Uber Database Breach Exposed Information of 50,000 Drivers, Company Confirms - <AUTHOR> http://techcrunch.com/2015/02/27/uber-database-breach-exposed-information-of-50000-drivers-company-confirms/ <comment><USER2> Data accessed on 5/13/2014, uber noticed on 9/17/2014, and then notifies affected on 2/27/2015\. Thankfully it was _only_ names and plate numbers, but still...

All I see from uber is bad publicity and poor management decisions. I wonder what it's like to work there from an insiders perspective, cause from the outside it doesn't look good.

<comment><USER3> I'm not defending them on this because that does seem to be a long enough time to be more proactive about it. You did bring up an interesting point though, Uber is facing opposition from almost every city they are in. Whether it's small town South Carolina where I'm from and even in some of the largest cities in the world. It would be interesting to see how people deal with this on the inside and how it affects the culture.

<comment><USER4> Uber's in a position where they get flak for breaking the rules while also being painfully aware that following the rules is worse for them. They face opposition, but every time they play nice it doesn't go well for them.

The lesson here is that sometimes, you do much better by breaking all the rules.

<comment><USER5> Well, if the only way you can make business is to break laws and be total assholes to everyone, then it kind of strongly suggests you shouldn't be in business in the first place.

<comment><USER6> I am not suggesting that they should be assholes, but do you think Napster won the war by playing by the rules?

<comment><USER7> what war did napster win?

</comment></comment></comment></comment></comment></comment><comment><USER8> I accidentally stumbled upon employee admin screens, all by changing a key, isAdmin = true. [https://news.ycombinator.com/item?id=9121004](https://news.ycombinator.com/item?id=9121004)

<comment><USER9> How in the world did you only get 8 points for that? I've upvoted yours. That seems almost as bad as the incident reported in this thread.

<comment><USER10> Because it's just the UI, you can't actually use it without an admin account. It's really not an issue at all.

<comment><USER8> This is a good point, but there should be more awareness towards the issue as a whole. I've seen many apps who expose data dangerously. Some developers may not be aware that these values are exposed (even with SSL), so they should architect their apps accordingly, reinforcing the fact that you should never trust the client. I also briefly touch on the fact about this dynamic architecture and some of the implications it brings.

<comment><USER11> You mean throwing up a Meteor app with a direct db feed and no fine grained security at the server side can lead to exploits?

</comment></comment></comment></comment></comment><comment><USER12> Under California law, data breach notifications "shall be made in the most expedient time possible and without unreasonable delay".

Civil Code § 1798.82(a): [http://leginfo.legislature.ca.gov/faces/codes_displaySection...](http://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.82)

I find it hard to square that requirement with Uber waiting 5 months from when it found out.

<comment><USER13> That is a bunch of lawyer words that they can stretch to mean anything. What we need are hard deadlines, say two days after the breakin. Not enough to full find out what happens, but enough to force the companies to act.

<comment><USER12> It's soft language, but I don't think they can stretch it to mean "anything." 5 months is just way too long.

</comment></comment></comment><comment><USER14> Congress needs to stop pissing in the wind and make a federal law on breach disclosure. Self evidently companies won't universally do this on their own, and state specific law makes compliance more difficult and expensive.

<comment><USER15> How would such legislation ensure companies are able to detect such breaches in the first place? For every Target/PSN/Anthem/Uber how many companies aren't even aware they've been breached?

<comment><USER14> Withholding knowledge of a breach is self-rewarding which is why there needs to be a law stating the time frame for disclosure, and either penalties or liablity (per affected customer, employee, contractor, vendor). Lack of skill in detection is a problem, but I don't know whether Congress is well equipped to legislate that, and also companies aren't exactly incentivized to just let themselves get completely owned. They're just ignorant. There's no question this behavior is changing, even if we're dissatisfied with how slow it's happening.

I mean, the average Congresscritter probably has no idea what the typical answer is to "how do you do a password reset?" other than "call daughter/son". They're not good at establishing competency. They are sorta half way decent at bringing out the hammer "disclose what you know within X days, or we're going to fine you... when we do find out when you knew it."

So that brings up the question how the legislation determines whether and exactly when the company knew they were breached. And I'd say they should learn from history which is not to be such dicks like they were with hackers in the 80's and 90's and instantly criminalize disproportionately. We were learning things as a result of all of that, and by repressing it, we learned a lot less. So with companies I'd say up front the disclosure needs to be civil in nature (fines), and if there's willful hiding of what they know, tampering of evidence, destruction of evidence in an attempt to claim they didn't know they were breached or how badly, then it becomes criminal and lay down the hammer. Ultimately though, the worst punishment is up to the states, since the corporate charter is granted by states, not the feds. Off hand I can't think of a case where a corporation was executed in this manner though (revoking it's charter or articles of incorporation).

</comment></comment></comment><comment><USER16> As much as Uber messed up here and there was a security breach, comparable information is publicly available. For example, the TLC in NYC provides this:

[http://www.nyc.gov/html/tlc/downloads/excel/current_medallio...](http://www.nyc.gov/html/tlc/downloads/excel/current_medallion_drivers.xls)

This is a spreadsheet containing all the taxi drivers in NYC with their names, license numbers, and license expiration dates. Given that the only information leaked (according to Uber) were names and license numbers, that really isn't much beyond what might otherwise be available publicly.

<comment><USER17> Those are medallion numbers or TLC license numbers, but not drivers license numbers. They can't be used for identity theft.

</comment></comment><comment><USER18> The TechCrunch article says "license plate numbers" but the Uber post[0] says "driver's license number".

[0] [http://blog.uber.com/2-27-15](http://blog.uber.com/2-27-15)

<comment><USER19> In Massachusetts the driver's license number used to be your social security number. This was changes but are there other states that have not done so?

</comment></comment><comment><USER20> "cowboys get stung by being cowboys"

the number of f*cks i can give for the company is so low. just feel sorry for all the drivers with the leaked information...

</comment><comment><USER21> Uber really needs to have a public data retention policy stating that they anonymize or delete all data older than a couple weeks. I'm just waiting for them to be hacked and have to reveal that people's trip data for years has been released.

<comment><USER22> Not just Uber.

Obama's proposing data privacy regulations. I think it's worth considering what you'd like to see involved in same.

<comment><USER23> Meanwhile, Australia is about to legislate mandatory data retention :( [https://stopthespies.org/](https://stopthespies.org/)

<comment><USER24> A data retention policy can state that you delete all non-operational data after 60 or 90 days. Or that it is moved to one-way encrypted storage for up to a year. In other words, it can be a security mechanism vs "we keep everything in the SQL database, forever" that tends to be the default in many circumstances.

</comment></comment></comment></comment><comment><USER25> > Uber says it will offer a free one-year membership of Experian's ProtectMyID > Alert

My ID has been breached twice in other, unrelated incidents. Each time these ID protection companies want to know my SS# and all sorts of other stuff. My heart skips a beat imagining them scraping the web for my SS# and CC# in an otherwise well intentioned effort. I've refused their services and insist they only provide the insurance policy associated with this.

