The Rise of the Front-End Developer - <AUTHOR> http://devblog.eduhub.nl/frontend-developer-worth-millions

<comment><USER2> The actual title of the article is "10 Skills to Become a Frontend Developer worth millions" with key points such as "#7 Be a conversion-horny UX nerd" and "#8 Write non-nerd hackable code". Of all the skills listed only one of them, the previously mentioned #8, requires some degree of vague technical proficiency. The other points involve having a desirable personality trait or simply using an existing web service. If that is worth millions hire me. I am UX-horny and I know how to click buttons and watch pretty graphs.

<comment><USER3> The talk / post is meant for frontend developers. So if you're a great frontend developer, and you have these skills, I'm sure you're worth millions. My whole point is that simply churning out HMTML/CSS/JS isn't enough anymore, you need more skills these days...

</comment></comment><comment><USER4> Thanks for this article. Eduhub is doing exciting agile development and they have chosen a great business model (scalable lead generation).

I am a front-end developer too. I also like conversion rate optimization -- you have to expand your skillset, but value standards adherence, accessibility and performance as core features for a good front-end developer.

May I be so bold as to suggest that you eat my dogfood? At a glance I'd fix the 52 Validation errors and 34 warnings for W3C validation of the homepage. I'd also look at Google page speed/Yslow and follow their tips: minify your css and javascript, combine other resources, and leverage browser caching. Should make a hefty difference in performance on a site of that scale and traffic.

Or at least look at adding performance and standards/accessibility in your top 10 as a front-end developer. Marketing, your SEO or statistics co-founder can always do your A/B tests, bar maybe the technical implementation (though Visual Website Optimizer is very easy to use and implement). As my mom used to say: finish your plate first, else you won't get your dessert :)

<comment><USER3> Thanks for the feedback! We'll certainly work on the points you mentioned, although validation is no goal in itself for us. We just hired our first frontend developer actually, so far we are still recycling the original (very well validating) templates an external agency made for us, but of course over time they've "broken" in terms of validation.

Optimizing is something we'll do for sure in our redesign since we'll redo all the HTML anyway. My guess is that it won't be a hefty difference as you suggest, since our pages already load in 1,6s on average for NL users (via Pingdom).

We can go a bit further in caching with Nginx too btw.

On your last point: to a certain extent it's true that the SEO or other marketing guys can also make tests. But in practice, for the most interesing tests you really need a frontender, the basic stuff you can do with VWO and some CSS hackery doesn't bring us much anymore.

Be sure that we try to eat our plate, but we won't eat it for the sake of emptying it. Desert might be more efficient, and there's always the next meal (day) with new opportunities that need chasing. You're 100% right in theory, but not in practice :)

<comment><USER4> Yes, I heard somewhere deep under the hood eduhub.nl is WordPress. Code can be poetry ;)

Validation offers little business value. My reply was perhaps a bit old- fashioned. Why eat your plate, when you can only eat desserts? But validation is a prerequisite for accessibility. Accessibility may or may not add business value -- like an architect that designs houses for people between 190 cm and 165cm might not ever face a problem.

I think Pingdom is not about page speed, but ping speed. Things like javascript resources won't be downloaded in parallel right now, no matter the Pingdom score: combining your 7 jQuery plug-ins will increase page speed.

You really need a front-ender for the exciting stuff, I agree. A statistician with front-end experience would be even better.

I understand that in iterating fast like you are, you might leave some crumbs, to move on to bigger and better things. But also in practice, as a good front- end developer, part of a good team, it is possible to validate and speed- optimize even the largest of sites.

And the multi-functionality you rightfully demand from a front-ender, you can extend to every scrum team member. That means if the front-ender hands in a valid template, back-end devs should take care (know just enough) to not invalidate it.

<comment><USER5> You heard that (partially) wrong. The only part of Eduhub that is Wordpress is the article section and then only the backend part of that. All the article views and the rest of the site are served by CakePHP.

Most (not all) of the validation errors on our page are caused by external Javascripts (eg. VWO) by the way. But you do raise a valid point about some performance related issues, like minifying JS/CSS and combining files. The good news is, we're working on that!

</comment></comment></comment></comment><comment><USER6> Does anyone know if there's a guide anywhere on how to write the 'non-nerd hackable code' described here? Sweet article btw.

<comment><USER7> You might be surprised at how easy it is for non-nerds to hack on HTML a bit.

Here's my guide:

1) Use CSS! Hide all that confusing color and placement code away from them.

2) Emphasize readability in the code. Spacing between sections, everything on it's own line, comments that tell even non-programmers where to put things (header, content, footer, etc)

3) MVC. Especially templating. Keep real code away from the stuff they'll be changing, like text and images.

Having said that, is it worth it? Only the parts that help programmers (including yourself) as well. Most clients will not get their hands dirty in this stuff out of simple fear, and they certainly won't pay you extra for it. (Assuming you gave a single quote up front and aren't getting paid hourly.)

<comment><USER3> On your last bit: I think clients indeed wo't pay for stuff like that, yet. They're learn the coming years that you either have to have a dev team (incl. front-enders!) in-house, or you should work with your agencies like they share your goals. Only then will they start to appreciate things like code quality...

<comment><USER8> Believe me, they won't ever appreciate code quality - they just care that it works. Clients get more hung up over a typo than clean markup!

</comment></comment></comment></comment><comment><USER9> Hmmm, the list of skills, that should be interesting because it seems to be the core of the "millionaire" thing, is in Dutch. Ouch!

<comment><USER3> The disclaimer is not actually to be read, it's just a joke to say that I am just listing skills as I see them, from my limited perspective as a business- owner :)</comment></comment>


Ask HN: Co-workers at my startup are frequently sick - <AUTHOR>

I work at a startup in San Francisco. We're all packed into a very small office, work hard and stay late.
Folks frequently get sick, sometimes 1-2 times per month. I feel as though I've been sick more often as we add more people.
I wonder what may be causing it, or if anyone else in a similar environment is experiencing the same thing, and how to avoid the issue. <comment><USER2> It could have something to do with the indoor air quality (search for 'Sick building syndrome: <http://en.wikipedia.org/wiki/Sick_building_syndrome>). I've worked in an environment where the air quality was lacking, and I always felt horrible after a couple of hours. Do keep in mind that in a packed office, with multiple computers, printers et al the CO2 levels will skyrocket.

Ventilation is important, as is cleanliness and excersise. If the problems persist, look out for a bigger office!

</comment><comment><USER3> Instead of asking what makes you sick, rather look at what keeps you healthy.

General health tips:

Fruit, vegetables and white meat - Eating Healthy

Regular snacking (small portions) is much more healthy than large meals.

Take daily supplements (Multi-vitamins, especially Vitamin B1/6/12, Omega3/6) and also weak probiotics (like the children take) and CellFood generally keep your immune system strong.

Regular and ocassional intense exercise is also excellent and recommended.

Good and regular sleeping patterns (specifically at night - between 6-7 1/2 hours show to be most efficient)

Sanitation tips:

Keep the office and workplace clean and clean regularily - I read somewhere keyboards contain on average 60% more germs than toilet seats - clean those buggers! According to dentists - toothbrushes should be replaced every 1-2 months.

Make sure the drinking water is good and there is good ventilation.

And wash those cups!

Har har :) Hope these tips provide some value to you. Don't consider me a fanatic - I work in the Health Care industry (as a hacker/developer) and pick a couple of things up along the way.

And lbcadden3 is right - daycare is a germ factory.

Also, try not to have your co-workers sit/work closer than 1 1/2 or 2 metres in proximity of eachother - unless you are looking for the domino effect!

