Redesigning GitLab's navigation - <AUTHOR> https://about.gitlab.com/2017/07/17/redesigning-gitlabs-navigation/ <comment><USER2> My first thought on seeing this headline was "what, again?"

Don't get me wrong, the new design looks great, but it feels like every six months they switch between having side navigation and putting everything on top. Every time they change there's a definite improvement, but you'd think they'd be able to come up with a design that works for at least a few years.

<comment><USER3> My thoughts exactly. We've used GitLab since version 6 [1] and things have always felt like they are in a state of flux ([2] [3] [4]). For an open source project this is tolerable. I do wonder what enterprise users make of this constant UI change? Now that the navigation is back on the left, we'll probably see it collapsible in 9.5 and then morphed into a horizontal bar by version 10, rinse and repeat.

[1]: [https://about.gitlab.com/images/6_0/mr_on_fork.png](https://about.gitlab.com/images/6_0/mr_on_fork.png) [2]: [https://about.gitlab.com/images/8_0/ci_dash.png](https://about.gitlab.com/images/8_0/ci_dash.png) [3]: [https://about.gitlab.com/images/9_0/navigation.png](https://about.gitlab.com/images/9_0/navigation.png) [4]: [https://about.gitlab.com/images/blogimages/redesigning- gitla...](https://about.gitlab.com/images/blogimages/redesigning-gitlabs- navigation/final.png)

<comment><USER4> > For an open source project this is tolerable. I do wonder what enterprise > users make of this constant UI change?

That's interesting to think about. What is the difference between the two types of users? Is it that the open source project is in no hurry and can accept a delay due to interface hassles? Is it that enterprise users are less capable and need a stable environment to function?

<comment><USER3> From my exposure to enterprise users, they are usually the sort of environment where hundreds, if not thousands, of employees work. Can you imagine how one "angry" of UI changes person in a team of a dozen scales set against that? With open-source users, it's more decentralised IMHO.

<comment><USER5> From my exposure to enterprise users their Gitlab updates will be wedged in the middle of a 2 year change control process and will jump over many iterations of design changes

<comment><USER6> If they were clever, they could structure the release schedule so that the enterprise customers which started with top navigation will renew when the top navigation is current again, and those who started with side navigation will renew when side navigation is on the mainline... ;).

</comment></comment></comment></comment></comment></comment><comment><USER7> Since you are redesigning UI features, are there any plans for a site-native dark theme? Seeing as there already multiple code themes available, it seems within the context of the configurable UI part of the goal. There have been Stylish themes for gitlab in the past but they break a lot because gitlab is a very large website to try restyling from the outside.

Solarized-dark with a white frame can be quite grating on the eyes.

<comment><USER8> All of my other code workflow (terminal and editor) is in a dark theme, having to switch to GitLab to review an MR can actually be quite uncomfortable to do because there's such a leap in contrast.

The dark theme I use is Dracula[1], it's a really beautiful theme and if there was a way to view GitLab using it it'd be incredible.

[1]: [https://draculatheme.com/vim/](https://draculatheme.com/vim/)

<comment><USER9> Did you know GitLab has themes? [https://www.dropbox.com/s/p6b8yupsw4opsuu/Screenshot%202017-...](https://www.dropbox.com/s/p6b8yupsw4opsuu/Screenshot%202017-07-18%2014.43.54.png?dl=0)

<comment><USER10> The point was that while the code frame has a dark theme, the webpage around it still blasts you with light, which causes the strain. GitLab doesn't support themes across the whole website (yet?)

</comment></comment></comment></comment><comment><USER11> GitLab are one of the only companies I really look up to as a UXer. You guys just Do It Right. Thanks for being so transparent into your process and even sharing InVision prototypes. More companies should do this.

<comment><USER9> Thanks for the kind words vogt, we really appreciate it.

</comment></comment><comment><USER12> If anyone at Gitlab is reading this, please, please, please do something with the wide blank space at the top of the home page of a project. The project logo, name and short description are really side information that you don't care when you are working everyday on the same projects.It is a waste of space that distract the user and does not let him jump right into the code. Cheers and thank you

<comment><USER13> Thanks, this is a fair point! I made an issue to explore ways to make this better: [https://gitlab.com/gitlab-org/gitlab- ce/issues/35244](https://gitlab.com/gitlab-org/gitlab-ce/issues/35244)

</comment></comment><comment><USER14> Props to the Gitlab team for the release. Have enabled it for a few days now and I really love it. I feel like it is much less confusing now.

<comment><USER13> We are so glad to hear that!

<comment><USER15> I don't often use Gitlab, I just logged in this morning to update my 2FA and saw the new nav in the profile. Enabled it and instantly felt a lot more compelled to use the site.

I'm a big fan of your guys' work but using Github for a variety of reasons (UI is a big reason why), so I really mean it when I say the improvement is noticeable.

BTW, have you thought about talking to Zenhub to get a "Zenlab"? Given that Gitlab implements a lot more than Github in terms of Zenhub features it might be worth looking into.

<comment><USER9> We have not talked with them. I love the work of ZenHub. But our strategy would be to add the features to GitLab itself instead of running it in another application. Feel free to submit/upvote an issue for something you would love to see.

<comment><USER15> Zenhub being separate from Github has actually been kind of a nice thing for us. And I can imagine it's a good deal for github as well -- I think Github adding all the features that Zenhub offers would be massive bloat. It being separate and easily removed makes it much nicer.

</comment></comment></comment></comment></comment><comment><USER16> Is it really accepted best practice for UX testing to use a sample size of 12? That sounds remarkably low to draw product conclusions.

<comment><USER17> It's qualitative research: as long as you take sufficient precaution picking the subjects to avoid obvious blind spots, it should be enough to get a rough idea of glaring mistakes or problems and to get a good feel of how users perceive and navigate the UI. It also allows you to individually observe effects that would often be "averaged out" by a larger sample. It's being used as a first step (before they conduct a broader quantitative research) so it sounds pretty valid.

</comment></comment><comment><USER18> I really like the UI paradigm built by gitbucket - [https://gitbucket.github.io/](https://gitbucket.github.io/). Its like they took Bitbucket and made it better. On that note - I cant believe how unusable Bitbucket is.

P.S. And obviously love the fact that it is a single jar file deploy.

<comment><USER19> GitBucket's UI used to be a full rip of GitHub until they received a notice to change it [0]. They then switched over to using a UI built with AdminLTE [1]. I'm not sure if the current UI is still based on it though.

[0] [http://gitbucket.github.io/gitbucket- news/gitbucket/2016/03/...](http://gitbucket.github.io/gitbucket- news/gitbucket/2016/03/20/change-user-interface.html)

[1] [http://gitbucket.github.io/gitbucket- news/gitbucket/2016/07/...](http://gitbucket.github.io/gitbucket- news/gitbucket/2016/07/02/gitbucket-4.2.html)

</comment></comment><comment><USER20> Something I found missing is the missing shortcut to easily go the page of "merged request assigned to me" (which is the link 'merge request' in the global menu) as it's the single page I visit the most every day at work, to see across all projects , the merge requests that i need to check.

<comment><USER13> The third icon from the right is a quick link to "Merge Requests Assigned to Me" and it is the same as in the old version of the menu. The quick link in the hamburger menu was simply a duplicate place to find this action.

To see all "Merge Requests" in a project, you will find that option in the sidebar now, as that is contextual to the Project you are in.

<comment><USER20> Sorry , I meant "keyboard shortcurt" , I know the link on the left menu is to go to this page, but at least in 9.2, if you have a long page, you need to scroll up to the reach the top, which is inefficient, and for which a keyboard shortcut would be extremely welcome. There's already one, but for only the merge request of the current project.

</comment></comment></comment><comment><USER21> Bloody hell, this looks like Bitbucket, but purple.

Compare:

Gitlab final prototype: [https://about.gitlab.com/images/blogimages/redesigning- gitla...](https://about.gitlab.com/images/blogimages/redesigning-gitlabs- navigation/final.png)

Bitbucket server: [https://confluence.atlassian.com/bitbucket/files/304578655/5...](https://confluence.atlassian.com/bitbucket/files/304578655/598940302/3/1404842084389/tutorial- overview_initialcommit-sidexpand.png)

The resemblance is uncanny.

<comment><USER22> In practice, it comes across as something of a hybrid of Github and Bitbucket's UI-- the top gobal navigation bar and sidebar navigation structure are _very_ similar to Bitbucket's, but they take Github's "code first" approach to displaying repositories (the first thing you see when opening a repository in Gitlab or Github is the source tree; on Bitbucket the first thing you see is the readme and a summary of bug reports).

It's probably also worth mentioning that Bitbucket's also in the process of a massive navigation redesign; the "new" Bitbucket eliminates the top global navigation bar, moving some of its elements to a new sidebar (beside the context-specific sidebar) and eliminating much of the global navigation elements completely from repository pages (want to go directly from a repository page to a team or project page? You can't unless it happens to be in the repository's breadcrumb bar.). This is about as much of an improvement as it sounds like.

(Sorry, no screenshots of the new Bitbucket UI since I can't quickly produce one that doesn't have private info in it.)

<comment><USER13> " the top gobal navigation bar and sidebar navigation structure are very similar to Bitbucket's, but they take Github's "code first" approach to displaying repositories (the first thing you see when opening a repository in Gitlab or Github is the source tree; on Bitbucket the first thing you see is the readme and a summary of bug reports)."

Thanks for the feedback! Glad you spotted the differences between BitBucket's Design and our own. While we would love to design with a blank slate, we are not. Our users arrive with expectations and deeply implanted ideas of how things should look, feel, and behave. We have to temper exploration with practicality. The downside of that can be that the UI has a similar appearance to other platforms.

</comment></comment></comment><comment><USER23> This looks nice, but hopefully this is a "stable" release for a while, in the last versions so much stuff moved around navigation wise. I especially like that the three vertical navigations ([http://imgur.com/UN1TDkw](http://imgur.com/UN1TDkw)) in a repo are gone.

Thumbs up for creating such an awesome product and involving the community in your thought process!