<comment><USER26> It's pretty hard (actually impossible) to pull the information necessary to do credit monitoring without your PII.

</comment></comment><comment><USER27> This incident - amongst many others - only shows that most companies don't give a rat's ass about our data or privacy.

They are happy enough if their systems actually work and run. That's enough for them.

This incident won't cost Uber anything. It won't matter to them. A few appologies here and there and that will be the end of it.

Maybe, maybe there is some trivial fine to pay, but that will be a rounding error on their balance sheet.

</comment><comment><USER28> I see a lot of comments about security, but would be happy to bet this was simple social engineering and "human hacking". It's sobering to see large-ish companies that give full read access (and sometimes write) of customer and financial data to interns, fresh grads and new contractors for expediency. Young people are cheap. $500 is a new computer or weeks of food to an indebted student.

Management usually doesn't care, revenue and convenience trump security; until of course something bad happens, which is why older institutions have draconian access standards, meetings to discuss who has the right to know about the meeting to determine the access list management program (true story) and so on.

Nothing in the press release hints at an actual attack. "An unauthorized third party accessed our database, and we immediately changed the password" sounds like they realized one of their competitors hired an intern to get them a login.

</comment><comment><USER29> Last year Uber was using Backbone and the JSON returned to the client included ALL information about the drivers you have used for trips including home address, phone number, etc. I wonder if this has something to do with that?

<comment><USER30> You could also use an auth token from the Android app and snoop around other users if you knew some info about them, which you could if you had access to a driver's phone (I did/do).

</comment></comment><comment><USER31> And depending on the state, you can find out the driver's birthday, or even if their real name is different from what is listed on their profile. The site at [0] shows how many states use soundex coding and modulus arithmetic to encode driver's license numbers with PII.

I'd be keen to see if every driver's info aligns with the license number (for those states that use encoding systems that embed PII into the number).

[0] [http://www.highprogrammer.com/alan/numbers/index.html](http://www.highprogrammer.com/alan/numbers/index.html)

</comment><comment><USER32> I find it unlikely they have a database explicitly for driver names/license plates. Unless it was some flat-file dump compromised. I'm curious how much data was really obtained. If only 50k were truly stolen, it could be a shard too. The lack of technical details is sketchy to me

<comment><USER33> Maybe they have query logging turned on and saw what queries the attacker ran?

<comment><USER32> Definitely plausible, and I hope so --- but there's no clarification of that or technical insight.

</comment></comment></comment><comment><USER34> Why does sec get breached? Marketing wants easy access to all data, that's it. Big Data / deep learning wants easy access, lots of data is in transit. Security is not convenient for operations, therefor companies have sec on paper and audits and stuff but no real sec.

</comment><comment><USER35> The free one-year membership of Experian's® ProtectMyID® Alert is genius, its giving away something that costs them nothing (presumably Experian are using this as a marketing opportunity) as if it's a real step in the right direction to make up for the data leak.

<comment><USER36> Virtually every breach disclosure press release I've seen has included a line like this, as if it actually matters. Common practice.

</comment></comment><comment><USER12> Here's a sample of the notification that went to affected "driver partners": [http://oag.ca.gov/ecrime/databreach/reports/sb24-48540](http://oag.ca.gov/ecrime/databreach/reports/sb24-48540)

</comment><comment><USER37> And apparently Uber has filed suit against github: [http://www.theregister.co.uk/2015/02/28/uber_subpoenas_githu...](http://www.theregister.co.uk/2015/02/28/uber_subpoenas_github_for_hacker_details/)

</comment><comment><USER38> I work in info sec, and in one of the "Who's Hiring" posts a few months ago (do we still do those? I haven't seen one in a while) I asked "why are startups never hiring security guys?", because I never see a security engineer position open in those topics. I never got a response. To me that indicates the response is "we don't".

Listen, guys. I don't care how small you are. If you are handling PII or credit card data or anything that, if leaked, would harm your business or your customers, _you need a security guy_. Not a programmer who knows some security stuff. Not a manager who checks off the online PCI self-assessment. Not "we outsource to an MSSP". At least one security guy, full time. Make sure that everything you do is run past that person. If you're so busy that you can't run everything past that person, hire another.

It's not a joke. Stop fucking ruining people's lives. It's 2015, four years past "the year of the breach" [1]. Get with the program. It's not okay to have a breach. It's not. It doesn't matter how much money you saved from not having a security guy or the tools they need. Get someone who knows what they're talking about and _listen to them_.

[1] [http://news.softpedia.com/news/IBM-2011-is-The-Year-of- the-S...](http://news.softpedia.com/news/IBM-2011-is-The-Year-of-the-Security- Breach-224465.shtml)

<comment><USER39> "Stop fucking ruining people's lives"

Serious, legit question here. How many lives will be ruined by this breach of 50k? How many lives were ruined when 40 million CCs and 70 million accounts (address, phone number , etc) were stolen in the Target breach?

Ruin seems like an awfully strong word here. I hesitate to say that because I don't want to downplay the importance of security. But to take security seriously I think we also have to be non-hyperbolic about the consequences of not doing so.

<comment><USER40> I think you're going to need to define what a ruined life is. I doubt getting a replacement credit card in the mail will ruin someone's life under most definitions.

<comment><USER39> One time I got an e-mail from Amex saying my account may have been compromised and to click a link. Fearing a phishing attempt I went direct to their website and logged in. A big red banner said to contact them ASAP. I called a number they gave. They asked if I ordered plane tickets for Turkey. I said no. They said ok, no worries, they auto-blocked the purchase. We went through my history to make sure everything else was correct, it was. The card was cancelled and they mailed a new one overnight. It was under 22 hours from e-mail to new card in hand. I was very impressed.

My sister has info stolen from a fake pad at a gas station. It was a debit card. She got all of her money back but it took close to 6 weeks to fully resolve. If you live paycheck to paycheck, and at the time she wasn't too far off, that can be a very difficult situation. It worked out in the end but it was definitely painful for her.

By and large these are not "ruined life" events. Identity theft and fraud are, unfortunately, common and mainstream enough that hitting "ruined life" level is exceptionally difficult. Back in the 90s when the average person didn't know those terms it might have been more common. But now it's just something that everyone, individuals and corporations, have to deal with.

</comment></comment></comment></comment><comment><USER41> Is this a signal that we should expect another large round of funding for Uber?

</comment><comment><USER42> I hope the authorities got hold of this data to check which drivers aren't paying taxes.

</comment><comment><USER43> No info as to _how_ this was exposed. Were they storing data as plain text?

<comment><USER44> probably, yes. storing data in plain text is common practice and not really a problem.

<comment><USER24> I would actively insist not storing PII in plain text unless there was absolutely no way around it. And it may involve changing the business model to enforce that certain data is not needed to be actively processed by the web application in the ordinary course of business. This is part of the security pushback phase that is essential that more developers adopt as a matter of professional ethics.

</comment></comment></comment><comment><USER34> Why is data lost all the time?

Because lists of data exist.

Why do they exist?

Because everyone is using Excel.