<comment><AUTHOR> Awesome tips. We're guilt of sitting with 2-3 feet of each other. About 20 people in 1800 sq. ft.

We'll go keyboard cleaning! The ventilation and water are top notch, and everyone exercise pretty regularly.

Thanks for the help!

<comment><USER3> It's a pleasure. Best of luck to you (and the rest of your startup)

</comment></comment></comment><comment><USER4> I worked at a place that seemed to be this way, it wasn't a startup though but a fairly small company. The offices were in an older office park and kind of dingy and I think thats why. When you have certain types of insulation, etc and the building isn't well kept up I think it tends to harbor mold, etc, I know I would always smell something (like mold) when I walked in one of the doors.

By contrast the building I work in now is actually quite old, but it has wooden ceilings, no layers of insulation, etc and is fairly open and airy. I think it really can be caused by the building and then of course the lack of space and number of people also contribute.

I work in SF now too but the "sick office" place was in Phoenix, there they had to run the AC all day for 7-8 months out of the year, which I think is part of the problem, here the climate is milder and I would think you can figure out creative ways to use the ventilation system to get more fresh air into the building

</comment><comment><USER5> I would encourage anyone who feels like they're getting sick to stay at home. If it's a really small space, it only takes one person to infect everybody. Keeping things around like keyboard wipes and hand sanitizer could help encourage everyone to stay vigilant.

</comment><comment><USER6> I appreciate it when a coworker works from home if they feel they're coming down with something.

</comment><comment><USER7> "work hard and stay late"

That's only sustainable in short bursts. why do you need to do that ?

</comment><comment><USER8> Environmental pollution, mold etc.

Do any of the employees have kids in daycare or school? They are germ factories.

The job sucks.

Only ones I can think of off the top of my head.

<comment><USER9> It could be a simpler solution, is everyone putting in long hours? It could be if you guys are burning hours long and fast that several of you are not getting adequate time for your immune systems to recuperate. If so it might be time to do a rolling schedule of time off to give peoples body some time to catch up.

<comment><AUTHOR> Good call. Everyone loves working here, so I think if anything it's just too much work.

</comment></comment></comment><comment><USER10> Go get some massage therapists - college students can be a cheap option. Touch is a great antidote for the immune system!

<comment><AUTHOR> We have one that comes in once a month! Maybe we'll increase the frequency. :)</comment></comment>


Microplastics Find Their Way into Your Gut, a Pilot Study Finds - <AUTHOR> https://www.nytimes.com/2018/10/22/health/microplastics-human-stool.html <comment><USER2> "Microplastics — defined as pieces less than .02 inches long, roughly the size of a grain of rice — have become ..."

The author does not know that .02 inches is NOT the size of a grain of rice.</comment>


G-WAN Captcha Decode - <AUTHOR> https://gist.github.com/2932918 <comment><USER2> This is something I find absolutely bizarre: for every person who is willing to make ridiculously exaggerated claims about something, there are _thousands_ willing to believe them. One example which springs to mind is the "spam free wordpress" plugin[0], which claims to use "anonymous password authentication to block 100% of all comment spam with zero false positives."

As it turns out, "anonymous password authentication" means that it gives you a randomly generated string which you have to copy and paste into another box each time you submit a comment. It sounds like something a machine could do because _it is something a machine could do_ with ease. And yet nobody seems to have noticed this for two reasons:

1) The author deletes all the comments on his blog questioning _why_ the system works

2) It has a 4.5 star rating on the WordPress plugin DB

As a result, the author is _still_ making ridiculously exaggerated claims about the capability of his system, like "If Gawker had been using the anonymous password authentication built into Spam Free WordPress this incident [the Gawker break-in in 2010] would not have happened." Another gem is "CAPTCHA is not used because it is hard to read, unnecessary, easily cracked, and reduces the number of real comments substantially."

So there it is, another snake-oil salesman spreading FUD and making users (of some very popular websites[1]) suffer.

[0]: <http://www.toddlahman.com/spam-free-wordpress/> [1]: <http://www.raspberrypi.org/>

<comment><USER3> > [1]: <http://www.raspberrypi.org/>

If I had not witnessed that, I would never believe that it happened. _The Raspberry Pi team fell for something that any kid who can write a python script should have known had the utility of a voodoo incantation?_ I'm floored.

</comment></comment><comment><USER4> Pierre (the sole G-WAN author) says some funny things. He also defends G-WAN using dummy accounts all over the internet (StackOverflow, Reddit, Wikipedia, etc). You can respect his coding knowledge if you can force yourself to ignore his high claims and self-importance. But good job tearing the captcha apart!

<comment><USER5> > You can respect his coding knowledge if you can force yourself to ignore his > high claims and self-importance.

Still seems totally insane to me. The extent of his features are things like "DNS lookups are asynchronous in all libraries".

</comment></comment><comment><USER6> I was looking at gwan with some friends a year ago, at that time it was presented as a C-script-page server. The idea of scripting with C was intriguing. But then, it just didn't work, unstable and the author claiming to be a victim of some odd spy-movie-like conspiracy.. that was really weird.. and funny somehow.

And the company name "TrustLeap" ... seriously ? <http://trustleap.ch> disappeared by the way.. here you go [http://web.archive.org/web/20110707004226/http://www.trustle...](http://web.archive.org/web/20110707004226/http://www.trustleap.ch/)

[http://web.archive.org/web/20091028041609/http://trustleap.c...](http://web.archive.org/web/20091028041609/http://trustleap.ch/en_timeline.html#finama)

[http://web.archive.org/web/20110707004059/http://www.trustle...](http://web.archive.org/web/20110707004059/http://www.trustleap.ch/en_technology.html)

Now it looks that they redesigned the site, changing target and adding new buzz words here and there (removing the obsolete buzz no one is using anymore)

see also <http://news.ycombinator.com/item?id=2776927>

And to be honest this king of restriction on a web server, sounds crazy:

=== "Server identification field" means the field in the response header which contains the text "Server: G-WAN/x.x.x" where "x.x.x" is the program version number.

You agree not to remove or modify the server identification field contained in the response header. ===

Funny stuff!

</comment><comment><USER7> Well done.

Except, I'm pretty sure the gwan guys are just a very sophisticated group of trolls.

I'm going to go out on a limb and say if you test their web server yourself you'll find that their claims are false, and that the reason it's closed source is because the joke would be too obvious if we could simply take a quick look.

In any event this is all hilarious.

Now, I hope someone with the time and curiosity will do this.. and publish some actual benchmarks of gwan so this controversy can finally end.

<comment><USER8> In the last GWAN thread[1] a user[2] who said they have been using it for a year claimed it was all quite true. The intimation in this thread is that was actually the author himself sockpuppeting. Indeed, the account has only had 3 comments in the last year[3] until the whole GWAN thing, which is certainly suspicious, though certainly no proof.

[1] <http://news.ycombinator.com/item?id=4109698>

[2] <http://news.ycombinator.com/user?id=ers35>

[3] <http://news.ycombinator.com/threads?id=ers35>

</comment></comment><comment><USER9> The more I see of 'original' captchas, the more I think people should be taking the same attitude towards captchas as they do to cryptography. Just use a well known library that has proved to be hard to break by the test of time and heavy use.

<comment><USER8> Like ReCaptcha? Man, I was signing up for something last night and failed to solve it 3 times. Captchas are getting harder for humans to solve than bots - is this really a good thing?

