + typescript, event loop blocking with a streaming JSON parser). But that still means that out of the box node is a pretty unsatisfying experience all around.

It took us a year to arrive at the solutions above, and many prominent members of the community scoffed at a number of them. Some are still scoffed at.

For example, everyone still thinks that promises should not catch errors, as if somehow throwing on typos is useful. Its not. The real solution here is a type system, the sensible error capturing model of promises that doesn't destroy all assumptions about code (unlike domains), and a sensible library like bluebird that reports rather than swallows up unhandled errors.

People also swore that streams are the best thing ever but the reality is that the built in streams are an organically grown design that accreted many flaws along the way. Most of them can be mended though and with streams 3 things are finally starting to be acceptable.

<comment><USER6> > "ditching built-in streams and replacing them with something decent"

What have you found sufficient for this?

<comment><USER5> We have an inhouse solution which is basically a set of external functions that work with built in streams in a way that avoids frustration.

Some of them can be found in [https://github.com/spion/promise- streams](https://github.com/spion/promise-streams) \- the others we haven't extracted to an npm module yet. (Promise streams also has a minimal extension of built in streams to make them work better with promises).

We never managed to find a full replacement though. Probably not worth the effort either given that it will always have to wrap existing streams, and the only drawback of external functions is that you cannot invoke them as methods. Although, one contender that I have hopes for is WHATWG streams [1].

note: to replace event emitters we built [https://github.com/doxout/promise- observer](https://github.com/doxout/promise-observer) which gives you a lot more power and control in terms of execution order and goes away with the "multiple events per object" stringy design that makes things harder for typesystems like typescript/flow.

[1]: [https://github.com/whatwg/streams](https://github.com/whatwg/streams)

</comment></comment></comment><comment><USER7> Why not Java EE? Everything out of the box. Tried, proven, standardized. Well suited for startups:

[http://www.adam- bien.com/roller/abien/entry/a_java_ee_startu...](http://www.adam- bien.com/roller/abien/entry/a_java_ee_startup_getting)

<comment><USER8> > Everything out of the box.

Everything except that special sauce called green threads (or goroutines). They are quite popular these days for good reason - callbacks suck.

<comment><USER9> Blatant self-promotion here, but Java's got fibers (aka lightweight threads, aka goroutines), too: [https://github.com/puniverse/quasar](https://github.com/puniverse/quasar)

BTW, I don't like the term green threads because they have a connotation of being scheduled onto a single OS threads, while fibers/lightweight threads employ parallelism.

</comment></comment></comment><comment><USER10> Why am I getting this strong deja vu feeling? Hmm. Oh, now I know! These were exactly the type of problems we were attacking, and solving, 25 years ago when we were creating Erlang. How you build concurrent, fault-tolerant and non- blocking systems with low-latency. And about 10 years ago there came implementations of Erlang which handled multi-core transparently and provided things like load balancing automatically.

I would say you would have to have really extreme requirements to handle those type of things yourself.

</comment><comment><USER11> > Plenty of times, there will be an uncaught exception which–through no fault > of your own–bubbles up and kills the whole process.

Really? I'm just a beginner with node.js, and I've been deeply frustrated by error handling, but if this is true, that's pretty damning. In just about every other web framework under the sun, you can go wild with exceptions and the worst you'll get is a 500 response for _that_ request. (Yes, worse behavior is possible but very uncommon.)

<comment><USER12> Same happens with Java, C++, and many other languages.

There are web server packages on node that do catch errors that happen in synchronous code. For async, you can use promises, which take errors into consideration.

I'm not sure what happens on unhandled async errors on other languages, I guess in Java you could have a dangling request (happened to me before) or it could crash the app (also happened to me before). C++? I haven't really done much webserver work on that one so someone else may be able to write more about it.

Also obviously PHP, you just get a white page or actual full error stacks sent to the client, the joy! (edit: of course, if you don't handle it properly)

<comment><USER13> C++ - couldn't you just put a catch(...) within your request handler and return 500 if that is hit?

<comment><USER12> And you can do the same on node :)

<comment><USER14> not if you are using any kind of event emitters. These don't participate in any kind of flow but fire "error" events as side effect sneakily in the background, and if there is no listener on an event emitter for the "error" event, it will crash the server. And almost everything in core is an event emitter.

Also bonus points if the event emitter object is private to some module that doesn't expose it and doesn't attach an "error" event handler to it.

</comment></comment></comment></comment></comment><comment><USER15> The switch from Node to Go seems quite popular right now and it honestly makes me thing there's something wrong with the general perception of Node.

We are currently in a world where we have a huge amount of traffic on almost every web app with just a discrete success, but we still make the mistake to pick a technology that seems "good enough", instead to pick a "great one" because looks slightly harder to manage/learn/deploy. I know that during the early stage, pace is very important and RAILS or Node are easier and faster to handle compare to Scala or Erlang, but sometimes another technology at the beginning would save a lot of headaches and night calls. We still fail at the very early stage to choice the right technology, but nobody is afraid to admit it and to switch, I find this amazing.

<comment><USER16> I think it makes sense, early on you're still "figuring it out" so a flexible framework thats easy to dive into is advantageous.

I don't see anything wrong with planning a rewrite X months into a product, since 90% of things don't make it to month X.

<comment><USER17> A code rewrite means time spent working on stuff that isn't delivering features, which means your business could be stagnating, making customers dissatisfied, giving competitors an opening.

As an example, I recently migrated a Node app from MongoDB to Postgres. This ended up taking two and a half weeks, due to re-writing a fair portion of the server-side code. That's a long time to go without delivering new features or fixes. We justified it because we had inexplicable data loss (not pinpointed on MongoDB, but a poor reputation is a hard thing to remedy) and our data model did not suit a document store. But you have to then accept it when the business folks say "well, why didn't you get it right the first time? Aren't you supposed to be the expert?".

As technologists, of course we find it fun to try new technologies. But outside of the main tech hubs, a large proportion of developers aren't working for tech companies whose main product consists of web services/APIs, in which case we need to always consider the costs/benefits of any tech switch. If it's not justified, you're stuck supporting flakey apps until you can move on to the next gig / learning experience.

<comment><USER3> As a counter-example, I recently read Twitter was built on Rails _6 months_ after it was released. Once the concept was proven out, and the production app was failing like crazy (fail whale everywhere) - they rewrote their entire stack in Scala/on the JVM.

Now should have Twitter spent the first 6 months of their life building out the perfect infrastructure with proven tools spending the little money they had mainly on engineering or were the justified in pushing that technical debt down the road to focus on other things today.

It seems to me, for most startups, that the marginal cost of building it "right" today is much higher than rewriting when you can/if you need to.

<comment> jon-wood Twitter was also originally built as a side project to amuse some friends. It wouldn't surprise me if someone took the view that they were writing a stupid little throwaway thing which everyone would probably get bored of, so why not try learning this hot new web framework everyone's talking about.

</comment></comment></comment></comment></comment><comment><USER18> Node has a lot of flaws today. But, even with those flaws, it's very useful for quick prototyping (discipline is required here since it must be a true prototype which means throwing away the code) and command line scripting (for me, it has mostly replaced python for small scripting tasks). Using it in a production service is possible, but should be limited to simple services (not too much business logic and it should be IO heavy).

But there is a lot of potential in the future. ES6 greatly improves the Javascript language and it's possible ES7 or 8 will add types. If something like TypeScript becomes standard Javascript and async/await is added, the language will become a "serious" language for many developers.

I think the Node of the future will look nothing like the Node of today. When Javascript/Node gains these features, it has the potential to become a true server side language.

<comment><USER19> I agree that JavaScript will get better with ES7, etc. that said, I am half way throw the edX Typescript class and it offers a lot of what ES6 and future releases will offer today. I also really like ClojureScript but TypeScript is an incredibly well designed language.

</comment></comment><comment><USER20> I've had some similar experiences as we've scaled from internal only applications a couple years ago, to handling thousands of requests a second at peak.

1\. Event loop. Yep, always be careful not to block it. But, I think this is more of a tuning thing. If you're using Java, you figure out how many requests you can reasonably handle and make that your water mark. Do the same thing in node, if you take too many connections, start refusing them fast and not queuing them forever.

2\. Exceptions. Honestly this has never been an issue. We've used Promises for async flow from the beginning. This means that there is nearly zero code that is not inside of a promise chain and hence inside of a try {} catch {}. We just don't have this problem and we don't crash.

3 / 4\. Oddly enough, I found streams to be a solution to this problem and not a cause, if using back pressure properly. I highly recommend highland.js.

</comment><comment><USER21> Some good stuff there, but I thought "don't do any heavy processing in consumer-facing node.js instance" was part of Node's 101.

</comment><comment><USER22> "To further avoid event loop problems entirely, we've started switching more of our data processing services to Go".

This seems to become a common pattern... start with Node, hit some limits, rewrite microservices in Go.

</comment><comment><USER23> The one problem they use as an example wasn't solved by switching to Go. Go is great but let's be real, parsing and concurrency problems don't just magically go away by switching languages.

<comment><USER22> Concurrency issues don't magically go away by switching to another language, but they have a much better chance of getting cleanly addressed by switching to a language which has explicit/native features as part of its design to help address concurrency issues, via goroutines/channels in this case.

<comment><USER24> _> by switching to a language which has explicit/native features as part of its design to help address concurrency issues_

…such as Haskell or Erlang.