</comment><comment><USER45> the amazing thing i found uber is after all the gaffe, privacy leak and maybe more. it still grows in such a speed. it surely means something big

</comment><comment><USER46> Is this what a 40 billion dollar startup looks like?

<comment><USER47> You're officially a billion-dollar corporation, when you start being careless with people's private data. :)

<comment><USER46> Ok you got me there. :-)

I just think that this is a company with no product, no business model, horrendous business practices and somehow their valuation is still higher than the entire market they operate in. At least their not selling the data to the IRS, right?

</comment></comment></comment><comment><USER48> On an unrelated note - does anyone want to be a co-founder of an uber competitior?

I got 50k drivers ready to drive for us. :P

</comment><comment><USER49> Good to get this news out there on a Friday afternoon.

</comment><comment><USER50> Between this breach, and the impending classification as a cab company by more and more major cities. I think that we can consider Uber to be either the walking dead or something very close to it at this point.

<comment><USER51> I think it's a bit premature to count Uber out. They have an absurd amount of money in the bank, and they take on a very small amount of the risk of their business. I don't think that this data breach will have the slightest impact to their bottom line.

If they get classified as a cab company in a particular market, they'll sue. If they don't get their way, they'll exit the market. They could also move into other businesses which are clearly not cabs, as shown by their dabblings in courier and delivery services. Consider how many startups are paying people to drive things from point A to point B -- that entire industry could be outsourced to Uber.

If they do exit a market, they won't lose anything besides face -- it's the drivers who will carry all of the capital investment and most of the operating costs, they're the ones who will be hurt.</comment></comment>


Ask HN: What has your experience on the Bitcoin subreddit been? - <AUTHOR> I found it to be quite the worst place to be on reddit. I'd heard that there's notoriety for callousness with insults being hurled every which way but I experienced it myself.
Curious what other people's experiences have been line on there.
Also, are there alternative places where civil discourse on the future of bitcoin and cryptocurrency in general is done? <comment><AUTHOR> I don't think I'm ever going back there. There's gotta be a better forum to discuss bitcoin.</comment>


Spreading Like Wildfire: An Interest in Making Electric Power Public - <AUTHOR> https://ilsr.org/municipalization-electric-utilities-update-2020/ <comment><AUTHOR> Excerpt:

"Governor Gavin Newsom has called the bankruptcy filing a "Godsend" for the _opportunity to create a safer public utility that serves the people_. The bankruptcy of PG&E presents a unique opportunity to buy grid infrastructure and redirect investment into public goods, like resilient solar and battery storage, _rather than private profits_."</comment>


If You Want My Trust, Give Me Control of my Data - <AUTHOR> http://radar.oreilly.com/archives/2007/12/trust_data_control.html

<comment><USER2> This is really true. Whenever I'm designing a system, I have to remind myself not to think just, "wouldn't it be cool if I knew X about everyone else," but also, "would I really want everyone else to know X about me." You can't have the first without the second.</comment>


Ask HN: Creating your founding team? - <AUTHOR>

We're a two man shop, UpOut, trying to raise a seed round (around $250k to $300k) within the next month or two. Therefore, it's time to put together our founding team. We want to bring on an extra 1 or 2 developers and 1 designer and give some money and equity.<p>Anyone have experience with getting employee 1, 2 and 3? <comment> rush-tea Nice website. Original idea. Hope it works out.

can you elaborate on your question? is it something like where and how to recruit? what equity and money you want to give? It's not very clear on what you ask.</comment>


Phoenix Focuses on Rebuilding Downtown, Wooing Silicon Valley - <AUTHOR> http://www.nytimes.com/2016/06/19/us/phoenix-focuses-on-rebuilding-downtown-wooing-silicon-valley.html?mabReward=CTM&action=click&pgtype=Homepage&region=CColumn&module=Recommendation&src=rechp&WT.nav=RecEngine&_r=0 <comment><AUTHOR> I lived in Tucson for four and a half years and will note that Phoenix has many obvious downsides. But this is a good sign:

 _this city's ... mayor, Greg Stanton, hung his re-election campaign last year on a push to raise the sales tax to pay for the extension of a light-rail system linking downtown to other parts of the city and beyond. Voters approved it._

The focus on downtown is a good sign. The Phoenix area has at least one excellent bookstore in Changing Hands. It's also way, way less expensive in a TCO sense than many hot coastal cities, including SF, Portland, Seattle, Boston, and others.</comment>


The tech industry: one or many? - <AUTHOR> http://daltoncaldwell.com/the-tech-industry

<comment><USER2> Could this be a 'software eating the world' effect: tech is now a part of all industries instead of its own?

</comment><comment><USER3> "tech industry" by itself is meaningless. That's like having a "things made of plastic" industry.

Near the end he talks about the 2000 kablooey with his anecdote of a very focused "Enterprise B2B-focused Tech Crapping Itself" event, which makes sense when all your Big Business Tech Things just broke the stock market for five years.

The big failures don't impact all the tiny startups now because tiny startups are, by definition, tiny. A single blade of grass does not fear the wind. But, some tech startups are bamboo and become big really fast and then fall over (sometimes not fast enough in the case of zynga and groupon). The bigness came from a seed not long ago, so it didn't have time to get ingrained into society to have any detrimental impact when itself kerplodes.

Ergo, QED, ad infinitum: the current tech failures aren't a symptom of people doubting the future of technology, digital things, and their impact on society, but rather just people manipulating the system for personal gains as fast as possible then flaming out. As long as those cases stay isolated, we're fine. When hundreds of companies collude to do it all at once, we collapse for another five years (unless you're banking, then you collapse for 18 months, regain all your power, and leave the world struggling worse than before).

</comment><comment><USER4> Information technology has its unique attributes. One of them is it's about information, which means technology in this regard could live in almost everywhere as long as information is one related element.</comment>


A second is a long time - <AUTHOR> http://blog.serverfault.com/post/per-second-measurements-dont-cut-it/

<comment><USER2> I agree with the general point that you might be over-smoothing if you graph data with large window sizes, but you don't have to change the units on the graph as well, and probably shouldn't, since "Mbit per half second" is a confusingly nonstandard unit--- the units of measurement and the granularity of measurement don't have to be tied. An Mbit/s is a _rate_ , and you can graph the rate in that unit for data points taken over a window of 1/2-second also.

Same as how in physics, lots of things are expressed in rates of "per second", but this does not necessarily imply that the measurement window was one second; it might be vastly larger or smaller than that. Or, with cars, you can measure the speed in mph or km/hr much more frequently than once per hour. =]

</comment><comment><USER3> I think he's made some unfortunate mistakes with his language and use of units:

" _we could transfer 900 Mbit for a half of a second and another 100 Mbit for the other half of that second. How much data was transferred during that second? The answer is 1 Gbit per second._ "

"for" implies multiplication, i.e. 2Mbit/s for 3s transfers 6Mbit in total, 2Mbit/s * 3s = 6Mbit. The phrase "900Mbit for half a second" should probably read "900Mbit _in_ half a second", giving 1.8Gbit/s (and thus supporting the point of the article).

"The answer is [ _not_ ] 1Gbit per second", it is 1Gbit. It is a measure of data, not transfer rate.