<comment><USER9> (is your ReCaptcha reference to it being broken? If so then I think my point is proved by how quickly it was fixed)

As for making it harder for humans, I very much see your point, but the solution isn't to come up with some of the trivial captchas that many come up with by themselves.

</comment></comment></comment><comment><USER10> [Reposted from <http://news.ycombinator.com/item?id=4113609>]

That example is easy to solve because it is not using any of the provided techniques that makes it more difficult for robots to solve the CAPTCHA: "changing the HTML background color based on: mouse cursor hovering, previous state or input or shared secret"

The purpose of the example is to give you a basis on which you could implement an effective CAPTCHA.

The claim of "difficult or even completely impossible for robots" applies to CAPTCHAs using the above techniques, which are not used in the example.

<comment><USER11> So you're implying that if you changed the HTML colors based on mouse events, the claim of "difficult or even completely impossible for robots" would hold?

Such a claim would be no less ludicrous.

I'd put my money on there being hundreds of people on Hacker News alone that could script a DOM-monkeying cracker for such a system. That runs with ~100% accuracy. And in under an hour of coding.

This Captcha strategy is so absolutely terrible in light of modern libraries that I'm honestly shocked you feel the need to defend it.

<comment><USER10> The best way for me to solve this dispute is to implement a CAPTCHA using some of the proposed techniques. If I fail, then I was mistaken. If I succeed, then maybe people will given G-WAN a try.

</comment></comment></comment><comment><USER12> I didn't read through all his code...but wouldn't OP's approach only work if they used the same GIF over and over?

In any case, it seems trivially easy to break. Just capture the image. Read the background color value. Generate the image (with the background color) in ImageMagick and run through your OCR of choice. Obviously, that's not the fastest way to do it if you're trying to do thousands of attempts at once, but it's the least brainpower-involved.

<comment><USER13> No, he just hard-coded the number shapes. As long as the numbers used the same font as the example (and don't overlap), it should work just fine.

OCR would probably be more robust in general (for varying fonts and number shapes)... but it's simply absurd to call G-WAN's scheme a better captcha. More obscure and less targeted? Perhaps.

<comment><AUTHOR> I thought about using OCR - just to over-engineer it. But I wanted to show how the characters are perfectly aligned and how clear the font is. I would like to understand, what he thought, why this Captcha is so special.

<comment><USER8> I need two more points to make up for the haters.

Come find us?

</comment></comment></comment></comment><comment><USER14> I think this algorithm Captcha is optional. I'm using G-WAN, and I implemented another CAPTCHA algorithm in C. I like it when someone proves that something is unsafe. It's inspiring to improve our applications.

</comment><comment><USER15> I've never even heard of G-WAN until now, so I guess it's working..

<comment><USER16> G-Wan is like the Great Old ones. It's time to forget it again...

</comment></comment><comment><USER17> How about using NoCaptcha technique?

</comment><comment><USER18> All the people who make something fantastic in some part were crazZzyYy

But G-wan author i think need chillout and start re-thinking

G wan should be OK for eq CDN

For hosters * need options to turn off script language * Support modules like in Apache * Support .httacess For me * Add fcgid but something better and more faster its posibble. Show that PHP on gwan can be balizing fast * add modules session mongodb redis etc * should be OK replacement for apache * recode version for windows for developer

Go to some IT conference run 2 machine NginX full optimized for speed + Gigagbyte network and show people how its work CPU usage request per second to compare

</comment><comment><USER8> For Fabian Fäßler, from DC949 chat:

      <@merlin_> do we know this guy?
      ... snip ...
      <@merlin_> """Today I had my first lightning talk at #BerlinSides_0x3"""
      <@Kos> OH YEAH
      <@Kos> that adude started following me a few weeks ago
      <@C-Ps> berlin sids is pretty slick
      ... snip ...
      <@Kos> I probably  meat that dude at berlinsides
      <@Kos> erm
      <@Kos> met
      <@savant42> meat, eh?
       ... snip ...
      <@C-Ps> do you often meat men in berlin?

Thank you for providing the lulz, as well as the link to stiltwalker!

<comment><USER8> Haters gonna hate! At least he replied above -- mission accomplished.

<comment><AUTHOR> I feel a bit observed and I don't know whether I should feel fear or joy... I'm confused.

<comment><USER8> It was appreciation for your work and your link to ours, as well as an invitation. So I would go more on joy, unless of course you are afraid of hackers that like to drink and break things, not necessarily in that order, but often.</comment></comment></comment></comment>


How an Architect Created a Crowdsourcing Platform for Interior Design - <AUTHOR> http://www.archipreneur.com/how-an-architect-created-a-crowdsourcing-platform-for-interior-design-filippo-schiano-di-pepe-on-cocontest/ <comment><USER2> great for the user, awful for the designer</comment>


Why did this invention -- obvious and trivial to implement -- take 30 years? - <AUTHOR>

Hand dryers in public washrooms are absolutely notorious for taking forever to dry your hands.  But I'm now seeing a new generation of hand dryers that blow the air really hard and dry your hands in just 15 seconds.
What I can't understand is why such an obvious innovation took 30 years to become available.
This is not like waiting for technology to catch up. Surely, sufficiently powerful motors were available 30 years ago.
Simply asserting that "strong motors are expensive" doesn't answer the question.  If expense were the determining reason in the past, then no one would make/buy them today either.
I'm thinking that there must be a more complicated or subtle business or social reason for why an obvious improvement--taking the product from ridiculously awful to quite acceptable--should take so long. But what? <comment><USER2> Are you talking about the Dyson Airblade? I'm not actually convinced that they work significantly better than the old-skool ones.

Still, as I understand it, making those tiny powerful fans is non-trivial, and it was more a case of the invention driving the application instead of vice versa. It was a case where Dyson (no relation to Freeman, tragically) started building tiny powerful motors for their vacuum cleaners and then went looking for other applications.

Or perhaps it's just a case of a "no hair on fire" demand. People just haven't been spending the last thirty years thinking "Man, I wish this hand dryer worked better", let alone "I wish I could pay a lot more for the dryers in my public bathrooms so that my customers could dry their hands marginally faster".

</comment><comment><USER3> What's the incentive for having a hand dryer at all? No towels to replace, either for cost or maintenance reasons, I guess. This isn't exactly something for the high paying clientele. So you have cheap, replaceable junk that every pop & son contracter in the country can install or fix. High end locations will have towels, maybe even with a real attendant handing them to you.

But in recent years, being environmentally friendly is a big deal. Having fresh towels might be as expensive, but it seems like a waste. So suddenly there's money available to companies who try to build a better dryer.

</comment><comment><USER4> The Max Hamburger chain in Sweden uses the Dyson Airblade. Max is a very innovative fast food company. They put how much CO2 your burger costs on the main menu for example.

The Dyson Airblade fits right in with the image they are trying to present. Clean, modern, efficient and cool.

</comment><comment><USER5> If you think optimal (in your perspective) hand dryers took this long, contrast this against the wheeled luggage, that took quite a long time to catch on ([http://www.travelproluggageblog.com/2010/06/luggage/the- hist...](http://www.travelproluggageblog.com/2010/06/luggage/the-history-of- rolling-luggage/)) as late as 1989!

Perhaps, it's just as conceivable that regardless of how well the dryers worked, consumers could have just wanted the option for paper towels. And even if the dryers are fast, I am sure the line doesn't help. Of course, I am sure the ladies room would have even worse time with just one effective albeit expensive dryer because of the already nasty wait times on average.

</comment><comment><USER6> Rough price I can find online for 'normal' hand dryers is ~$200 bucks. The Dyson Airblade you're referencing is $1,400. That price includes the cost of non-trival engineering (and a good bit of marketing). Sounds like the setup for a great pitch.