<comment><USER13> Thanks! We would love to hear your feedback as you use the new navigation. Our goal here is to get as much input from the community as possible to make improvements over the next few weeks. You can leave thoughts on the issue here: [https://gitlab.com/gitlab-org/gitlab- ce/issues/34917](https://gitlab.com/gitlab-org/gitlab-ce/issues/34917)

</comment></comment><comment><USER24> My main gripe with gitlab navigation is I can't see the languages split up (chart) quickly like in Github. Other than that since I am not a heavy user of the website (more on time on git than on website) I find no other problems. Also the redesign looks better than before. Hope they also introduce a dark theme. (would love to have this one)

<comment><USER25> Thanks for the feedback! In 9.5 we'll be introducing fly out dropdowns that will allow users to easily access sub-menu items from the sidebar. This will make it super fast and easy for you to reach the charts page from anywhere within a project. Follow along in the issue here: [https://gitlab.com/gitlab- org/gitlab-ce/issues/34026](https://gitlab.com/gitlab-org/gitlab- ce/issues/34026)

</comment></comment><comment><USER26> This is awesome. Probably the only gripe I have about GitLab is the navigation and this is a great improvement.

</comment><comment><USER27> Hope, the design would be good. The issue I have faced so far is that the navigation (and several other features of GitLab site) doesn't work well when javascript is turned off. The equivalent features in Github works without javascript with no much issues.

Hope this will be fixed.

<comment><USER28> Thanks for your feedback - I'd like to see some more things work without javascript as well.

For the navigation, the links and buttons all work. For more complex components like dropdowns and search we require JS. We have considered server rendering for new things, but for now it is quite high effort for comparatively low gain.

If there are specific actions that you are missing, please consider creating issues - [https://gitlab.com/gitlab-org/gitlab- ce/issues/new](https://gitlab.com/gitlab-org/gitlab-ce/issues/new)

Issue about what to render without JS: [https://gitlab.com/gitlab-org/gitlab- ce/issues/32401](https://gitlab.com/gitlab-org/gitlab-ce/issues/32401)

And I've made an issue to clarify that we require javascript here: [https://gitlab.com/gitlab-com/gitlab- docs/issues/120](https://gitlab.com/gitlab-com/gitlab-docs/issues/120)

</comment></comment><comment><USER29> You can tell someone is copying someone else's work when they copy the bad stuff. The search box on GitHub and now GitLab wastes space with "This repository" spelled out. It's also odd that you get more space to type when you're not searching inside of a repo, and that backspace is how you switch to a more general search. Pity. I thought that GitLab had learned their lesson and stopped copying GitHub.

Aside from that, it sounds like a well thought out feature, and it's good that they're redoing it instead of just changing it bit by bit.

<comment><USER30> >You can tell someone is copying someone else's work when they copy the bad stuff.

Once people learn a UI, they really hate deviations from it. It doesn't matter whether githubs UI is good, and it doesn't matter whether gitlab's UI is better. People are used to github, and the peanut gallery will bitch if things are different. The trick for gitlab will be in finding the UI differences that give the maximum improvement for the minimum change. That's what will give the desired sensation of "clearly better than github". Overdo it, and it'll feel alien and weird.

<comment><USER13> "The trick for gitlab will be in finding the UI differences that give the maximum improvement for the minimum change."

This is the holy grail of UI for sure. We are striving for this in all of the decisions we make on the UX team. This change required a lot more change than we would have liked but we are implementing it in a way that we hope will bring maximum effectiveness and longevity.

</comment></comment></comment><comment><USER31> Layout is nice, but the header color... uh... it's like a bike shed, but a header ;)

GitLab should consider adding an option somewhere, that lets users override a few primary theme colors to their liking. Not a full-fledged theme engine - that would be awesome but would take a lot of time to implement - just a few light CSS overrides that are persisted in the account settings, don't require browser extensions and more tolerant to the layout changes.

<comment><USER25> Thanks for your feedback! We will be adding color palette options for differentiating instances in an upcoming release. You can follow along in the issue here: [https://gitlab.com/gitlab-org/gitlab- ce/issues/35012](https://gitlab.com/gitlab-org/gitlab-ce/issues/35012)

</comment></comment><comment> dorian-graph > We knew from previous feedback and from our research that including the > global navigation links on the top navigation bar was superior to hiding > them in a hidden hamburger menu.

Is this not at odds with [https://gitlab.com/gitlab-org/gitlab- ce/issues/29835](https://gitlab.com/gitlab-org/gitlab-ce/issues/29835)? Regardless, thank goodness they're changing it.

</comment><comment><USER32> I worked with Taurie at Househappy and learned a lot from her. She's an incredibly talented designer. Kudos on the redesign!

</comment><comment><USER33> Updating...can't wait to see the new sidebar. But, gitlab team has spent quite a lot of time in UI redesign.

<comment><USER33> UPDATE: After apt-get update, now js assets are returning 404.... I should have resisted and save a few hours of googling.

</comment></comment><comment><USER34> Okay, so BitBucket style navigation.

</comment><comment><USER35> Heads up for the Gitlab people here-- The user preferences link under try it yourself 404s for me, both when logged in and out. Excited to try out these changes though!

Edit: Appears to be the same path but with `about` subdomain

<comment><USER13> Thanks for the heads up, we are investigating this now.

<comment><USER36> GitLab should make it so that anyone who reaches a 4xx or 5xx error page should be able to trivially (as in one click from the error page) file a bug about it on the GitLab tracker. Make sure to pre-populate the template with URL, status code, and referer.

<comment><USER37> You're assuming they're not doing that automatically in the background. I'd rather assume that they're already getting at least all 5xx reports. (it would be a big failure otherwise)

</comment></comment></comment></comment><comment><USER38> I think GitLab needs to hire more designers instead of programmers.

<comment><USER39> They need more programmers because until now they still experience down times, a lot!

<comment><USER40> Do they really? We're considering switching from self hosted CE to Gitlab.com EE. Reliability and speed is what we're concerned about regarding the switch.

</comment></comment></comment><comment><USER41> Thank you for using text labels. I hate Bitbucket's icons. None of theirs are intuitive to me, which limits usability and feature discovery.

</comment><comment><USER42> That is why I'm getting a 404 on all my repos? How hard is to deploy frontend changes without breaking the core backend?

<comment><USER43> Sorry to hear you're experiencing issues. Are you still affected? Are you logged in? If so, could you please open an issue in [https://gitlab.com/gitlab-com/support- forum/issues](https://gitlab.com/gitlab-com/support-forum/issues) with as much info as possible?</comment></comment>


FBI concludes that the North Korean gov't is responsible for Sony cyberattack - <AUTHOR> http://www.cnbc.com/id/102284428

<comment><USER2> _> Due to sensitive sources and methods to obtain the information, the FBI said it is limited in what it can share_

I guess that's the reason for no or weak "evidence".</comment>


Show HN: My weekend project - inspirational quotes - <AUTHOR> http://www.inspirationalquoteaday.com/?hn=1

<comment><USER2> Taken out of context, most "inspirational quotes" seems to me to be startlingly vapid.

1\. "Be the change you want to see in the world."

How? This might just mean, "It's up to you to change the world," (a questionable assumption), but this actually says to "be change." What the hell does that mean?

2\. "The real leader has no need to lead -- he is content to point the way."

Leaving aside the fact that Henry Miller is a questionable authority on this subject, one might wonder what leadership would actually look like if the leader actually did nothing but "point the way."

3\. "A leader is a dealer in hope."

Let's hope the CEO doesn't come in Monday morning with this one.

4\. "To do great things is difficult; but to command great things is more difficult."

Why?

I could go on (and on and on).

I don't mean, of course, to impugn the authority of Napoleon, Gandhi, Nietzsche, or Miller (maybe Miller in this case). But I do think little micro- quotes from these thinkers are not simply poor substitutes for their writings, but distillations of those writings into near nothingness.

There are writers who are very aphoristic, but damn few of them. Most set their clever phrases within a much wider web of contemplation and argument. The person who mistakes one thing for the other is likely succumbing to the illusion that they are learning something.

<comment><USER3> 1\. "Be the change you want to see in the world."

Q: What the hell does that mean?

A: Objects and Methods evolve onto the onomatopoeiac holotrope. For example, holomorphic functions' identity of change: "I am that whose rate of change is myself", or more familiar: d/dt e^t gets e^t. Read YC Hacker News daily to know the fomenting currents of today's market transactions, so to effectively code what you are able; into what is desired and therefore become successful.

<comment><USER2> I take it all back.

</comment></comment></comment><comment><USER4> Nice, I like the design.

I have a similar app which if you want more quotes I've collected a few dozen, a JSON list of them available here <http://quotaculous.appspot.com/a/quotaculous.json>

I create the app <http://quotaculous.appspot.com/> to be a screen in Safari top sites so whenever I create a new tab I will see it

</comment><comment><USER5> Nicely done! Shameless plug for my own random thought a day with pseudo-random flickr image background: <http://penny-for-your-thoughts.appspot.com/> also has an api if anyone wants to use it.

</comment><comment><USER6> People still like motivational quotes? When I see someone tweet one I immediately unfollow them.

</comment><comment><USER7> I like pages like this. Here is a another one <http://bigquote.co/>

</comment><comment><USER8> There was a site that did this with the quotes on top of a nice picture. Would love to see you automate the quote collecting, the old site eventually stopped getting updates.

old site: <http://www.inspiremyday.com/>

</comment><comment><USER9> Most inspirational quotes, including some (if not most) of these, are bogus in the sense that they've been falsely attributed to the famous person. Your site would be better than the rest if you tracked down sources and dropped the bogus ones.

</comment><comment><USER10> Nice design! Are the quotes input manually or taken from an api like twitter?

<comment><AUTHOR> Manually at the moment, but I am starting the process of putting in a few hundred and automating the publishing for the future.

I'm actually thinking about opening up an API for other people to use to get a quote a day, but I'm not sure if there is a demand for that.

</comment></comment><comment><USER11> Are the listed quotes an example of what the user should expect to see if they sign up for the mailing list, or are they today's quotes?

If it is a "quote a day" service I would expect to see just one quote.

<comment><AUTHOR> The list of quotes gets an additional quote added to it every day and shows all quotes that have been sent/posted so far. It is the same quote that is emailed, posted on twitter and facebook.

</comment></comment><comment><USER2> Immediately put me in mind of this recent HN thread:

<http://news.ycombinator.com/item?id=5232643>

</comment><comment><USER12> I like the project. Its simple and clean.