</comment></comment></comment><comment><USER25> Just curious though, I have seem quite a number of posts in the past year mentioned the switch from Node to Go, is there a pattern here?Why Go in particular?

<comment><USER26> > Why Go in particular?

Its the new shiny thing.

<comment><USER27> I think go and node are more or less of the same "age" and "shininess"?

EDIT: Very much so, they were actually released to the public in 2009.

<comment><USER28> Ruby was first released in the mid 90s and became the shiny new thing in around 2005 when ten years old.

Sometimes the shiny newness is in the public eye rather than absolute terms.

<comment><USER27> Not really, Ruby ON RAILS became the shiny new thing, and was released in 2005.

</comment></comment></comment></comment></comment><comment><USER29> > At any given time there's only a single running code block.

> But here… there be dragons.

That's one of the things Erlang solves pretty well. Sometimes I sort of envision it as that robot dog/mule thing that they keep kicking and it gets back up and keeps going.

[https://www.youtube.com/watch?v=cNZPRsrwumQ](https://www.youtube.com/watch?v=cNZPRsrwumQ) if you have never seen it before.

<comment><USER30> Segment.io seems like the type of challenge that would be right in Erlang's sweet spot. The talk that Whatsapp gave on scaling Erlang is a good proof point that it's built to handle these systems quite well.

</comment></comment><comment><USER31> PyPy (a JITed Python interpreter) is experimenting with STM to solve the issue:

[http://morepypy.blogspot.de/2014/11/tornado-without-gil- on-p...](http://morepypy.blogspot.de/2014/11/tornado-without-gil-on-pypy- stm.html)

</comment><comment><USER32> Their first problem was sending customer requests directly into processing. They're collecting customer metrics - they should never be unable to handle a request because another request has consumed all the resources.

A much better way to do this would be to have a very lightweight API putting events into a stream (Kafka or, since they seems to be on AWS, Kinesis [1]). Let the stream absorb that crazy customer data, and let your data processing run full-speed from the stream. You'll get blips and slow downs, but it won't affect your ability to receive more data. Log out any errors or malformed data so that customers can see the problems. Do your profiling and optimisation, but avoid losing data.

[1] We're using Kinesis. Very easy to provision, does what it says on the box, and can easily handle thousands of requests per second.

<comment><USER33> Yep. This technology is too cheap/readily available to "do it wrong."

Let the Kafka project handle the nuances of durable, performant queueing - that's not your business model.

</comment></comment><comment><USER34> Arbitrarily limiting JSON size/nesting because it blocks your event loop seems silly. What if a customer needs to give you something taking a while to parse?

Do the parsing in a web worker.

</comment><comment><USER35> OT but can someone explain this?

PHP: Starts reading from database, blocks everything else, returns data.

Node: Starts reading from database, lets it go and continues with other stuff until the data is ready and then returns it.

I understand it in theory but since Node is single-threaded, doesn't it need to use that thread for the database operations? Which means it's blocking the program until it's done anyway?

<comment><USER36> I believe what happens is it registers the functions callback on the event- loop which it'll check the next time around to see if it's done, then pushes the work to be handled in a separate pool of threads that libuv manages. When it's done, the next event-loop tick or the next time around it will execute the callback with the results. This is how asynchronous functions work anyways, but some functions are actually synchronous functions such as JSON.stringify, so if you are doing a JSON.stringify on a huge JSON object, you're literally grinding everything to a halt until you're done doing that

<comment><USER35> Thanks. So Node is actually using multiple threads behind the scenes or did I read that wrong? How do I know which kind of operations are pushed there by libuv?

<comment><USER36> Yeah, there's a pool of non-blocking C++ threads that do the work behind the scenes. Any async operation gets pushed out, and honestly most functions will behave asynchronously. JSON parsing is a sync operation that usually doesn't block for very long because it will be a small operation 99.9% of the time, so it's kind of a pitfall because you almost never see this blocking issue unless your parsing huge JSON objects. In nodeland things are kind of expected to be asynchronous, and if they are not they should be labeled as such so that everyone using it knows. Checkout the FileSystem (fs) nodejs lib, you'll see calls explicitly labeled as "sync" to denote that they are blocking.

</comment></comment></comment></comment><comment><USER37> Event loop debugging is key and I'm glad that there are some interesting offering profiling services on this level, especially for frameworks like Meteor: [https://kadira.io/](https://kadira.io/)

</comment><comment><USER38> Node, like Rails before it, was an enabler tech - it enabled non-developers to build stuff. Those with experience would have gone direct to something like Erlang in the first place, carefully sidestepping the dog that is Go.

</comment><comment><USER39> Anyone else thinking this sort of blog post is actually really bad PR?

There are some very obvious architectural issues here, issues that _aren 't_ tied to the choice of Node.js. I wouldn't want to use a provider whose stack was this immature, to be perfectly blunt.

For example, an API shouldn't do any of the processing they describe. The API's role is to handle submitted requests as fast as possible, so it must off-load the actual work to a queue that can be processed elsewhere.

I'm also skeptical of solutions like YAL, at least the way it seems to be used here. IMHO you'll want local spooling via something like rsyslog, so that you're impervious to network failures. Logging directly to a remote server means you become completely reliant on that server.

</comment><comment><USER40> I wonder why they don't use a stream JSON parser like oboe.js?

</comment><comment><USER41> "Simple exceptions should be caught using a linter. There's no reason to have bugs for undefined vars when they could be caught with some basic automation [...} It catches unhandled errors and undefined variables before they even get pushed to production. " And there are people still thinking untyped languages are good for the server...

"Node is good when you're using a linter, when you're writing your back end in go, when you write MASSIVE unit tests..." May be it could be much simpler to use a more suitable langage, no ? Just saying...</comment>


Online grocery shopping is causing a cold storage shortage - <AUTHOR> https://www.latimes.com/business/la-fi-cold-storage-demand-jumps-20190707-story.html <comment><USER2> [http://archive.is/CPhan](http://archive.is/CPhan)</comment>


Native Responsive Images - <AUTHOR> http://dev.opera.com/articles/native-responsive-images/ <comment><USER2> For things like retina-aware images, e.g.:

        src="cat_500px.jpg" srcset="cat_750px.jpg 1.5x, cat_1000px.jpg 2x"

Does anyone know if the browser will download a higher-res image once the user zooms in? E.g., in Chrome on OSX, if I zoom from 100% to 130% on a non-Retina display, will it download the 1.5x version and downsample it? Likewise, in iOS, if the initial zoom setting is "zoomed out", and "retina" is almost meaningless from a web perspective because people are zooming in and out all the time, what will be downloaded?

I've never really understood the attention paid to exact pixel alignment, and retina versions of images, when zoom levels are all over the place these days on all sorts of devices.

<comment><USER3> The browser can do whatever it wants (read: whatever's best for users) in this case. Current Blink (Chrome/Opera) code wouldn't download the higher res image for 'x' descriptors, but that may change in future versions, perhaps tied to user preferences,network info and other possible conditions.

</comment></comment><comment><USER4> Honestly, we're (collectively) never going to adopt this on a large scale. Everything I read in this article is just horribly complicated. I don't have a solution, but none of these are the right one. There's so much complexity going on that no developer will get it right without devoting a massive amount of time and effort just to load the "right" image at the "right" time.

Honestly, I need to support retina screens for mobile and desktop. For non- retina screens getting a larger image doesn't really matter. Non retina mobile devices are rapidly disappearing. So therefore I'm comfortable delivering higher resolution images to all devices.

I optimize our images by making them as small as possible and using lazy loading. These two techniques are more than adequate to suit out needs right now.

I am (loosely) of the opinion right now that this is an answer in search of a problem.

<comment><USER5> > For non-retina screens getting a larger image doesn't really matter. Non > retina mobile devices are rapidly disappearing. So therefore I'm comfortable > delivering higher resolution images to all devices.

Must be nice to only have big-city first-worlders as users :)

<comment><USER4> Yeah I hear ya. Literally just going based on our traffic numbers though. For the vast majority of our audience, this technique is just fine.

</comment></comment></comment><comment><USER6> > Unfortunately some browser vendors were reluctant to add new content > negotiation-based solutions, because of past bad experience with this kind > of solutions.

Can anyone provide more details of what they're talking about? I'm actually not too interested in naming names of browser vendors (which they were trying to avoid clearly) -- I'm more interested in details of the 'bad experiences', what was it (some people) thought went wrong with what particular aspects or areas of con-neg-based solutions in the past?

<comment><USER3> The canonical link in that aspect is [http://wiki.whatwg.org/wiki/Why_not_conneg](http://wiki.whatwg.org/wiki/Why_not_conneg)

There are various people in various vendors (Mostly Mozilla and Apple) that oppose conneg based solutions. I didn't mean to be vague, just didn't think it's very interesting :)

It's important to note that the opposition is not unanimous, and things may change in the future.

<comment><USER6> Thanks!

What's interesting to some is not to others. :) You could add a link to that doc from the relevant sentence if you wanted, woo, the web.

</comment></comment></comment><comment><USER7> I can see a simplified <picture> element possibly working, but scrset just seems like I'm writing inline stylesheets again.

</comment><comment><USER8> What about a proper image format with support for multiple resolutions? Similar to the way it's done in SVC ([http://en.wikipedia.org/wiki/Scalable_Video_Coding](http://en.wikipedia.org/wiki/Scalable_Video_Coding))

<comment><USER9> That would add unnecessary data overhead as clients would get image data they may not need, e.g. a low-resolution device would not want a high-DPI version of all images on the site.