He makes a good point though, averaging may mask important details.

<comment><USER4> It's ambiguous and either interpretation holds. '900 Mbit for half a second' is meaningless and requires correction. Either for -> in or Mbit -> Mbit/s.

</comment></comment><comment><USER5> The resolution of data and units the data is expressed in are orthogonal. You can still use X/second units but report 10 samples per second. Changing the units is confusing. I don't have an immediate frame of reference for how fast Mb/half-second is without doing a conversion in my head.

</comment><comment><USER6> _For example, we could transfer 900 Mbit for a half of a second and another 100 Mbit for the other half of that second. How much data was transferred during that second? The answer is 1 Gbit per second._

The dimensional analysis doesn't work here. He asks for a quantity of data and answers with a transfer rate. Also it shouldn't be surprising that the instantaneous transfer rate at a given time is different than the average transfer rate over a period of time.

</comment><comment><AUTHOR> It's a fabulous troubleshooting effort made by the admins - "we saw we would frequently burst the 1 Mbit per millisecond rate of the so called 1 Gbit/s interfaces"

</comment><comment><USER7> > This effect is made even worse by most monitoring tools because most take > samples every 5 minutes.

Who exactly is using monitoring tools that sample every 5 _minutes_? Goodness. Maybe I've been spoiled, but I couldn't imagine using such a blunt tool.

<comment><USER8> Munin, the package that charts performance and usage metrics, does so at 5 min intervals by default. But its purpose is to show historical trends (it tracks every single metric for the past year), and its users are expected to understand that it doesn't help for the kind of thing this article is about.

</comment></comment><comment><USER9> rrdtool[1] can be configured to "merge" measurements in various ways: by default, the pixel at (say) "4min" is an _average_ of the measurements at (e.g.) 3:30, 3:40, ..., 4:20 [2], but it can also be configured to be the _maximum_ (or minimum, or median) of these measurements.

[1] the database and graph software which underlies most (Unix?) server monitoring tools, including e.g. Munin and Cacti.

[2] Or the measurements at 4:00, ..., 4:50, or those at 3:10, ..., 4:00; I forgot, and it's not important.

</comment><comment><USER10> What you need is standard deviation and other stats of all the samples.</comment>


The strange contagion of a dream - <AUTHOR> http://www.thespacereview.com/article/2611/1

<comment><USER2> This is a strange piece of writing. Two things stand out in particular:

First, it paints Von Braun as a visionary hero doing what it took to survive during the war, under pain of death. Von Braun's moral position was much more problematic than this. The best you can say about his stance during the war is that he was not an ideologue, but an opportunist. Holding him up as an example of moral courage is a perversion of history. "I aim at the stars (but sometimes I hit London)." There are excellent biographies of Von Braun that go into rich detail about his conduct during the war.

Second, the article argues that Korolev and Von Braun somehow manipulated their respective countries into funding their dreams of human spaceflight. Given the obvious military applications of rockets that could launch large payloads into orbit, and the huge advantage this technology would give any nuclear power over its rivals, the suggestion that human space flight would not have happened in the 1960's without these dreamers is fantasy.

Military planners at this stage of the Cold War were thinking seriously about armed space stations (and the Soviet Union in fact built one). Moreover, questions of who could put a human being in orbit first, and who could put people on the moon, were universally recognized as prestigious technological achievements with immense propaganda value.

<comment><USER3> > The best you can say about his stance during the war is that he was not an > ideologue, but an opportunist.

The best expression known to me of this is Tom Lehrer's song "Wernher von Braun" (e.g., [https://www.youtube.com/watch?v=TjDEsGZLbio](https://www.youtube.com/watch?v=TjDEsGZLbio)).</comment></comment>


Functional programming explained in Clojure with a terminal-based game - <AUTHOR> http://www.braveclojure.com/functional-programming/?again <comment><USER2> I'm sure this is great walkthrough. Although I'd like it if there weren't headlines like "FP explained".

I realize this may be pedantic, but If I've learned anything about FP, the term means different things things to different people, and a statement which makes universal claim about FP _In General_ then will misrepresent the other flavors of FP.

At least qualify it somehow. Actually, why not just say something like "Terminal-Based Game Walkthrough in Clojure"?

<comment><USER3> Maybe I'm a "glass is half full" kind of guy, but explaining one kind of FP (rather than all of them) still counts as "FP explained" in my book.

<comment><USER4> I agree. I think of it like 'x' explained (from 'y' perspective or with reference to 'y'). e.g. 'Woodworking Explained, master the lathe"

</comment></comment></comment><comment><USER5> How does Clojure handle piping state through a series of functions? Is there anything like monads in Haskell to abstract it away? Haskell makes immutable data a little bit more tenable because you don't need to explicitly thread your state. How does Clojure handle this? Does it provide escape hatches for mutable state, perhaps restricted to using Java libraries?

<comment><USER6> For very simple cases there are the threading macros, `->` et al., that you can use like this:

      (-> state
          (assoc :a val)
          (update-in [:b :c] f args)
          (dissoc :d)
          (some-other-fn args))

where :a - :d are keys.

Or you could use monads in much the same way as you would in Haskell; there are libs for that.

Or you could write a new macro (or maybe even function) that does exactly what you want. I did that for a game. It looked like this:

      (call-update-fns game-state hook
        (update-monster-positions)
        (update-monster-ai)
        (let-characters-attack)
        (some-other-stuff))

It would thread the game-state (immutable) through all the functions, and call hook (a function) in between all the functions to send network messages and stuff (to minimize latency), and also collect and return new events that the functions created that I needed to handle (e.g. someone died when the characters attacked). It's almost like the state monad but not quite.

<comment><USER7> And there's synthread[1] for more complex cases:

       (-> {:a 1 :b 2}
         (->/assoc :a inc)
         (->/as {:keys [b]}
           (->/when (> b 10)
             (->/assoc :large-b true))))

1: [https://github.com/LonoCloud/synthread](https://github.com/LonoCloud/synthread)

</comment></comment></comment><comment><USER8> This site is an amazing resource. Higly recommend it if you want to learn Clojure

</comment><comment><USER9> I've started diving into Clojure...or rather drinking it's Joy from the firehose due to a birthday Barnes and Nobel gift card used for Fogus in the first edition [I'm cheap]. To me, this discussion of pure functions is distinctly not Clojuresque. Clojure is the _Love Child of Common Lisp and Java_ ™ both of which are distinctly pragmatic languages and neither of which is bogged down in a theory of pure anything.

Clojure is structured to _limit_ mutability to allow for reasoning about state in an environment with concurrent processes, but it expects this reasoning to be done in the context of professional programming, not the ivory tower of academics. It's idea of functional programming is in the history of Common Lisp, and a good description of it is given by Graham in chapter 3 of _On Lisp_ :

[http://unintelligible.org/onlisp/onlisp.html#SEC23](http://unintelligible.org/onlisp/onlisp.html#SEC23) or [http://www.paulgraham.com/onlisptext.html](http://www.paulgraham.com/onlisptext.html)

Essentially, the idea is to isolate mutation - just like Haskell and for exactly the same reasons but without an explicit proliferation of types.