Just one thing which may be a bit off-topic too. What if you receive a quote in the morning and you tend to not agree to it?

<comment><AUTHOR> Unfortunately, not everyone will agree with every quote that is sent out. I'll try to do my best to accommodate as many people as I can and gladly will take into consideration any feedback. You can get an idea of the kind of quotes that will be sent out by what is listed on the site already. That being said, if you are not happy with the quotes that you receive there is an unsubscribe link in every email.

</comment></comment><comment><USER13> Hey, nice idea for a weekend project :)

Perhaps you could add server-side validation for the signup if you're looking for ways to improve it?

</comment><comment><USER14> I submitted my email but it says it is invalid email... I checked the spelling and everything.. My email was entered correctly.

<comment><AUTHOR> Sorry about that. I just pushed a change that should fix that. It might take a couple minutes to propagate.

</comment></comment><comment><USER15> I'm not sure of the best solution to this problem, but these quotes (and a lot of famous inspirational quotes, I suppose) are very clearly "men-only".

They refer directly to "men", or "man", use masculine pronouns only, etc..

Do you need a different stream for women? Or even optionally tweak the gendered words on the fly?

I'm not sure if this was just a random sampling, but it really struck me, just scanning down the list on the front page....

<comment><USER16> I think in general, when the quotes say MAN, it is used sort of as a short for huMAN i.e, all of us.

<comment><USER17> Still, I feel like I'm playing Bioshock, reading those quotes.

<https://www.youtube.com/watch?v=J47ENHSomc8>

</comment></comment></comment><comment><USER18> Bug report - I see a flash of a green box saying "Almost done, need to confirm email address" on page load.

<comment><AUTHOR> Thanks for letting me know. I'll take care of this right away.

</comment></comment><comment><USER19> Please consider adding a RSS feed.

<comment><AUTHOR> I knew I was forgetting something. Just added an RSS feed. Thanks!

<http://feeds.feedburner.com/inspirationalquoteaday/wAuk>

On a side note, Django made this incredibly easy!

<comment><USER20> LOL! Less than a minute, right?

<comment><AUTHOR> Yup. Took longer to deploy and set up feedburner than to add the code.

</comment></comment></comment></comment><comment><USER20> upvote. It could be more fun if you make it open-source on Github.

</comment><comment><USER21> I don't want anymore email. Maybe you can SMS me instead?

</comment><comment><USER22> You might want to change your spelling of 'receive'

<comment><AUTHOR> Well that's embarrassing. Thanks for letting me know.

<comment><USER23> Hi, You may move this button 'Sign up to receive a quote a day!' elsewhere. Currently, the center of attention goes to this green button. But, make this button look small, atleast. Just like you have this floating array of buttons for sharing, you can create a floating button just for Signing up. This way, the initial attention to this website is on the first inspirational quote, rather than on the Sign Up button.This way, any inspirational seeker is driven from the beginning. Hope you understand. These are my suggestions. Anyways, a nice, clean design.

<comment><USER24> How about this order:

1\. header 2\. the first (current?) quote, with slightly bigger text than the rest, or something else to set it apart 3\. the sign up button 4\. the rest of the quotes 5\. footer, naturally ^^

?

<comment><USER23> This also sounds fine.</comment></comment></comment></comment></comment>


Ridejoy (YC S11): Make Some Dough On Your Next Roadtrip - <AUTHOR> http://techcrunch.com/2011/10/28/yc-funded-ridejoy-hitch-a-ride-on-the-cheap-or-make-some-dough-on-your-next-roadtrip/

<comment><USER2> I tried it out the other day, and actually found a ride! Not the mention Jason from ridejoy poked me right away for feedback. They're really friendly, and seem attentive! Best of luck :)

<comment><USER3> Thanks Shenlong! There's almost always someone manning the chat widget (usually me). I'm glad you found a ride!

<comment><USER4> Best of luck with the app, but the fonts are killing me, man.

<comment><USER3> Haha - you mean the handwriting one? =)

<comment><USER4> Yeah, Architects Daughter is, well, anyways. It just went up in price, but I've found The Big Book of Font Combinations to provide some good guidance in relation to font picking. <http://bonfx.com/the-big-book-of-font- combinations/>

</comment></comment></comment></comment></comment><comment><USER5> A handful of my friends used this to get rides to burning man. Worked like a charm, and really saved the day.

</comment><comment><USER6> We've had a few of these types of things up here in America's hat, they seem to end up sued/legislated out of existence by the various transport groups. I know a few of the student unions ended up taking their rideshare boards offline. Shame, they were handy.

</comment><comment><USER7> I made a ridesharing application(<http://www.ridezap.com>) this summer! Sadly it hasn't really caught on among my friends.

I really hope this takes off, I feel like there is a true hole for ridesharing in the US. I feel like this is a good application and I feel that they are making rapid progress(I saw large improvements in just a week!). It needs a little more polish and they should be able to catch up with ZimRide(<http://www.zimride.com>).

</comment><comment><USER8> Cool concept. Its like a digital solution to hitchiking. I can see how this service would be useful for trips into the valley.

</comment><comment><USER9> In the UK there's liftshare.com, although I think they do a lot of their business via companies wanting to reduce their carbon footprint by introducing car-sharing schemes for their employees.

<comment><USER3> Yeah, we've seen people take the enterprise rideshare approach and while that's great way to generate revenue, we're focused on building a company for the long term that really facilitates rideshare to anywhere for anyone.

</comment></comment><comment><USER10> Interesting. But I'm kinda curios how scrapping craigslist will turnout. Check this for example.

<http://www.ridejoy.com/portland>

</comment><comment><USER11> Just out of curiosity, _why_ is it technically illegal for drivers to make a profit on the ride? What's the law and why does it exist?

<comment><USER12> This is a publication from the California PUC: [http://www.cpuc.ca.gov/NR/rdonlyres/42294D2B-412E-466E-A74B-...](http://www.cpuc.ca.gov/NR/rdonlyres/42294D2B-412E-466E-A74B-F1862BFC6924/0/PassengerCarriersBasicInfoandApplicantsRev012811.pdf)

</comment></comment><comment><USER13> Let us specify destinations in terms of Airports. I put in SFO and I got an awkward address instead. Using this for rides to and from airports would be godly, since parking there is often overpriced.

<comment><USER14> By awkward address, you mean "International Terminal G (EMB), 275 S Airport Blvd, San Francisco, CA 94080, USA"? Just checking. We'll add support for place names at some point. Thanks!

</comment></comment><comment><USER15> So it's like eRideShare or Ridester, but a bit more Web 2.0?

<comment><USER3> Yes. But 100x better. =)

<comment><USER15> Completion could need some work, though. Maybe it's just me, but I'd expect that clicking on one of the origins/destinations when they pop up would select it and quit the dropdown (normal combobox behavior).

<comment><USER14> This was fixed shortly after your report. Thanks!

</comment></comment></comment></comment><comment><USER16> What a great idea. I wish them success!

</comment><comment><USER17> We've had something similar in Slovenia for many years and it's working _wonderfully_.

Best of luck to you guys! I'll give it a try next time I'm in the US.

<comment><USER15> There's a bunch of those services in Germany, too. Then again, I think car sharing has been a bit popular in Europe in general, as cars per capita might be a bit lower, gas prices are higher and not everybody has a car suited for longer routes.

(Established players in Germany: <http://www.mitfahrzentrale.de/>, <http://www.mfz.de>, <http://www.mifaz.de/>, <http://mitfahrclub.adac.de/>, <http://www.mitfahrgelegenheit.de/>; One new startup I'm aware of: <https://www.flinc.org/?l=en>)

<comment><USER18> when i went to Germany, someone hooked me on to gelegenheit. i thought it was the shit ever since. i would use google translate for the site, then call the drivers asking if they spoke english. They all said 'a little bit' even though 98% were fluent, which must be some kind of German modesty thing. The site seems to have clones or sister sites in most western europe countries as well. I would have expected people in various Eastern european countries to shun these services on safety grounds, so I am surprised that it is big in Slovenia.

</comment></comment></comment><comment><USER19> <http://en.wikipedia.org/wiki/Kalifornia>

<comment><USER20> When I think of ridesharing this much more pleasant one comes to mind: <http://en.wikipedia.org/wiki/When_Harry_Met_Sally>

</comment></comment><comment><USER21> This seems like AirBnB except with cars. Seems like they might run into the same liability problems.

<comment><USER22> Of course. Modern startup thinking seems to be "we'll get a fireproof door once the wood one has burnt down".

Only with this one it's not likely to be your possessions like it is with AirBnB, more likely to be you. Imagine the driver taking you down a quiet road to where his friends happen to be waiting.

Also, since you're taking passangers, do you need a taxi licence or liability insurance as a driver taking passangers for payment?

<comment><USER17> Slovenia has had a service like this for about 6 years and nothing has ever happened to anyone. It's much less of a problem than you'd think.

<comment><USER22> You can't get a complaint letter from a murder victim.

It's an awesome service among friends though.

What's the service called in Slovenia?

<comment><USER23> I'm sure this service would also be an awesome way to make friends. Everyone's a stranger before you get to know them. So maybe it's worth meeting up before getting into a cross-country car ride with them.</comment></comment></comment></comment></comment>


Silicon Valley: You and Some of Your VC's have a Gender Problem - <AUTHOR> http://www.techcrunch.com/2010/02/07/silicon-valley-you%e2%80%99ve-got-a-gender-problem-and-some-of-your-vc%e2%80%99s-still-live-in-the-past/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Techcrunch+%28TechCrunch%29&utm_content=Google+Reader <comment><USER2> So what?

I love dancing and took classes and was the only male in a class of more than 30 women. I didn't tell them "you have a gender problem". I accepted that in a free world nobody should force anybody else to do what they don't want to do.

</comment><comment><USER3> I don't know why we have to assume men and women should have the same roles at startups. I'm not saying they don't play an equally important role, it's just not the same.

It seems that men are more inclined, for whatever reason, to start companies. It could be a combination of many factors. However, I don't think we should assume something is wrong just because the numbers aren't the same.

