Worst-Case Thinking - <AUTHOR> http://www.schneier.com/blog/archives/2010/05/worst-case_thin.html <comment><USER2> Worst-case thinking among business lawyers:

One of the worst traits of a _bad_ business lawyer is to fixate on remote risks when advising a client and driving a transaction. Negotiations along such lines rapidly enter into a surreal mode that leaves entrepreneurs scratching their heads and wondering, "why can't we just cut through this garbage and get to the heart of the deal?"

This sort of fixation normally adds significant costs to any business deal ("we'll need to thoroughly research all these possibilities"; "we'll need a 3-page indemnity clause instead of the 1-paragraph version"), tends to paralyze deal momentum and cause the parties to shift their focus onto side issues in their deal ("this deal can't possibly move forward until we can absolutely eliminate these risks"), and winds up causing parties to negotiate 50-page contracts where a 10-pager might have done the same thing without necessarily addressing every remote contingency that might occur in hypothetical scenarios where things can go wrong.

A good business lawyer should be neither a deal killer nor a CYA type but should be sharp in identifying risks and have good judgment in weighing them against benefits so as to strike a practical balance that moves deals forward while keeping them honest, with the client making the final decisions based on such guidance. Of course, some deals _are_ incredibly complex, or have very large amounts at stake, and this does warrant more fastidiousness about risk issues. The key is to know which is which and to handle each accordingly.

<comment><USER3> Very timely ... Amen on business lawyers! I just signed the papers on a seed round and what drove me nuts was all the expensive back and forth on possible IPO provisions (caps on legal fees etc.) let's see if we can get user one without using up a significant chunk of capital on legal fees first!!

</comment></comment><comment><USER4> This reminds me of a political philosophy course I had in college. There were a large number of libertarian-minded students in the class, and there was a lot of vigorous debate and discussion about the proper basis of law, the role of the state, etc.

In one informal discussion session, the instructor introduced his concept of "libertarian socialism", intended to design a political system that maximized individual liberty with constraints designed to mitigate the iniquities that might arise in a system of absolute, inviolate property rights.

The example that he used to justify his constraints on property rights was this: What if X owned and lived happily on his private plot of land, but his enemy, Y, decided to buy up all of the land surrounding X in a 360-degree circle, and then build an impenetrable stone wall, completely sealing X within? X would not be able to leave his own land without violating Mr. Y's property rights, and Y could not be stopped from building a wall on his own land. Y would have effectively imprisoned X, and possibly indirectly cause X's death. Since this is clearly an undesirable result, we are justified in adopting a system of law that allows Y's wall-construction project to be preempted.

Most of the libertarian-minded students began attacking this model by construing Y's wall-building as a violation of X's natural rights, and started constructing a list of explicit abstract rights that could be asserted by X to prevent Y from sealing him behind a stone wall a la Edgar Allen Poe.

But in retrospect, it looks like everyone, the instructor and the students alike, was making the same mistake: in attempting to universalize their model, they take on the challenge of having to accommodate _every_ imaginable contingency.

Perhaps it's not merely the tendency to focus on the worst case at the expense of the general case that causes these problems, but also the tendency we have to think things through in an abstract, categorical way, and rationalize universal solutions instead of defining the particular scope of our solutions from the outset.

</comment><comment><USER5> I jotted this down from a speaker at a security conference last year:

 _"My nightmare scenario is that I don't know my nightmare scenario. We can obsess about all the extreme things that could happen; but the truth is when, or if, it does happen the chance of it being one of them is tiny. In fact we probably haven't thought of the very worst sort of scenarios; those tiny little things that someone suddenly figures out they can exploit and turn against us. We cannot predict or offset these scenarios. All we can, all we should, do is make security relevant and robust - and then be ready to meet threats quickly when they occur."_

(pretty much what Schneier says too; but I thought worth sharing)

<comment><USER6> What I take away from this is that we can waste too much time focusing on lots of WCS, and a WCS we didn't think of comes along.

So we would be better on focusing on the core, rather than the edges.

</comment></comment><comment><USER7> At the same time, it's important to keep Murphy's law in mind. That doesn't mean you should let yourself be immobalized by the worst case, but you need to make a conscious decision that the worst case isn't worth worrying about. Don't write something off because you feel it will never happen. Assume that it _will_ go wrong and decide if the cost of dealing with it is greater than the cost of preventing it.

<comment><USER8> >decide if the cost of dealing with it is greater than the cost of preventing it

Yes. I build small apps for various tasks at my current job and am always surprised at how bullet proof they want the thing to be. I spend the majority of my time trying to safely handle the remotest of issues for these apps which are mostly fairly trivial (not operationally critical) if they stop working. I find it especially amusing because we host our entire operation off a single box in our own network closet.

In other words, make sure you take care of all the simple things that have a much higher chance for disruptive error before you start worrying about the once in a lifetime catastrophic ones.

</comment></comment><comment><USER9> Whether we're talking about WMD, Global Warming, overpopulation, terrorism, hackers, or any other issue, people have this bad habit of falling into "Pascal's Wager" type thinking: identify the worst case, and then avoid it at all costs. This leads to expensive and often unnecessary solutions, and it often results in more cost-effective solutions being tabled because they don't particularly touch on the worst case.

A better approach to risk management: create a table with likelihood on the vertical axis, and severity of outcome on the horizontal. Then look at the costs to move any given risk either down or to the left. Do some cost-benefit analysis on reducing your overall risk profile, and focus your spending accordingly.

<comment><USER10> That's not a good approach to risk management because we don't know all of the specific risks. Even if we knew that, we don't know the likelihood of it occurring. Even if we knew that, we don't know the harm that it would cause. Even if we knew that, we don't know how much it would cost to make that risk go away.

I think a better approach to risk management is to flip it and think of the key parts of the system, and figure out ways to make the system more robust, have redundancy, and some strategic slack built in.

<comment><USER4> The fact that we will never know all of the specific risks is an argument against worst-case thinking. No matter how many contingencies you try to account for in your baseline system, there will always be risks that you cannot account for, which will become the new worst case. So, by definition, you can _never_ actually avoid the worst case. (Even if you may end up with a worst-case situation that isn't as damaging as the ones you've accounted for.)

But the real solution is to distinguish risk avoidance against risk response. Prescriptive solutions tend to focus on avoiding risks, and building those avoidance methods into the baseline system that applies generally. But if we isolate the unlikely risks in the way that lotharbot suggests, we can draw a line across the likelihood axis and say "we'll avoid the risks on this side of line and deal with the outliers on a case-by-case basis."

The best strategic slack is to have a robust way of handling unexpected occurrences after the fact, so you optimize the prescriptive system to the expected general case.

BTW, I'd bet there's a pretty strong correlation between "risks that we can't account for" and "risks that are unlikely to occur".

</comment></comment></comment><comment><USER11> Very important when applied to personal problems. Worst-case thinking can get you in a lot of trouble. I cannot articulate how it happens but it does. Perhaps you become paranoid and blow things out of proportion. Fear immobilizes you. Or perhaps, you just accept the worst and stop looking for answers.

</comment><comment><USER12> As a single proprietor/founder/programmer, I've heard this "worse-case" question far too many times:

"What happens if you get hit by a bus?"

I have no good answer, but I have lots of bad answers:

"Can't happen. There are no buses where I live."

"I work out. The bus will get damaged."

"If I don't log in 3 days in a row, the server will automatically ftp all the source code to you."

"No problem. I have Blue Cross."

"No problem. All the code is self-documented."

"I guess I won't care anymore."

<comment><USER13> Heh, now I feel weird. I work for a big corporation and I've been trying to make them worry about the "hit by a bus problem". Imagine having a very critical part of your application, without which your business logic can't run. Imagine that this part could bring down the production database server. Imagine that there's only one guy who knows the heart of that part of the system and almost no documentation at all.

Now imagine the situation in which that guy is trying -- and failing -- to make his bosses care about that...

<comment><USER14> Sounds like you should be threatening to leave the company unless better compensated. While you're out, you could write the documentation that doesn't exist and sell it back to them :).

<comment><USER15> Threatening can erode the relationship.

</comment></comment></comment></comment><comment><USER16> Here's a good example:

[http://wtop.com/?nid=25&sid=1956201](http://wtop.com/?nid=25&sid=1956201)

Even if the people paid to think about these problems mean well, sometimes the cure is worse than the disease.

</comment><comment><USER17> Funny, I used to joke that "democracy" really comes from Deimos, brother of Phobos, and thus should be spelt differently.</comment>


Amazon, please don't hijack the web on Kindle Fire - <AUTHOR> http://gigaom.com/mobile/yo-amazon-please-dont-hijack-the-web-on-kindle-fire

<comment><USER2> The interesting thing here is that this appears to be done with intents. So it's quite possible the web re-direct is a side effect of a system wide re- direct that sends you to the Amazon app store whenever you would normally go to the Android Market.

The author casts this as amazon re-writing web request when what probably happening is that web request is turned into an android market intent, which is in turn sent to the Amazon app store because the Android market is not supported on the Kindle Fire. I don't think it's as evil as people are making it out to be.

Most likely amazon never even wrote the code that turns the web request into an intent in the first place.

<comment><USER3> The stock Android browser treats all URLs as Intents; this is by design so apps can catch URLs from their service. Normally, when you hit a URL that an app has registered for, you're prompted for what you want to open it with.

Amazon's broken this behavior; any market.android.com Intents get bounced to the Appstore; other apps aren't given the chance to answer these intents. While it's true that one can't download Market-sourced apps on the Fire, blocking a website for any reason without communicating it is fairly shady. Also; market.android.com is the home of Google's music, video, and book stores; the first two I'm certain would work in the Fire's browser. They're blocking competition to their own stores; I don't think there's any way to defend that as a legitimate action.

<comment><USER4> > They're blocking competition to their own stores; I don't think there's any > way to defend that as a legitimate action.

If intentional, I agree. However, I wouldn't be surprised if they were also surprised by this side-effect of redirecting the Android Market intent. If so, I'd say the right thing to do would be to make sure their browser doesn't raise an intent for <http://market.android.com>, side-stepping the issue.