Hi, we're going to revolutionize hand-drying with an hand dryer. Oh yeah, and it's going to be super expensive because we need to use quality parts for it to work well. So, uh, you interested in funding us?

Took 30-years for someone to front the cash to do the development.

</comment><comment><USER7> >Simply asserting that "strong motors are expensive" doesn't answer the question. If expense were the determining reason in the past, then no one would make/buy them today either.

This assumes that stronger motors aren't cheaper today than they were, relative to weaker ones. I think that there are also advances in robots and toys that it seems to me should have been possible decades ago (even with slower processors)

</comment><comment><USER8> I hate those things because they are so noisy. I haven't tried the AirBlade yet, but I have tried the "Xcelerator". It's so loud that I'd cover my ears if I weren't busy drying my hands. Also, if I splash water on my face; how am I supposed to dry it?

I much prefer paper towel to the air driers.

</comment><comment><USER9> > If expense were the determining reason in the past, then no one would > make/buy them today either.

The relative cost of "much better" may have gone down.

Someone may be unwilling to pay 3x to move from mediocre to adequate yet be willing to pay 3x to move from mediocre to excellent.

</comment><comment><USER10> Who goes to a restaurant or an airport to use the washrooms?

Put another way, how many manufacturers of coffins are there in the US? We'd rather not think of such things.

</comment><comment><USER11> Mitsubishi introduced something very similar in 1993: <http://www.mitsubishijettowel.com/>

</comment><comment><USER12> In hindsight most inventions are obvious.

</comment><comment><USER13> Because the benefit to the owner of the building (the one paying for it) is almost zero.</comment>


Britain is sailing into a storm with no one at the wheel - <AUTHOR> http://www.economist.com/blogs/bagehot/2016/06/anarchy-uk?fsrc=scn/tw/te/bl/ed/anarchyintheuk <comment><USER4> Renowned British historian Timothy Garton Ash[1] wrote a very good comment in The Guardian, which takes a step back and considers some of the larger picture:

[http://www.theguardian.com/politics/commentisfree/2016/jun/2...](http://www.theguardian.com/politics/commentisfree/2016/jun/24/lifelong- english-european-the-biggest-defeat-of-my-political-life-timothy-garton-ash- brexit)

[1][https://en.wikipedia.org/wiki/Timothy_Garton_Ash](https://en.wikipedia.org/wiki/Timothy_Garton_Ash)

<comment><USER5> Great read, thanks very much

</comment></comment><comment><USER6> The positive things that _could_ happen are all European - that is the rest of Europe could take this as a wake up call and start dismantling the "bureaucracy" and giving member states electorate more direct access to decisions. This is apparently being talked about (cf Politico)

But there is almost nothing positive UK can do. All our moves depend on others. Negotiating treaties with EU, India, cutting immigration, introducing trade barriers. All of it we cannot unilaterally do without breaching serious treaties with serious consequences.

And you don't do that without a clear mandate. And we don't have one.

We are likely to have to have another referendum or general election just to discover what the plan actually is. I mean did the British electorate just vote for sending home immigrants now? For reducing net migration to 10,000 pa? To erecting tariffs on Steel imports? How the duck does one ask that of an electorate? Ballot papers would look like crossword puzzles.

Nothing discussed in the election actually represented the serious expectation they would win. And now they did.

Chances are high Boris will turn round tomorrow and prevaricate. "Not turning out backs on Europe"

And this will tear the right wing apart. A large chunk of voters thought we were really leaving the EU, actually going. This time Farage will be able to convert those people into MPs in the inevitable general election.

And we will have a three way split in the right wing - remain camp, Boris leave and Farage leave, probably sharing 1/3 of the middle and right wing. Add the SNP in and a weaker labour and there will be six or so parties none of whom are strong enough and no tradition of coalition.

This power vacuum will last for years.

<comment><USER7> Tack onto this the extreme increase in boldness from SNP - they're no longer taking about _just_ a second referendum, but about negotiating directly with the EU about how Scotland can remain in, and about talks with London.

And the instant demands for a referendum on Northern Ireland.

And the fact that we now have a small but serious (amid a much larger signed- a-petition-for-the-hell-of-it crowd [1]) starting to work towards independence for London - it's too early to tell if it will turn into something lasting, but there are people working on drawing up plans to create an actual political party.

This will be a circus. And it's virtually certain at this point that the UK will no longer be united in 5 years time. The question now is whether it'll be just Scotland that leaves, or if Northern Ireland and Gibraltar will follow.

London won't happen anytime soon - most of those signing the petition for London independence will have forgotten about it in days -, but expect substantial further devolution to all the major cities over the coming years to try to prevent such movements from actually gaining traction.

Westminster will have the choice between being left stripped of power or stripped of land.

This referendum will be remembered as the start pistol for the dismantling of the UK.

[1] [https://www.change.org/p/sadiq-khan-declare-london- independe...](https://www.change.org/p/sadiq-khan-declare-london-independent- from-the-uk-and-apply-to-join-the-eu)

<comment><USER8> Pretty sure the independent London thing is just a joke.

<comment><USER6> I would suggest it's a serious joke. No one "serious" thinks London could split from the country but believe it is a interesting way to highlight the massive disconnect between rural England and much of the rest of the country

Ironically there are going to be plenty of people who are "voting" for London to leave but don't expect their vote to have an effect and it's just to send a protest message.

<comment><USER7> I'm sure it's a joke to most, but it's gone beyond that to some, and people are organising. It may not go anywhere, but it won't just go away either.

</comment></comment></comment></comment></comment><comment><USER9> [http://news.sky.com/video/1717859/islam-there-is-no- brexit-p...](http://news.sky.com/video/1717859/islam-there-is-no-brexit-plan)

</comment><comment><USER10> Frankly they're lucky that Cameron didn't just resign on the spot. "You break it, you bought it. Cameron out."

<comment><USER11> Except Cameron greatly weakened the uk by resorting to printing through land.

<comment><USER12> I don't understand. What does printing through land mean?

<comment><USER13> I'm guessing he means helping inflate the housing bubble as a means of pumping our GDP. The UK may be one of the fastest recovering economies since the recession, but a lot of the growth is in housing. And if you don't happen to live in the south-east where the housing pressure is at its worst, you probably aren't benefiting from it at all. Hence the North/South divide in the referendum.

<comment><USER11> Nobody benefits from it except he money issuers. It's not growth it's inflation.

<comment><USER12> At least in sf, landlords do incredibly well for themselves...

</comment></comment></comment></comment></comment></comment><comment><USER14> If 1940's Germany or 1970's Soviets had wanted to decapitate British leadership they could have done little better than this. It would be nice if the Queen were to exercise Royal Perogative - quickly - and order Britain to honor its obligations as an EU member apart from immigration. In this way, the Queen could minimally pacify all sides and Britain could extricate itself from this quagmire with some face intact. She would set herself above the fray and if the EU objected it would be Brussels at fault thereafter.

<comment><USER15> > and order Britain to honor its obligations as an EU member apart from > immigration.

Free movement of EU-citizens is a core obligation in the EU. You can't honor all other obligations without honoring this one. The ironic twist is that for people from new EU member states, there is a transitional phase where movement and work permits can be restricted and the UK explicitly opted out in the case of Poland, because at that time they were in dire need of cheap labor - <USER3> now they're complaining.