</comment><comment><USER4> Posted and discussed a few hours ago: <http://news.ycombinator.com/item?id=1107806></comment>


Show HN: ForwardMX – Premium Email Forwarding - <AUTHOR> https://forwardmx.io?ref=hn <comment><USER2> Hi,

that's a pretty cool service!

Can you publish a screenshot that gives an overview of the settings page?

And: \- What happens when I want to disable email@example.com? \- Do I get any statistics? What about the disabled addresses? \- Do you have an uptime guarantee?

I was working on exactly the same service, but gave up because of some legal issues using a third party for receiving the mails (mailgun) - the easiest way to do it. Furthermore, there was too much to do for me alone.

I think 9$/year is a fair price.

<comment><AUTHOR> Hey sorry for the late answer.

there are a few screenshots on the ProductHunt page: [https://www.producthunt.com/posts/forwardmx](https://www.producthunt.com/posts/forwardmx) there are not exactly a lot of options other than defining forwarders.

You can forward emails to /dev/null if you mean that with disabling. I decided against any form of statistics i rather simply dont log anything, than think about how far i want logging to go. We may implement a very basic counter in future.

We do not yet have a uptime guarantee, however i use this for myself and run health tests every other hour. Due to using different servers in different locations with different operating systems and update policies i would say it is very unlikely that both are offline the same time.

I also had a while until i finally made the service, but it got really a huge pain to have my email settings spreaded everywhere and paying for premium features i nether want or need. So i build the server structure and run it for a while just to notice it works great, so i build this SaaS around it and recruited a friend in a different timezone to check on the health tests. Its not exactly magic, but it HAS TO WORK whatever what :)

The price is obviously not ment to get rich, it should just pay for the servers, the traffic and a few beers to keep this alive. It does not have to be profitable soon, it already saves me more money than it costs to run.</comment></comment>


Face scans for Americans flying abroad stir privacy issues - <AUTHOR> http://www.chicagotribune.com/lifestyles/travel/ct-airport-face-scans-privacy-issues-20170712-story.html <comment><USER2> is drawing in some dots on your jawline still an effective countermeasure? seems to be about all the folks at [https://cvdazzle.com/](https://cvdazzle.com/) were suggesting....</comment>


Ask HN: dealing with credit card fraud while selling physical products online? - <AUTHOR> Dear HN,
A contract of mine is close to launch, doing e-commerce, (partially) selling physical goods. Since I will also be supporting the codebase during the first couple of months, I'm seriously investigating the possibility of fraud, and dealing with it. We're using PayPal website payments pro.
Two humble questions for a safer Internet:
-What crash-curse would you recommend in proactively going against this problem? Articles, papers, or anything, really, that is not a commercial offering would be nice.
-In the case of fraud, how long does it take for PayPal to detect, and cancel a given fund from our account? That is, after what time shall we safely assume, that the money will be actually ours? (shipping will be immediate -but this will affect inventory management)
Specifically not asking for: paypal bashing, alternative credit card processors, adding obstacle courses to our customers.
Specifically looking for: stories with data, statistical breakdown for merchandise-driven industry's general fraud rate, and articles to read :) <comment><USER2> I have dealt with fraud prevention for non-physical goods both with PayPal and a merchant account. It's a small start-up, annual web orders of $1m, average purchase price of $16.50.

We were hit pretty hard with fraud (when we first started, Aug/Sept 09) but we now have it down around 0.5%.

I know you don't want a commercial offering but we had great success with maxmind (<http://www.maxmind.com/app/ccfd_features>) it costs about $0.015 per order.

Here is how we did it... We tested every order through maxmind and using the fraud score we divided them in to three groups, low, medium and high risk.

* Low risk orders were fulfilled as normal. * Medium risk orders had to do an automated telephone verification (we used twillo for the calls, we mapped distances from area code to billing address and rejected voip numbers). * High risk orders required one of our support staff to call and confirm the order.

Recommended reading: <http://www.detectmalice.com/>

However, I don't think stolen cards will be your main issue. Unless you have tracking numbers for all your shipped orders people are going to open claims with PayPal. PayPal always favor buyer and you will find people abusing the system. Be prepared for a lot of "Not as Described" claims because the item didn't match the users expectations. This isn't a one off, this happens often.

<comment><AUTHOR> Maxmind's offering was already within our radar, but your datapoint pretty much nailed that investment.

Re: "Not as Described" -Given that our shipping solution offers package tracking with numbers, and signed-for options, AND the user will be clearly presented with an image, and a video of the goods; AND after first abuse, I will explain these things to paypal's customer rep, will their abuse still be considered legit?

Also, what if the item in question is only part of a service, and neither can work without the other? Will that change the claim-percentage at all?

<comment><USER2> Re: "Not as Described" - You will still get those customers that have buyers remorse or just simply don't want to be charged for the item they received. You will find the customer service reps that make the decision on these cases spend a few minutes on each. Unless you have an awesome case the buyer will win.

The fact that this item is part of a service should hugely reduce fraud.

In all honesty you should be fine. I would start out with some pretty solid rules; only ship to the US, Canada & Western Europe, only ship to paypal verified addresses and IP location should match the billing address (< 150 miles). Once you find your feet I'd start relaxing these rules and plug any holes in the system if they appear.

If a paypal dispute arises, call the customer.

</comment></comment></comment><comment><USER3> If you're selling physical goods make sure that the intended recipient and the shipping information they give you are one and the same entity.

This makes it harder to ship presents and stuff like that but when shipping goods the majority of the fraud is done by redirecting the goods to a 'drop' and then making off with the loot.

Make sure you use a delivery method that asks for a signature of the recipient, make 100% sure that they will honor your request to ID the recipient and to make sure that the names match.

Don't leave more balance in your paypal account than you need.

You can't really say how long it will take paypal to detect fraud, that's more up to you than up to them, if there is no fraud to detect you'll be fine, if people start using stolen paypal accounts and/or cards to order your stuff the ban hammer would come down without any warning whatsoever.

There is no hard knowledge out there what it takes for paypal to block your account but typical merchant account checks include < 1% of total charges, anything over that and you're suspect / liable to be axed.

I hope that helps.

Oh, and it's 'courses', not 'curses' (that goes for 'crash curse' too ;))

<comment><AUTHOR> We're planning to use the shipping address returned from Paypal as-is (and not querying from our side), mostly for stripping the funnel to it's bare minimum -is that kosher?

Definitely signed-for. Other than Nigeria (which I'm quite keen on blacklisting, as a whole), any particular countries which we should be careful about?

<comment><USER3> > We're planning to use the shipping address returned from Paypal as-is (and > not querying from our side), mostly for stripping the funnel to it's bare > minimum -is that kosher?

Yes, it's kosher, but there are a number of checks you can't do like that (such as doing geo verification of the IP, email verification).

Those go a long way in screening out fraudulent charges.

Presumably paypal has already done a bunch of that, but if the shipping address paypal gives you does not match the geolocation of the IP and residential information of the account holder (not always the same as the shipping address!) within reason that would be a great reason _not_ to ship.

> any particular countries which we should be careful about?

Yes, but that's going to make me a lot of enemies here ;)

Until you have the fraud angle worked out and have ways to monitor and predict risky transactions I would stick to the US initially, the roll out in Europe, one country at a time, after that Japan, and I'd leave it like that for a long time to come.

This is not because I do not like people from other countries (rather the opposite), but because combating fraud is a percentage game and _one_ fraudulent transaction can eat up the profits of 10 or more good ones if you're in to physical goods (depending on your margin of course), as well as cause you to be banned, which is a risk not worth taking.

</comment></comment></comment><comment><USER4> Already some good advice here, so I'll just add a couple we used to use at a place I worked at that sold physical goods (of the kind that prove surprisingly popular to fraudsters).

\- I don't think Paypal offers address verification other than under 'verified' accounts but it might be worth asking depending on which service you are using.

\- We used to flag deliveries to "Suite XXX", "Apartment XXa" etc for further investigation as in the UK these types of address are usually no more than PO box services. Find out what kind of address the common mailbox services offer and if it's fairly uncommon, do something similar.

\- Sounds a bit obvious, but large initial orders can also be a red flag. A first time visitor ordering £1100 worth of stuff is going to warrant more attention than a long-time customer.

\- Wherever possible try to indentify frauds yourselves. Payment providers will just transfer the cost to you and law enforcment, in my experience, couldn't care less (we were actually told they have an unofficial policy of non-investigation for < £10,000). Basically, as I'm sure you understand, if you get burned - you've lost it for good.

</comment><comment><USER5> Step 1 assess the level of fraud for the given type of product your selling. I ran and ecommerce site that sold over 100 Million dollars with of product in its lifetime and had only 1 case of credit card fraud. If you still think its a problem check out verified by visa. I know your using Paypal but you might get some pointers there.</comment>


Hackers can exploit your 2G, 3G, 4G and 5G smartphones through GTP protocol - <AUTHOR> https://androidrookies.com/hackers-can-exploit-your-2g-3g-4g-and-5g-smartphones-through-gtp-protocal/ <comment><USER2> To set the record straight, this allows an attacker to impersonate your phone to the eyes of your carrier and maybe (not sure how?) intercept an ongoing data session. This doesn't "hack" the phone itself and any data being transmitted is safe if it's using HTTPS which the majority of website and apps use nowadays.

The article is very light on technical details and is mostly spreading alarmist FUD (fear, uncertainty and doubt). These risks have been around for years and while it's definitely a major problem for carriers, it is less so for the end-user.</comment>


Show HN: Avengers List PWA - <AUTHOR> https://www.amitmerchant.com/pocket-avengers/#/ <comment><USER2> Awesome job! One suggestion, when going to a new page scroll the user back to the top of the page automatically.