</comment></comment></comment><comment><USER5> Not cool. For this to be defensible as "curating the device for an inexperienced user" (see comments on linked article) the behavior would need to be:

\- display a modal dialog explaining that the device does not support downloading/installing apps from the Android market, and that the Amazon market contains apps for the Kindle Fire

\- dialog includes "no really, do what I say" option

\- dialog includes "do not offer to redirect me away from Android market in the future" option

</comment><comment><USER6> Anyone know if they Amazon is actually hijacking "<http://market.android.com/..>. " links, or are they just taking over the "market://..." url protocol handler? Huge difference.

<comment><USER7> I had the same thought, and I tested it; I believe (but am willing to believe that I am wrong, as I didn't watch the network traffic itself) that it is actually hijacking the http(s):// URL.

What I did: I went to one of my websites from the Kindle Fire, and sent the same Accept and User-Agent headers (the only ones that seemed to be special) to <https://market.android.com/>; there was no redirect returned: it simply gave me the home page. However, going to that same URL in the Fire browser application immediately loads the Amazon App Store.

<comment><USER8> I've accessed market.android.com but using Mini-Opera browser.

Isn't possible http[s]://market.android.com redirects you to market:// when you open it from an android device?

<comment><USER7> That specific question is precisely why I explained that I attempted to use the same User-Agent and Accepts--the only seemingly differentiating headers that are sent by Amazon's Fire service--in a connection to the Android Market to see if it would redirect.

</comment></comment></comment></comment><comment><USER9> Wow, DISGUSTING behavior from Amazon. Probably violates trademark law as well.

<comment><USER10> I seriously doubt that it violates trademark law, but you are right, this is disgusting.

</comment></comment><comment><USER11> Successful Tablet? I don't know if the Kindle Fire is going to make it past the first round of people who bought (even though that was a huge number). It's gotten a lot of bad reviews, and the first people to buy it are often unaware of a products shortcomings.

<comment><USER12> I'm an iPad 2 user, and can't stand using my Amazon Fire. If one owns and uses both, the Fire's shortcomings are glaring.

That said, if someone says they want a tablet just for watching Netflix and reading Kindle books, and doesn't want to spend over $200 and will never do anything else it, the Fire is the one to get.

People with very limited goals and who don't know better, love it. I recommend it.

(If they want to do anything else, but are price conscious, I recommend the 1st gen iPad WiFi refurb.)

<comment><USER13> Well, there is the iPod Touch. Yeah, the screen isn't as big as the fire, but that means you can easily carry it in your pants pocket.

</comment></comment></comment><comment><USER14> Just out of curiosity, has anyone here flashed gingerbread on their kindle fire? Further, how does it work?

<comment><USER15> XDA forums are hard at work: <http://forum.xda- developers.com/forumdisplay.php?f=1309>

Basically, they have CyanogenMod 7 running on it, but there are still some kinks that need to be worked out (a few features aren't working yet, video isn't perfect, etc.)

</comment></comment><comment><USER16> Interestingly, the few times I've used the android market web site from my web browser, I installed stuff on my phone. I should still be able to do that from a kindle should it be allowed.

<comment><USER17> Right, but that would allow you to see and (gasp!) install apps that Amazon doesn't want you to install on the Fire.

</comment></comment><comment><USER18> does author realize that you can turn off web browser acceleration in Kindle thus eliminating all their complaints?

<comment><USER19> FTA:

> The browser does redirect any Android Market requests to the Kindle app > store; even if you turn off the accelerated browsing feature that routes > traffic through Amazon's servers. That means this hijacking isn't done via > the cloud, but instead is hard-coded into every Kindle Fire.

</comment></comment><comment><USER20> Old news, you can sideload any apps, move on.

<comment><USER21> You can't sideload apps that you don't know about.

The issue is that, using a Kindle Fire, it is impossible to see the Android Store's website. If Apple or Microsoft were to make websites impossible to view, it'd be rightly called out as censorship. Similarly, if Google were to make Amazon's online app listings impossible to view on stock Android installations, it would be censorship as well.</comment></comment>


Show HN: Simple Linux Backups - <AUTHOR> https://jarvys.io <comment><USER2> Backups are good. Backups are important. But who are these guys who want you to trust them with your data?

They're at 2522 Chambers Road Suite 100, Tustin, CA 92780. This is "Irvine Ranch Executive Suites" which advertises "Private Offices From: $ 375 to $1000 / Per Month, Identity Package (Phone and/or Mail Only) From: $ 65 / Per Month".

SSDNodes, Inc. (their parent company) is a Delaware corporation at that address. The agent for service of process is MATTHEW GEORGE CONNOR. He's on LinkedIn: [https://www.linkedin.com/profile/view?id=166917144](https://www.linkedin.com/profile/view?id=166917144) and has another business, "Xerq.io". It's a social network (at [https://xerq.io/hotness](https://xerq.io/hotness)) which has a big banner ad for Jarvys.

There are terms of service ([https://my.jarvys.io/JARVYS_TOS.pdf](https://my.jarvys.io/JARVYS_TOS.pdf)) but no sign of a service level agreement.

The pricing goes up by a factor of 10 after the first three months. $240/year for 150GB. That's more than 3x more expensive than iDrive, which supports Linux. Jarvys isn't cheap.

Not seeing a good case for using this service.

<comment><AUTHOR> I happen to be Matt Connor :-) My username also happens to be "XERQ," and my profile lists SSD Nodes, JARVYS, and XERQ. I'm transparent when it comes to the projects I'm a part of, if that's a concern.

If the main concern of this post is pricing: our service isn't the cheapest, nor do we want it to be. We want JARVYS to provide the most value and peace of mind to our customers. It allows us to focus on delivering quality instead of searching for the next buck. Is the loss of your data worth the money you'd be saving from choosing one providing over another?

We actually called up iDrive to learn more about their Linux product and to ask them for help installing it, and their response was to read the documentation. Linux felt almost like an afterthought with them, with their core product being Mac and Windows. Instead of us half-way supporting Windows, Mac, Linux, and everything else, we want to be the best Linux backup service available and to focus solely on it.

</comment></comment><comment><USER3> Backups are this thing that lots of people buy but nobody tests. People seem to refuse, every single time, to understand that if you're hoping your backup system will protect you from catastrophic failure, until you've actually tested your production servers by making them fail catastrophically and then restoring from your backup, then you what you bought was an expensive wish.

On the other hand, if you're implementing catastrophic recovery in the first place, something's gone seriously wrong with your engineering culture, assuming you have one, or never implemented important capabilities in the first place, like one-command provisioning and deployment. Your app's years out of date but it's supporting your entire business. You can't afford to test your security end-to-end because if it fails, it might be days before it comes back up, because the guy that invented it skipped town, and there's bits of functionality hiding everywhere on the machines, done ad-hoc without any documentation.

Nothing says "Faith-based engineering" like buying a backup system you refuse to test. And I see it way too often.

<comment><USER4> _Nothing says "Faith-based engineering" like buying a backup system you refuse to test._

I'd rank "not doing backups" pretty highly in terms of having misplaced faith in things not breaking, too.

I don't ask new Tarsnap users why they decided to start using it, but sometimes they volunteer the information; and by far the most common reason I hear is "I just lost all of my data, so I decided it was time to start doing backups". I am frustrated every time I see this...

<comment><USER5> "To be precise, the time to start doing backups was immediately _before_ you lost all your data", huh...

<comment><USER4> I usually say two weeks, but yes. Immediately after you've lost all your data, you don't really have anything worth backing up any more...

</comment></comment></comment></comment><comment><USER6> No word on encryption.

No word on _what_ is actually backed up, how to include or exclude files.

No word on _when_ anything is backed up and _how_ (cronjob, daemon?).

No word on how running services and databases are backed up that may need special procedures for a consistent snapshot.

No word on how to restore or access backups when the backed up host has failed.

All things considered I have a strong feeling you are not qualified to run a service like this. Your expertise seems to be in webdesign, not in Unix and servers.

<comment><AUTHOR> Hi there and thank you for taking the time to look into JARVYS. I'd happily go through and answer your questions. Some of them are answered here[0]

> No word on encryption.

We encrypt data in motion, but not at rest (yet). Since this is a beta product we wanted to get it out there first with a free version that would bring the barrier down and allow us to learn as much from users as possible.

> No word on what is actually backed up, how to include or exclude files.

By default it backs up everything except /proc and /sys, which you can change here (with detailed instructions): /var/jarvys/etc/include

> No word on when anything is backed up and how (cronjob, daemon?).

It's a cronjob that checks in with our servers every hour and backs up once a day. The reason it's not a daemon is because daemons die, and we needed something as bulletproof as possible. Checking in every hour allows us to tell you when your server hasn't been checking in (which means you can proactively see if your cron daemon is broken or if something else went wrong before it affects your backups).

> No word on how running services and databases are backed up that may need > special procedures for a consistent snapshot.

We include a special script that allows you to run things like mysqldump before the servers back up to JARVYS: /var/jarvys/etc/run-before-backup.sh

> No word on how to restore or access backups when the backed up host has > failed.

That's also included in here[0] - that feature is still in testing and hasn't been released yet.

> All things considered I have a strong feeling you are not qualified to run a > service like this. Your expertise seems to be in webdesign, not in Unix and > servers.

Another backup concern you didn't mention is bit rot, which we're using ZFS to mitigate.

Thank you for your kind words regarding our website, our designer actually wrote a detailed blog post on how they came up with the logo[1]. We've been providing managed backup services (among other managed services) for our SSD Nodes[2] clients, which is for whom we originally built this service.

[0] [https://my.jarvys.io/docs/home](https://my.jarvys.io/docs/home) [1] [https://blog.jarvys.io/2014/11/04/the-jarvys-logo- design/](https://blog.jarvys.io/2014/11/04/the-jarvys-logo-design/) [2] [https://www.ssdnodes.com](https://www.ssdnodes.com)

<comment><USER7> > We encrypt data in motion, but not at rest (yet).

What does this even mean? When is data in motion or at rest? I hope your servers never see a single unencrypted byte. Just imagine lots of services using your backup system. That will make you a very very valuable target for hacking. You don't need to hack N services anymore, you only need to hack one.

Also what encryption algorithms are used? What key lengths? How are the keys generated?

And even if you do proper encryption, how can the authenticity of your software be verified? What if you where hacked and the hacker manipulated your software and thus installs back doors on all your customers through your software install/update method? Can a customer see the source of what is running on their server?