So long as we have von Neumann machines, we're going to have mutation. The goal is to abstract as much of it away as possible to facilitate the management of state. But it never goes away, and we shouldn't imagine or try to convince ourselves that that it does...nor that it should, completely.

Polemic over; still a good article and worth a read. Certainly got me thinking.

<comment><USER10> I think you may be misunderstanding a few things, and I hope I can clear them up :) First, the term "pure function" does not imply "ivory tower" any more than "recursion" does. Pure functions are tools that allow you to "isolate mutation". In fact, Paul Graham mentions that experienced lisp programmers "try to segregate side-effects in a few functions, allowing the greater part of the program to be written in a purely functional style" ([http://unintelligible.org/onlisp/onlisp.html#SEC27](http://unintelligible.org/onlisp/onlisp.html#SEC27)). So - don't let the terminology throw you :)

Second, the point of the point of the chapter is to show how much can be accomplished without mutating data structures. I think that's something valuable to focus on. Saying "You can do a lot with pure functions and immutable data structures" is not the same as saying "You'll never need to mutate anything" and as the author, I apologize if my writing suggests otherwise :(

Lastly, Clojure definitely places a huge emphasis on limiting mutability by using pure functions and immutable data structures. I think Rich Hickey even describes pure functions as stable bricks or stable atoms in one of his talks. My impression is that it's definitely not the love child of common lisp and java. Clojure is pragmatic, but that doesn't mean it doesn't place an emphasis on functional programming. I agree that it's "not bogged down in a theory of pure anything", but that doesn't mean it wasn't intentionally designed to support and encourage programming with pure functions and immutable data structures.

<comment><USER9> The article well written. It didn't throw me or make me confused. I simply was bothered by the lack of nuance in regard to mutation. Trillions of pixels have been burned describing pure functions and giving small examples of immutability and recursion. Trees have even been killed.

What makes Chapter 3 of _On Lisp_ or _SICP_ useful is they're Third Acts. They go deeper than pure functions. They're pivotal because that's where we start talking about the messy world where mutation is necessary. It's where we admit that there's a rationale for the way Java works even if it's implementation could stand improvement.

What makes Clojure interesting is the way in which it implements that depth. Lisp went on a journey to Java and was transformed by the experience. Clojure is not just another Lisp - that side of the family has always had shared structure and a propensity for functions. There's `is` and 'testing` and agents and vars and `.` and `..`. JavaScript the good parts is a book. Java the good parts are in Clojure. Clojure is an Act V not an Act I.

<comment><USER10> The book chapter aside, I think you might actually have it backwards. Hopefully I'm not misunderstanding you terribly! The reason why PG has to spend as much time as he does warning programmers about hidden ways in which Common Lisp mangles your data structures (nconc, for example) is because Common Lisp does not come with immutable data structures out of the box. My impression is that he's telling you how to work as well as you can (strive for purely functional code) with the tools at hand. Clojure, on the other hand, was built so that you could code without having to worry about that stuff by default.

Also, you say that lisps have "always had shared structure." I'm not sure what you mean by that? Clojure implements _structural sharing_, which is what allows it to have persistent, immutable data structures. Common Lisp certainly doesn't do the same.

I'm not sure what you mean by "Lisp went on a journey to Java and was transformed by the experience." I think you're saying that Rich Hickey designed Clojure to be a lisp that's more Java-like? Could you explain how? My impression is that Rich Hickey thinks OO is broken (see the talk "Are we there yet?"), as is the notion of mutability as implemented by Java. Clojure's interop with Java is a great convenience, but the emphasis is still on functional programming. I don't think I understand what you're saying, or maybe it's just that we disagree?

Finally, from clojure.org: "Clojure is predominantly a functional programming language, and features a rich set of immutable, persistent data structures. When mutable state is needed, Clojure offers a software transactional memory system and reactive Agent system that ensure clean, correct, multithreaded designs." Maybe it's these state management features you're concerned about? If so, then I would suggest that vars, atoms, refs, and agents are not as inspired by Java as you're saying. Or maybe we just disagree that, the majority of the time, you should be writing pure functions and using immutable data structures in Clojure?

<comment><USER9> PG isn't warning any experienced Common Lisp programmer about `nconc`. The [n] at the front means it's destructive...there's also `nsubst` and `nreverse` and `nstring-capitalize`. They all exist in Common Lisp to allow a programmer to avoid consing and the subsequent garbage collection. In other words, they exist to allow a programmer to optimize their code. They exist as exceptions to idiomatic Common Lisp practice of returning values in lieu of mutating locations. Sure it is not as idiomatic in Common Lisp as in Clojure in part because Common Lisp is largely a product of its time and that time was largely single threaded.

Avoiding mutation in Common Lisp is even less idiomatic than it is in Scheme - where there are not destructive versions of various functions by default and idiomatic practice is mutation is signaled with a bang [!]. But again, the preferred approach is persistence and writing side-effect free functions. Indeed at the front edge of Scheme, Racket implements immutable data structures by default.

Idiomatic functional style and defaulting to immutable data structures are not what makes Clojure unique as a Lisp - it's knob twiddling, not a new paradigm. It has some great built in syntax that allows for the best part of Lisp-2 programming - i.e. symbols representing a collection acting as functions over the collection and the association of a meta-data map with a symbol like a plist. But it's evolutionary as a Lisp.

On the other hand, though not unique, idiomatic functional style and defaulting to immutable data structures are unusual in relation to the Java platform. Its relationship to the Java platform is what makes Clojure unique. STM is not a product of it's Lisp heritage. Neither is it's implementation of objects with via interop [largely eschewing objects despite availability is also idiomatic Lisp].

Understand, I'm writing to think. What you've written is just a starting point I can use as an excuse for saying what I was primed to say anyway. Like I said in my original comment, I was already drinking from the Clojure firehose.

So what's the upshot? Well what did your article say that hasn't already been said before about functional programming? Why not point people to Chapter 3 of Graham? It's more convincing for those who need convincing and more in depth for those who don't. Why not point people to _The Value of Values_ , it's again more convincing for tire-kickers; a comfortable sermon for the newly converted, and a reference point for those already in the cult.

What really makes Clojure unique?

<comment><USER10> I don't think I read On Lisp the same way. From 3.1: "If a function is advertised as destructive, that doesn't mean that it's meant to be called for side-effects. The danger is, some destructive functions give the impression that they are. For example,(nconc x y) almost always has the same effect as (setq x (nconc x y))". Calling it dangerous sounds like a warning to me. I definitely agree, though, that he makes the case that the preferred approach is writing side-effect free functions. I'm not sure what you mean by "persistence" though, because Common Lisp doesn't have persistent data structures.

I don't know if its emphasis on functional programming and values makes Clojure unique, but that's definitely one of its core design concerns. The "article" is a chapter from a book on Clojure, and learning to write in a purely functional style is essential to learning Clojure. The point of the chapter isn't to get to the heart of what makes the language unique, it's to offer instruction on how to use it.