In any case, there's no question at the moment if the UK needs to honor all EU membership obligations: Until the UK government decides to invoke the exit clause, the UK is a full member with all privileges and all obligations - <USER3> it seem they're not in a rush to do so. However, I fully expect them to be sidelined in all upcoming negotiations, especially the ones that don't require an unanimous vote. They've already thrown away the improvements that Cameron negotiated in February, those were under reserve of not leaving the EU.

Fun times ahead, for sure.

<comment><USER14> > Free movement of EU-citizens is a core obligation in the EU.

Until its not. The EU would be delighted to look the other way if it means keeping the Union together. Yes, it may be that immigration reforms have to be extended throughout, and that move would be welcomed in most EU countries.

</comment></comment></comment><comment><USER16> Every single article I have read had indicated this is terrible. I have seen a lot of people who would I guess be classified in America as progressive liberals, e.g. the types who speak of privelege and safe-spaces, decrying how the country has gone to ruin via fascism. Just in general, younger people seem to be totally against this. All the 'economists' on CNN, FOX, Bloomberg, ect are saying this was stupid and economically catastrophic.

All this is to say, everyone has pretty much decided this is terrible for Britain.

Is it? I have seen some data and understand that they will lose an outsize ability to steer European affairs and that they will lose out economically because they contribute less to the euro union than they net back. However, there hasn't been much explanation other than sillyness and name calling.

What did they gain, and honestly why is this so negative. There hasn't been a particularly strong or cohesive explanation other than saying Cameron is an idiot and the world is over?

<comment><USER17> Not being in the EU is not nearly as big a deal as leaving the EU. They need an entire framework for dealing with the EU that doesn't currently exist.

It's like Britain just drank some poison, then went into a shop and said

"Hi, I drank some poison and you're the only person that sells the antidote, What kind of deal can you give me on that?"

<comment><USER16> This is case and point what I indicated above. Bizarre assertions and analogies that don't even attempt to explain why it is bad.

I am having trouble finding out legitimate answers to why this is actually heralded as a catastrophicly bad move:

> "Hi, I drank some poison and you're the only person that sells the antidote, > What kind of deal can you give me on that?"

Doesn't really cover it. I guess it could be translated to, there is a mismatch in leverage for trade negotiations and GB will need the EU much more than they need it, thus weakening their position.

<comment><USER18> * Because "leave" involves untangling the UK from the EU, which is ridiculously more complicated than never having joined at all.

* Because Scotland overwhelmingly voted "Remain", and are already talking about another independence referendum so they can stay in Europe.

* Because a large chunk of the "Leave" voters (I don't have percentages, I expect they'll show up soon) are regretting it already. They're the dogs that chased a car and caught it and don't know what to do.

* Because everyone who has any idea what "leave" would imply thought it was such a bad idea that they didn't take the idea seriously.

* Because the "Leave" campaign didn't expect to win and had (seriously) _no plan at all_ for how to achieve this.

* Because everything the "Leave" campaign promised was literally lies, and now they have to explain this to the people who voted their way.

* Because David Cameron originally said that if "leave" won, he'd invoke Article 50 the next day - and instead, he went "you know what? bugger this" and resigned, punting it to whichever unlucky bozo takes over as Tory leader and will thus be personally responsible for visiting a disaster upon the UK.

* Because all of the details of the above, and plenty more besides. It's a cluster of clusterfucks, each of which contains another, smaller, clusterfuck.

<comment><USER8> > Because a large chunk of the "Leave" voters (I don't have percentages" are > regretting it already.

Clearly those people exist, but is there really any reason to think they are "a large chunk"? It's possible, but I would be surprised if millions of people had done a complete political U-turn overnight.

<comment><USER19> A lot of people in the UK's more deprived areas have been relying on EU money to keep some semblance of economic activity going.

These areas literally have nothing. There used to be industry, but the Tories killed most of that and sent it abroad because they could make more money by selling and/or offshoring it.

There's some tourism. Maybe some food production. A little light industry. And that's pretty much it.

These areas had some of the strongest leave votes. Today they've woken up and demanded that the UK government continue to give them the same level of funding they got from the EU.

Which is never going to happen. So - regrets - they have a few. But then again, certainly not too few to mention.

<comment><USER7> Just to be clear in case someone thinks this is exaggerated:

Cornwall voted Leave. Cornwall Council immediately started begging Westminster to plug the 60 million pounds/year funding hole that Brexit will leave as a result of lost EU funds. From [1]:

> John Pollard, the leader of Cornwall council said: "Now that we know the UK > will be leaving the EU we will be taking urgent steps to ensure that the UK > Government protects Cornwall's position in any negotiations.

> "We will be insisting that Cornwall receives investment equal to that > provided by the EU programme which has averaged £60m per year over the last > ten years."

[1] [http://www.independent.co.uk/news/uk/home-news/brexit- cornwa...](http://www.independent.co.uk/news/uk/home-news/brexit-cornwall- issues-plea-for-funding-protection-after-county-overwhelmingly-votes-in- favour-of-a7101311.html)

<comment><USER16> but where did the money come from? The EU doesn't just randomly dole out capital, right? The UK must pay into some sort of central fund? I have heard they pay as much as 3%(of GDP, taxes I am not sure) but the money must come from somewhere, of course. What capital flows out of UK and into the UK based on the old (or current) model?

<comment><USER7> The EU doesn't "just randomly dole out capital", no, but Cornwall is one of the most deprived regions of the EU, and so got development funds from funding mechanisms earmarked for under-developed regions.

Notably, it was/is this underdeveloped because pre-EU British government had not bothered to invest much in Cornwall.

In terms of payments, the UK is a net contributor overall, but part of the issue is that the UK could have funnelled money into regional development whenever it wanted to, but hasn't, so for Cornwall to think that the government will prioritise them now is quite comical, given that the government will have to prepare for extensive reductions in treasury income that's likely to make the EU contributions seem cheap.

This has been a recurring theme: The wishful thinking that a post-Brexit UK government will suddenly change priorities and allocate lots of money to things they have been mercilessly cutting so far, even in the face of massive economic uncertainty.

Many of the areas voting Leave will be in the same boat as Cornwall of having substantial EU funding stripped, while facing an uphill battle to convince the UK government to replace it.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> I noticed that on _Question Time_ one of the panel mentioned the possibility of a "Government of National Unity" \- which is something the UK hasn't had since 1945 and the end of WW2.

Still requires a leader to stand up and become PM though.

<comment><USER18> Cameron leaving was a poison pill - whichever idiot takes over as Tory leader will be faced with having this blitheringly stupid idea attached to their name forever, or torpedoing themselves out the gate by not going forward with it.

(What will actually happen is some glib fool will come forward who actually thinks it's a good idea. They're not short on those.)

</comment></comment><comment><USER21> Reading the economist lately I note they are going on with the same neoliberal patter that they always have, little oblivious to the fact that neoliberalism is what we got to this place. (A few weeks ago they were gushing about a congressman from Nebraska who had an intellectual epiphany when he learned there was a town named Chicago with a University of Chicago in it that has an economic department...)

If they showed some empathy for the "little people" from time to time, things might have worked out differently.