<comment><USER10> Please read the wiki op linked.

> A subset video bitstream is derived by dropping packets from the larger > video to reduce the bandwidth required for the subset bitstream. The subset > bitstream can represent a lower spatial resolution (smaller screen), lower > temporal resolution (lower frame rate), or lower quality video signal.

<comment><USER9> Then we are not talking about an image format but instead a network protocol.

Inventing a new protocol if the problem can be solved by serving the proper markup, seems misguided.

</comment></comment></comment></comment><comment><USER11> Did I read that not carefully enough, or did the article really not explain what that "vw" unit is/stands for?

And what does the "calc(33vw - 100px)" do, apparently in void context?

Somehow I feel more confused after reading the article.

<comment><USER12> I believe it stands for "viewport width" which is specified in percents over the width of the browser viewport.

Google has a first-class definition, too: [https://www.google.com/search?q=css+vw+unit](https://www.google.com/search?q=css+vw+unit)

</comment></comment><comment><USER13> I used to rely on this, until some browsers suddenly stopped supporting it. It's a nice idea, but I recommend using retina.js ([https://imulus.github.io/retinajs/](https://imulus.github.io/retinajs/)) for consistency.

</comment><comment><USER14> ...and if you don't want to pre-scale/crop all those different image sizes, you can have Pixtulate ([http://www.pixtulate.com](http://www.pixtulate.com)) generate them on the fly from one high resolution image.

<comment><USER15> Two things: Being half the comments in this thread (2/4 as of right now) makes it seem like you're spamming. And you spelled "tailored" wrong on your site.</comment></comment>


BAE sold cyber-surveillance tools to Arab states - <AUTHOR> http://www.bbc.com/news/world-middle-east-40276568 <comment><USER2> Not just BAE.

Facebook only a few months ago began helping Pakistan "fight blasphemy", sending a team to the country.

[http://www.bbc.co.uk/news/world- asia-39300270](http://www.bbc.co.uk/news/world-asia-39300270)

Only for a man to be sentenced to death for committing blasphemy on Facebook a little while later.

[http://www.bbc.co.uk/news/technology-40246754](http://www.bbc.co.uk/news/technology-40246754)

Facebook say they are not responsible for this but it's obvious they have blood on their hands.

<comment><USER3> If this is real then wow.. do Facebook employees know this is happening? Or are they just okay working for a company like that?

If you work for Zuck I'd love to hear your take on this.

<comment><USER4> Btw. are you a US citizen? Do you feel personally responsible for what your fellow citizens did there? Have you already packed your stuff and moved to Brazil?

I'm totally aware that asking these questions there is a chance >0 that you are actually not American and/or already living in another country. Let's just agree that you can still follow the intended purpose: People in a huge group don't really feel responsible for what other people on the other end of the world do unethically for the same group.

<comment><USER5> I agree. I wonder if people who work or looking to work for companies which make ad/surveillance software and get huge salaries are always different than people who rail against these companies. Or is it just different mode of same people?

<comment><USER6> For a lot of people the salaries are too good to pass on. And its not hard to rationalize what you are doing. This is kinda why a broader education seems very important to me, so that smart people understand exactly what they are contributing to and can take a reasoned stand.

In other cases, it may be just a small part of an otherwise great organization. e.g. Palantir is used by CIA to track bad actors, but it can also be misused by police depts (hypothetically?). So the developers of the software think they are helping protect their citizens but it may be misused.

</comment></comment></comment></comment></comment><comment><USER7> All of you programmers working on "cool" technology understand that this is going to be turned against your own children? Doesn't matter, does it? We all had a good time!

Its really amazing to watch iron chains form from digital crystals. Did we learn nothing about history while our young people studied algorithms? Did taking "Computer Science" classes seclude us from the reality of how all of this would be used?

We should feel some shame and remorse. If you're in this industry, start telling us here everyday what you've done so that some can have a chance to deal with the coming digital dictatorship. It will be worldwide, it will be unjust, and people will not be able to run away from it because it will cross borders.

They lied to you when they told you they "needed" it for safety reasons, or for the children, or other soundless reasons to deceive you into building invisible prisons.

<comment><USER8> >Did we learn nothing about history while our young people studied algorithms? Did taking "Computer Science" classes seclude us from the reality of how all of this would be used?

Obviously the answer to your questions is, "Enough people don't learn those lessons, don't believe it will apply to them, or simply don't care."

The time for analysis and hand-wringing was years ago, now it's just a pump- and-dump scheme at every level. The fools just think they have a place to run to, and that's the big flaw in the plan.

</comment></comment><comment><USER9> In other news: West funds oppressive Arab states. Really, if we didn't want them spying on people, we shouldn't be giving them all that oil money. Funding terrorists is illegal, why is funding oppressive governments OK and then it's suddenly not OK when they spend that money to oppress people?

<comment><USER10> Let's not fool ourselves. We need that oil to keep business as usual going. Gigatons of liquid energy that fuels most of our civilization.

<comment><USER11> Importing goods from non-democratic countries is not an all-or-nothing proposition. The externality created by giving non-democratic countries cash issued by democracies can be partially corrected by assessing a unilateral scaling tariff on imports, in proportion to the level of human rights abuses created by the country of origin.

<comment><USER12> >"Importing goods from non-democratic countries is not an all-or-nothing proposition. The externality created by giving non-democratic countries cash issued by democracies can be partially corrected by assessing a unilateral scaling tariff on imports, in proportion to the level of human rights abuses created by the country of origin."

So lets apply that to Chinese imports. Let say that the US places one of the highest tariffs on Chinese imports since its one of the least democratic countries[1]. So China's economy grinds to a halt. But China is one of the largest purchasers of U.S debt so now both China and the U.S economies completely tank[2]. And then that has knock on effect on Africa where China is buying up minerals and investing in infrastructure projects. This would effectively tank the economies of North America, Asia and Africa. Does this still strike you as a viable idea?

[1] [https://en.wikipedia.org/wiki/Democracy_Index](https://en.wikipedia.org/wiki/Democracy_Index)

[2] [https://www.thebalance.com/u-s-debt-to-china-how-much- does-i...](https://www.thebalance.com/u-s-debt-to-china-how-much-does-it- own-3306355)

<comment><USER13>
      Does this still strike you as a viable idea?

Sure. Just announce the tariff will be phased in at 0.5% per year over 40 years.

<comment><USER12> China had exports of 2.3 trillion dollars in 2016. 16.9% of which was to the US[1].

.5% of trillion is 5 billion. Let's just round down China's exports down to 2 trillion.

That means the US would be levying 10 billion dollars in tariffs on China during the first year alone and this would continue to increase for the next 4 decades?

How do you imagine China would react to that? Do you imagine a trade war would be good for the world economy?

This is the kind of nonsense that Trump was recently spewing during the US election season.

You know who's going to actually pay that tariff? The U.S.? They will pay for it in higher prices on goods and perhaps more importantly they will also pay for it in China financing 100s of billions dollars less of U.S debt in the coming decades. That might be the kick in the pants the US needs to get its deficit in order but before wreaking lots of havoc.

You realize that China is the United States second largest creditor right? Until very recently they were the United States largest creditor[2]. Yes China finances the United States by buying up U.S Treasuries.

[1] [https://en.wikipedia.org/wiki/Economy_of_China](https://en.wikipedia.org/wiki/Economy_of_China)

[2] [https://www.statista.com/statistics/256591/share-of- chinas-e...](https://www.statista.com/statistics/256591/share-of-chinas- exports-in-gross-domestic-product/)

</comment></comment></comment></comment></comment></comment><comment><USER14> 2014 while working in US federal info sec, one of my coworkers had a boyfriend employed by BAE working on surveillance software. I was surprised to learn that BAE produced such software. She explained to me that while certain laws prohibited US citizens from spying on each other, foriegn countries are exempt from those laws, so it is apparently common for surveillance software developed in the US to be deployed targeting the US by US allies who work with the US government.

<comment><USER15> Yup, while it's technically illegal for the NSA/etc to deliberately intercept American communication, it's an open secret that they work in cooperation with other nations who spy on us and give the data back to the US via programs like ECHELON.

They also bend the rules as much as legally permissable. They can't deliberately intercept domestic-only traffic, but anything that goes overseas is fair game for a bulk tap, and you don't really have control of how your packets are routed.

</comment></comment><comment><USER16> Rather than just whine about lax security practices, here is an nginx config file that will get you a pretty high score on scanners like Mozilla's Observatory.

[https://gist.github.com/zachaysan/89d40b3214160ce9d59a2b9136...](https://gist.github.com/zachaysan/89d40b3214160ce9d59a2b913645a012)

If you work on things that involve sexuality, health, or finance and you don't enable these types of protections you're risking lives or financial ruin.

Also if you see a shortcoming please let me know, I created this in a bit of a rush and I'm always happy to learn more.

<comment><USER17> Seems odd that something designed to protect lives or prevent financial ruin you'd do "in a bit of a rush."

<comment><USER16> My schedule is packed and it's better to share something than nothing, no?

The point is to show how little is needed to protect against the type of encryption thwarting tools these guys likely employ, and to give people a starting point from which they can learn more from.