Great design!</comment>


Ask HN: What are some good resources and patterns for authentication? - <AUTHOR> The oauth guide[0] is incomplete and outdated but helpful. Auth0 has a lot of good information and stackoverflow does as well, although a bit balkanized.
Do you have resources or design patterns for authentication that provide a conceptual walkthrough of the components. Not the implementation, but the design & possibly routing diagrams of:
* creating a new user & account routing & login
* confirming email and moving user from temp to verified account
* transactional email & alerting user of sign ins as well as password updates.
* 2fa
Scotch.io has a pretty good guide I looked at a few years ago. It is great for a beginner side project, but most guides seem at that level. Get password, use bcrypt, verify, send token/cookie.
[0]https://www.owasp.org/index.php/Guide_to_Authentication <comment><USER2> The best (in terms of 'best effort') masterpost on this is at [https://stackoverflow.com/questions/549/the-definitive- guide...](https://stackoverflow.com/questions/549/the-definitive-guide-to- form-based-website-authentication)

It's also a perpetual work-in-progress, but that's both my necessity and design.</comment>


Things I learned from iPhone and Droid ads - <AUTHOR> http://mislav.uniqpath.com/iphone-droid-ads/

<comment><USER2> Hopefully this was intended as humor (and it _was_ funny), and not as a straight-faced critique. It is not news that different styles of ad campaign can be effective; Apple has launched a fair few smarmy (Get a Mac <http://www.apple.com/getamac/ads/> ) or fanciful (1984 <http://www.youtube.com/watch?v=OYecfV3ubP8> ) salvos at the competition itself.

What I learned from the 1984 ad:

The CEOs of all Apple competitors have monkey-like visages and enjoy sitting very close to the camera as they brainwash the world.

The Macintosh makes you proficient at the hammer throw. Incidentally, it also turns you into a woman with orange shorts.</comment>


Wordpress frameworks that don't suck - <AUTHOR> http://wordpress.stackexchange.com/questions/3725/wordpress-frameworks-and-parent-themes By now there is a considerable amount of WordPress code around that is meant to be re-used by other developers. Unfortunately there is little to none practical and solid information on it and generally you are stuck going through frameworks one by one until you find the first you like or think they all suck terribly (whichever comes first).
A community writeup on which frameworks and parent themes we really use and why.
I for one have always found it painful to find a decent wordpress master theme/framework to work off. <comment><USER2> Back in 2006 I released a WordPress theme based on my website design, called Tarski. Since then it's been through a lot of versions and many of the features it pioneered (custom headers; alternate stylesheets; navbar selector; update notfication) have been added to the core WordPress software.

<http://tarskitheme.com/>

Unlike many other themes, it has a decent amount of documentation (check the sidebar for a full set of links).

<http://tarskitheme.com/help/>

It's got an extensive API (in addition to the standard WordPress one), is child theme-friendly, and is used by thousands (the forked WP.com version is used, for example, by Terence Tao). Many wonderful users have contributed translations in over 20 languages.

<http://tarskitheme.com/help/localisation/>

I don't really have a huge amount of time to improve or maintain it these days, although I do try to keep it up to date with the changes that come out in new versions of WordPress. If anyone is interested in contributing or taking over as maintainer, please do email me at email@example.com. The code is, of course, up on GitHub.

<https://github.com/beastaugh/tarski>

</comment><comment><USER3> I usually start with a theme called Wordpress Naked. <http://code.google.com/p/wordpress-naked/> It's pretty much a blank canvas.

<comment><USER4> Is it anything like the Sandbox theme? <http://www.plaintxt.org/>

</comment></comment><comment><USER5> Honest question: was WP ever rewritten to use a MVC architecture or is still a pile of "functions.php" includes?

I haven't looked at the source in at least 2 years so I'm hoping it's not still using the same anti-patterns it originally used.

<comment><USER6> It still uses predefined PHP files recognized by their name. It has an extensive (and good) API, but it's still common to see SQL in the view. MVC is so 70s anyway ;)

</comment></comment><comment><AUTHOR> 'By now there is a considerable amount of WordPress code around that is meant to be re-used by other developers. Unfortunately there is little to none practical and solid information on it and generally you are stuck going through frameworks one by one until you find the first you like or think they all suck terribly (whichever comes first).'

A community writeup on which frameworks and parent themes we really use and why.

Featured question on the stack exchange (beta) Wordpress site <http://wordpress.stackexchange.com>

I for one have always found it painful to find a decent wordpress master theme/framework to work off.</comment>


Windows Live Messenger Now Lets You Add Chat To Your Website - <AUTHOR> http://www.techcrunch.com/2009/03/18/windows-live-messenger-now-lets-you-add-chat-to-your-website/ <comment><USER2> I have been seeing it on the sites from ages...so not sure why techcrunch is announcing it now????</comment>


Duncan Riley (TechCrunch) has a new site - <AUTHOR> http://www.inquisitr.com/

<comment><USER3> I was following his twitter (<http://twitter.com/theinquisitr>) - the current tweet is "Jennifer Aniston Finally Has a Man!"

I'm not sure how long I'm going to keep following =)

<comment><USER4> > I'm not sure how long I'm going to keep following =)

Same... He does a weird mix of TMZ & TechCrunch

</comment></comment><comment><USER5> The tech writing is as good as ever (and I really like the design - <USER2> 'cleaner' than TechCrunch). I thought all the celebrity stuff would be J key fodder but it is strangely compelling.

</comment><comment><USER6> I wrote about my take on this site..."Inquisitr - I am Inquisitive!"

[http://bonchibuji.blogspot.com/2008/05/inquisitr-i-am- inquis...](http://bonchibuji.blogspot.com/2008/05/inquisitr-i-am- inquisitive.html)</comment>


May was hottest on Earth since records began - <AUTHOR> http://www.theguardian.com/environment/2014/jun/24/may-was-hottest-on-earth-since-records-began

<comment><USER2> HN does not care.

<comment><USER3> Yes we do.</comment></comment>


Future of Storytelling Survey: $50 to 20 people with the best responses - <AUTHOR> http://latd.com/2012/02/09/innovative-thinkers-wanted-how-do-you-envision-the-future-of-storytelling/

<comment><USER2> After 4 pages of unrelated marketing research questions I've closed the page.

<comment><AUTHOR> Sorry, I think they're called "demographics"?

<comment><USER2> Demographics are my age and gender, not my tablet and interest in specific products. It's not very hard to see what you did there...

<comment><AUTHOR> I'm sorry, I really don't understand what you think our intent was. The interesting, more topical questions need to be crossed with data about WHO answered them; data isn't all that useful without the added context. Most media studies you see written about on the internet or elsewhere report on things like, "smartphone owners were more likely to desire [x]," or "people who use multiple platforms to get their news tended to think [y]," or something similar. Asking which devices someone owns is just meant to make the study data more informative, not trick anyone. Understanding your basic audience profile is an important part of nearly all research. We understand if you're not comfortable answering those questions, but I wanted to clarify that they're entirely commonplace, and we meant nothing tricky or nefarious by asking them.</comment></comment></comment></comment>


Ask HN: Startup Share Distribution for New Comers - <AUTHOR>

We are a startup of two who have an idea that we started working on for sometime. For example, we have gone so far to form partnerships with groups who specialize in the domain of which problems we are trying to solve.
We realize that we need more people to help us implement our idea in a timely fashion. We want to involve our friends who are willing to join and who we think are among the best in the industry that we are in. However, I and my founder are faced with the problem of share distribution - who gets how much - for those who join us right now or the immediate future.
We have some ideas of our own; however, we want to listen to those who have gone through such a phase or who have encountered such a problem.
What are your thoughts or experiences? <comment><USER2> <http://www.paulgraham.com/equity.html>

</comment><comment><USER3> [http://sethgodin.typepad.com/seths_blog/2009/03/advice-on- eq...](http://sethgodin.typepad.com/seths_blog/2009/03/advice-on-equity.html)</comment>


House Flipper Zillow Lost $109K (37%) per Flip - <AUTHOR> https://wolfstreet.com/2019/05/10/house-flipper-zillow-lost-109k-35-per-flip-net-loss-triples-shares-soar/ <comment><USER2>
      $20.8 million in sales and marketing expenses

$56K per house sold

      $12.3 million in technology and development expenses

$29.7K per

      $14.4 million in general and administrative expenses

#34.8K per

      $3.8 million in "segment interest" expenses

$9179 per

This all sounds like phony accounting, Hollywood-style.</comment>


Django security releases issued - <AUTHOR> https://www.djangoproject.com/weblog/2012/oct/17/security/

<comment><USER2> I din't yet understand the risk from the 'Host' header issue. In order to modify this header for a user's traffic, wouldn't an attacker already be in control of the user's browser or (unsecured) network path to the server? And thus, would have even easier ways to display arbitrary malicious URLs/content?

Or is the mention of password resets an indicator that an attacker, in their own separate connection, can contaminate an email sent to other users with bad URLs? (If so, detecting suspicious Host values would seem to leave a risk that legal-looking but wrong Host values are still trusted by the email mechanism.)

<comment><USER3> I have no Django experience, but I can imagine how an attack like this works:

1\. Links are rendered via some function that takes into account the user's current request (ie: to determine the proper host)

2\. The "reset your password by clicking this link" URL is generated using that function.

3\. I am a malicious attacker and I submit a password reset request for your account.

Thus, I can control the URL that is sent to you in an email.

<comment><AUTHOR> Yup, that's basically it. It essentially makes phishing Django sites easier. The vulnerability could allow an attacker to send a legit email -- _sent by the real site itself_ \-- with a link that sends a user to a malicious site instead.

[So please upgrade!]

<comment><USER2> The fix as described seems to just check the Host header for suspiciously- formatted information. Is that also enough to prevent other wrong (but well- formatted) Host values from being used?

It seems to me that the deeper risk is composing emails based on a passed Host value, rather than any sort of canonical name the site has for itself. Does the warning about avoiding domain-wildcard setups mean this is still a risk, even after the latest fix?

<comment><AUTHOR> > The fix as described seems to just check the Host header for suspiciously- > formatted information. Is that also enough to prevent other wrong (but well- > formatted) Host values from being used?

No, it's not. As the release notes say, "Some attacks against this are beyond Django's ability to control, and require the web server to be properly configured"; see [https://docs.djangoproject.com/en/1.4/topics/security/#host-...](https://docs.djangoproject.com/en/1.4/topics/security/#host- headers-and-virtual-hosting) for details.

<comment><USER2> Thanks for the clarification.

The note about "beyond Django's ability to control" seems hand-wavey to me. Avoiding the use of the Host header to construct URLs -- not necessarily as a quick fix, but as a long-term better-practices goal -- would put safety against such attacks completely under Django's control, and provide a bit more defense-in-depth.

<comment><USER4> But most sites need to work from at least two hostnames (dev and production). So would you need to set up a whitelist in advance?