> By default it backs up everything except /proc and /sys

I guess you don't include the encryption keys in the backup, so there has to be something more excluded. Also what about /tmp?

</comment></comment></comment><comment><USER8> There are several questions that I need to ask anyone who claims to provide backups as a service (Baas?):

1) Client-side encryption?

2) If the answer to 1) is "yes", are the keys managed on the client-side as well?

3) What algorithms do you use for encryption and key derivation? They're not home-grown, are they?

4) Ideally, the keys that are used to manage my account on the web should be totally unrelated to the keys that are used to encrypt my backups. Otherwise it becomes trivial for the service provider to capture my password the next time I log in, and use that to decrypt my backups.

5) In order to minimize damages when a client is compromised, clients should not be able to access/restore files backed up by other clients, except with a key that is stored elsewhere.

6) For the same reason as above, clients should not be able to modify or delete files that were previously backed up, except with a key that is stored elsewhere. In other words, snapshots should be read-only.

7) Ideally, clients should not even be able to access/restore files that were previously backed up by itself, except with a key that is stored elsewhere. This prevents previous versions of files (or deleted files) from becoming exposed in case of compromise. But this is probably too much to ask of the typical backup service...

8) Filesystem permissions and other basic metadata (e.g. mtime) should be backed up and restored, too.

9) Proper and fully configurable handling of symlinks, please.

10) Your TOS, AUP, and privacy policy should be readily accessible from your home page, and customers should be notified of any changes at least a couple of weeks in advance.

My favorite solution so far is to _pull_ backups from another machine that I control, using rsync/rsnapshot over ssh. The snapshots are then encrypted and _pushed_ to their final resting place, such as S3, which knows nothing about the rest of my infrastructure. It's a bit of a hassle to set up correctly, but I'm in control of all the keys, a compromised client cannot access anything (restores are pushed from the server), the intermediate server can be destroyed if necessary, and the final storage provider (Amazon) cannot decrypt anything even if someone held a gun to their head.

Unfortunately, I have yet to find a one-stop backup solution that achieves the above. I'm not even sure if it would be possible without risking serious inconvenience. Tarsnap comes close, but AFAIK it makes it too easy for a compromised client to pull down everything I ever backed up.

<comment><USER4> The tarsnap-keymgmt utility allows you to create a key file which can be used to create backups but can't read or delete them. I think this satisfies the concern you mention at the end?

<comment><USER8> That looks great! I should really stop relying on the human-friendly documentation and dig into the manpages where all the gems are.

If I were really paranoid, I'd still be a little worried about possible information leakage via the local cache, which seems to be necessary for deduplication to work, especially without being able to read previous archives. But I don't have enough money to buy that much tinfoil :)

</comment></comment></comment><comment><AUTHOR> I've seen many of my clients set up their own backup systems and have those fail at the worst times. Last month a large client of ours called our managed support team at 3AM saying they hired the wrong developer who completely trashed their database and hosed their entire application. They had their own backup system in place and it silently failed, but luckily they ordered our internal backup solution as a secondary. We were able to get them restored in 5 minutes, if they didn't have our solution in place they would've had to spend weeks fixing what the developer broke.

Current Linux backup solutions are not made for humans. Have a look at the mondorescue guide[1], nobody is going to read that and comprehend it with full mastery, meaning you're leaving yourself open to losing data. VPS providers offer backups that are usually in the same datacenter, which means you're SOL if there's a disaster. Those same providers also don't allow you to restore single files/directories from snapshots, usually you have to launch a new instance or revert everything back to snapshot.

We ended up creating a simple Linux backup solution[2] that's as simple as copying and pasting a single command to get installed, notifies you if your backups aren't running, handles snapshots, and is secure. Restoring your data is a single command away, so you can focus instead on building your startup rocketship. Our mission is to make data loss a thing of the past.

[1] [http://www.mondorescue.org/docs/mondorescue- howto.html](http://www.mondorescue.org/docs/mondorescue-howto.html)

[2] [https://jarvys.io](https://jarvys.io)

<comment><USER9> This comment is identical to your comment from 18 days ago: [https://news.ycombinator.com/item?id=8670717](https://news.ycombinator.com/item?id=8670717)

You're far from the only one using HN to advertise your business, but maybe you should try to mix it up a little.

18 days ago was in November. Did a client call you a 3 am in October and also in November?

<comment><USER10> Out of curiosity, do you have an automated system that checks for duplicate comments? Did you just happen to read it before and remember it?

<comment><USER11> The third and most likely option is looking up the poster's HN profile and checking out historical comments made by the poster.

<comment><USER10> I guess the idea of looking a person's profile is foreign to me. Perhaps I should get into the flow of doing that.

</comment></comment></comment></comment></comment><comment><USER12> I think if you provide enough features to be the only backup solution a business needs for their server, $20/mo is too cheap. Just my 0.02.

</comment><comment><USER13> The pricing page is deceptive enough to make me reconsider trusting them.

Pricing that's presented like that makes me think like this:

"$20/month in large text, then $200/month hidden below that? I wonder what other details I'm missing that could cost me 10x (in time, money, security, anything else) in the long run. <close window>"

<comment><AUTHOR> I apologize if there was any confusion. We're running a holiday promo, which is written above the pricing table: "Get 14 days free + 90% off for 3 months during the holidays!"

We try to keep it as clear and concise as possible by showing the pricing you get with the promo + the normal pricing after that.

<comment><USER13> I understand. The way it was presented _seemed_ deceptive though. Hope that feedback is useful.

</comment></comment></comment><comment><USER14> Upvoted. For those that prefer getting their hands dirty (but not too dirty), duplicity and S3 might be a good alternative. It's really simple to get up and running: [http://kappataumu.com/articles/cloud-backups- duplicity-s3.ht...](http://kappataumu.com/articles/cloud-backups- duplicity-s3.html)

<comment><USER5> I much prefer attic: [https://attic-backup.org/](https://attic-backup.org/)

<comment><USER15> And here's an attic wrapper script I wrote that makes it easy to use: [https://torsion.org/atticmatic/](https://torsion.org/atticmatic/)

<comment><USER5> That's very useful, thanks!

</comment></comment></comment></comment><comment><USER16> Any product that wants you to pipe some crap from curl is communicating "our product is for all of the Windows people who bought Macs in the last couple of years and are still playing pretend when it comes to administering a Linux box."

<comment><USER17> Is this just a long way of saying that you shouldn't execute code, downloaded using curl, like this?

<comment><USER18> Yes, but in a way that makes the person saying it feel superior to others.

<comment><USER16> My beef isn't with the people who don't know they don't know, it's with vendors that encourage this. It makes the vendor look like amateur hour.

</comment></comment></comment></comment><comment><USER19> I am quite jealous of everyone else's bootstrap skills. Wish I could pull something even half that quality together.

</comment><comment><USER20> What's "enterprise security"? Is it like regular security? Does it involve client-side encryption?

<comment><USER21> Not sure, but if you want real security and dead simple backups on Linux, check out Tarsnap. From the inventor of scrypt. Full client-side encryption with very strong key derivation.

<comment><USER4> _from the inventor of scrypt_

It's more the other way around - I created scrypt because I wanted it for Tarsnap. :-)</comment></comment></comment>


New LLVM C++ Standard Library - <AUTHOR> http://blog.llvm.org/2010/05/new-libc-c-standard-library.html <comment><USER2> Apple is systematically cutting their dependence on GCC and related code. I wonder if it's due to GPLv3 or some other reason.

<comment><USER3> Among other reasons, I'd guess this is Apple's attempt at modernization. The GCC/libc/libstdc++ codebase has been around for ages, and has accumulated cruft. Starting from scratch isn't always a solution, but in cases like this I think it can be.

Modernizing the compiler (via clang/LLVM) is a great step forward, but modernizing the C++ libraries to take advantage of the new compiler infrastructure is a sensible step 2. If they can in fact speed up compilation speed and memory requirements (both at compile-time and run-time), as well as providing link-time and run-time optimization, it could be a big win, especially for large C++ projects (such as Mozilla, KDE, Qt, etc.).

</comment></comment><comment><USER4> I merely glanced at bits of the code without diving into the implementation that much, but my high-level thoughts:

\+ I love the "synopsis" header in front of all the classes.

\+ I find the style horrible, but still more readable than the SGI-based STL headers. This is a very good thing.

\+ Only one developer currently? I wonder how many bugs are yet to be found in this code. Making it ABI-compatible with libstdc++ should make the "swap it in, does it crash?" test very easy.

</comment><comment><USER5> Could someone explain: As a person who uses Apple products but doesn't code, what does this mean for me? Is Apple already using this compiler with OS X? Does it mean faster and smaller binaries down the line?

Or is it mostly cool stuff for coders, but mostly transparent for end-users?

<comment><USER6> _Is Apple already using this compiler with OS X?_

Its in use for _some_ products in Snow Leopard; Xcode, OpenGL, (and, I believe) OpenCL and Automator are built with Clang.

 _Or is it mostly cool stuff for coders, but mostly transparent for end- users?_

Mostly, this. However, the cool things it gives are subtly passed onto the user. For example, LLVM and Clang have a nice static analyzer to help developers find and fix memory leaks. There are other optimizations (for the size of the binary and speed of the program being run) that LLVM is working on, but they're not ready for primetime yet (or weren't, the last time I looked).

<comment><USER5> Thanks!</comment></comment></comment>


Giant Concrete Arrows Across the American Landscape - <AUTHOR> http://www.core77.com/blog/transportation/what_are_these_giant_concrete_arrows_across_the_american_landscape_25236.asp <comment><USER2> A Google Maps collection of these.

[https://maps.google.com/maps/ms?source=gplus- ogsb&ie=UTF8&oe...](https://maps.google.com/maps/ms?source=gplus- ogsb&ie=UTF8&oe=UTF8&msa=0&msid=213732418950957933334.0004e1e9dedbfbfa2281f&dg=feature)

<comment><USER3> Any particular reason most of the locations on that map are in the West?

</comment></comment><comment><USER4> _> since navigation charts of the day were fugazi..._

OT but Fugazi is the name of one of my favorite bands. In interviews I had read that the word meant "a fucked up situation" but until now I had never seen it actually used that way. Interesting choice of words, interesting article too!