</comment></comment></comment><comment><USER18> "While the sales are legal, human rights campaigners and cyber-security experts have expressed serious concerns these powerful tools could be used to spy on millions of people and thwart any signs of dissent."

Whilst true, why does this point seem to matter for other countries governments than our own?

<comment><USER19> By no means am I excusing the excesses of my government or its western allies, though I would like to point out that we won't execute someone for blasphemy like some of those other nations.

I say we put out the big fire first.

</comment></comment><comment><USER20> This is more of the same inglorious British Government tradition of being willing to sell anything to anyone, provided they've got the cash.

<comment><USER21> As far as I am informed the British Government adviced agains th sale, however the danish government approved it.

</comment></comment><comment><USER22> If you have time, watch Bitter Lake by Adam Curtis: [http://www.bbc.co.uk/programmes/p02gyz6b](http://www.bbc.co.uk/programmes/p02gyz6b) (also available on youtube if you are outside the UK - though seems mildly edited)

Shows the tangled complicity in each others affairs that exists between UK, US and the Arab countries, and some of the background behind them and the leverage that we have over each over.

</comment><comment><USER23> The Danish media is less gentle with their wording. The customers aren't talked about as "repressive governments" but is straight up called dictatorships.

<comment><USER24> Is dictatorship a necessary condition for oppressive governments? Democratically elected governments can be oppressive as well.

</comment></comment><comment><USER11> Western democracies should impose a domestic procurement ban on companies which sell to foreign governments without civilian control over their militaries. This would not require new export controls or restrictions on international trade, only voluntary divestment when awarding domestic procurement contracts on the public's behalf. Problem solved.

<comment><USER25> They would just do some wizardry to avoid the consequences like making a parent company with two subsidiaries that licensees the IP to the individual operating companies one for the domestic market and one or the undesirables.

<comment><USER11> Yes, but requiring socially undesirable accounts to be compartmentalized and spun-off may allow democracies to start removing the currently blatant conflicts of interest surrounding procurement and lobbying.

A longer term solution would most likely require imposing a scaling import tariff on non-democratic countries in proportion to their level of human rights abuses. This would establish a rule where their ability to acquire democratic foreign currencies redeemable for weapon systems automatically decreases on the margin if they they pursue authoritarian policies, and automatically increases on the margin if they pursue reforms.

</comment></comment></comment><comment><USER26> It sucks when nationstates have real security they work that the citizens want done, but are also relatively evil. You have to guess whether they'll be doing more evil or more real useful law enforcement. We only hear about the evil.

<comment><USER27> You don't _have_ to guess. You could just refuse to collaborate with any of it until the level of evil is reduced.

</comment></comment><comment><USER28> "within the regulatory framework" aka against the people

</comment><comment><USER29> If your big enough and have enough money you can do anything. Legal or not.

<comment><USER7> _moral_ or not, legal is a formality.</comment></comment>


Ask HN: Why there isn't CSS on the cloud? - <AUTHOR> <comment><USER2> What do you mean? CDN's can deliver CSS too.</comment>


AT&T Collaborates with NSA spying via a web of secret buildings in the U.S - <AUTHOR> https://techcrunch.com/2018/06/25/nsa-att-intercept-surveillance/amp/ <comment><USER2> I think they failed to mention other sites. Here in Springfield Missouri we have an AT&T building which seems highly fortified like what is described in the article.</comment>


Muscular Hydrostats for Games - <AUTHOR> http://codepen.io/soulwire/details/KLrBz

<comment><USER2> Tried it on a Mac mini of age but still a Core 2 Duo. It was very slow in Google Chrome. If it's moving smoothly on more modern computer I guess It's time to upgrade.

On another note, I believe that this is why native still is around.

<comment><USER3> Works smoothly on Chrome 21 on Windows XP. Note that if you change tentacles to max, thickness to about 9, gravity to max, and friction to 0.3, it is a good simulation of long flowing hair - maybe could be used in a RPG with a girl as protagonist?</comment></comment>


The Least Free Place in America [video] - <AUTHOR> https://www.youtube.com/watch?v=dJaM8IOev7E

<comment><USER2> I tend to have a hair-trigger for flagging Youtube videos here on HN, and was doubly suspicious that this one got such a quick upvote. But I was surprised to find that instead of spam, it's a short but solid presentation about free speech issues on American college campuses. PDF for the non-video-inclined is here: [http://www.prageruniversity.com/documents/The-Least-Free- Pla...](http://www.prageruniversity.com/documents/The-Least-Free-Place-in- America.pdf)

<comment><AUTHOR> Well looks like it has been flagged anyway. Just wanted to share this very instructive video.

I personally experimented this when going to college. I wanted to show the experience of a programmer at school versus the real world and was silenced and threatened.

Of course a pre-approved essay was presented to me later to read to my fellow class mates. I did not.</comment></comment>


Show HN: We made mobile collaboration tool for IOS and Android to reduce email - <AUTHOR> http://doubledutch.me/pride.aspx

<comment><AUTHOR> Good thing is- its Free! Its a tool for start-ups like ours. Here are some benefits we have experienced by internally using this tool.

1.Reduce email, meetings and duplication of effort. With transparency comes efficiency. Short status updates replace lengthy email threads and all-hands meetings, and prevent multiple people from working on the same thing.

2.Keep your entire team up-to-date on customers and projects. Quick status updates keep everyone in the know about critical business issues, and enable real-time group collaboration and problem solving.

3.Build a culture of radical transparency and accountability. Empower your team to create a workplace where trust, openness and achievement are celebrated.</comment>


7 trends that will rule web design in 2015 - <AUTHOR> http://alexsblog.org/2014/11/03/7-trends-that-will-rule-web-design-in-2015/

<comment><USER2> >#3 – Focus on text

And yet the site uses a a combination of background and text colors that make the text difficult to read. What really matters is apparently headings, not the main body of text.</comment>


Waterfalls of the Great Lakes Region and Beyond - <AUTHOR> http://gowaterfalling.com/ <comment><USER2> _The Man in Seat 61_ is one of these sites, except it's still continually updated and is probably the single best location for train travel information, anywhere.

[https://www.seat61.com](https://www.seat61.com)

<comment> 52-6F-62 Well I've always wanted to do the VIA Rail Canadian trip from Toronto to Vancouver via Jasper. Now the page on that one has convinced me I want to do the most expensive option, too. That "Prestige" class... not too shabby.

[https://www.seat61.com/train-from-toronto-to- vancouver.htm](https://www.seat61.com/train-from-toronto-to-vancouver.htm)

That and/or the Rocky Mountaineer (how have I not heard of this route?) [https://www.seat61.com/RockyMountaineer.htm](https://www.seat61.com/RockyMountaineer.htm)

</comment></comment><comment><USER3> [https://www.sheldonbrown.com](https://www.sheldonbrown.com) is another great one. His website got him to Wikipedia: [https://en.wikipedia.org/wiki/Sheldon_Brown_(bicycle_mechani...](https://en.wikipedia.org/wiki/Sheldon_Brown_\(bicycle_mechanic\))

<comment><USER4> Virtually anyone who is interested in bicycles has at some point landed on Sheldon Brown's site. Bless whoever maintains it and Rest in Peace, Sheldon.

</comment></comment><comment><AUTHOR> The title has now been editorialized (fairly enough), but I posted this as an encouragement for all the great "classic" websites. I love seeing others people are posting here.

Working right now with a static site generator for my own website (Pelican) and been loving it.

</comment><comment><USER5> A favourite of mine is a website about Disused Stations in the United Kingdom [http://www.disused-stations.org.uk/](http://www.disused-stations.org.uk/)

The body tag is <BODY bgcolor="#CCCC99" text="#FF0000">

</comment><comment><USER6> And I admire the one of Berkshire Hathaway Inc. - one of the biggest financial conglomerates in the world:

[https://www.berkshirehathaway.com/](https://www.berkshirehathaway.com/)

</comment><comment><USER7> I was thinking about this last night, and was going to make an ASK HN about it. How do we build a site to help explore these parts of the web?

I know it would get gamed really, but what if there were an injected "related- sites" link list as an extension, that drew from a curated directory? That was how you used to explore, through blog and site "friends of" sections that sent you on an endless rabbit hole.

I feel like it can't be feed oriented, because that's a more consumption mindset than exploration mindset, and I feel part of the fun of the old web was that constant active exploration.

I don't want to turn this into a conversation about SEO, but suffice to say commerce dominates search results for so many terms that it can be hard to find anything community oriented, or niche information. So search engines and feed sites are not quite right for exploration.

<comment><USER8> Yes, this existed and was popular for some time in the early 2000's. Stumble Upon was a tool you could use to explore random websites. Some were related by topic. It was easy to spend several hours exploring new or hardly viewed websites.

[https://en.wikipedia.org/wiki/StumbleUpon](https://en.wikipedia.org/wiki/StumbleUpon)

<comment><USER9> Reddit.com _got started_ as the same kind of service, even though today it has clearly outgrown that use case altogether and become something like a new Compuserve BBS of sorts.

</comment></comment></comment><comment><USER10> Hmm, don't want to be rude, but there is nothing classic about that website. Actually it's quite modern, and maybe I'm too old to consider site from 2008 as classic. :)

Yet, it's nice source of information.

<comment><USER11> The submitted title was 'gowaterfalling.com : example of the "classic" web'. We changed it per the HN guidelines: [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html).