<comment><USER2> Not exactly, but sort of.

My estimation of what would be most safe/robust would be for a deployment to know its own canonical hostname/base-URL, and use that trusted value in construction of emailed URLs.

Perhaps this would be one of the explicit parameters that vary in dev-vs- production configurations. Maybe it's looked up from a key that's the local hostname. Perhaps, even, it's looked up based on the 'Host' header, but if the key is absent it's a failure. (Then, the available mappings are a sort of whitelist.)

The official Django recommendation essentially equates to, "be sure to enforce a whitelist on passed 'Host' values at the HTTP server". So it's leaving responsibility to the many alternate web server configurations Django devs might be using... while it could be solved definitively with a slightly different practice inside Django itself.

<comment><USER4> I can't totally disagree, but "enforcing a whitelist on the server" is not exactly a tall order. It's the default for many installs and IMHO is already a clear best practice for a production web server. Having your site available under hostnames you didn't intend to make public is generally not a good idea -- it runs the risk of Google picking the wrong one as canonical for one thing.

<comment><USER2> I agree, it's not a tall order on the webserver... but that means it's not a tall order in Django either... and Django devs may find it easier to do in Python/Django, compared to translating the Django admonitions into their various local server configurations.

Even if it's _easy enough_ to do it elsewhere, if in practice it gets overlooked, and the risks of overlooking it are high, that would be a reason to make the lazy/common path the safest path.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> where can i sign up to receive emails when a new django release is published?

<comment><USER6> <https://groups.google.com/group/django-announce/>

email@example.com

<comment><USER5> subscribed. thank you</comment></comment></comment>


Programmers generate every possible melody in MIDI to prevent lawsuits - <AUTHOR> https://www.musictech.net/news/programmers-generate-every-possible-melody-in-midi-to-prevent-lawsuits/ <comment><USER2> vice article on same thing submitted 2 days ago and discussed:

[https://news.ycombinator.com/item?id=22413526](https://news.ycombinator.com/item?id=22413526)

Edit: And apparently discussed even more 2 weeks prior:

[https://news.ycombinator.com/item?id=22301091](https://news.ycombinator.com/item?id=22301091)

<comment><USER3> And discussed in 1692, by Bernoulli, Mersenne and Kircher

[http://articles.adsabs.harvard.edu//full/1979HisSc..17..258K...](http://articles.adsabs.harvard.edu//full/1979HisSc..17..258K/0000258.000.html)

</comment></comment><comment><USER4> Back in the day I worked for Atari, writing game cartridges for their line of home computers. I had a decent relationship with marketing and had developed a reputation as one of the more helpful geeks.

One fine day a marketing guy knocked on my door and asked:

"What would it take to print out every possible eight-by-eight bitmap? We want to copyright them so our competition can't use them."

Seriously.

So I told him the story about the king who wanted to reward the inventor of chess, and upon being asked what he wanted the inventor said "one grain of wheat for the first square, two for the second, four for the third..."

I thought a bit, and added "I think that printout would outweigh the planet."

He went away. I was not a helpful geek that day.

Later I realized that I had only considered black-and-white bitmaps, and that preempting copyright on color bitmaps would have meant a lot more planets.

There's got to be a Douglas Adams style tie-in here somewhere involving aliens with planet-chewer-uppers invading and taking Saturn, Mars, Jupiter and then _us_ for some cockamamie copyright scheme in another galaxy . . .

<comment><USER5> I tried calculating this number for 16-bit images in Python (8^8^16), and the interpreter just froze. Go was pretty quick though: 3.940200619639448e+115

<comment><USER6> Neither of those numbers are correct. Firstly, exponentiation is right associative so 8^8^16 ≠ (8^8)^16 ≈ 3.94e+115.

Secondly, that number is wrong anyway. The correct number is (2^16)^(8*8).

<comment><USER5> Yeah apparently each pixel of a 16-bit image can have 256 different colors. Oops.

<comment><USER7> That's an 8-bit image. Each pixel of a 16-bit image could have 2^16 = 65536 possible colours.

<comment><USER5> I give up. I shouldn't post before having coffee.

</comment></comment></comment></comment></comment></comment><comment><USER8> It's about fourteen kinds of ridiculous, as summarized in other threads. No rhythms, no meter, no tempo, melodies are longer than 12 notes, it's diatonic, single octave, no concept of underlying harmony, the headline is literally false, etc.

Some of the copyright lawsuits are dumb and this is effective satire or performance art but that's all it is.

<comment><USER9> The code actually can produce every possible melody in MIDI. They simply have not stored every possible melody explicitly (uncompressed) on a hard drive (which is impossible, as the size is infinity).

However, if you interpret the program itself as a self-extracting compressed archive, they actually have stored every possible melody (in a compressed way).

So the question reduces to how much the type of compression matters here (is ZIP allowed? is TAR allowed? what about more sophisticated like PAQ? and what about this Rust code?). This is what I/we discussed here: [https://news.ycombinator.com/item?id=22441328](https://news.ycombinator.com/item?id=22441328)

<comment><USER10> Gotta love programmers.

> So the question reduces to how much the type of compression matters here

If you compress, you can copyright the compressed bytes.

If you don't compress, you can copyright the uncompressed bytes.

As far as that copyright extending to derivations, e.g. decompressions, the answer indeed situation-dependent. For example, converting a copyrighted font from TTF to WOFF does not remove the copyright. But converting a copyrighted font from TTF to screen pixels to WOFF removes the copyright. (Sorry I don't have a reference; probably findable.)

The "self-extracting zip" derivation would probably fall into the latter category; that is, the copyright would not transfer.

\---

 _But even if the copyright were maintained during your advanced decompression,_ one could argue that editing down to very specific portion of that _extremely_ large body of work was a substantive/transformational derivation, which they could then copyright themselves.

Transformative works are very common in art. The most famous example is Duchamp simply adding a mustache to a print of da Vinci's _Mona Lisa_ , and copyrighting that. [1]

[1] [https://en.wikipedia.org/wiki/L.H.O.O.Q](https://en.wikipedia.org/wiki/L.H.O.O.Q).

<comment><USER11> > But converting a copyrighted font from TTF to screen pixels to WOFF removes > the copyright.

I hope nobody takes this as legal advice; I'm not a lawyer but I'm fairly certain it's wrong. The font would still be the same work.

<comment><USER10> Alright, you made me add references :)

It comes down to this: Typefaces/glyphs are not copyrightable. The font code that produces those glyphs is.

> Typefaces cannot be protected by copyright in the United States (Code of > Federal Regulations, Ch 37, Sec. 202.1(e); Eltra Corp. vs. > Ringer)...However, there is a distinction between a font and a typeface. The > machine code used to display a stylized typeface (called a font) is > protectable as copyright. [1]

In software, a similar "black-box" derivation process has happened many times, e.g. UNIX/GNU. Copyrights applies to software source code, but not software functionality.

Determining what is the "essential, creative work" in each case in a nuanced way is a matter for courts and armies of lawyers: Apple round corners, Oracle Java APIs, etc.

[1] [https://en.wikipedia.org/wiki/Intellectual_property_protecti...](https://en.wikipedia.org/wiki/Intellectual_property_protection_of_typefaces#United_States)

<comment><USER12> Presumably copyright law makes this allowance for type because the _point_ of typefaces is to be reproduced.

<comment><USER10> That is in fact, the point of all digitized information, including recorded audio.

(But yes, I do agree that typefaces are exceptionally commonly distributed.)

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> The code is written in Rust. The core algorithm can be found here: [https://github.com/allthemusicllc/atm- cli/blob/master/src/ut...](https://github.com/allthemusicllc/atm- cli/blob/master/src/utils.rs) (Specifically the function gen_sequences. It basically uses multi_cartesian_product to iterate over all permutations.)

Isn't it a bit of wasted space to store the generated data on archive.org ([https://archive.org/download/allthemusicllc- datasets](https://archive.org/download/allthemusicllc-datasets))? I mean, as we see, it's trivial to create them. The code above is kind of a self- extracting archive, so it's just the same thing but in compressed form. And I guess it should not matter (legally) whether you store it compressed or uncompressed (or less compressed).

<comment><USER13> You can trivially write a program which will enumerate all the possible byte sequences in the universe. So you can claim that this tiny program contains everything including god. So you can claim copyright for everything.

<comment><USER14> > You can trivially write a program which will enumerate all the possible byte > sequences in the universe. So you can claim that this tiny program contains > everything...

Not to get too far off topic, but even an infinitely long byte sequence cannot represent all numbers. It's possible to construct something not representable by that sequence via Cantor's diagonal argument: [https://en.wikipedia.org/wiki/Cantor%27s_diagonal_argument](https://en.wikipedia.org/wiki/Cantor%27s_diagonal_argument)

<comment><USER15> It doesn't contain the floating point representation of that number, which would be infinitely long, but it does contain the UTF8-encoded constructive proof that uniquely identifies that number.

<comment><USER16> Surely not? If there are more numbers that can be represented in any amount of bytes (as shown by the diagonal argument), then you cannot represent a constructive proof for each of them in any amount of bytes.

<comment><USER15> Kind of. A constructive proof by definition means something like you can explain exactly what the number is in a finite number of bytes.

The standard diagonalization argument is a constructive proof, identifying a specific number. Normally a constructive proof is preferable. But with a bit of hand waving you can make it into a non-constructive proof that there are "unknowable" numbers that cannot be described in any finite amount of bytes.

<comment><USER17> In practice constructible for reals mean that you can approximate them with arbitrarily small know precision e.g. a sequence of retional number numbers q_n each no more that 1/n apart from the actual real number.

The point is that such a sequence needs to be constructive in the usual sense, so there are still only a countable number of them.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> But this will of course not work, because enumerating the bitspace does not produce bits of the right colour: [https://ansuz.sooke.bc.ca/entry/23](https://ansuz.sooke.bc.ca/entry/23)

<comment><USER19> A tl;dr would be nice it you post such a long article that doesn't directly seem to have anything to do with the current topic.

<comment><USER20> It's actually very relevant, the TL;DR (from memory) is that lawyers (and judges) aren't programmers, and the source of data (referred to as the "colour of the bits") is as important as the actual bits of the data. Thus "I have this bit pattern as part of a bit enumeration" is different, to the legal system, than "I have this bit pattern because I specifically created it".