<comment><USER5> I heard it used that way from growing up on Military posts. It just means any fucked up situation. I'm not sure it's known, but I was told it was made popular by troops in Vietnam. The most interesting theory I've seen is that it may derive from fougasse ("land mine"). All of that said, it makes one of the best band names ever.

<comment><USER6> My understanding is that it is an acronym.

Fucked Up, Got Ambushed, Zipped In.

<comment><USER7> My understanding is that acronym stories like that are almost always apocryphal.

<comment><USER8> Yes: [https://en.wikipedia.org/wiki/Backronym](https://en.wikipedia.org/wiki/Backronym)

</comment></comment></comment></comment></comment><comment><USER9> We had a tower with light in my town. We're right on the Pacific coast to the tower was inland and behind a hill so it couldn't be mistaken for a lighthouse by passing ships.

The tower and shed are still there and are used for communication antennas.

<comment><USER10> > _behind a hill so it couldn 't be mistaken for a lighthouse by passing > ships._

I wonder why they didn't just put it on ship maps as an additional lighthouse.

<comment><USER11> Lighthouses are regularly used for navigation, so they need to have almost guaranteed up-time. Don't think that would always be the case for these particular kinds of lights.

</comment></comment></comment><comment><USER12> See also: Satellite imaging test patterns[1]

[1] [http://www.clui.org/newsletter/winter-2013/photo- calibration...](http://www.clui.org/newsletter/winter-2013/photo-calibration- targets)

</comment><comment><USER13> The link at the end to concrete recycling is fascinating - having demolished 100 ton of concrete and steel in the back yard in the last year, it sounds great to have a largely mess free system.

<comment><USER14> Unfortunately, it's a student design concept, not an actual product. (This means there are likely to be major functional flaws in the design, as feasibility is generally not a consideration in these design competitions.)

</comment></comment><comment><USER15> I wonder what semi permanent structures we are building now that future generations will be looking at in 80+ years and wondering about our archaic technology.

<comment><USER16> The waste water storage tanks at the Fukushima nuclear plant will probably still be around and contaminated 80 years from now. Although I suspect that isn't exactly what you had in mind.

<comment><USER17> Just fill them with grain and have the birds eat it all. Problem gone.

<comment><USER18> If the problem was "How can I spread radiation throughout the environment?"

<comment><USER19> Release a large number of cats to catch and eat the birds. Solved once and for all. ONCE AND FOR ALL.

</comment></comment></comment></comment></comment><comment><USER20> This is so cool. I'm taking my kids on a road trip around the west soon.

Does anyone know of other cool, historical things like this we could hunt for?

<comment><USER21> Search the Twelve Mile Circle blog: [http://www.howderfamily.com/blog/](http://www.howderfamily.com/blog/) . He covers many cool geo-odities.

</comment></comment><comment><USER22> Is there any plausible reason such arrows would be broken up on purpose? In my mind, I would want more things like this to exist; large physical failsafe markers seem like a great idea.

<comment><USER23> These arrows, probably not so much, as they are pretty much all in the middle of nowhere. However, general concrete recycling is useful because breaking up existing, unused concrete for works projects tends to be cheaper than, and is more environmentally friendly than, quarrying.

<comment><USER24> I don't get it. Doesn't concrete crack and break in a messy way? How could it be re-used?

<comment><USER25> _> How could it be re-used?_

To somewhat over-simplify, concrete is made from three things: Cement, large aggregate (big rocks), and small aggregate (little rocks). Broken up concrete works pretty well as large aggregate.

<comment><USER24> Awesome, thanks!

</comment></comment></comment></comment></comment><comment><USER26> But if the arrows only point east to west, how did the pilots make the return trip?

;)

<comment><USER21> This one's pointing East... ? [https://maps.google.com/maps/ms?source=gplus- ogsb&ie=UTF8&oe...](https://maps.google.com/maps/ms?source=gplus- ogsb&ie=UTF8&oe=UTF8&msa=0&msid=213732418950957933334.0004e1e9dedbfbfa2281f&ll=40.704617,-112.253657&spn=0.000836,0.002064&t=h&z=20&vpsrc=6&iwloc=0004e1e9e47c301dc9749&dg=feature)

</comment></comment><comment><USER27> Even modern pilots (without GPS) use rivers and highways. Why couldn't 1920s pilots use railroads?

<comment><USER28> Modern joke "What do you mean by IFR" it means "I follow Roads"

<comment><USER29> With the extra joke being that following roads is actually VFR and that you most likely couldn't follow roads in IFR.

<comment><USER30> If that's the extra joke... What's the primary joke?

<comment><USER29> "Haha IFR is a fancy-sounding term but you really mean you just find a road and follow it to your destination as though you were in a car"

</comment></comment></comment></comment></comment><comment><USER31> If we had the government make concrete arrows like that today, they would be cracked into rubble in three years because the contractor cut as many corners as they could. (Sorry, My cynical, the past was so much better moment for today)

<comment><USER32> Yeah! The g'ubment can't build anything right!

 _Uses GPS system to get home_</comment></comment>


Ghost in the Shell and anime's troubled history with representation - <AUTHOR> http://www.theverge.com/2016/5/9/11612530/ghost-in-the-shell-anime-asian-representation-hollywood <comment><USER2> Writer is disappointed at the lack of outrage in Japan:

"The reactions are depressing, but if you've been following up to now, fully predictable. "I think this is better than hiring a Japanese actress," says one woman enthusiastically. "Yeah, it will look more anime-ish if the actors aren't Japanese." Every interviewee seems genuinely flummoxed as to why American audiences would be opposed to the casting."

Personally, I am only concerned that Scarlet or the script won't be very compelling.

</comment><comment><USER3> Speaking as a non-american, non-white.

Representation is mostly an american issue, most of the world doesn't have problems with it; when I was a kid, we played to be anime characters, us cartoon characters or local heroes depending on tv popularity. I can understand that in the segregated America, having a hero of your etnicity is important, but none of us cared about the skin or ethnicity; it wasn't an issue in our local culture.

On the other hand, shaming another culture into having the same perspective as your own, it's the book definition of cultural imperialism.

EDIT: BTW, I do think Scarlett is a poor casting choice.

</comment><comment><USER4> >(Of course, the average anime character does look unmistakably Japanese, but in the same way a rococo painting in a gilded frame looks unmistakably French.)

Uhh... No. I actually remember wondering why anime characters almost never look Japanese, and ended up decided that they wanted them to look different from themselves. Blue and pink hair, huge eyes, all those differences added up to "not us" in my mind. There are some anime characters who do look distinctly Asian to me, but they're pretty few and far between.

In addition, they often give them non-Japanese names as well, which further cemented my belief that they didn't want them to be Japanese. The ones with Japanese names often didn't look more Japanese, either.

But according to the article, Japanese people aren't upset at all with the casting of this film... Why should I be? Worse, what _right_ have I got to be upset about that? It's specifically not affecting me or my culture, and I can only be outraged _for_ them, to help them with their issues. It makes no sense for me to be outraged if they aren't.

</comment><comment><USER5> I don't see how this is whitewashing. There is nothing inherently Japanese about Kusanagi or the narrative of the movie. The same story could have been set in NYC, London, etc.

<comment><USER6> Ghost in the Shell is a Japanese film, set in Japan with Japanese characters and you don't think casting the Japanese protagonist as Scarlet Johansson is not whitewashing?

On top of that, Paramount contracted a VFX studio which claims Paramount asked them to do some CG tests to make Johansson look more Asian. Paramount claims it was other characters and not Johansson but either way that is about as clear cut a case of whitewashing as there is.

Now if they're redoing the movie such that it is set in NYC and organizations and characters are all changed to reflect being set in NYC, it would be a little bit different, but it would it still be yet another case of Hollywood taking a story and purposefully eliminating people of color from it.

<comment><USER7> The creators of the anime are OK with it.

People in Japan (or, as the epithet you call them, "people of color") are OK with it.

Most of the people watching are OK with it.

Maybe the whole thing is overblown by people looking for outrage?</comment></comment></comment>


The Chemical Space Project - <AUTHOR> http://pubs.acs.org/doi/full/10.1021/ar500432k

<comment><AUTHOR> See also: [http://www.gdb.unibe.ch/](http://www.gdb.unibe.ch/)</comment>


Security interns find 6 bugs in Oracle ERP in under a day - <AUTHOR> http://m.channelweb.co.uk/crn-uk/news/2431773/security-researcher-has-last-laugh-over-oracle <comment><USER2> Oracle deserves to die in a fire for everything they've done, and more importantly not done, to the open-source movement.

Not to mention Java and especially Sun - buying a competitor to destroy them and screw over their existing customers is a monumental dick move. I hope they get exposed for the pile of shit company they've become.

</comment><comment><USER3> Anybody what is XXS ???

<comment><USER4> Based on the next paragraph, a typo of XXE, or XML External Entities.</comment></comment>


The Inner Workings of a Realtime Search Engine - <AUTHOR> http://blog.oneriot.com/content/2009/06/the-inner-workings-of-a-realtime-search-engine/ <comment><USER2> So they are basically combining google + digg, indexing pages while taking account of user feedback through a recommendation system. Actually... I don't see what the big deal about "realtime search" is and the whole article sounds a little like PR material rather than a technical explanation of the inner workings of their search algorithm.

Also keep in mind that this is the same company that was me.dium, the company which got 15 million dollars of funding with like... (20k ? ) users, somewhat a poster-child of the web 2.0 bubble. I guess their original idea didn't take off and they started this instead.

</comment><comment><USER3> I would be more interested in their search infra, specifically scaling that "highly optimized in-memory index".

I'm guessing it's similar to LinkedIn's Zoie (<http://code.google.com/p/zoie/>).</comment>


Segway by Honda - <AUTHOR> http://www.youtube.com/watch?v=cuIJRsAuCHQ <comment><USER2> I see this and I think about the fat people in Wall-E.

What's wrong with using your legs?

<comment><USER3> I think Honda and Toyota are designing these devices for their growing elderly population in Japan.

<comment><USER4> While Honda, Toyota, and many companies in the Japanese robotics space do devote quite a lot of resources to thinking about the elderly population, a significant amount of the R&D work done is not done with the intent of being immediately productizable, but rather to do basic R&D and to fly the company flag. (See Asimo or, indeed, any robot which looks remotely like a human. Or the gigantic eight-legged spider robot who existed to wave a large fan at people that my tech incubator made, which existed to say "Look at us, we're capable of making a gigantic semi-autonomous eight legged robot with one functional limb which you could mount all sorts of things that are not cooling devices on.")