<comment><USER12> Sometimes it would be very good to have an option to tell why the site was posted. In this particular case, adding a completely new the title made a lot of sense. Merely posting a site on waterfalls doesn't really fall into the Hacker News world, but the reason - namely the old web simplicity of it - does.

<comment><USER11> There is such an option. Simply post a comment explaining why you submitted the site.

<comment> mark-r Is there anything to guarantee your comment remains the top-most comment? Otherwise it gets lost in the noise.

<comment><USER11> That sort of comment doesn't get lost unless the thread becomes huge, in which case it's probably less relevant.

Allowing commentary by the submitter to be pinned to the top would break HN's rule that submitting an article confers no special rights to interpret it for the reader. That's a bedrock rule here. It has served super well over the years.

[https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...](https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=by%3Adang%20%22level%20playing%20field%22%20&sort=byDate&type=comment)

</comment></comment></comment></comment></comment></comment><comment><USER13> Unfortunately the Hamilton waterfalls have been so overrun by GTAers (probably due to Instagram) that the city has cut back access, including banning people from Albion Falls.

<comment><USER3> What are "GTAers"?

<comment><USER14> I think GTA means greater toronto area

</comment></comment></comment><comment><USER15> The very first site I ever visited on the web is still live some 25 years later [http://www.armory.com/](http://www.armory.com/)

Older sites are unfortunately ever rarer, thankfully the archive project does a good job in maintaining a record of all the information they stored.

</comment><comment><USER12> I love these sites. They contain an extensive amount of information, all in a catalogue that reflects how the creator thinks. My personal all time favourite is [http://www.mir.com.my/rb/photography/](http://www.mir.com.my/rb/photography/)

<comment><USER16> And how fast these pages load :-)

<comment><USER12> There's no black magic in that at all: serve a static HTML page with small images on modern hardware. Suddenly it becomes visible that our connections are not 128Kbps ADSL any more, and that the bottleneck is actually JavaScript processing, not the network.

</comment></comment></comment><comment><USER17> [http://gowaterfalling.com/waterfalls/cascadecanyon.shtml](http://gowaterfalling.com/waterfalls/cascadecanyon.shtml)

If you press Previous or Next you will download un-parsed php file .

let me guess it was hosted on PHP-capable host and now moved to PHP non- capable host?

</comment><comment><USER18> I remember last time there was a discussion about this style of websites, someone posted a link to a static site that showed what kind of amazing things you could do with a <map> tag[0], but I forgot to bookmark it.

[0] [https://developer.mozilla.org/en- US/docs/Web/HTML/Element/ma...](https://developer.mozilla.org/en- US/docs/Web/HTML/Element/map)

</comment><comment><USER19> I don't get it, is "classic" bad? My page is online since 1995 and is still the best way I share my work. There surely are many "classic" style sites, with unique information. I'd encourage everybody who has something rare to share, to do this in a "classic" way.

[http://imar.ro/~mbuliga/](http://imar.ro/~mbuliga/)

</comment><comment><USER20> As everyone seems to be adding 'classic' websites, here's a similar website about lighthouses and lighthouse conservancy:

[http://www.michiganlights.com](http://www.michiganlights.com)

Bonus:

[http://www.terrypepper.com/lights/](http://www.terrypepper.com/lights/)

</comment><comment><USER21> I hope someday we get truly minimalist movement around the web design. Static site generators are a good start.

</comment><comment><USER22> I think I wrote the manual about my software in the same manner :) [https://www.photopea.com/learn/](https://www.photopea.com/learn/) It also loads very fast and the HTML code is readable :)

</comment><comment><USER23> Here's a good classic website with endless information on one topic...

[https://www.collectingsnapon.com/](https://www.collectingsnapon.com/)

</comment><comment><USER24> Last Modified: Saturday, 18-May-2019 18:38:40 MDT.

Someone is still maintaining this... How/Why?

<comment><USER25> How? By writing new html pages when they take a picture of a new waterfall.

Why? Well, as the FAQ on the site says, because they like waterfalls.

More generally, I'm not sure why it strikes you as odd that this site is still being updated. The old(er) way of building sites hasn't gone anywhere, and this site seems perfectly functional. Why _not_ contenue to update it?</comment></comment>


Ask HN: Has software you've written ever bitten you IRL? - <AUTHOR> Reading this comment's 'fun story' about the time its author accidentally made 1M API calls to a $x/request service made me wonder if anyone else has 'fun' tales of times they automated something or otherwise wrote some software intended for fun, profit, or benefit; that had some unintended real-world consequence?<p>https://news.ycombinator.com/item?id=22212063 <comment><USER2> Not exactly 'IRL', but many years ago I wrote a simple bash script to submit many entries into an online competition. Yes, I know... I did scour the competition T's&C's and they didn't have anything in there explicitly prohibiting it (its obviously implied, but I was young and bored...). Anyway:

Each entry required a unique email address, which then had a validation link you needed to click. I scripted this up using curl to submit the request using a randomly generated email address via a catch-all on my domain, reading the mail to extract the submission URL, and then using curl to hit that.

I actually ended up winning the 'random draw', but now I get ~18000 copies of their spammy newsletter! Unfortunately their unsubscribe page has the anti-bot protection that their competition page really should have had ;)</comment>


NASA says it has discovered water on the moon - <AUTHOR> http://www.cnn.com/2009/TECH/space/11/13/water.moon.nasa/index.html

<comment><USER2> Cross reference: <http://news.ycombinator.com/item?id=940299>

That item points directly to NASA rather than to a news report about NASA.</comment>


Ask HN: Should I ignore a cease and desist letter from our competition? - <AUTHOR>

Our main competitor, mapmyride, sent us a cease and desist letter a while back demanding we remove our account importation feature.  The feature downloaded all (or select) mapped routes from the users mapmyride account, and imported them into ours.  It was done tastefully, with adequate time outs between requests and all that.  Their objection was in our supposed violation of their TOS.  Of course that's a load of bull, since I never agreed to their TOS.  However, we pulled the feature as we were afraid of their legal budget.
Now that we have many more users (but still legal budget), I am less afraid of the consequences.  However, I won't re-implement the functionality if it has a reasonable chance of tying me up in court, or otherwise wasting time/money.  Does anyone have any experience with this?  I understand most of you aren't lawyers and your advice isn't a substitute for adequate legal council, yadayadayada, but your input is definitely appreciated.
One last note: they can easily ban our servers IP and keep us from doing this.  However, we are considering reimplementing the feature as a desktop application and making it generic enough to just archive a users content from a variety of these sites.  No IP bans, and each user is violating their TOS.  Our users are clamoring for this functionality, as many have 200+ mapped routes tied up on the site. <comment><USER2> OP - couple of things:

1) I know now who mapmyride is but who are you? What is your company? You don't mention it which, IMO, is a mistake. I've typed mapmyride now 4-5 times yet don't know your company's name at all.

2) No, I think you were right to pay attention to the C&D. Are you in a high margin business and you are the key player? For example, you are one of four companies worldwide making a product that people "have to have" and you can charge 1000% of your cost? Those are the types of businesses that can easily afford to ignore C&Ds. In businesses where there are a small set of customers and you have to fight, fight, fight to get every single customer, your time is better spent in customer acquisition, marketing, and feature dev than in the attorney's office or the courtroom.

You can listen to all the folks who suggest dodgy tactics but how will you feel if you accept such advice and later get sued? It won't matter that it was the customers' IP addresses that accessed the server, will it? You'll be the one not focusing on customer acquisition, etc b/c you'll be in court. Where will the marketing budget go? To the attorney. Doesn't matter if you were right/wrong, does it?

And what if mapmyride (there, I said it again - I'm going to go to that site now!) decides to send C&D letters to your customers? Or to sue your customers?

<comment><AUTHOR> Thanks for pointing out my lack of reference to our site. <http://ridewithgps.com>

mapmyride is the key player in the market, in terms of userbase and, recently, a $5 million A round. I am more wary now they have VC's, who may be more aggressive than mmr ever would have been in other circumstances. At least, that's my assumption.

I can't imagine MMR would sue their own customers over it, that would be downright suicidal as far as public opinion goes. However, that is duly noted.

I wonder if I can convince a particularly feisty/intrepid user to maintain this piece of software, pulling the risk away from us primarily ;) Hmmm. Thanks for the advice, definitely something to think about.

<comment><USER3> This has "don't do it" written all over. If i were mapmyride, i'd find your screenscraping to be dodgy and opportunistic. If i found this thread and saw you contemplating how to avoid their cease and desist and not get caught, i would be royally pissed off.

When you piss on business people, especially the ones with 5 mill in the bank, dont be surprised when they come after you on grounds of principles.

</comment></comment></comment><comment><USER4> If you access their servers without their permission and without accepting their terms of service, you put yourself at risk of a lawsuit or possibly even criminal charges depending on how zealous your local prosecutors are (so far the question of whether TOS violations can constitute criminal unauthorized access to computer systems is an open question legally). This is particularly true if they take technical measures, such as banning IP addresses, in an attempt to keep you out and you circumvent those measures -- to make an offline analogy, it's much easier to prove a case of trespassing if said trespass involved climbing over a 15' fence.

If you merely provide a tool which your customers use, things are much less problematic. The only way I could see this causing difficulties would be if they claimed that they owned the copyright on their users' data, but it seems to me that it would be very difficult to make such an argument stand up.