<comment><USER9> Here's the recycled cons at the car of _ANSI Common Lisp_ section 12.4:

 _Common Lisp includes several functions that are allowed to modify list structure. These functions are destructive for reasons of efficiency. Though they may receive conses passed to them as arguments, they are not meant to called for their side-effects._

 _For example,_ delete _is a destructive version of_ remove _. While it is allowed to trash the list passed to it as an argument, it doesn 't promise to do anything. This is what happens in most implementations:_

       > (setf lst '(a r a b i a))
       (A R A B I A)

       > (delete 'a lst)
       (R B I)

       > lst
       (A R B I)

_As with_ remove _, if you want side-effects, you should use_ setf _with the return value:_

       (setf lst (delete 'a lst))

Because garbage collection and homoiconicity can sometimes feel like magic, it can be hard to think of Common Lisp running closer to the metal than a language like C. But it does. Cons cells are locations in memory, and symbols are pointers and there's nothing in between. A programmer doesn't even get `free(array)`. Memory locations can be shared willy-nilly because just as in Clojure, two distinct lists/sequences can share a tail. From _ANSI Common Lisp_ section 12.8, "Constant Structure":

       > (defun arith-op (x)
           (member x '(+ - * /)))
       <function:arith-op>

       > (setf lst '(as it were)
       (AS IT WERE)

       > (nconc (arith-op '*) lst)
       (* / AS IT WERE)

       > (arith-op '-)
       (- AS IT WERE)   ;; bad

       > (arith-op 'as)
       (AS IT WERE)     ;; even worse

"Oh Shit!" moments like this are why Lispers like Graham developed a functional programming style. It's a lot of what motivated the design of Scheme. It's not really what motivated Clojure because Java already solves this problem. Clojure is designed to solve the problems Java doesn't more easily.

That fundamental goal is why what makes Clojure unique matters when explaining Clojure. It's also what makes Clojure a less than ideal vehicle for teaching functional programming style - it's designed for programmers who are solving problems on the JVM [or CLR or V8], and not really so much as a general purpose language. It's designed around interop. As weavejester says in his linked talk, Clojure is a Java library.

There are better languages for teaching functional programming - Scheme/Racket. What makes them objectively better is that helping people learn to program in a functional style is one of the problems they are trying to solve, and they have almost four decades of development toward that goal. Education is entirely orthogonal to Clojure, even more so than Java with its two decades of introductory text development and promotion via vocational arguments in CS departments. And, Racket/Scheme isn't trying to solve JVM problems.

Teaching functional programming style is hard, but a largely solved problem because the internet allows pointers to excellent materials.

[http://learncodethehardway.org/blog/AUG_19_2012.html](http://learncodethehardway.org/blog/AUG_19_2012.html)

<comment><USER10> You're right about being able to point to the same tail from two different lists in common lisp, of course. I'm not very experienced with scheme so I can't comment much on that. Clojure is different in the way it implements its data structures, so "structural sharing" in that context refers to its use of tree structures to implement vectors, maps, etc.

Still, though, I think you have it wrong about Clojure's design. You mentioned the talk "the value of values." Immutability and functional programming are core to Clojure's philosophy. This is pointed out on the clojure.org home page. I'm not sure why you think it's not?

Also, Clojure is meant to be a general-purpose language. Also from the home page: "It is designed to be a general-purpose language". So I'm not sure why you think otherwise? I started learning Clojure with 0 experience with the JVM, and many others are doing the same.

I'm also not sure what you mean by "education is entirely orthogonal to Clojure." I think you're commenting on the value of producing an introductory Clojure book? In any case - you mention that "there are better languages for teaching functional programming." The point of Clojure for the Brave and True is not to teach functional programming, it's to teach Clojure.

<comment><USER9> If the purpose of _Clojure for the Brave_ is not to teach functional programming, why bother teaching it? Why go through the motions when not fully committed? Is it better than pointing the student to excellent resources despite those resources using another form of Lisp?

To put it another way, is anyone really going to know Clojure without knowing the something about _SICP_? Is there anything out there that more fully captures Clojure's definition of functional programming than _On Lisp_ or _Learn You a Haskell for Great Good_?

OK so here's where we differ. It's in our definitions [what could be more Clojuresque] of "learning Clojure". Sure, Clojure's syntax takes an hour versus the thirty minutes Ableson takes to cover Lisp syntax including the substitution model. Then what?

Well I'm saying the two things a person needs to learn Clojure are the practices already described in four decades of Lisp's literature and the Clojure interop. Without either piece, I won't know Clojure.

[http://norvig.com/21-days.html](http://norvig.com/21-days.html)

<comment><USER10> The book covers functional programming because Clojure places a heavy emphasis on functional programming, and learning it is essential to learning Clojure. The book is not "Functional Programming for the Brave and True, with Clojure as the Medium." That doesn't mean that I'm merely "going through the motions" and am "not fully committed" to helping people understand functional programming, and it's bizarre, presumptuous, and rude that you would suggest that. At this point, it seems to me like you're merely being argumentative.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> Does anyone else find Clojure's syntax a bit obtuse? I feel like basic recursive definitions are much clearer in Haskell and ML. To sum over a list using an accumulator shouldn't take more than two or three trivial lines of code.

<comment><USER12> Pattern matching would be nice, but destructuring helps.

        (defn sum-acc
          ([xs] (sum-acc xs 0))
          ([[x & xs] acc]
            (if (nil? x)
              acc
              (recur xs (+ x acc)))))

Could you show Haskell equivalent?

BTW there should be a macro that adds argument with default value.

<comment><USER13> I believe it should be something along the lines of:

      sumacc xs = summer xs 0
        where summer [] n = n
              summer (x:xs) n = summer xs (x+n)

I'm sure there are macros in some library somewhere that implement pattern matching in lisp (regardless of dialect).

</comment></comment></comment><comment><USER14> Thanks! This was awesome to visualize some abstract concepts I've read about but never implemented.</comment>


SeanBoard – A Big Sean Soundboard of Ad-libs and One Liners - <AUTHOR> http://www.seanboard.com

<comment><AUTHOR> #swerve

</comment><comment><USER2> paid forever</comment>


Ask HN: Vibrating band or bracelet for android device - <AUTHOR>

I am looking for a band or bracelet like device that can be worn on my hand and paired with my android mobile (Moto X). I just saw a device by Alcatel named Boomband at http://www.engadget.com/products/alcatel-onetouch/boomband/
I often keep my device silent and cannot feel or hear it vibrate if I am not near the device. Plus when I am out, the ringtone is often drowned by the surrounding noise. The only similar device I found was Fitbit Charge and seems too over-priced.
So I am looking for a reasonably priced durable device with good battery life. <comment><USER2> There is a whole category of not-quite-smart Bluetooth devices that only do ringer and caller ID. A google search, or if you are looking for rock bottom prices, a search on Aliexpress for _bluetooth ringer bracelet_ will give you many options.</comment>


Highr.io - <AUTHOR> https://highr.io/#/

<comment><USER2> "It's only mystery and I like it", anyway I entered my email ;)</comment>


What was the code quality of the initial version of Google? - <AUTHOR> http://www.quora.com/What-was-the-code-quality-of-the-initial-version-of-Google <comment><USER3> The irony is that this is _still going on_ at Google, and presumably everywhere else in the industry as well. Some new strong-willed engineer joins, takes a look at the code, declares "This is amateurish. We should be doing so much better," and then gets a whole bunch of people to rewrite it, usually in a different language, with a different style of coding.