<comment><USER22> Care to comment on this article specifically, or are we now reduced to simply throwing out hollow partisan platitudes?</comment></comment>


"In 15 Years Half of US Universities May Be in Bankruptcy" - <AUTHOR> http://www.bothsidesofthetable.com/2013/03/03/in-15-years-from-now-half-of-us-universities-may-be-in-bankruptcy-my-surprise-discussion-with-claychristensen/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+BothSidesOfTheTable+%28Both+Sides+of+the+Table%29 <comment><USER2> I read the article but did not listen to the audio. I'd like to know if he's referring to _all_ universities - online, brick-and-mortar, hybrid; private, public; for profit, not-for-profit; and any other categories I haven't thought of. I think a lot of the private for-profit ones will bite the dust, along with some of the smaller private not-for-profit schools. I think most of the public schools will still be around; from a market perspective, maybe some of them should bite the dust, but I don't think the state legislatures and other constituencies will allow that to happen. At least, not in the next 15 years.</comment>


CSRF: Cross-Site Request Forgeries - <AUTHOR> http://coffeeonthekeyboard.com/csrf-cross-site-request-forgeries-basic-security-part-3-747/

<comment><USER2> Google also did a very good job introducing security vulnerabilities, and also a sandbox for trying them out. Their take at Cross-Site Request Forgery: [http://google- gruyere.appspot.com/part3#3__cross_site_reques...](http://google- gruyere.appspot.com/part3#3__cross_site_request_forgery)

The sandbox: <http://google-gruyere.appspot.com/start>

</comment><comment><USER3> * These are submitted with a form (over POST, hopefully) *

I don't think that the author implies that using POST prevents CSRFs but the article seems to imply it. In case anyone thinks it is the case: using POST won't prevent a CSRF.

Cross Site Request Forgeries occur when a user opens an "evil" page on site B, while being logged on site A. If site A solely relies on cookies in order to identify logged users, there is a risk of CSRF. The attack exploits the fact that the user's browser will always send the auth cookies when issuing a request to siteA. If the evil page on siteB embeds an image (or script, or any resource that can be loaded using an URL) whose source is an URL on siteA, the browser will request the resource on siteA with the auth cookie coming along.

In order to issue a POST request to siteA from the evil page, the attacker only has to submit a crafted POST form using an iframe.

<comment><USER4> > In order to issue a POST request to siteA from the evil page, the attacker > only has to submit a crafted POST form using an iframe.

Yes, but requiring POST for anything that changes anything (especially bank transfers) is a best practice anyway, for how all actors involved understand HTTP verbs, and reduces the surface area of attack.

You can create a POST with an iframe, but you can create a GET with an image tag: `<img src="[http://mybank.com/transfer?...>`](http://mybank.com/transfer?...>`)

</comment></comment><comment><USER5> This is a decent article, but it's really just another "use your framework to mitigate CSRF" article. There's probably been hundreds of them in the last five years. Useful for junior devs who haven't seen it before; uninteresting for most everyone else.

<comment> chao- Speaking as someone who is still, arguably, a "junior dev", and who started reading Hacker News as a far-more-junior dev, getting these topics on your radar has to happen somehow. I've learned about many topics' existence by simply bumping into articles like this, and checking the comments to learn more.

I do agree the article is little more than introductory, but rather than complain, let's provide some more in-depth links for those who want to learn:

[http://www.slideshare.net/guestdb261a/csrfrsa2008jeremiahgro...](http://www.slideshare.net/guestdb261a/csrfrsa2008jeremiahgrossman-349028/)

[http://appsandsecurity.blogspot.com/2012/01/stateless- csrf-p...](http://appsandsecurity.blogspot.com/2012/01/stateless-csrf- protection.html)

</comment></comment><comment><USER6> A simple explanation for the non tech folks: [http://crazyviraj.blogspot.com/2009/10/xsrfcsrf-attacks- in-n...](http://crazyviraj.blogspot.com/2009/10/xsrfcsrf-attacks-in-non-geek- speak.html)

</comment><comment><USER7> One thing that's not covered by a lot of frameworks is protecting against CSRF in AJAX requests. Django has some info on enabling this (<https://docs.djangoproject.com/en/dev/ref/contrib/csrf/#ajax>), but it's easy to overlook.

<comment><USER4> Honestly, "easy to overlook" is why I wrote a checklist for basics. CYA, then get to the advanced stuff.

</comment></comment><comment><USER8> Is it displaying as grey text on a brown background for everyone else? That's nigh-on unreadable

edit: maybe not grey but some colour which doesn't contrast with brown at all

<comment><USER4> Ugh, I really need to create a lighter-weight theme. Sorry about that.

<comment><USER8> Nope it was just me being an idiot :)

</comment></comment></comment><comment><USER9> Perhaps I'm just nieve but if someone has access to the DOM via XSS; isn't CSRF nonces like Django uses pointless?

<comment><USER10> If you have XSS attack vector on your site, the attacker can do almost anything including cookie access(for all cookies that aren't HttpOnly). Also CSRF protection doesn't protect against clickjacking attacks where the page is iframed set transparent and user is encouraged to click in a specific location(punch the monkey in the face) on the attackers page. Easiest solution is to use javascript to detect if your page is iframed and bust out of it.

<comment><USER4> For click-jacking, the easiest thing to do is to set the X-Frame-Options header, but I'll get to that. And it doesn't help IE <= 7, so you need to weigh cost/benefit and your user base there.

And we'll get to session hijacking and why your session cookies in particular should always be HttpOnly and preferably secure.

<comment><USER10> Thanks for the info, didn't know about the header.</comment></comment></comment></comment>


Microsoft Discovers Scary Bugs in Huawei PC Driver (CVE-2019-5241) - <AUTHOR> https://sensorstechforum.com/microsoft-huawei-driver-cve-2019-5241/ <comment><USER2> What would be the usage in a driver of mapping arbitrary pages of memory to RW mode?</comment>


ARM (Dual-core Cortex A7) based desktop and laptop - <AUTHOR> http://crowdsupply.com/eoma68/micro-desktop/ <comment><USER2> Allwinner is less good about GPL-compliance, but I'd definitely take about 20 of these for my company. EOMA68 is looking to be a wonderful thing.

<comment><USER3> allwinner's a complex situation, i'll be taking the opportunity to go over and help them out. luckily, due to a _lot_ of work by a lot of people in the software libre community, the A20 is pretty much fully reverse-engineered, so that we can boot entirely from GPL-compliant source: even the 1080p60 hardware-accelerated video encode/decode engine is properly compliant (without any help from Allwinner!) G2D 2D-acceleration, sorted, and the sunxi-next (mainline) kernel now provides access to the on-board hardware crypto engine. just please be prepared to accept that despite having Virtualisation (it's a Cortex A7) that it's also a $7 tablet-style processor.

but, like i mention in the hopeconf2016 video, you can always upgrade: [https://www.crowdsupply.com/eoma68/micro- desktop/updates/hop...](https://www.crowdsupply.com/eoma68/micro- desktop/updates/hope-2016)</comment></comment>


Peach App Token Reuse Flaw - <AUTHOR> https://www.hakobaito.co.uk/b/peach-app-token-reuse-flaw/ <comment><USER2> While I agree that the tokens must be expired on logout, it's hard to gain access to the token via MITM because the API requests are performed over TLS [0]! This point seems glossed over in the post. You would need access to a client app directly to be able to inspect its storage or sniff the traffic yourself to determine the token being used.

Access to an unencrypted client device is usually game over for most apps' data security anyway.

[0] [https://www.ssllabs.com/ssltest/analyze.html?d=v1.peachapi.c...](https://www.ssllabs.com/ssltest/analyze.html?d=v1.peachapi.com&hideResults=on)

(OP: love the graphic design and appropriate color scheme!)

<comment><USER3> > While I agree that the tokens must be expired on logout

Is there really that much additional security over deleting tokens locally when logging out, but expiring all existing tokens (using a timestamp) on password change?

Blacklisting individual tokens requires storing them in the db and then looking them up each time a user logs in. It seems like given the app already uses TLS, the tiny security gain isn't big enough to justify the performance impact.