So my non-lawyerly input is that if you should definitely not access their servers directly, but providing code to allow your customers to access their own data is probably fine.

<comment><AUTHOR> That was my assumption. They never took any technical measures to prevent us from doing it, they just sent us a letter. Calling it a cease and desist is a bit generous, as it wasn't crafted very well, or by a lawyer.

I am not worried about arguing over copyright, considering that ultimately, if the user created the map using Google's maps, then Google trumps all. If it was created by uploading a log file, then it's more gray, but, the user provided a file created by hardware they own, and MMR is merely representing it on a map. I can't imagine they can successfully pursue a copyright case.

Thanks for the input!

</comment></comment><comment><USER5> Their robots.txt allows all bots access to all pages and the ToS says that users retain "full ownership of any and all of his or her User Content and any intellectual property rights or other proprietary rights associated with said User Content." Doesn't that mean that you can scrape the content for the user?

<comment><USER6> No, it means that the user retains rights to their own data. It says nothing about a competitor's right to access their servers _ad lib_.

</comment></comment><comment><USER7> Congrats on taking on mapmyride -- I used mapmywalk recently and their "new" UI is quite rubbish -- I use GMaps now but it certainly lacks some features.

The desktop concept seems like a lovely idea-- but just be careful about getting too caught up in it. Desktop software (cross-platform?) can be a serious time sink. Make a better product and you won't need to import their data. For the users who are begging for it maybe try to hack together some desktop software with a scripting language -- don't worry about making it too polished, just make it work with as minimal as work as possible. Stay focused on the core user experience and you'll find plenty of users regardless.

BTW, you can take some pleasure in knowing they wouldn't be calling in the lawyers if they really had confidence in their product.

<comment><USER8> He doesn't need a desktop app. A Javascript app (thus client-side) would suffice.

<comment><USER9> Same origin policy would stop it from scraping MMR's site unless it was hosted there.

<comment><USER8> Can you enforce this? Here in Italy some websites forbid crawlers. I guess an user can always run a software over a website, especially on data entered by herself, can't she?

Isn't a browser a scraper, too? Just make the user load a page and then harvest data from the DOM.

<comment><USER9> The browser enforces it, not the website. You can't use in-browser JavaScript to load a page from a site other than the one you downloaded the JavaScript from.

Otherwise any site you visited could load gmail in the background and read all your email.

It's inconvenient when you're making client-side applications, but for the web to have any kind of security it's absolutely essential.

<comment><USER8> Thank you for your explanation. I've tried it.

I'm a system programmer, not a web developer, and it shows ;-)

</comment></comment></comment></comment></comment></comment><comment><USER10> Maybe make the desktop application open source? That may remove a lot of the headache for you if you can find a keen customer to develop/support it.

Good luck taking on mapmyride. Mapmyrun (the runner's equivalent) has got worse and worse over the years, I'm sure you can do better!

<comment><AUTHOR> This is a consideration. I just would need a willing, competent and feisty user to take on the project! I'll have to consider it.

<comment><USER10> Or maybe the Google cache can give you what you want...

<http://www.mapmyride.com/view_route?r=488106908>

Becomes:

[http://webcache.googleusercontent.com/search?q=cache:_kV756J...](http://webcache.googleusercontent.com/search?q=cache:_kV756JjADsJ:www.mapmyride.com/view_route%3Fr%3D488106908+site:mapmyride.com&cd=95&hl=en&ct=clnk&gl=au)

</comment></comment></comment><comment><USER11> (1) You should never "ignore" a cease and desist letter. I would have it reviewed by an experienced lawyer in the field perhaps over lunch (to save on legal costs) and get their input on the risk and likelihood of getting sued. Then I'd go back and make a business decision on whether that risk makes sense vs. giving your users what they want.

(2) If they can ban you via IP, they should be doing that already. I wonder why they aren't.

(Disclaimer: None of the above is legal advice or forms an attorney client relationship. The statements above are only for informational purposes and should be used at your own risk.)

</comment><comment><USER12> No matter what you do, if they want to pursue it you will end up in court. Even if their claims are baseless you still have to show up in front of a judge. The judge will then decide if it goes to trial or not. So you will be paying legal fees if you want to re-implement the feature as is.

Also, violating a site's terms of service is not illegal. It will just get you banned. Facebook tried to bring someone to court over terms of service(and other items) and the terms of service part was dropped by the court.</comment>


Ask HN: Help on how to start getting customers - <AUTHOR> Ive built a SAAS product aimed at small take-away/restaurants.  It provides EPOS, website and online ordering in a single package.  Not revolutionary but works well.  Android tablet and online based.
I have a single client (family member) who has been using this product in their business reliably for over a year as Ive gradually added functionality.
The product is still rough around the edges, but a lot of this is cosmetic or usability in certain areas.
What Im now stuck with is how to move this forward to get some proper customers.  Theres maybe some mindset issues here whether i'm worried about whether the product is polished enough or how to actually get people to want to use it.
Any help, advice or starting points would be appreciated. <comment><USER2> [https://startupschool.org/library](https://startupschool.org/library)

[https://www.amazon.com/Four-Steps-Epiphany-Steve- Blank/dp/09...](https://www.amazon.com/Four-Steps-Epiphany-Steve- Blank/dp/0989200507)

</comment><comment><USER3> Only way to find out is to go talk to some small restaurant owners. Maybe there are some industry events that you can demo your service to restauranteurs.</comment>


What happened to  https://www.getbridge.com? - <AUTHOR>

I was interested in it a while back. It fell off my radar but know it seems like its gone. <comment><USER2> That's a strange one. In early 2012, Andreessen Horowitz and Salesforce put $1.4M into Flotype, a YC-backed startup. Flotype is the creator of Bridge and NowJS, both of which were very popular that year. That summer, the company seems to have disappeared. The social media accounts and Github repos all stopped updating, and all their domains are now offline.

You might tweet the CEO in search of details: [https://twitter.com/dshankar](https://twitter.com/dshankar)

</comment><comment><USER3> I was looking into the company the other day. From what I can tell the company simply fell apart, which is a fairly common outcome for failed YC startups. One of the cofounders went back to school and works at another company. The others are doing other things.</comment>


Show HN: Our startup got featured on HN and BetaList: Statistics, comparison. - <AUTHOR> http://blog.elastic.io/post/22253468976/featured-on-hackernews-and-betalist-comparison-and

<comment><USER2> Bar charts should always start at the x-axis (where the value is 0) because otherwise it warps how large the difference is to a casual reader.

<comment><USER3> Indeed. My favorite recently [1]: omg!! look at chart #1! they lost all their users... not!

[http://www.businessinsider.com/chart-of-the-day-daily- users-...](http://www.businessinsider.com/chart-of-the-day-daily-users-of- draw-something-totally-crater-2012-4)

</comment></comment><comment><USER4> Just wanted to add a second set of 'data points' to this as well - we had a very similar situation, but for us the traffic we got from Betali.st was higher quality - while we had significantly less overall referrals from BetaList than from HN (~1300 vs ~500), the users coming from BetaList were much more apt to create an account, hang around and give us feedback.

<https://www.trestleapp.com/blog/being-featured-on-beta-list>

So I would highly recommend BetaList if you are just getting rolling.

</comment><comment><USER5> Here's another comparison in case people are interested: [http://blog.capography.com/comparing-traffic-from- betalist-w...](http://blog.capography.com/comparing-traffic-from-betalist- with-traffic)

I should point out the comparison isn't totally fair as in this instance HN traffic is directed to specific blog posts, while the Beta List post linked to the homepage.

Disclosure: I'm the founder of Beta List (Marc). The post was written by one of the startups (Capography) featured on our site.

<comment><AUTHOR> Right. With HN in our samples users need to do an additional hop over to the main website. I think next time we could compare it on the other HN link.

</comment></comment><comment><USER6> Betali.st is awesome, we used most of the Free Startup beta listing for Dropdock ( Startupli.st, betapunch ,etc ) and betali.st was definetly the best!

Here's the Goal completion for the Week we got featured on those website.

[http://dl.dropbox.com/u/149780/Overview%20-%20Google%20Analy...](http://dl.dropbox.com/u/149780/Overview%20-%20Google%20Analytics.jpg)

Also, I chatted a little bit with Marc who run the site and he's a great guy. ;)

<comment><USER5> Thanks, and nice graph :)

Marc from Beta List. ('keesj' is an old nickname of mine)

</comment></comment><comment><USER7> Great analysis. Sustainability is pretty reasonable. There are tons of high quality posts on HN; if you don't gain points fast enough, you disappear from the first page too fast. BetaList has twitter integration which has a much more sustainable effect. What puzzles me is the lower willingness of visitors from HN to provide feedback.

<comment><USER8> I've noticed that too; I had a similar experience when I asked for feedback on my project, only with Reddit. I got 0 replies and little traffic from HN (admittedly it was pretty sparse on data and I'll resubmit it soon now that I've vastly improved it), but got some wonderfully useful feedback and 100x the traffic from posting to /r/unitedkingdom. A more specific target market, I guess.

</comment></comment><comment><USER9> To get a bit meta, I'm curious what the HN conversion rate is for blog posts about previous HN conversion rates.

</comment><comment><USER10> Do you have already any data on retention?