</comment></comment></comment><comment><USER5> Stupid for humans, maybe, but that'd be a cool mobility platform for robots.

<comment><USER5> Actually, I just remembered something along the same lines from a few months ago: <http://www.youtube.com/watch?v=bI06lujiD7E>

</comment></comment><comment><USER6> Like Paul Graham said in July 2009[1] The trouble with the Segway is that it makes you look smug. This thing will make you look even more so.

[1]: <http://www.paulgraham.com/segway.html>

<comment><USER7> Really? I think it makes you look less smug. It doesn't make you effectively taller the way Segway does, and sitting is a more casual position.

I think the people in this video look smug, for various reasons unrelated to the U3-X itself.

<comment><USER8> Additionally, your arms are free which is a big win, and at least in the video, it didn't require wearing a helmet. I think they've made leaps and bounds over the smug issue.

It looks like this only targets indoor super smooth surfaces, but I think it could definitely find a niche.

</comment></comment></comment><comment><USER9> A part of me thinks that Honda has solved the problem of walking. Something evolution solved a long time ago. The evolved solution also allows us to go up steps!

While it's cool it seems like there is a long way to go before it's useful/cost effective.

None of the above undermines the technology btw, just the application.

<comment><USER10> Another thing about this particular execution is that it is still not cool. It's even worse than the conventional segway: you necessarily sit shorter than everyone around you which will make an impact. We as a species favor tall individuals on a subconscious level (think of US presidents). Whatever alternate mode of locomotion is to be created, it needs to be cool. Think jetpacks.

<comment><USER7> I actually think that it's better than the Segway for making you slightly shorter. One of the problems with the Segway is that the increased height (and width) makes you so conspicuous as to practically be flaunting your use of it, and how independent you are from the lowly ambulating masses.

Whereas someone riding a Vespa can still come off as cool. (Though they'll immediately look silly next to someone on a Harley.)

<comment><USER10> Well, yes. Someone sitting lower than others around him/her is not necessarily bad: think driving a Ferrari vs walking down the street. But this thing does not look cool. It looks more like you are somehow incapacitated (I think some other comments mention knee injuries). Even a hover chair from the Austin Powers movies would be better. Jetpacks would be ideal.

<comment><USER7> I agree with you. I don't think this thing is going to take off as a mainstream transportation device. I just think it's less awkward than the Segway.

</comment></comment></comment></comment></comment><comment><USER11> For those who haven't seen it:

<http://tlb.org/eunicycle.html>

<comment><USER12> I kinda expected to be invented by some girl named Eunice.

</comment></comment><comment><USER13> Accidental acceleration will have a whole new set of consequences.

No-one has topped motor assist on a bicycle yet. It's fun and useful to be able to move 20+ mph all day without being a top-notch athlete (or while wearing business clothes).

</comment><comment><USER14> What a waste. I want one. I'm so conflicted. Does wanting to buy consumer oriented yet entirely unnecessary products make me more American, dumb or both?

<comment><USER15> It's not socially acceptable to want one until someone uses it to put her life in jeopardy before a worldwide audience.

</comment></comment><comment><AUTHOR> There is also this device:

<http://www.youtube.com/watch?v=0S_SL8IWObY>

</comment><comment><USER16> They will need vastly more rugged versions for your average American. I say this being from Texas.

</comment><comment><USER10> In the mall near me all the security personnel rides around on "conventional" segways, presumably to get to whatever issue arises faster. Mind you the mall is a two story mall with stairs and escalators. What exactly happens if the security office is on the bottom floor and the issue that needs immediate attention is on the top floor? I imagine ditching the segway would be a bad idea.

</comment><comment><USER17> Power wheelchairs are better, comfortable and ergonomic.

But then you'll look like a crippled.

So take a La-z-boy and add power wheels to it. Then sell it for $999.

<comment><USER18> This is infinitely more maneuverable, especially in the house e.g. the kitchen. A house has to be made wheelchair-compatible. This avoids that cost. And makes you look more human.

</comment></comment><comment><USER19> I think, for more or less healthy people (being able to walk) it's the opposite what would be usefull, not sitting/being passive when we were once moving/using our muscles, but running/using muscles when we were once just sitting (more or less passively), I remember a standing desk with a running treadmill underneath as a nice example.

</comment><comment><USER20> That's actually a pretty cool wheel design.

</comment><comment><USER21> I'm not particularly impressed by the chair (references to both pg's Segway essay and the fat people in Wall.E come to mind), but I'm very interested in the omniwheel technology.

Imagine a wheelchair with one omnidirectional wheel instead of four. That'd make a world of difference for disabled people!

<comment><USER22> They didn't invent the omni wheel, been around for a while. <http://en.wikipedia.org/wiki/Omni_wheel>

I'm sure Honda tuned it up a bit though.

Also, there have been some wheelchairs made with omni-directional wheels, although I'm not sure if they are only a prototypes.

<http://en.wikipedia.org/wiki/Mecanum_wheel>

<comment><USER23> Are you sure? This omniwheel is novel because the rollers are powered. This is the first device I've seen that can move in any direction with a single wheel.

</comment></comment></comment><comment><USER24> Um...Wow.

Aside from Mr. Garrison's gyro-thingie ( <http://en.wikipedia.org/wiki/The_Entity_%28South_Park%29> ), that's the most emasculating mode of travel I've ever seen.

</comment><comment><USER25> Need a monster version built out of top fuel dragster components.

</comment><comment><USER26> Segway is Dean Kamen's company, not the product. The product is the Human Transporter (or HT). They make other things, too, including the Segway Centaur.

</comment><comment><USER18> Looks like you have to stoop forward constantly to stay in motion. Not useful as a vehicle, not even for a short while.

Maybe useful as an office-chair replacement?

<comment><USER27> Office chair was the first thing I thought of when I saw them sliding sideways. I wonder how hard it would be to stay still enough to type accurately.

<comment><USER18> Just talked to a friend who runs a kitchen, thinks it would be ideal for a commercial cook.

</comment></comment></comment><comment><USER28> Only practical -- if that! -- during dry days. I wouldn't want to see the state of my pants after using this on a wet pavement or street.

</comment><comment><USER29> I'd love to see the off-road version!

<comment><USER15> I hope it comes with the ability to dodge trees on its own. I'm guessing an outdoor model would have to be very smart, almost self-guiding.

</comment></comment><comment><USER30> Slightly faster than walking, without all the messy dignity.

</comment><comment><USER31> All examples of use are indoors. Rough outdoor floors may prove too much. In any case an impressive device.

</comment><comment><USER32> They haven't learn anything from Segway, you look utterly ridiculous riding one of those things (even worse than someone riding a Segway).

</comment><comment><USER33> Note how they didn't let us hear how it sounds, but they visually suggested that one could tour an art gallery. I'm guessing it sounds almost as menacing as Big Dog.</comment>


Ask HN: What would an OOP-style human language look like? - <AUTHOR> <comment><USER2> For parametrically constructed language according to Noam Chomsky, Sanskrit was best constructed. Chomsky's work of language theory has inspired many compiler designs in early programming. He favored particularly Sanskrit grammarian called 'Panini' and his 500AD work called 'Ashtadyayi'

There was a huge discussion about 8 years back on HN itself.

[https://news.ycombinator.com/item?id=4729626](https://news.ycombinator.com/item?id=4729626)

</comment><comment><USER3> To me, variable.method(argument) looks a lot like "subject verb object".

</comment><comment><USER4> Human language is already pretty OOP; I think that's a big part of the latter's appeal. We speak in terms of categories, objects, and subject-verb- object clauses.</comment>


A small fast and cute web framework in Python. - <AUTHOR> http://bottlepy.org/docs/dev/

<comment><USER2> Although I've been working with django daily for about the past six months, I used bottle for a small stand-alone 'desktop-like' application.

I needed an easy, quick way to take roll call of a large group of people. We have a laptop with a projector but no internet access where the meeting occurs, so it had to be able to live on a Windows machine without network access. Bottle allowed me to pull together something in about five hours that uses sqlite for local storage of all of the participants names and whether they are present/absent and any notes. Previously, I was doing this on an inherited excel spreadsheet and it was very difficult for anyone else to read their name or any information. Now, it's a very simple HTML page with very large font that can be read from the back of the room.

So, thank you bottle! I was able to develop on Linux and fairly painlessly deploy it to the Windows laptop, and it worked the first time. (That was scary... Rarely happens to me.)

<comment><USER3> I'm curious, how did you justify the return on investment of developing this? In most business situations, "Use Zoom to make the font bigger" would have been the boss reply.

I almost always have to seed Version 1 as a stealth project or weekend project. Version 2 is more likely to be approved once it has been shown useful.

<comment><USER2> Ah, I should mention that this is for a volunteer non-profit group. They are/were falling into the 'spreadsheet as a database' trap, so this is the first visible step to move off of that and onto something manageable.

The next stage is to get a slightly more comprehensive site going which will keep track of contact information, attendance history, etc.

</comment></comment></comment><comment><USER4> People interested in frameworks should read bottle's code. It has a neat feature where the request handling is built by sub classing exceptions. This allows request processing to terminate at any point by simply raising the handler. There is a global try/except that then renders the result.

This mechanism is quite good for ensuring every request proper gets a response, though it also allows dodgy exception handling to interfere with processing. A discussion on the merits of exceptions themselves is beyond the scope of this comment. :)

<comment><USER5> The Play framework (java) also does this:

[https://github.com/playframework/play/blob/master/framework/...](https://github.com/playframework/play/blob/master/framework/src/play/mvc/Controller.java)

See "renderTemplate(String templateName, Map<String,Object> args)" for a good example.

</comment></comment><comment><USER6> Bottle is great, not sure if this is really news though?

<comment><AUTHOR> Apparently no one has submitted the page before. I love bottle. I switched from RoR and never looked back.

Of course I just use it for tiny basically desktop apps, where I just wanted to use the browser as an interface to avoid writing UI code.

<comment><USER7> <http://news.ycombinator.com/item?id=2773524>

<comment><AUTHOR> Hmm. Shouldn't HN detect dupes and just upvote the orig? Odd.

<comment><USER8> It's also almost a year ago. It only does the dupe collapsing when within a certain timeframe.