<comment><USER4> I agree although I think about it more in terms of development and maintenance effort.

There's plenty of other relatively computationally and IO intensive activity happening during login so I can't see an extra select having a tangible impact to performance.

<comment><USER3> The issue isn't tokens getting created on login, it's them getting validated on every request. That's already 40-50ms, even without the db hit each time.

</comment></comment></comment></comment><comment><USER5> I get that non-expiring tokens are a Bad Idea™, but it's complete bullshit that this is a groundbreaking security flaw. Any service that uses Bearer tokens for request authorization is "vulnerable" under these terms -- regardless of whether or not tokens are invalidated on "logout." What's to say a malicious MITM isn't going to hijack your account while you're still logged in?

Secure infrastructure isn't the one and only solution, but it certainly means that "vulnerabilities" like this are pointless unless your malicious attacker either has the remote server certs or has cracked TLS.

</comment><comment><USER6> So the article title could be changed to "Peach API has replay vulnerability"?

I haven't actually tried this yet but can someone confirm the app has pinning? If so, thoughts on how he sniffed the original traffic and ran the replay?

<comment><USER7> If you have a jailbroken iOS device you can use SSL Kill Switch [0] to disable certificate pinning and get the traffic with MITMproxy [1] or Charles.

[0] [https://github.com/nabla-c0d3/ssl-kill- switch2](https://github.com/nabla-c0d3/ssl-kill-switch2) [1] [http://mitmproxy.org/](http://mitmproxy.org/)

</comment></comment><comment><USER8> Wesley, The readability of your blog is rather poor. You might want to change the default width `font-size: 2vw;` to a fixed width (Use rem or em). Current css settings are not user friendly and breaks the browser zoom.

Thanks.

<comment><USER9> When the author of a website does this, there are a few tricks you can use in modern browsers to help.

In Firefox _shift+ctrl+m_ launches a developer tool that allows you to resize the viewport (for testing responsive designs) without having to resize your browser.

Also available in Firefox (and even nicer) is the Reader View, which works on this blog post. Its icon should be visible on the right hand side of the address bar.

</comment></comment><comment> 2-m3m3n70 So thoughts on an actual solution? Invalidating tokens means you have to maintain an infinite growing list of invalidated tokens and perform a lookup on every login - somewhat defeating the purpose of 'stateless' tokens like JWTs (ie why not just implement a traditional session store then).

Furthermore, if sniping someone's token like this was doable over MITM, what's to prevent someone from grabbing a live token and then infinitely refreshing it (provided there's a /refresh endpoint).

I'm really wondering if anyone has best practices around this because I have not seen anything.

<comment><USER9> Good point. I wonder if it is sensible to limit the number of refreshes permitted (by placing a counter in the JWT that gets decreased on every refresh). That way you could have the JWT be valid for, say, 30 minutes, and allow up to seven refreshes; after four hours you would have to re- authenticate.

As for invalidating tokens; if tokens expire after a sensible interval (as they should), than you would only have to maintain a short list of recently issued and invalidated tokens. Older tokens can be removed from that list, because they cannot be used in any case after expiring. You could use a cache with a TTL set to a bit over the configured expiration interval.

<comment><USER10> The problem is that having a counter doesn't really work, because you can't force the client to take the updated JWT. (And the previous JWT is still valid as it's checked based on signature.)

The way to go is pretty simple - issue a long-term refresh token, and a very short-term JWT to the client (as little as 5 mins or so). The app can then make requests directly to the services, which can independently verify the validity of the JWT.

The services then also check for tokens which have been revoked - using a very fast mechanism, like holding them in-memory or querying a Redis store. The token's JTI only needs to be held in the revocation list for a short period of time - until the JWT expiry time - using a TTL in Redis, or similar.

The app uses the refresh token to get replacement JWTs. It goes with the refresh token directly to the auth service, which can then check whether the user should be able to get new tokens or not.

<comment><USER9> When you use JWT with the option to refresh the tokens, you usually set an expiry date on the token (if not, there is no point in refreshing at all). So in order to stay authenticated, the client application has to refresh the token a short while before it actually expires and use the new one (which has an updated expiry date) or simply get signed off.

The previous token expires automatically — a well-designed back-end checks against the expiry date and any other claims that should be verified, as well as the signature. So you can force clients to accept the new token with a counter that gets decremented at each refresh until you have to re- authenticate.

There is no need for a separate long-term refresh token.

</comment></comment></comment></comment><comment><USER11> Complete aside: I tried changing the text size and the site dynamically restored the text size to their preference.

Highly annoying!

<comment><USER12> Indeed! I can't even read it without resizing my browser window.

</comment></comment><comment><USER13> Am I misunderstanding something, or wouldn't this just be solved if they simply used SSL for all communications?

<comment><AUTHOR> The official Peach app uses SSL and they also do certificate pinning in the requests, that's not a problem. The problem is that Peach's server side authorisation token does not expire when you 'log out' and you can reuse the token.

The issue is mainly got to do with third party apps + this flaw in Peach's API. There is already one[0] which has reversed the Peach API, and the flaw is still present. What happens when another third-party Peach app comes out and does not use SSL, you can still use Peach's API without SSL and it does not default to HTTPS.

This sort of flaw would lead to a similar issue to the Snapsaved leak[1].

[0] [http://techcrunch.com/2016/01/14/peach-gets-an-unofficial- we...](http://techcrunch.com/2016/01/14/peach-gets-an-unofficial-web-and- android-version-called-nectarine/)

[1] [http://techcrunch.com/2014/10/13/snapsaved-takes- responsibil...](http://techcrunch.com/2014/10/13/snapsaved-takes- responsibility-for-latest-snapchat-leak/)

<comment><USER9> Then a major factor in this vulnerability is that the API does not exclusively use TLS to secure all communication. You might want to clarify that in the blog post.

</comment></comment></comment><comment><USER14> What tool does one use to inspect requests?

<comment><USER15> Charles proxy is pretty good [https://www.charlesproxy.com](https://www.charlesproxy.com)

<comment><USER14> Fantastic. Is this the defacto tool? Can this be done without a tool?

<comment><USER16> On windows? Try fiddler: [http://www.telerik.com/fiddler](http://www.telerik.com/fiddler)

<comment><USER17> Fiddler works on all platforms. It is my proxy cap tool of choice.

<comment><USER16> Oh, very cool. Last I used it (just after Telerik acquired them), it was Windows only.</comment></comment></comment></comment></comment></comment>


Ask HN: How about an anonymous social network? - <AUTHOR> Over the last weeks(since all the crazy stuff regarding the NSA) I was thinking of this startup that would be an anonymous social network. Well not 100% anonymous, your profile would be public/private with your data but everything you do and all your comments to other people will be anonymous(messages encrypted even in the database based on tokens). This would also validate the idea behind you will get real answers to your questions, real and honest feedback to your photos and so on. What do you guys think of this idea, is it a valid startup? <comment><USER2> It's an interesting idea. The number of 'throwaway' accounts on HN suggests there might be some value to a network where now and then a comment or thread couldn't be traced back to an account.

It doesn't mean at all that you would necessarily get more valid answers to your questions. If that were true, the boards on 4chan that aren't /b/ would be glittering beacons of civilized discourse. People given the mask of anonymity can act more truthfully but also deceptively because they don't bear the consequences of identity.

Of course, there's public anonymity and there's anonymity to the mods and anonymity in the database. If the NSA wants to know who's who in your network, encrypting messages and hashing IPs probably isn't going to keep them at bay. What will the server logs tell them, for instance? Or packet sniffing? Or planting a mole on your staff?