<comment><AUTHOR> Hi Andreas,

We don't have yet any data about this. We are in private beta phase so we just got started. We track our visitors/users very carefully, so by the time goes by we will definitely see some numbers that we can share with HN and Betalist communities.</comment></comment>


How to drive your users up a wall by being nice (HN Search) - <AUTHOR> http://i.imgur.com/NuBXp.png

<comment><AUTHOR> To be fair, I don't know if this is HN Search's fault, or the fault of some of their underlying technology. It's been driving me absolutely crazy though.</comment>


Why does Google keep making products for nobody? - <AUTHOR> http://thetechblock.com/why-does-google-keep-making-products-for-nobody/

<comment><USER2> It used to be that the major corporations did basic research. The actual R in R&D. Bell Labs and Xerox PARC come to mind.

Today, few if any companies do that. They focus on D and assimilate products and IP wherein the research was done elsewhere and which fits their specific market needs in the near term.

I think that is a loss.

So I am quite encouraged to see a company that is really exploring with basic research: Self-driving cars, medical contact lenses, augmented reality, and lots more that I am sure have not seen the light of day yet.

Once in a while, they will get something right, like ChromeCast. And in the mean time, they provide me kindling for innovative optimism.

</comment><comment><USER3> It still blows my mind that Google works on exciting, experimental moonshot products that could provide a major benefit in the far future, and all these bloggers can do is whine about the lack of product strategy.

In this case, the contact lenses are not even close to a finished product yet, and Om is protesting a licensing and distribution strategy that doesn't even exist yet.

Also, it's not as if Google doesn't already have several major products that are part of everyones daily life.

</comment><comment><USER4> Because they aren't products, they are explorations. I don't think they are meant for the average consumer. Not everything has to be consumed.

<comment><USER5> Exactly. It's like asking "why do mathematicians work on number theory? It would be much better if they were all physicists or computer scientists."

What a dumb article.

</comment></comment><comment><USER6> im ready to buy google glass at $99 ...and id bet a whole bunch more folks are too</comment>


KiCad Joins Linux Foundation to Advance Electronic Design Automation - <AUTHOR> https://www.linuxfoundation.org/press-release/2019/11/kicad-joins-linux-foundation-to-advance-electronic-design-automation/ <comment><USER2> Hopefully, EDA tools for chip-design will get similar attention too, as well as a "normal" CADs. Software like LibreCAD[1] and FreeCAD[2], Qucs[3], gEDA[4], Yosys[5] and Symbiflow[6], Chisel/FIRRTL[7], OpenROAD initiative[8], Degate[9], and many others.

[1] [https://librecad.org/](https://librecad.org/)

[2] [https://www.freecadweb.org/](https://www.freecadweb.org/)

[3] [https://github.com/Qucs](https://github.com/Qucs)

[4] [http://www.geda-project.org/](http://www.geda-project.org/)

[5] [http://www.clifford.at/yosys/](http://www.clifford.at/yosys/)

[6] [https://symbiflow.github.io/](https://symbiflow.github.io/)

[7] [https://www.chisel-lang.org/](https://www.chisel-lang.org/)

[8] [https://theopenroadproject.org/](https://theopenroadproject.org/)

[9] [https://github.com/nitram2342/degate](https://github.com/nitram2342/degate)

<comment><USER3> Is there a high level overview, for programmers, of how chip design software works? Something I eventually want to investigate is building some of those pieces of software but I have no idea where to get started learning about that ecosystem. From a software perspective I have a good understanding of how source gets turned into machine code, which gets packaged into shared object code, which then gets linked into a binary. How do those steps work for HDLs? What standards are involved? How do you test that each of those steps works?

<comment><USER4> Take a look at Verilog-to-Routing - an educational/research tool that is open- source.

[https://github.com/verilog-to-routing/vtr-verilog-to- routing](https://github.com/verilog-to-routing/vtr-verilog-to-routing)

<comment><USER3> That looks like a great resource! Thank you!

</comment></comment></comment></comment><comment> ur-whale Kicad is an amazing tool. Not easy to get into, kind of like vim in that regard, but when mastered, it's really powerful.

With that in place, I wish it had:

       . Something to import LTSpice files directly into its schematics tool (or even better, go back and forth)
       . A rough but well integrated auto-router
       . A better parts library management system (the current one is really bad).

But even without those, designing electronics circuits with KiCad is a blast once you've mastered it.

And it's free ...

<comment><USER5> > A rough but well integrated auto-router

If you're depending on an auto-router, you're doing it wrong.

<comment><USER6> There's a lot of autorouter hate in the electronics community which I think has a basis in truth, but is in danger of losing sight of the big picture.

Autorouters can be terrible. They mainly are. The reasons are partially with optimisation algorithms (although these are getting better), but primarily with poorly defined constraints.

Currently a schematic holds the physical connections and maybe a little bit of extra data - some pins might be "power" pins, or maybe a net or two is defined as a high current net - but broadly the circuit metadata which is highly relevant for routing is held in the designers head.

When you lay out a board you're always thinking about high current and high frequency (and especially high current high frequency) paths. You're looking for paths to ground, you're isolating sensitive analog regions from noisy digital regions, you're making sure the ground plane is uninterrupted. You're basically making thousands of tiny tradeoffs based on an understanding of what the board should be doing. If a computer doesn't have that knowledge, of course it can't effectively lay out a board.

If we can improve schematic annotation and part representation to properly hold this information then there's absolutely no reason autorouters can't be better than manual layout. If we can combine it with simulation then autorouting should really be the only logical choice. If you can almost completely avoid EMC testing by carefully defining all the high frequency nets and letting the autorouter find a design which is optimised for RF performance, then why wouldn't you? An EMC chamber costs thousands of dollars a day - you can easily spend 10s of thousands just on the testing alone, not to mention redesign costs.

<comment><USER5> There are tons of rule of thumb routing design choices made that lead to being able to route incredibly complex PCB's which becomes a topological problem. Rules that would need to be either programmed into such a system, or somehow potentially AI could use a huge corpus of board designs and schematics to make a better auto router.

My point is that as they stand currently, autorouters are absolute trash and you should not be depending on them.

The only real place they work is when you have a trivial routing situation but it would be incredibly tedious to route by hand, like a bus with 100+ traces or something.

</comment></comment></comment></comment><comment><USER7> Most importantly, KiCad needs funding: [https://funding.communitybridge.org/projects/kicad](https://funding.communitybridge.org/projects/kicad)

</comment><comment><USER8> How/where are people getting their PCBs manufactured and assembled? Are cheap chinese services reliable? How do you protect your IP when using manufacturing services?

<comment><USER5> 1\. I use PCBWay, a chinese fab that can manufacture small quantities for like $5 (+$18 shipping if you want them fast) but they arrive in five days.

2\. Protecting your IP with your PCB design isn't something you can really do. Any PCB can be reverse engineered very easily. Besides, if you're asking this question on a random internet forum, I have to doubt you have any serious IP to worry about.

<comment><USER9> Can vouch for PCBWay, inexpensive and fast (even with DHL shipping from China).

</comment></comment></comment><comment><USER10> Nothing bad about KiCad (don't know it), but the Linux foundation have recently been caught neck deep in what seems like a (needless) identity politics controversy.

TLDR: it kicked out white males trying to mostly have a reasonable conversation on Twitter from attending its events, while allowing an openly and viciously racist and sexist black woman to attend the same event, with her asking for "safe spaces" to top the irony.

Needless to say, my respect for the Linux foundation has plummeted. They're clearly off my donation-lists now.</comment>


What happens to user experience in a minimum viable product? - <AUTHOR> http://37signals.com/svn/posts/2963-what-happens-to-user-experience-in-a-minimum-viable-product <comment><USER2> Building a good MVP takes practice. The minimum bar is going to be different on every app. It is confusing and tricky.

I think it makes more sense to figure out the one thing that your software needs to really nail to be the product that you are building.

For example, Dropbox is a fantastic example of this. They figured out the most simple way to sync files and nailed that. Put files in a folder and the machine syncs in the background. Want to share a file? Drop it in public or shared folder. It shares automatically.

I know Dropbox has a ton of other features that I never ever use. That's great for some people, but they nailed the core right away and built the rest around that.

Instead of building a "minimum" product that may or may not suck, build the absolute simplest version of that one core feature and polish it to a shine. Polish tends to mean fixing a lot of little bugs, UI issues, and UX issues like password resetting.

Simplicity is hard and making it beautiful is even harder.</comment>


Set Up Your Server Right, Part 1 - <AUTHOR> http://blog.envylabs.com/2009/08/set-up-your-server-right-part-1/

<comment><USER2> My 3 most important rules for Linux servers are:

1\. Run software update!

2\. Don't allow everyone to access sensitive ports. Moving SSH to some nonstandard port is not enough. Use iptables to limit access to it from only certain static IPs.

3\. Run SELinux! If you think its only purpose is to make your life more difficult, you have a lot more studying to do. (Also, make sure you don't use a distro that comes with a badly broken selinux config)

UPDATE: formatting

<comment><USER3> I've never been a fan of changing SSH's port.

If you're going to firewall SSH, changing the port is redundant.. The only reason to change the port is to prevent brute force attacks, and the firewall will do that for you.

<comment><USER4> Still.... it really cleans the logs up. It's not safer, but the logs do become easier to read in a pinch.

<comment><USER3> Huh? The firewall logs? Got grep -v?