I'll credit this with a major shift in my thinking about what constitutes "good" programming. From the outside, I looked at Google and thought "wow, they're accomplishing amazing things, they must have amazing engineering practices". And yeah, things are pretty rigorous...but what I found was that the people who were, by and large, _responsible_ for all those amazing things didn't care. Most of them had fairly loose preferences for favorite programming languages, and favorite development methodologies, and basically ignored the fad du jour. What they _did_ have was an obsessive focus on the user, and on getting things done so they could move on to get other things done. Navel-gazing about what language was best or whether we should be using OOP or how stupid the previous engineers were was generally reserved for the B-players. The As were thinking about how we could return results as you type, or how we could process real-time microblog feeds, or how we could expose new and potentially groundbreaking new features without losing millions of dollars from UI tweaks.

Basically, the code quality of the initial version was "good enough", as was the code quality of every subsequent version of Google (except when it wasn't, which is when it got rewritten), and that's all that mattered. As long as you can do useful things for the user, it doesn't matter whether your coworker thinks you're a 1337 hacker.

<comment><USER4> _What they did have was an obsessive focus on the user_

I'm surprised to read this. Google's products never seem to me to be the result of an obsessive focus on the user. Rather they seem to be the by- product of an elegant engineering concept, with the interface something of an afterthought.

<comment><USER3> Good UI design is invisible - if your UX designer is doing their job, you will never even think about them. For things like Search, GMail, and Maps, the user need's definitely come first, and then the elegant engineering is a byproduct as people try to figure how the hell to implement the product they have in mind.

The notable flops have been the ones that have been driven by an elegant engineering concept; in particular, one of the major differences between Wave and GMail is that Wave seemed to ask "What can we do, and how should we expose that to the user?" while GMail (pre-Labs) largely asked "What _should_ we do, and how can we figure out how to implement that?"

<comment><USER5> > _if your UX designer is doing their job, you will never even think about > them._

UX is not something you can stitch on afterwards. Good UX is deeply ingrained in engineering and an omnipresent, pervasive focus of the team. I think that's what parent is referring to in regards to what Google is lacking.

<comment><USER6> That depends on the product. A 50/50 UX back end split is fairly common. But, some products need a simple interface and a ridiculously complex back end. EX: Weather map's.

</comment></comment></comment></comment></comment><comment><USER7> I was developing an app in Java at the time (1996). The Java motto was "write once, run anywhere." (everywhere?) We used to say "write once, debug everywhere." It was a mess (granted, we were using it to build a client, not a server). A San Jose Mercury news reporter and asked Eric Schmidt (who was running the Java show at the time) to respond to my claim that Java was buggy and Eric Schmidt replied with something along the lines of "If it's crashing, then they must be bad programmers."

Of course I got the last laugh because he went on to become a billionaire. Wait a minute.... maybe _he_ got the last laugh. Either way we're both laughing to this day.

<comment><USER8> > We used to say "write once, debug everywhere."

Used to?

<comment><USER9> The "debug everywhere" thing typically refers to GUIs and filesystem conventions. If you don't slavishly use File.separatorChar everywhere and let a "/" slip in there, yeah, you'll have bugs on windows.

For most code, and if you're not going to run on windows, it's not an issue. It's nothing like dealing with header files.

<comment><USER10> Maybe it's been long enough since I've written anything in Java for Windows that I've simply forgotten, or maybe I somehow never manipulated paths directly, but I don't recall having to worry about path separators on Windows. I believe I was using \ and / interchangeably, particularly by appending some cross-platform path with /s to the home directory path, which would have \s on Windows (e.g. %AppData%/.company/program/). Could it be something they fixed over time?

<comment><USER9> Yeah maybe they do an auto replace on windows, I actually haven't been bitten by the bug because I've never written a program intended to run on windows, ever :) Just happened to notice that File.separatorChar is there and that's what it's for. When it first came out, apple was using ":", anyone remember that?

</comment></comment></comment></comment></comment><comment><USER11> The most surprising thing for me: python was much more stable then java at the time.

Checking wikipedia, python was released 4 years before java. I always just assumed python was a more recent language.

<comment><USER12> The _most_ surprising thing to me was that the language choice rather than the application architecture is what's blamed (in the excerpt) for only being able to serve 10 reqs/sec.

<comment><USER13> To put this into context, at the time you would have been going via cgi scripts or maybe trying to embed directly into apache. Mod_python did not exist, asyncore was the only thing you had to do async callouts so that you did not block the thread, etc. There is a reason perl was considered state of the art for serving web pages at this point in history. To give you a bit of an example, YahooMail (nee RocketMail) was basically a bunch of html wrappers around python code to read/manipulate mbox files and you would have been amazed at the amount of hardware it required to keep that performant; google had to be faster and was doing a lot of background work that we never had to deal with.

In the late 90s there was just not the same set of options available in the standard library, people were just learning what was required for horizontal scaling, and I can easily see how the added burden that Python 1.4 would have imposed compared to C or C++ would be a deal-killer when it came time for a re-write.

</comment></comment></comment><comment><USER14> > _What surprised me was that Larry Page had lots of trouble getting his > crawler and indexer to work, partly because he was in Levy's words "not a > world-class programmer" but also because of lots of bugs in the brand new > and still unstable language he was using, which was called Java._

Reminded me of:

[http://groups.google.com/group/comp.lang.java/browse_thread/...](http://groups.google.com/group/comp.lang.java/browse_thread/thread/6923c024ed392c85)

<comment><USER15> Hey this is really strange. My user agent was not set (I thought but it was a different issue) and so I googled other solutions besides System.setProperty("http.agent", ""); and so I stumbeled over this entry. Nothing related to your finding :)

Then I posted it on twitter and yesterday on hackernews. That's why I thought that it was my finding. Sorry :)

<comment><USER14> Hey. Sorry for the comment on the other thread ( <http://news.ycombinator.com/item?id=2459123> ), I was thinking "damn, why didn't I submit this separately?", I thought it was a weird coincidence.

I think it was linked on Twitter / Buzz a few months ago (that's where I first heard of it), and that may have improved the post's ranking on Google, which would explain how you stumbled on it 15 years later ;)

Anyway, I'm glad you shared it, since lots more people got to see it.

</comment></comment></comment><comment><USER16> Slightly tangential note. I read Steven Levy's book last week - it is a _very_ good read. If you are even remotely interested in technology and entrepreneurship (which is probable give the site you are seeing this on :) ) - you should definitely go read this.

The parts on Google's early years are very nice. The chapter on Google in China is also phenomenal.

<comment><USER17> > The chapter on Google in China is also phenomenal.

Related: <http://news.ycombinator.com/item?id=2450030>

</comment></comment><comment><USER18> An excerpt from the new book In the Plex by Steven Levy, quoted in the Quora post:

"Over the course of that two years Page and Brin had figured out Backrub's applicability to web search, failed to license the technology to Excite or Altavista, and had founded their own company."