</comment></comment></comment></comment></comment><comment><USER9> I've used it for a couple of projects and did a presentation on it at pyAtl this past March. Nice framework, easy to learn, simple to deploy, has adapters for many of the potential front end servers. If you want a copy of the presentation on the project, I posted it in the presentations area on my blog (marginhound).

<comment><USER9> Forgot to add - one of the really nice things about using a microframework is that it is easy to assemble a "best of breed" solution using libraries from other frameworks.

</comment></comment><comment><USER10> At the top of the website, in _very_ small text:

        Warning: This is a preview for Bottle-0.11.dev, which is not released yet. Switch to the latest stable release?

Just something to be aware of.

</comment><comment><USER11> If you like bottle but find yourself needing to write Ruby, check out Sinatra.

<comment><USER12> +1 Sinatra is amazing convenient to use. In the last month I have written two REST style web services for a customer in Sinatra. I sometimes also use Sinatra instead of Rails for for simpler web apps.

That said I installed Bottle and played with it - looks nice!

</comment></comment><comment><USER13> Thanks for the nice feedback :) I am defnull, the author of Bottle. Any questions?

</comment><comment><USER14> Bottle vs Flask, who will win?

<comment><USER15> Bottle supports Python 3 (as does CherryPy, Pyramid, and Tornado), while Flask currently doesn't. Depending on project requirements, this may or may not be important.

<comment><USER16> Werkzeug must support Python 3 before Flask can, and Armin has discussed Python 3 support here on HN before (and there's now a FAQ about it).

</comment></comment></comment><comment><USER17> I think Flask is a bit better known and tested these days.

One man's opinion (based on experience).

</comment><comment><USER18> I like the tabs on the side, that's pretty cool. It would be really great on longer webpages where the user is doing even more scrolling.

cool stuff, man.

</comment><comment><USER19> Is it wrong that I use web.py? Should I feel dirty and start using bottle instead? :P</comment>


UltraViolet Is Shutting Down - <AUTHOR> https://www.cordcuttersnews.com/ultraviolet-is-shutting-down/ <comment><AUTHOR> People paid money to have digital access to these movies, and after the shut down all of their content may not be accessible. I hate this not owning the physical disk/bits. I would like to buy an digital file like I can do for music.

</comment><comment><USER2> [https://news.ycombinator.com/item?id=19046108](https://news.ycombinator.com/item?id=19046108)</comment>


KLOS: Kernel-Less Operating System Architecture (2005) [pdf] - vezzy-fnord http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.59.2606&rep=rep1&type=pdf <comment><AUTHOR> Reading and trying to understand this:

1\. The address space for each process has an unprivileged "user-level" segment (DSAPP), and a privileged "OS" segment (DSOS) where the data traditionally associated with the kernel is stored.

2\. Traditional "system calls" are implemented as ordinary procedures. These procedures switch to the privileged segment, do their stuff, and then switch back to the user segment.

3\. Since these are ordinary procedures, what's to prevent application code from switching to the privileged segment and mucking with the OS guts? Well, the app doesn't know which segment is privileged! It can try to read it out of the "system call" procedures, but that memory is execute-only, so that won't work.

4\. Maybe the app determines the privileged segment via guess-and-check! To prevent that, the OS plays shell games, switching which segment is privileged around every time the app guesses wrong.

5\. Ok, so there aren't that many segments: the probability of guessing right is still ~.01% per try. That's very unlikely, assuming the app only guesses once. (We hope attackers haven't thought of guessing more than once.)

This guess-and-check attack would seem to be a deal-breaker, no? This seems like a terribly insecure design.

<comment> vezzy-fnord You mostly have it right.

It's mostly a PoC for a nokernel architecture, and a rather admirable affront at taming the darker corners of x86 segmentation to create a system where you have a per-address space "event core" rather than a traditional kernel, thus largely not performing so much as multiplexing. Though, I think an important addendum is that the selector relocation is context-global and thus the probabilistic mitigation cannot be thwarted by spacing the workload across threads.

\----

(EDIT: Actually, I just reread it and in fact the event core will terminate a process after three successive "segment not present" faults, so that should be effective.)

\----

By their testimony it is not any more susceptible to standard memory corruption errors than traditional monolithic OSes. One could then argue that the probabilistic weakness requires a malicious application that higher level security policy could weed out, but even further that the value added of a nokernel exceeds the downside of this hole relative to the monolithic kernel state of the industry which is _already_ susceptible to a host of other vulnerabilities. It would, however, discount this KLOS in particular from any high-assurance use cases, but again so are monolithic kernels to begin with.

I think the gist of this is that the nokernel architecture _is_ viable, but perhaps COTS architectures are not that expressive. Certainly not x86 it seems.

<comment><USER2> it's not effective. you can just start another process and try again right? i think after 16k attempts you have about 2/3 chance of succeeding. kind of cool but not secure.

</comment></comment></comment><comment><USER3> Darn, that's two good ones you given me to review in one day. Officially on my backlog. People interested in kernel-less OS's might also want to look at Tiara and its successor SAFE:

Tiara [http://dspace.mit.edu/bitstream/handle/1721.1/37589/MIT- CSAI...](http://dspace.mit.edu/bitstream/handle/1721.1/37589/MIT-CSAIL- TR-2007-028.pdf?sequence=1)

SAFE [http://www.crash-safe.org/assets/ieee- hst-2013-paper.pdf](http://www.crash-safe.org/assets/ieee-hst-2013-paper.pdf)

<comment><USER4> Funny, Tom Knight (Lisp Machine cpu designer) suggested to read about crash- safe.org work. Small world.

<comment><USER3> That is a trip. LISP machines were doing tagged memory and GC before most of them. Knight agreeing that SAFE is great work is a sign Im on right track. :)

<comment><USER4> Didn't know it was your work. Enjoy the trip ;)

<comment><USER3> SAFE is not my work. I was evangelizing many of the same principles, working similar things, and generally try to draw mainstream attention the The Right Thing (eg SAFE) when it manifests for a given problem/domain. High assurance security & systems path has been quite a trip, though. Thanks. :)

</comment></comment></comment></comment></comment><comment><USER5> I've read through the paper, and while I understand how the operating system achieves memory protection (by using W^X flags and memory segmentation), I don't understand how the scheduler would work in a kernel-less OS. What prevents my program from hogging all of the system resources, and preventing other programs from executing?

</comment><comment><USER6> Unfortunately, I am being served an error about exceeding the "daily download allowance", is there a mirror somewhere?

<comment> vezzy-fnord Here you are: [http://darknedgy.net/files/vasudevan_klos_05.pdf](http://darknedgy.net/files/vasudevan_klos_05.pdf)

</comment></comment><comment><USER7> vezzy - thanks for posting! You do not disappoint :-)

I really like it when people use the segment architecture to do something interesting. It forces people to really think about the question... what is a kernel?

Also, their technique of mapping the TSS I/O bitmap to virtual memory is clever.

</comment><comment> vezzy-fnord Page 2 diagram is blacked out for whatever reason, rest is fine.

<comment><USER8> Diagram renders fine in Safari; here's a screenshot of the diagram: [http://i.imgur.com/GoytjRf.png](http://i.imgur.com/GoytjRf.png)

</comment></comment><comment><USER9> Does this have any running code?</comment>


The cult of WeWork - <AUTHOR> https://www.propertyweek.com/insight/the-cult-of-wework/5098454.article <comment><USER3> Am I extremely out of the loop by just thinking that it's a hot desk company that rolls up all the expenses of the office adds 10%-25%, throws in some booze and lunches and says it's changing the world?

<comment><USER4> Actually yes - this perspective would discount the immense value of brand, design, narrative and belief. And before you think that that stuff is "not real", consider that the reason you do anything is because of some dominant narrative you may or may not have reflected on.

Narratives are what get people build rockets and go to the moon, or build them and go to war instead.

<comment><USER5> Whilst that's true, narratives at some point do have to meet reality. If rental prices drop by 10%, it doesn't matter what you believe, WeWork will be underwater.

<comment><USER6> Wework is underwater. Have you seen their bond offerings? They will default.

</comment></comment></comment></comment><comment><USER7> Can anyone recommend a "coworking space" [0] for people who don't like coworking spaces? I like to work on my own independent projects, preferably at a place that isn't my apartment, but I just can't stand WeWork-style coworking spaces, which I find to be a mix of equal parts motivational speech, "networking," pretension, and pretend work. It just seems so fake to me. Am I being closed-minded?

[0]: I live in NYC fwiw.

<comment><USER8> > motivational speech, "networking," pretension, and pretend work

This.

I'm in the same boat, my company has some space in one in London. It's exactly as you describe plus noisy. I really can't figure out what the people around us do all day as they always seem to chatting. Fortunately we're able to work from home, which I've taken to doing more recently, especially as the beer tends to almost always be out by the time I finish work.

<comment> swingline-747 Regus rents office space, conf rooms and mail drops in nearly every major city. It's like a gym membership more than an Uber meets a cult [https://regus.com](https://regus.com)

For 9x5+, I recommend leasing/renting a desk or office privately because Regus wants an arm/leg at their rates.

</comment></comment></comment><comment><USER9> I work at a WeWork office in the East Bay. My impression of WeWork events is that a small minority attends them and a slightly larger minority goes just long enough to swipe some free food (I would _never_ ). My main complaints are that the office is noisy and people seem to think it's acceptable to eat lunch in the shared workspace, also the keycards are terrible and usually require 3-4 attempts to open any door. As for a cult-like atmosphere, I haven't noticed anything like that, but then again I don't work for WeWork.

But the bright side about the WeWork office? On any given day, 80% of the desks are empty. I certainly can't complain about _that_!

<comment><USER10> I don't get it, what's wrong with eating in a shared workspace? I don't work in one, but it seems like a "normal" thing to do.

<comment><USER11> It's beyond antisocial. Being forced to smell and see food, and watch people eat can be disgusting. Some food is obviously worse than others. Deliberately inflicting it on an entire office is not-so-subtly telling everyone else that their eating at their desk, rather than use any provided kitchen or dining facilities, is more important to them than their consideration of every other person in the place.

It might be "normal" in some places, but those are places I would find detestable. It only takes one person to make the rest of an open plan office feel nauseous.