</comment></comment></comment></comment><comment><USER5> Every sysadmin has their own fingerprints. I read some of the suggestions and kind of cringe since they don't match my preferences (not that they're absolutely bad). One of my current aspirations is to "use the tools the way they were intended". Rather than perverting the core components or skinning over them with other admin tools, I believe it's important to appreciate the system as designed and take advantage of the toolset provided.

1) sudo NOPASSWD is the moral equivalent of making that user root. I don't care for it. My preference would be to configure sshd_config with "PasswordAuthentication no" and continue to use passwords in the regular way, with password complexity enforcement if your distribution supports it. I'm not going to blanket condemn ssh public key auth, since it's generally smart. However, you can not enforce a requirement that the public key be encrypted on the remote host. If someone is undisciplined with the distribution of their public keys they can end up turning a single box exploit into free reign of the network, particularly if NOPASSWD is enabled.

2) I prefer manually editing iptables rules myself, using -I and -D. It's certainly not intuitive at first blush, more like using "ed" than "vi". I've gained an appreciation for using the "-m comment -comment 'this rule does blah'" construct. The benefit of this model is that an unfamiliar sysadmin won't immediately know that a host has another FW package installed, but if a change is needed everything is documented and commented in an "iptables -L" -- a standard diagnostic command. Furthermore, firewall rule generators often create unreadable rulesets, making diagnosing specific problems tough.

A specific nit I have against Shorewall is that it requires (last time I checked) you to edit a bunch of different files, using boilerplate recipes that aren't really much simpler than just writing the rules yourself. It could be a big win if you had multiple platforms to support, I suppose.

<comment><USER3> re: 1) sudo NO PASSWD...

So the problem I have with this is that it collides with using Puppet to manage your users--Puppet will have to know about the users' Unix passwords.

It should be fairly straightforward to write a script that tests for SSH keypairs with an empty passphrase, simply try to authenticate an SSH agent by loading the user's key.

<comment><USER5> I can't speak to puppet, but I would expect the proper thing to do is to run puppet as root, or possibly create a puppet user with NOPASSWD if you must. There's really no reason to not run as root if you're going to run NOPASSWD ALL, since anyone with the slightest bit of deviancy in mind (or just annoyance with not being root) is going to "sudo su -", and sudo is done.

You can probably write a script that searches for empty-phrase keypairs, but this would be a client side thing. The private key is not disclosed to the server, and all operations involving the private key happen post-decoding, so this is unenforceable server-side. It would be an interesting policy/hygiene enforcement tool but would be of little or no use for security purposes.

<comment><USER3> D'oh, upvoted instead of clicking reply =(

What I mean is that in order to manage user accounts, the management tool (Puppet) will have to know what the encrypted password is so it can insert it into /etc/shadow. Otherwise you have no password and must rely on NOPASSWD in sudoers if you want to log into that managed machine and use sudo.

If the system doesn't have a password for you in /etc/shadow, sudo can't authenticate you via getpwent or whatever.

So your only two options are to write a tool for users to update their password in Puppet directly/indirectly, or allow NOPASSWD and religiously check for empty passphrases on SSH keypairs.

</comment></comment></comment></comment><comment><USER6> It's kinda fluffy. Most of the advice is good, but basic.

One peeve I have is that it's pushing a firewall solution on the local box. In general, that's best done off-host. Even better are MAC security solutions like AppArmor, which is really easy to set up (frankly much more so than a non-trivial set of firewall rules) and much more capable in general. Typical applications need access to only a handful of paths and capabilities that are well-defined in the documentation.

<comment><USER2> Considering how firewalls and AppArmor do completely different things, I'd say you need both.

</comment></comment><comment><USER7> I'd add a quick section for a basic iptables setup as well, with holes for the appropriate services.

<comment><USER8> He's using Shorewall for that.

</comment></comment><comment><USER9> We could automate all these steps using scripts. A very good example is the scripts by RightScale - <http://github.com/rightscale/right_link/tree/master>

<comment><USER10> Definitely agree, and the series will move in that direction. However, I think it is important to go over the setup sans automation first -- for the sake of people who have never used the utilities I'm going over.

After all, some will need to step out of an automated script's / puppet config / chef recipe box to do something custom to their setup.

</comment></comment><comment><USER11> * List all installed applications and libraries with versions

* Subscribe to all security advisories of those components

* Look for problems that hit your setup

* Take patch/corrective action when necessary

* OS update is good, but is not the final word in what you need to patch. You need to do your own homework

</comment><comment><USER12> Enlighten me: How is a user with sudo rights different from a root user?

<comment><USER13> In addition to the advantage that notaddicted mentioned, you can also limit the user(s) to a specific command, set of commands, and so forth. Using sudo in that fashion doesn't give a user root access to the entire system, so it's quite different from "being" the root user.

</comment></comment><comment><USER14> How hard is it to provide attribution for the photos used? e.g. <http://www.flickr.com/photos/thomashawk/287666827/>

<comment><USER15> It is attributed. Double-check the bottom of the blog post.

</comment></comment><comment><USER16> First thing I do is configure the backup software!

It defies belief that a lot of people don't consider this in these guides.</comment>


Guy Is Suing the Patent Office for Deciding an AI Can't Invent Things - <AUTHOR> https://www.vice.com/en_us/article/5dz44b/this-guy-is-suing-the-patent-office-for-deciding-ai-cant-invent-things <comment><USER2> This court case isn't about whether AI can invent things. It's about whether AIs can receive patents.

Normally, non-natural persons (a funny legal way of saying organizations) can do anything natural people (human beings) can do under the law (e.g. file lawsuits, sign contracts). However, there are some privileges that are reserved only for natural persons, and one of those is receiving patents (which can later be transferred to any entity).

Plainly, the AI is not a natural person. It can certainly invent things, but the government doesn't choose to grant it a monopoly for manufacturing said inventions.

This ruling does not in any way suggest that you can't patent an invention created by an AI. All you have to do is say that the AI is a tool that you, the inventor, used.

Just because you used an AI to create an invention doesn't mean the AI gets the patent, anymore then Microsoft Word gets a copyright on what people type in it.

</comment><comment><USER3> > "Such tools are not capable of true independent creativity. In order for AI > tools to create new work, prior creative work must be used as training data"

Isn't this exactly how humans do it too?</comment>


Macro-Lisp, a Lisp-Like DSL for Rust Language - <AUTHOR> https://github.com/JunSuzukiJapan/macro-lisp <comment><USER2> Rust macros are extremely impressive. This reminds me of Will Crichton's Lia library[0], which embeds a convenient matrix manipulation domain specific language inside of Rust. This seems like a very promising direction for fusing the low-level performance of Rust with the high-level readability and usability of a managed language. Exciting times.

[0]:[https://github.com/willcrichton/lia](https://github.com/willcrichton/lia)

</comment><comment><USER3> Interesting, I'm planning to implement a translator from a subset of Scheme to Rust. The source code will be Scheme plus extraneous forms for declaring types and borrow checker information / referencing, minus support for call/cc and other difficult to translate Scheme features. I want to develop a program in a Scheme interpreter then be able to compile it as a Rust program. Contact me if interested (and meet me in London via [http://rustaceans.uk](http://rustaceans.uk)).

</comment><comment><USER4> This reminds me a little bit of rebol, and the concept of dialecting. So the language is composed of many DSLs called dialects each specialized for different things.

</comment><comment><USER5> Rust macro based language. All great until you have to debug or figure out why it does not compile. Then you may just as well kill yourself.

<comment><AUTHOR> While not ideal, one tool for this situation is "cargo expand". It will expand your macros so that you can examine what code is being generated, and hunt down what might be happening.

</comment></comment><comment><USER6> Imagine if Rust just used s-expressions as syntax in the first place.

<comment><USER7> You'd get something quite similar to Chez Scheme, presumably. (Without the battle-proven heritage, of course.)

<comment><USER8> Similar in what way?

</comment></comment></comment><comment><USER9> From this project, I gather it wouldn't be hard to remove the need for calling `lisp!` on every form.

Then you'd have a lisp syntax on Rust that is not embedded. Is that correct?

<comment><USER10> It would be impossible to remove the `lisp!` on every form, as you have to actually invoke the macro.

You _could_ make a build script that would read in lisp files, and then run them through a pre-processor of sorts before compiling. That's the closest thing, and it'd still require setting up that build.rs.

<comment><USER11> > _You could make a build script that would read in lisp files, and then run > them through a pre-processor of sorts before compiling._

At that point, you would be better off using a Lisp implementation and its expander over a bunch of Lisp to Rust macros.

<comment><USER10> Sure. I don't suggest that this is a _good_ idea, just that it'd be possible this way.

</comment></comment></comment></comment><comment><USER12> Very cool! Is this meant for actual use, and why would anybody use it?

</comment><comment><USER13> Hah, I thought about doing this at some point. I think it's cool that someone put the effort into it, Rust's macros are conducive for this sort of thing.</comment>


Find Jobs. Post Jobs. Easily - <AUTHOR> https://www.coserna.com/ <comment><USER2> Page looks very messed up on mobile (iPhone 7 plus in portrait mode)</comment>


Advantages of R Programming - <AUTHOR> http://imarticus.org/advantages-r-programming-language <comment><USER2> What a poorly-written blog entry.

So, the author argues that the "advantages of R programming" are the fact that it's "entirely open sourced", it can be used to produce visualizations, and that "anyone is allowed to provide code enhancements and new packages."

What a waste of bandwidth, this blog entry is.</comment>