<comment><USER21> What's the legal principle that distinguishes methods of generation? Even if enumeration is definitely on one side, there is an infinite gradation from there to human generation.

<comment><USER22> The principle is: _what actually happened_. "Enumerated" is a different colour than "composed by human".

<comment><USER23> The line between enumeration and a very prolific artist is blurry. What if someone instead of just enumerating them created actual songs featuring them as themata? And what if those songs were tool-assisted? But still catchy?

I see it as likely that someone will eventually try it not just as a legal strategy but because of a genuine curiosity in music and AI.

According to wikipedia

> There is a long tradition in classical music of writing music in sets of > pieces that cover all the major and minor keys of the chromatic scale. These > sets typically consist of 24 pieces, one for each of the major and minor > keys (sets that comprise all the enharmonic variants include 30 pieces).

I don't think anyone would say there is any ill intent even though it is based on an enumeration.

<comment><USER22> That's what courts are for! Their job is to figure out the shade of colour a thing has.

<comment><USER23> Your color paradigm can trivially solve the current case - it's an enumeration and not a creative production.

But the future case I'm speaking of will be a very real dilemma and either decision will have drawbacks. It's not just about seeing through a hack.

<comment><USER22> > _a very real dilemma and either decision will have drawbacks_

That's bread and butter for the courts. You don't need judges and juries and lawyers to see through a simple hack; trying to use a trivial enumeration to defeat a copyright claim is just "ha ha, nice try, but nope" issue no reasonable layman would have a problem with. Shades of colour are of critical importance in precisely those cases that are fuzzy, where there is no obvious ruling to be made. That's what the courts are made for.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER24> Adam Neely (professional musician and YouTuber mostly about music theory) did a video about this with the guys behind it: [https://youtu.be/sfXn_ecH5Rw](https://youtu.be/sfXn_ecH5Rw)

<comment><USER25> This really needs to be at the top, as it answers a lot of the criticisms found here on HN

<comment><USER26> It also makes it clear they realise the limitations of the exercise (it isn't nearly all possible melodies), and it shows their motives a bit better too (helping protect against corporate music copyright trolls).

</comment></comment></comment><comment><USER27> I am not a lawyer, but as I understand copyright law there seem to be to be two problems with this:

\- a copyrightable work must include some human creativity. It seems to me that an enumeration of possibilities might be creative, but there is no way an individual element of that enumeration can be considered creative.

\- Copyright depends on _copying_. If you release a song with a catchy melody stolen from another song, then you infringed its copyright, regardless of if there is an licensable version of that melody that you could have copied. What matters is which one you copied, not the existence of alternate copies.

<comment><USER28> > Copyright depends on copying

This is a response to the Flame v Katy Perry lawsuit, where a youtube video with 100,000 views was deemed sufficient popularity for the court to assume copying without proof.

The element that Katy Perry was found to have illegally copied is a 4-note descending line with equal spacing between the notes. In both "Joyful Noise" and "Dark Horse" the pattern was probably generated by a producer pressing the "arp" button on a minor chord in a DAW. Neither of them actually plotted out each of the notes with particular purpose. But the Court still said that the 4-note descending pattern is original and creative enough, the fact that it was composed by software notwithstanding, and illegal to reproduce.

<comment><USER29> Tangentially relevant is Adam Neely's take on that lawsuit: [https://youtu.be/0ytoUuO-qvg](https://youtu.be/0ytoUuO-qvg).

</comment></comment></comment><comment><USER30> Reminds me of an aside in Accelerando:

> His suitcase is full of noise, but what's coming out of the stereo is > ragtime. Subtract entropy from a data stream – coincidentally uncompressing > it – and what's left is information. With a capacity of about a trillion > terabytes, the suitcase's holographic storage reservoir has enough capacity > to hold every music, film, and video production of the twentieth century > with room to spare. This is all stuff that is effectively out of copyright > control, work-for-hire owned by bankrupt companies, released before the CCAA > could make their media clampdown stick. Manfred is streaming the music > through Annette's stereo – but keeping the noise it was convoluted with. > High-grade entropy is valuable, too ...

[https://www.antipope.org/charlie/blog- static/fiction/acceler...](https://www.antipope.org/charlie/blog- static/fiction/accelerando/accelerando.html)

</comment><comment><USER31> It's interesting to think about this from a more general perspective: what if we're not limited to midi, and we're talking about a more general kind of _design_ problem, where the design problem is to select a good solution to a problem within some (large) but finite and theoretically enumerable search space.

We can think of selecting a good melody to fit into a song as one example of a design problem -- searching through some finite enumerable space of melodies and selecting a melody that's a good fit. A lot of the effort in this process is testing and evaluating the melody to see if it is any good to listen to / any good in context. This effort hasn't been done if you simply brute force enumerate and list the search space without testing anything.

There are many kinds of design problems where the effort of checking if a proposed solution is any good vastly outweighs the effort of suggesting a solution.

We could do the same thing for other kinds of design problems.

In principle, what if we enumerate some (vast) finite space of digital circuits -- if we put a few limits on the amount of stuff we can put into a single circuit, and discretise any continuous parameters to produce a finite space. Does that mean we can copyright all these possible circuits, even if we put no effort into seeing if any of them are fit for any purpose?

Can we enumerate some large finite space of possible arrangements of atoms into molecules and then copyright them all, without putting any effort into analysis or experimental testing to see if any of the proposed molecules are fit for any purpose?

Snisarenko made a similar criticism when this was posted 15 days ago:

> As other commenters have pointed out, this is gimmicky, shallow and > clickbaity. All that they did was count from 1 to 68 billion. Any piece of > digital data can be converted to a number, and if we apply their argument > then you can be "creative" by just counting numbers. But we all know that's > not true. Once the search space becomes that big, you can't actually "enjoy" > any of these melodies. Because you can't listen to all of them in your > lifetime, the ones that you WILL hear are going to be awful 99.999 percent > of the time. Hence, the "creative" process is navigating this search space, > and figuring out which melodies are catchy. Better yet, trying to figure out > how or why our brain decides to like or not like a melody.

\-- [https://news.ycombinator.com/item?id=22306857](https://news.ycombinator.com/item?id=22306857)

From my perspective of framing this situation: this is dumb, as no design of any melodies has been performed. The design is the uniform prior distribution over some space of all possible melodies, most of which will be uninteresting / not fit for any particular purpose, which is a pretty uninspiring notion of design.

<comment><USER21> If intellectual property of this kind is a finite resource, then maybe there should be a lifetime intellectual property "takings" limit.

</comment></comment><comment><USER32> Wouldn't they get into legal issues as they are colliding with every song already in existence?

<comment><USER33> Since they're not trying to profit from them, they'd probably just get cease and desist letters and take the offending ones down. Since one of the founders is a lawyer, it's probably feasible to handle most minor conflicts that come up while still protecting the vast major of the melodies.

</comment></comment><comment><USER34> This reminds me a lot a short story "The Library of Babel" by argentinian author Jorge Luis Borges in which he conceives "a universe in the form of a vast library containing all possible 410-page books of a certain format and character set"

[https://en.wikipedia.org/wiki/The_Library_of_Babel](https://en.wikipedia.org/wiki/The_Library_of_Babel)

*Edit: book -> short story

<comment><USER35> There is at least one website that hosts a "real" library of babel (generatively).

[https://libraryofbabel.info](https://libraryofbabel.info)

</comment></comment><comment><USER36> I know it's many orders of magnitude more difficult.. but if I got a printer to print out one of every possible art and published it, CC licensed it, etc wouldn't that have the same legal status as these melodies... probably none?

I showed this article to a musicologist (in the UK) and he said:

> I assume that somehow lawyers can refer to a precedent of "this is too > ridiculous to be taken seriously"

<comment><USER37> The other thing is that machine-generated works almost by definition do not reach the "creative" aspect of the "original and creative" requirement for copyright to apply.

<comment><USER38> Exactly. Their work is not protectable under copyright because it is not a work of authorship, but an exhaustive list of all possible melodies.

</comment></comment></comment><comment><USER39> Love the spirit of this work, but nobody is an authority on what a melody is. How many different tuning systems were used? Why 8 notes? Why not 0..n notes? [0] Is a given melody, realized at 10ms per beat a melody? How about a 17-month pause before the first note? [1] Absurd? Sure. But who decides where the boundaries are? Lest one think that there is only an appeal to extremes here, check out Polansky's beautiful Lonesome Road, and put boundaries around melodies [2].

[0] [https://www.amazon.com/Larry-Polansky-Worlds-Longest- Melody/...](https://www.amazon.com/Larry-Polansky-Worlds-Longest- Melody/dp/B003P5AJIU)

[1] [https://universes.art/en/specials/john-cage-organ-project- ha...](https://universes.art/en/specials/john-cage-organ-project-halberstadt)

[2] [https://www.youtube.com/watch?v=0aIifUv1Tmk](https://www.youtube.com/watch?v=0aIifUv1Tmk)

<comment><USER40> 8 notes is what popular music is based on. I don't see why it matter what the tempo is. Pretty sure no one would be in danger of copyright infringement of a 17 month pause.

<comment><USER39> > 8 notes is what popular music is based on.

OK, forget everything I said but the 8 notes thing. Just, no. "Yesterday"? Great melody. whistle just the first eight notes. "Yesterday, love was such an eas". Hmm. Wonder if there are more examples.

</comment></comment></comment><comment><USER41> Gonna leave this here: [https://ansuz.sooke.bc.ca/entry/23](https://ansuz.sooke.bc.ca/entry/23)

</comment><comment><USER42> Now is the time to train convolutional NN to find "catchy" melodies, and then unleash it over this dataset, and become famous songwriter.

<comment><USER43> You wouldn't use a CNN for this because there's no spatial correlation to take advantage of. Maybe an RNN somehow but the basic problem is scoring (ie how melodic a song is) not classification so honestly I don't know you'd do this using neural networks.

<comment><USER44> On the contrary, with a more generous reading of the previous comment, it holds some merit.