If a person can't find 30 or even 15 minutes to leave their desk to eat their lunch, then there's something seriously wrong with their work culture. It's not like they are going to be actually "working" while stuffing food into their faces. They should take the time to switch off for a few minutes for their own physical and mental health, and the consideration of others.

<comment><USER12> You'd get more sympathy without the "its for their own good" part.

<comment><USER11> Why? The point about it being antisocial and inconsiderate stands on its own.

The point about it being for their own good is separate, but still valid. Too many people end up with long term health problems from sedentary jobs, and a small amount of physical and social activity at lunch is all some people get. Missing that out can be quite detrimental in the long run, from depression, lack of motivation and migranes to bad circulation and consequent RSI problems and other health problems.

I've suffered from some of the above even with not eating at my desk and taking breaks. Some of the people I've known who basically didn't move for 9+ hours a day had some horrific health and mental problems, and because people often minimise the dangers I'm deliberately bringing them up. They can creep up slowly over the course of years, which makes them insidious and underestimated. Being "so busy" you rationalise eating at your desk is symptomatic of a more general lack of care which needs sorting out.

</comment></comment></comment></comment></comment><comment><USER13> From my own brief membership at WeWork - can confirm about the cult feeling. Every member of the "WeWork [support] Team" had this airhead quality about them that assured one there wasn't calculation (or anything of depth, really) going on under her/his fanatically happy veneer.

I'm happy I read this article, because I thought I was being judgmental in thinking none were too bright.

</comment><comment><USER14> WeWork seems to really attract the "playing startup" crowd. Lots of networking, craft beers, office puppies, the whole nine yards.

Incidentally, the hectic foosball, random barking and other sounds of great enthusiasm make it damn near impossible to actually do any deep work there.

</comment><comment><USER15> I attended a similar industry event in 2006 called HedgeStock[1], for hedge funds and the various remora fish that feed off them. It was a very strange and quite unpleasant experience. Most of the attendees' firms were severely damaged if not destroyed in 2008.

This seems similar.

Pride does seem to come before a fall.

[http://news.bbc.co.uk/2/hi/business/5059232.stm](http://news.bbc.co.uk/2/hi/business/5059232.stm)

<comment><USER16> This brings me back. While I didn't attend HedgeStock, I used to post on the Albourne Village forums of the "conference" organizer. They had a points system which I found a way to game, accumulating enough points to buy a Hedge Stock calendar. "strange" and "unpleasant" were thoughts that ran through mine and my coworkers heads as we paged through the calendar.

For WeWork the vegan, hippy vibe seems part of their culture. I had a harder time reconciling that type of atmosphere applied to the investment management industry.

<comment><USER15> Ah yes, Albourne Village. I vaguely remember their website having an actual village metaphor for navigation - I guess it was just close enough to the '90s :)

</comment></comment></comment><comment><USER17> I know a few people at the NYC office and have observed some of this, but I'm not sure if that muchworse than other "startups". My own (far smaller, about $500m / 400 people) employer certainly has a bit of groupthink itself.

If the one correcting comment on the article

> __Pescatarian not Vegan. Wework still have dairy, eggs and fish allowed at > their events.

is true, I'm not sure how much i can trust the rest of it.

<comment><USER18> Should have gone pesca-pescatarian.

</comment></comment><comment><USER19> Believe it or not, the last tech bubble had a company doing exactly the same thing. They were called Regus, they ended up in bankruptcy and sold off their US division to avoid shutting down entirely. They are still running, they are significantly larger than WeWork (they have offices everywhere from New York to Mongolia)...somehow they are only 10% as valuable. Seems legit...

And the CEO of Regus is still a bit crazy about tech btw. They actually have an R&D arm that is trying to build self-driving office cars...or something. I never worked it out.

</comment><comment><USER5> Many months ago I listened to a podcast about WeWork that summarised the problem as: renting office space is a very traditional business. It's demonstrably true that the cost of these rental spaces is cyclical with the business cycle, and companies like WeWork are basically taking on long term leases at the height of the boom. These leases are 10-15 years, and realistically the value of those spaces are going to dip at some point over that time, at which point the business goes bankrupt because it's massively leveraged.

Everything I've seen about WeWork indicates that this is exactly right -they've got a very traditional, poor business strategy, alongside full on insanity scale silicon valley optimism. Does anyone know why WeWork is valued at close to 10x competitor Regus?

</comment><comment><USER20> Sounds like just a sampling bias. The kind of people with the time and desire to go to this festival are probably the kind of people to "drink the kool aid". They are also smart enough to know not to trash their company while being interviewed by a stranger.

If I was at a company sponsored event I would of course praise our glorious corporation to some stranger, but its not like I actually believe the hype, I just like getting paid.

</comment><comment><USER21> The Gwyneth Paltrow of coworking.

<comment><USER22> When Paltrow was referenced in the article I was thinking, this is one of those touches that in fiction would stand out as too contrived or on the nose.

I wonder if there will be a day when WeWork "consciously unincorporates."

</comment></comment><comment><USER23> Oh my, are these people going to have a "Well, that was embarrassing" moment later.

Then:

 _A big part of being a woman is to help men [like Adam] manifest their calling in life."_

Aaaaaaaand nope.

<comment><USER24> Reminds me of a quote from The Bell Jar which will probably make you just as uncomfortable as Esther.

> "What a man is is an arrow into the future and what a woman is is the place > the arrow shoots off from."

There's no shame in wanting to play a support class but don't pressure others into it.

<comment><USER25> There's no shame in wanting to differ from the status quo maintained since time immemorial, but don't pressure others into it.

Valid?

<comment><USER24> I don't think so, at least not completely. The message should be to treat others as individuals and not impose societal expectations on others.

Don't assume that the default or expected role for a woman is to be supporting and passive. And don't look down on a woman who still wants to assume that role.

</comment></comment></comment></comment><comment><USER26> "There are 150 million orphans in the world, but we want to solve this problem and give them a new family: the WeWork family."

...what?

Oh, I see, it's because WeWork is launching a private elementary school for budding entrepreneurs.

...what?

</comment><comment><USER27> This reminded me of another article I read about this company: [https://www.bloomberg.com/view/articles/2018-04-27/wework- ac...](https://www.bloomberg.com/view/articles/2018-04-27/wework-accounts-for- consciousness) Their value is predicated entirely on the perception. Select quote from the CEO:

>"WeWork isn't really a real estate company. It's a state of consciousness, he argues, a generation of interconnected emotionally intelligent entrepreneurs."

Riiiiiiight.

</comment><comment><USER28> I'm not surprised the property industry dislikes WeWork, WeWork's success is a reflection of how poorly that industry serves it's customers.

<comment><USER29> The "property industry" is doing just fine seeing as how they are the ones selling top-shelf commercial leases in bulk to WeWork.

"Success" for these types of companies is similar to their tedious "we can change the world" mantra in that neither have any basis in reality. They have racked up a $723 million loss and are on the hook for $4b in new spending, and yet they are a 'decacorn'.

They are propped up through investment capital alone. No wonder they have to roll out these absurd claims of expanding into education, daycare and town- building.

</comment></comment><comment><USER30> I lose so much respect for people like this.

I don't want to offend Americans, but this is mostly an American thing and it's not just corporate: it's politics, religion, NGOs, entertainment, news - everywhere. (America literally invents it's own religions!)

The scariest part is when you meet true believers, those not just 'playing the game' but are really on the koolaid.

I believe this is because in America, people don't have quite as much of a cultural foundation to buy into, or rather, the local culture might be sparse, or unappealing. In non-American Western cultures and certainly Japan - <USER2> are establishment role models for people to look up to, across the spectrum in business, politics, nobility, etc. and there are tons of accepted cultural norms in sports, the arts, culture, cuisine etc.. There are more 'established ways' about everything from office culture, to manners, to politics, to religion. It's as though there are fewer 'seekers' perhaps because people are more grounded in their identities. Paradoxically this leaves less room for true change to happen because, in a way innovation often comes about when there's a little bit of kool-aid in the mix.

You can see this with Nike's recent commercialization ostensible social justice movements, or even with some of Steve Job's old ads. The one with Gahndi in it ... 'memba that? So funny.

I wish De Tocqueville were still alive to give us an updated view on things.

<comment><USER31> Handwave-y nationalistic generalizations rarely lead to thoughtful discussion so we'd appreciate it if you would please not post them.

<comment><USER30> The article specifically concerns 'cultish behaviour' in a uniquely American firm, and the author is specifically speaking from the perspective of a 'non American'.

My comment reflects observations I've made having living in many places around the world, speaking several languages immersing myself several different cultures and I think they speak directly to the nature of the article, more so than most of the comments on this thread which are a smidge colloquial side by HN standards.

Also this isn't an issue of 'nationalism', it's about culture, ironically those are two subjects North Americans tend to conflate.</comment></comment></comment>


Akaunting: A web-based accounting system - <AUTHOR> https://lwn.net/SubscriberLink/795771/73d501fdc7d2b482/ <comment><USER2> Maybe it's the shared icon set and layout, but this software really reminds me of firefly-iii, which does personal accounting/finances tracking. (And it does that well - recommended)

Firefly: [https://firefly- iii.org/static/screenshots/4.7.4/index.php](https://firefly- iii.org/static/screenshots/4.7.4/index.php)

Akaunting: [https://static.lwn.net/images/2019/akaunting.png](https://static.lwn.net/images/2019/akaunting.png)

Although it could probably be used for companies as well - double entry is one of the first listed features and it supports different account types.

<comment><USER3> One major difference is:

Akaunting is multi user but Firefly is single-user only

[https://firefly- iii.readthedocs.io/en/latest/support/feature...](https://firefly- iii.readthedocs.io/en/latest/support/features.html)</comment></comment>


The Digital Advertising Duopoly - <AUTHOR> http://avc.com/2017/12/the-digital-advertising-duopoly/ <comment><USER2> There are only two ways to break the duopoly: create your own massive medium like Facebook or work with publishers. Having worked in this industry, I think working with publishers is an impossible battle. The whole publishing world is rife with fraud and desperate attempts to increase page views.

Most publishers cram their websites with ads. The number of low-content, click-baity websites is just staggering. Sometimes I wonder how could this even be a profitable proposition for advertisers. This is one reason why Google absolutely dominates the space. It has the capability to deal with all the fraud, calculate the right reward for publishers, and give a meaningful ROI to the advertiser.