I still remember the days when Altavista was the very best at Web search, and Excite had some features that made it worth checking as a plan B. It was near the end of the two years described in the excerpt when I started noticing Backrub regularly crawling my site, which used to rely primarily on Yahoo for online search referrals. I became a Google user as soon as the Web crawling from Google identified a site I could visit to see the sender of the Web crawler in action. I became hooked almost immediately, and started telling my friends about Google in online forums as I discovered more and more pleasantly surprising highly relevant results from searches I did. Too bad for Altavista and Excite that neither company grabbed PageRank and other Google technologies when they had the chance.

<comment><USER19> As I remember it, the "highly relevant" results on Google were almost exclusively determined by a $299 Yahoo! Directory listing or a DMOZ directory listing. If you could get the Yahoo Directory or DMOZ to link to you with your preferred anchor text - you were all but guaranteed the #1 spot on Google. Of course it didn't mean as much back then, but boy was it easy.

This brings back a lot of memories. Like you said, Yahoo! was referring all of the traffic. For those of you that weren't around or don't remember - <USER2> Yahoo Directory was based on the alphabet, like the phone book. I had to beat out AAAUsedLaptops.com with exclamation-point-used-laptops.com (listed as "! Used Laptops"). No wonder Google won.

<comment><USER18> There were plenty of good websites in those days that had (and still have) DMOZ listings absolutely for free. That's even more so for the earliest sites listed on Yahoo back in its human-curated days.

</comment></comment></comment><comment><USER20> I sort of miss the time when knowing how to use Google (and knowing to use Google at all) allowed you to be instantly 10-100x smarter and more productive than everyone else. (it still applies, just not in the tech industry; being able to google to find drivers for obscure industrial or enterprise computing hardware is sometimes a competitive advantage, but that's about the limit)

<comment><USER21> I think that being skilled in the use of Google still gives you a huge competitive advantage over your peers. You'd be surprised how many people don't even think to search for answers to their problems.

</comment></comment><comment><USER22> There are two excepts of the book at the bottom of the answer that also link to a free preview of the first chapter. I'd recommend reading the preview even if you don't plan on buying the book right now.

<https://kindle.amazon.com/post/1EJFN69GTE3AN>

<https://kindle.amazon.com/post/2BJ69NQFHGN1P>

</comment><comment><USER23> What did they switch to after Python wouldn't scale?

<comment><USER21> I don't think the problem was with Python. It seems that the problem was that their code wasn't very good.

It's worth pointing out that there are lots of good tools available now (which were not available then) which make Python an excellent choice for high performance systems.

I will take my Python zealot hat off now. You just raised my hackles slightly, is all :-)

<comment><USER24> Scaling a website and scaling a search engine are two very different things. Python websites are OK, Python search engines... well: <http://whoosh.ca/blog/fools_errand>

</comment></comment></comment><comment><USER25> Backrub....

I don't recall the name, but I remember using something exactly like (the originally intended) Backrub my first year in the dorms (1996 or early 1997). The program I was using was more of an overlay where you could draw on the page (using a simple MS-paint like UI) in addition to adding text annotations. You could either keep the changes local, or share them on some central site. It's downfall, as I recall, was threefold: buggy code, popularity, and the publicly annotated copies of popular websites turned into layer upon layer of graffiti. Something like the original concept for PageRank as mentioned would've been perfect.

It was a neat concept, but really only practical (as implemented) for the static web. It died long before dynamic page generation became widespread. (I just can't remember the name of it! :) )

<comment><USER26> _I just can't remember the name of it!_

Sounds like you're talking about ThirdVoice, but I can't be certain.

<comment><USER25> Possibly something that became ThirdVoice. The concepts are very similar. Whatever it was, it had to be around in the 1996-1997 timeframe, and the sources I can find for ThirdVoice show it as starting in 1999. (Perhaps Beta?).

Thanks.

</comment></comment></comment><comment><USER27> "Larry Page's grad school project was initially designed to be a way for users to make comments and annotations on web pages."

Google has been trying to learn social since before its inception.

</comment><comment><USER28> Sold me on Levy's book.

<comment><USER29> Me too, but I just went to amazon to buy it and discovered that the kindle edition is more expensive than the hardcover:

<http://www.amazon.com/gp/product/B003UYUP6M>

<comment> brown9-2 Are you sure about this? The prices for me display as:

Hardcover, Amazon Price: $13.98

Kindle price: $12.99

The price table also shows someone selling a used "New" copy for $12.14.

<comment><USER29> Interesting, for me the Kindle price still is the most expensive:

<https://skitch.com/kroger/r4t51/shades>

<comment> brown9-2 I take it you are browsing from outside the US? That may explain things.

</comment></comment></comment></comment></comment><comment><USER30> If this was an ad for the book then it worked, just bought it and am reading it now - fantastic so far

</comment><comment><USER31> the article makes the day i ship my shit be the next week, not next month</comment>


Never Read the Comments - <AUTHOR> https://medium.com/@saraheadler/never-read-the-comments-9cba93b5712a

<comment><AUTHOR> I found it interesting that perhaps the questions were more due to the person had the degree in journalism. I am not sure which would be better for perception of the tech world, a college dropout or a liberal arts major?

</comment><comment><USER2> May I know why you are saying this? Because Reading Comments is one of the best advantage to judge the post, product or service

<comment><AUTHOR> It wasn't more about reading comments. The article goes into how you shouldn't let abrasive comments impact you. This is my first post to hackernews so I wasn't sure if I should change the title of the post to something different than the article</comment></comment>


The Problems with the Internet of Things - <AUTHOR> https://www.cascoda.com/the-problems-with-the-internet-of-things/ <comment><USER2> So your post raises correct problems. However your solution is "Use my technology" and use Google "Let's be evil" software. Another example of a Marketing that plagues our industry.</comment>


Show HN: Jira-select: a tool that lets you run queries far beyond JQL - <AUTHOR> https://github.com/coddingtonbear/jira-select <comment><AUTHOR> I recently decided to scratch an itch I've been having and put together this tool to help me (and you, accidentally), run complex Jira queries. Hopefully others find it as useful as I do.

\- Project: [https://github.com/coddingtonbear/jira- select](https://github.com/coddingtonbear/jira-select)

\- Docs: [http://jira-select.readthedocs.org/](http://jira- select.readthedocs.org/)

Cheers!</comment>


OpenDNS to stop hijacking NXDOMAN - <AUTHOR> http://www.opendns.com/no-more-ads/

<comment><USER2> It would be nice if they included a statement as to how they will replace revenue otherwise earned through hijacking errors.</comment>


Zombie Map of the World - <AUTHOR> http://static.guim.co.uk/sys-images/Guardian/Pix/maps_and_graphs/2011/09/23/zombieslarge.jpg <comment><USER2> Neat, but I really wish it also included other languages than English.</comment>


Holographic Screen - <AUTHOR> http://mind-dimension.zen.pt/2009/08/holographic-screen/

<comment><USER2> Isn't this just an AR overlay?</comment>