1\. CNN's are used fairly commonly for sequence tasks nowadays. Convolutions can be 1D after all. 2\. It's also possible the previous comment was referring to using 2D convolutions on the spectrogram of the audio, which is a common approach. 3\. Neural networks are capable of more than classification. Scoring is a regression task which is common application of neural networks.

<comment><USER43> a 1D CNN is an extremely simple RNN...

do people really run 2d convolutions on spectrograms? that seems rather backwards to me - why convolve in frequency space when you can just multiply in the time domain.

re regression tasks: sure I guess that's just an embedding basically right?

<comment><USER42> Yes, I meant to run 2D CNN over generated spectrograms. We do something similar to classify some specific emissions in RF with good success. As for scoring/classification, you can start by having an output of CNN say whether the song is catchy or not.

<comment><USER43> why run a CNN over a spectrogram? besides what I said (convolutions in frequency domain are multiplications in time domain) an FT is linear. if classifying using those features were effective then your CNN would've learned the DFT matrix weights from the original signal.

<comment><USER45> A spectrogram has time on one axis and frequency on the other, so the ultimate result is a multiplication in one dimension and a convolution in the other. It can be used to show things like when a note starts and stops in a piece of music, which is difficult in either purely-time or purely-frequency space.

Also, it's computationally intractable to individually train 2^N weights. What a CNN does instead is train a convolution kernel which is passed over the whole domain to produce the input for the next layer; by operating in frequency space, it's considering the basis functions e^{j omega +- epsilon} instead of delta(x +- epsilon)

<comment><USER43> my mistake i didn't realize spectrogram and spectrum were distinct objects.

>Also, it's computationally intractable to individually train 2^N weights.

that's a good point - i'd forgotten for a moment (because i'm so used to cooley-tukey fft) that in principle getting the spectrum involves a matmul against the entire vector. which brings up a potentially interested question: can you get a DNN to simulate the cooley-tukey fft (stride permutations and all).

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER46> Assuming we accept their premise: how does this prevent lawsuits? Wouldn't the melody-set they've created be subject to a copyright infringement claim from every melody produced before their experiment that is still under copyright?

<comment><USER47> The method of generation prevents that. They didn't listen to song A and write down the melodies from it, then listen to song B and write down those melodies. They generated them all in order using a computer program.

Presumably it prevents lawsuits because I can write a song starting with a melody from this archive knowing that it's in the public domain. (Or because it makes obvious the absurdity of having a copyright on a 12-note melody in the first place.)

<comment><USER48> It doesn't prevent lawsuits, or do anything at all. Other comments here are close; this material is not an original work, so copyright does not subsist in it. No copyright, no ability to place in public domain or issue licenses at all. This is the equivalent of pouring a glass of water in the ocean and then declaring you own all international waters.

<comment><USER47> It certainly contains many melodies which are not original. But what about the rest? It either contains some melodies which are original or it contains no original melodies. In the former case then they can be copyrighted, and in the later case they cannot (well, that hinges on access rather than mere equality, but I'll ignore that). However, in the latter case nobody else can get copyright on any new melodies either.

<comment><USER48> In copyright law, original does not mean new. It means that a person originated the work. Here, this was done by a computer. Remember the monkey who took a selfie who couldn't originate a work, and therefore there was no copyright work to be owned? This is a monkey on a typewriter.

Copyright law protects expression, and the labour required to produce that expression. Just like people who copy others' work to gain from it, the "authors" have attempted to gain from doing no work and letting a computer give them all the world's music. Imagine if they didn't release their library into the public domain, and instead started to immediately sue over every new song that came out? It is fortunate that they cannot do either.

</comment></comment></comment></comment></comment><comment><USER49> Overhead, without any fuss, the stars were going out.

<comment><USER41> [https://archive.org/details/ninebillionnames00clar/page/n15/...](https://archive.org/details/ninebillionnames00clar/page/n15/mode/2up)

</comment></comment><comment><USER50> I hope someone Copyrights all possible Java method signatures for the Oracle v Google case. You could write a "compression/decompression" tool in the website's javascript for people to check if you own the Copyright or not. There would be many pages of data so you might want to make it work offline with a Service Worker. To prove you are on the up and up.

</comment><comment><USER51> I'm sure this has already been remarked upon in comments, but.... Not every possible melody!

A significant portion of melodies likely to be generated by people, or put another way these are the more trivial melodies. The range of complexity is vast, so just like cracking passwords might use a dictionary attack, or use English alphabet, or similar limited scopes, so it goes here.....

</comment><comment><USER52> All very interesting discussions. Some have broached on it, but let's be clear: mechanically generated sequences are not copyrightable. The program that generates them is, of course.

It doesn't matter if there isn't enough space to enumerate them all. It doesn't matter if most of them sound like crap. It doesn't matter if some match a pre-existing song. It doesn't matter if you do or do not highlight "interesting" songs.

The very fact that they are machine generated eliminates the element of creativity that is a central requirement to copyright.

Copyright law may be stupid, but it isn't this stupid. An even more stupid argument that isn't even valid doesn't really help.

> 503.03(a) Works-not originated by a human author.

> In order to be entitled to copyright registration, a work must be the > product of human authorship. Works produced by mechanical processes or > random selection without any contribution by a human author are not > registrable.

</comment><comment><USER53> What an awesome effort. However, frivolous suits will still remain especially in places where the burden of proof rests on the defendant. A lot of these suits are filled knowing that they can't win but use the machinery to drain the defendant's resources until they are forced to submit because they have no means to fight it.

<comment><USER54> If they have no means to fight it, where would the money come to pay it?

<comment><USER53> Might not be immediate money but could be something like owning the rights to a song. Also "some men just want to watch the world burn"

</comment></comment></comment><comment><USER55> So...they have remade all songs made as well? I predict lawsuits coming...!

</comment><comment><USER56> It's time to repost _What Colour are your Bits_.

[https://ansuz.sooke.bc.ca/entry/23](https://ansuz.sooke.bc.ca/entry/23)

</comment><comment><USER57> Not the greatest recording, but fantastic lightning talk kinda along the same lines but for code, "Mark Dominus - Debugging the De Bruijn Sequence (YAPC::Asia 2007)"

[https://m.youtube.com/watch?v=QhtuG4htrb0](https://m.youtube.com/watch?v=QhtuG4htrb0)

</comment><comment><USER58> I hereby copyright every combination of ones and zeros of length one to infinity, now you cannot sue me .

</comment><comment><USER59> It wouldn't work in my country. Thing has to have individual creative quality to be copyrighted. Autogenerated stuff doesn't get copyright unless a human chose one of the autogenerated things for some particular creative reason. Then this thing gets copyright.

<comment><USER60> Which country?

<comment><USER59> Poland.

</comment></comment></comment><comment><USER61> Here's a quick app I made to page through and play each of the melodies in the All the Music catalog: [https://gen.co/allthemusic/?notes=53325332](https://gen.co/allthemusic/?notes=53325332)

</comment><comment><USER62> The idea might be to prevent lawsuits, but presumably the authors have opened themselves up to being sued by anyone who already owns a melody. If melody owners can't sue the authors then their work can't protect anyone either.

<comment><USER63> The artist suing, however, would have to worry about legitimizing this work. If the artist suing were to win, it would be setting precedent that everything else is the archive is also copyrightable, including all the melodies that are novel.

</comment></comment><comment><USER64> Definitely the most extremely programmer thing I've seen this week.

</comment><comment><USER65> Won't they have inadvertently copyrighted tunes already under copyright? That is to say for anything written before this stunt, they've given away rights they don't own.

</comment><comment><USER66> I hope that will not hurt them. Imagine that in copyright lawsuite I refered to their midi archive as a source and since that they become in charge for copyright infringement.

</comment><comment><USER67> I think it's an interesting idea, however, wouldn't this also risk generating already-copyrighted melodies? Putting archive.org at risk of getting massively sued ?

</comment><comment><USER68> It can be argued that since the melodies were generated by an algorithm, they are not a product of creative process and therefore not subject to copyright.

<comment><USER69> Now all we need is some "head cheese" [0] to generate the same thing using human neurons

[0]: [http://www.technovelgy.com/ct/content.asp?Bnum=687](http://www.technovelgy.com/ct/content.asp?Bnum=687)

</comment></comment><comment><USER70> I'm just gonna jump in and say how cool this is. I get that it's not perfect but it's sort of a middle finger to "the man".

</comment><comment><USER71> I wonder if someone has done this for other things like say, generating all possible combinations for 9*9 Sudoku etc

</comment><comment><USER72> Not to cause a combinatorial explosion, but...

next they need to generate every possible chord progression underneath that melody.

</comment><comment><USER73> This is something else. What will happen to the origins of sound after all the sounds have sounded?

</comment><comment><USER74> This reads like an Onion article. I heard about this on _Lawful Masses with Leonard French,_ a copyright attorney who pwned Prenda Law. Also, the number of potential melodies, considering the degrees of freedom involved, is on the order of the number of games of chess. IANAL but this doesn't seem more than a stunt to call attention to the legal climate.

</comment><comment><USER75> Copyright law that make something like this necessary is not justice but perversion of justice.

</comment><comment><USER76> Bobby Prince certainly wouldn't get away with the original DooM soundtrack today.

</comment><comment><USER77> Copyright law is a joke and this is the perfect way to demonstrate that.

<comment><USER78> And yet this will prevent exactly 0 lawsuits.

</comment></comment><comment><USER79> Isn't any substantial block of random bits already covering this?

</comment><comment><USER80> So we could create a directory in IPFS with all melodies possible? :)

</comment><comment><USER81> This was on HN several days ago, is it a double post?

</comment><comment><USER82> Spoiler alert: This will not prevent lawsuits.

</comment><comment><USER83> I should do this for words.

<comment><USER84> I've often thought how strikingly easy it seems to be to produce sentences that have probably never been written before.

For example:

I am typing these words on a mobile phone whilst sat on a train to an airport, wearing a green jacket, brown shoes and a maroon hat with a black bag containing gifts for my children. That seems a fairly prosaic sentence at first glance but I doubt has been written before.

<comment><USER85> Try searching for it in the Library of Babel: [https://libraryofbabel.info/](https://libraryofbabel.info/)

(edit: ninja'd)

<comment><USER84> Fantastic project, thanks!

</comment></comment></comment></comment><comment><USER86> this is kinda getting out of hand</comment>