Maybe a new kind of advertisement medium could unseat Google from its dominance but the way digital advertising works today, it sounds like an impossible idea.

<comment><USER3> I'd like to see an industry by which companies or their advertising reps engage with sites in a subscription-like mechanism for direct advertising. Cutting out the middleman seems like a logical step in this day and age.

<comment><USER4> Subscription to ads would mean a lot of waste in the budget. Very few advertisers would go for that over CPC/CPA pricing

<comment><USER3> It's not subscription to ads, it's advertisers subscribing themselves into sites.

</comment></comment></comment></comment><comment><USER5> All the more reason we need adblockers and private-by-default browsing. It worries me that I can't use something like Privoxy on Android without rooting the device. An alternative would be a good privacy VPN with blocking/filtering of ads and trackers.

<comment><USER6> I've switched to using Firefox Focus as my main Android browser. It provides ad blocking and privacy features. For apps, I try to avoid ad-supported ones whenever possible, and am happy to pay for apps that I find useful.

<comment><USER7> Does the focus app block ads on Android Chrome mobile? On iOS it does.

<comment><USER5> It does not block ads, but it does block ad trackers.

</comment></comment></comment></comment><comment><USER8> Isn't this normal?

Doesn't radio advertising have a similar duopoly? Same for outdoor advertising?

The internet never delivered disintermediation, it only changed who those intermediaries were.

</comment><comment><USER9> The content looks similar to the WSJ article:

[https://www.wsj.com/articles/the-google-facebook-duopoly- thr...](https://www.wsj.com/articles/the-google-facebook-duopoly-threatens- diversity-of-thought-1513642519)

Discussed here:

[https://news.ycombinator.com/item?id=15960606](https://news.ycombinator.com/item?id=15960606)

</comment><comment><USER10> The problem with subscriptions is not the cost, its the sheer number of them - and some come up almost accidentally. I pay a lot to my ISP every month. I would like to see a company that charges me monthly to eliminate all adware by micro-paying the participating websites for my actual page visits. In fact, if my ISP added such a service for a fee, I would sign up.

<comment><USER11> We tried this - there's a lot of political and business issues that basically mean you can't pull it off unless you're a major player (like Verizon or Google) already. Selling the data (of which one of the uses is advertising) is more lucrative than letting users pay direct, and that's before overcoming the hurdle of most consumers who think that they already pay for "the internet" including all the content.

Google's has the Google Contributor option [1], but that only applies for ads via their ad network and not other potential sources. There's also Flattr which is not as automated but it's now owned by AdBlockPlus crew and has raised rates so it's not such a transparent and clean system anymore.

1\. [https://contributor.google.com/v/beta](https://contributor.google.com/v/beta)

2\. [https://flattr.com/](https://flattr.com/)

<comment><USER3> Forgive me if this is naïve, but how does Joe Random site owner participate in the selling of data? My impression is that that's an area of commerce with a pretty closed membership.

I'm not asking in order to do something like this, just that I think it's an interesting question about exactly who is able to profit from activities that are somewhat assumed to be occurring everywhere, and not by and within the ad networks that everybody is using.

<comment><USER12> The only places that buy and sell user data are spammy mailing lists. That's it.

Browser history predicts almost nothing, anyway. There is no market where user data is bought and sold, except for spammy mailing lists to other spammy mailing lists.

<comment><USER11> That is completely wrong.

There is a vast market for consumer data (which is more than just browsing history) with everything from credit agencies like Equifax to data brokers like Axciom to traditional analytics companies like Nielsen and Comscore to top tech companies like Google, Adobe, Oracle, Salesforce, and others that have marketing clouds with DMP platforms. It's a massive industry.

</comment></comment></comment></comment></comment><comment><USER13> _> I don't think subscriptions are the only answer here, as many do._

 _> We need models that support free consumption of media for many reasons._

If you rule out paid subscriptions to subsidize the freeriders, what options are left for "free" consumption? Either advertisements or a government- sponsored system (e.g. citizens taxed to support the BBC tv channels).

If there's a crypto financing option that Fred is hinting at, what would that look like?

<comment><USER14> Any idea why Fred is not a believer in subscriptions?

My hypothesis is subscriptions, for news at least, are all-or-nothing propositions. But in a world where there's so much content, much of it for free, we will only want to bypass a paywall for a given site occasionally when we encounter it.

Why hasn't someone built a variable subscription model that is geared to one's reading habits?

<comment><USER15> Subscription fatigue, maybe?

The idea of variable subscription models is interesting, especially if the consumer can see detailed justifications for their bill. I think that's a key point in battling subscription fatigue.

Software companies water down their financial models to a very simplistic bill, partly because there's no way of (easily) variably billing consumers of their software, but also because it's easy to understand.

I know that if I received an easily digestible bill of my monthly Spotify usage, and was charged more than what I'm currently paying for on my fixed plan, I'd be ok with it. I also know that if I'm not using Spotify as much for a specific month, and was charged less than what I normally pay for it, I'd also be very ok with it!

</comment></comment></comment><comment><USER16> >We need models that support free consumption of media for many reasons.

We have that already. In fact, we've had it for a while. The problem is that we keep taking something that is already free to distribute, and putting it behind arbitrary gates. We then think it's perfectly normal to pay the gatekeepers.

I don't know why we still use this model which hasn't made sense for >10 years.

</comment><comment><USER17> This is something that I'm exploring in 2018 with a group of people from the publishing world. Still very early stages, but if you have any further ideas or solutions then we'd love to hear them:

[https://pollygot.io](https://pollygot.io)

e: link

</comment><comment><USER18> These people project that we'll be setting $105 billion on fire for digital ads by 2019. To put that in perspective, it's more than 10% of what we spend to provide health care to seniors and poor people via a mostly dysfunctional health care system: [https://www.hhs.gov/about/budget/fy2017/budget-in- brief/cms/...](https://www.hhs.gov/about/budget/fy2017/budget-in- brief/cms/medicare/index.html)

<comment><USER19> Solution: tax ads.

<comment><USER20> we already do

<comment><USER19> I don't know what jurisdiction you're in, but would love a reference.

As far as I know in the U.S. there's a long history of talking about specifically taxing ads, but very little and brief doing. One overview: [http://www.taxhistory.org/thp/readings.nsf/ArtWeb/E6C2E18E1E...](http://www.taxhistory.org/thp/readings.nsf/ArtWeb/E6C2E18E1E011AF485257BE400723DFB)

</comment></comment></comment></comment><comment><USER21> It feels like an obvious revenue stream for content publishers is in education - specifically, MOOCs. "Content" is really access to interesting information and storytelling. That'd lend itself well to highly specialized MOOCs that people would pay for, potentially. (I guess that's not technically a MOOC, but you know what I mean).

</comment><comment><USER22> With increment in dollars spent on digital advertising there seems to be a huge growth potential for online advertising agencies that can create successful campaigns- those not measured by likes, clicks, taps ... But by actual sales figures.

</comment><comment><USER23> All that needed to happen is that the authority responsible for enforcing US antitrust laws vetoed against the acquisition of DoubleClick by Google and of Whatsapp by Facebook. Why haven't they?

<comment><USER20> both of those acquisitions contribute a small amount to each companies earnings. There will still be a duopoly without those acquisitions.

</comment></comment><comment><USER24> > I don't want nor do I expect any governmental response to this market > failure.

Why is it a failure? Price? Quality? Something else? I'm not convinced this is a problem.

<comment><USER25> market participants not taking externalities into account. i.e. this transaction benefits both you and me, but doesn't take into account the effect of the transaction on the environment/others

<comment><USER24> What do externalities have to do with duopolies?

</comment></comment></comment><comment><USER26> Being against government intervention is naive. If the US did what the EU has done with allowing people to avoid being tracked the big tech companies would be nudged toward developing smarter business models. Maybe it's not necessary but it's foolish to dismiss government out of hand.

Allowing your largest companies to compete over hijacking your public's attention is precisely the sort of thing that reeks of government failure.

This generation of internet users is a lot more willing to pay for content than mine was. Gen X's reluctance to spend money online is what created the attention economy to begin with. Maybe the shift will happen on its own, but how much damage will we do in the meantime?

<comment><USER27> If the US did what the EU has done, I would probably have to wait another 50 years for products I use every day like \- Google Maps \- Google Speech Recognition \- Google Photos Search \- Google Home

I'm thankful that my government has allowed innovation to continue. I'm glad they have represented my interests as a consumer by favoring technological growth over protection I neither want nor need.

<comment><USER28> Ever used Skype? Spotify? Trivago? Those are EU tech products many people use everyday, just goes to show that intervening from time to time doesn't necessarily mean that we live in some socialist, repressive regime.

You're welcome, by the way.

<comment><USER29> Google offers plenty of minor services but Maps is in a completely different league than Skype or even Spotify.

YouTube is closer to Spotify but would probably still be impossible without Google's massive investment. Dailymotion is pretty far behind.

<comment><USER30> Open street map then ;)

</comment></comment></comment></comment></comment><comment><USER31> Cofounder of successful mid-tier competitor in this space (www.publir.com). Can confirm.

</comment><comment><USER32> >I don't want nor do I expect any governmental response to this market failure.

You should want it and it's weird not to expect it because the EU has already begun.

<comment><USER33> Isn't that the role of governments in a healthy economy? To step in when markets fail?

<comment><USER34> This is where all corruption originates. One group seeks to use the state to impose their will on another group. The victimized group, in turn, seeks to defend itself by bribing the enforcers. Instead of capital flowing to those who are best able to convert it into the most happiness for the most people, it flows to those seeking to enrich themselves by pitting people against each other in order to extract ever larger bribes. The state grows ever more corrupt in this fashion. It might be wise to refrain from the impulse to use force long enough to consider alternative ways to remedy the perceived problem.

<comment><USER35> > Instead of capital flowing to those who are best able to convert it into the > most happiness for the most people

This isn't the natural progression of free market capitalism though. The money will flow to those who are best able to use it to control the behavior of their customers spending. Making someone happy is just one way of controlling their spending, but there are many, many others.

<comment><USER34> That's an interesting point. Are there any examples of "alternatives ways of controlling the behavior of their customers spending" which do not result in the customer feeling motivated to withdraw from the relationship?

<comment><USER36> Addiction</comment></comment></comment></comment></comment></comment>