If you allow file and image uploads by anonymous posters, you WILL inevitably wake up one day and find a ton of child porn, that's just how anon rolls sometimes. How will you deal with gore, porn and copyrighted material? When someone makes a threat against another user and posts personal information about them, will you go to the police? Under what conditions would you as an administrator violate the anonymity of your users?

Maybe only allow the anonymous posters to post text, or make certain that the mods can tell which account it really is (although this by definition makes the system less secure for users.) Either way, I think you'll need to be prepared for trolling and mischief, have your moderators ready with a clear set of guidelines, and even a few rather fascist options available like blocking Tor if need be.

</comment><comment><USER3> Why not just have a social network where you required _not_ to provide any real information about yourself. You must create an anonymous virtual identity.

Another idea I once had was an anti-social network called "strangers". In this network you add people you know as friends, and all of their activity is hidden for you, and all your activity is hidden for them. You can only discover and interact with complete strangers.

</comment><comment><USER4> What would your profile look like? I'm a little confused. At first glance, does this add any features past what 4chan has already done? It's 100% anonymous and you get real answers (though I think we've got different definitions of 'real'). I think if you can make 4chan "a nice place to visit" with your friends' photo/text updates with the same all-data-expiring-soon policy, you've got a niche.

I'm also reminded by CupidWithFriends, though that's a slightly different concept.

<comment><AUTHOR> from what I see 4chan is not a social network :)

<comment><USER2> It is, but their idea of society differs from the norm...</comment></comment></comment>


Holovect Volumetric Display (real 3D projections) - <AUTHOR> https://www.kickstarter.com/projects/2029950924/holovect-volumetric-display-real-3d-projections <comment><USER2> After watching the video I don't think it works at all... It just looks like a LASER making a flat shape. The camera only ever shows it from one angle. So I am very skeptical that it actually works.</comment>


Firefox 8.0 is Released - <AUTHOR> https://www.mozilla.org/en-US/firefox/8.0/releasenotes/

<comment><USER2> The Firefox teams seems to no longer care about add-ons and add-on users. I am an Add-on author. I submitted an updated version of my addon for Firefox 8 on October 27. Twelve days later the new version is still sitting in a sandbox waiting editorial review. With a new release happening every 6 weeks this kind of behavior is inexcusable and will likely drive people away from Add-ons.

<https://addons.mozilla.org/en-US/firefox/addon/categorize/>

<comment><USER3> I disagree. The folks at Mozilla are not so quietly encouraging developers to get involved in the alpha and beta releases to ensure that things do work on day one of a release? How much work was done up to October 27 ensuring that your add-on was ready to go?

<comment><USER4> Sorry Sanddancer but my experience as an add-on author is that writing free add-ons can quickly turn to a demanding job.

For example, if you look at the tab mix plus add-on source code you can find a very long list of workarounds to make it work in different contexts.

</comment></comment></comment><comment><USER5> The add-on thing could be huge, if it works out. I am tired of seeing computers riddled with spybars.

<comment><USER6> Definitely a good idea for Windows users, and possibly Macs as well (I don't know the prevalence of browser-infesting software there).

On Linux, though, it promptly flagged all of the addons I had installed through the distro packaging system as "third-party addons" and wanted to disable them by default.

<comment><USER7> so it worked properly on Linux. there is no way to know whether an addon instaled 'for the whole' system was added by third party, or by package. only addons in Your home dir are considered as 'installed by you'

<comment><USER6> Except that Linux doesn't tend to suffer from the browser-infesting stealth installs common to other platforms; the case of packaged addons seems far more common and likely.

<comment><USER7> ubuntu? yes, you can unistall it, but popular distros do come with pre- installed stuff.

</comment></comment></comment></comment></comment><comment><USER8> Folks at mozilla - keep up the good work. Could you create some videos and tutorials about extension development?

<comment><USER9> Tutorials (and learning material in general) can be found on <https://developer.mozilla.org/en/Extensions>. This page seem to cover both API (XUL & Jetpack).

<comment><USER8> I am aware of the page and have written an Extension in the past. I am unclear about the following things a) Is Jetpack the way to go going forward? How much of the XPCom api is available through Jetpack? b) Is there an IDE I can setup that will allow me to get autocompletion for extension development? c) Is there an API browser for XPCom objects listing the objects, the methods available on them and the minimum version of Firefox that supports the particular api? Having a searchable index would be even better. d) When I was working on a Firefox extension I often got the feeling that I was doing something suboptimal because the development process seemed pretty broken. I was building extensions and had to restart the browser for them to take effect, getting a debugger going was more work than it should be, I wondered why isnt the Firefox ui itself written using HTML and css. I am hoping that more tutorials and workflow related posts will address many of my concerns.

Knowing the workflow of folks at mozilla will be a huge help to people like me who are working on writing extensions because the road to writing a meaningful extension is not as straightforward as it could be.

In the end I dont want the above points to act as a downer in a software release post and would like to congratulate folks at Mozilla about the great work that they do.

<comment><USER10> Jetpack is preferred because it's easier to write, reduces compatibility problems between versions (because there are fewer "hooks" into deep FF innards), and you don't have to restart to install, uninstall, or reload them. Of course there are limitations, but unless you really need something in XUL that's not available in Jetpack, Jetpack is the way to go.

</comment></comment></comment></comment><comment><USER11> Have the memory issues been resolved? Under Windows 7, it isn't uncommon to find an idle Firefox browser with a few low-activity tabs using up more than 1.5GB of memory. It's gotten to a stage where I have to restart the browser every couple of days...reminds me of when I had to this with my Windows PC! I've recently moved over the Chrome and while I miss Firefox, the browser is far less of a memory hog.

<comment><USER12> Why does it bother you that an application is using so much RAM? Do you only have 2 GB or something like that? I'd prefer that applications used my RAM since unused RAM is just wasted electricity.

I find it strange that people still think of RAM as a precious resource that needs to be conserved and under-utilised. I'd rather have it used than have to fetch something from disk or the network.

<comment><USER13> > I'd prefer that applications used my RAM since unused RAM is just wasted > electricity.

I... but... er...

This is probably the most ridiculous thing I've ever seen on this site.

You could write a two line C program that allocates all the memory on your system and then sits in a loop doing nothing, but then you'd be _wasting_ even more electricity because your hdd would be reading/writing to your swap space. :|

> I'd rather have it used than have to fetch something from disk or the > network.

Modern operating systems _do_ use your free memory for cache. Linux will regularly chill at 90%+ memory usage (the majority being cache that can be freed instantly when other apps need it) and Windows has SuperFetch which does basically the same thing as I understand.

<comment><USER12> Yes, you could write such a program.

Yes modern OSes do use non-Application RAM for caching, mostly files and other small buffers. While Firefox is probably doing a lot of caching for web content, something that modern OSes don't yet do. Hence I have no qualms about it using over a gig of RAM.

I guess my comment was read more angrily than I meant it to sound. What I mean is let applications use as much RAM as they need and be done with it.

</comment></comment></comment></comment><comment><USER14> Is this great news, or good news, or nothing too exciting? Dunno. It might be interesting to learn how many people read this in another browser, popped over to firefox to update it ... and then returned to their other browser. We may be at the point where browsers are like toilet paper -- lots of brands will do the work, and it's hard to pay much attention to which one is installed.

<comment><USER15> Firefox Sync sort of changes that for me. It gives enough convenience that I've also gone Firefox on my mobile devices. Being able to access open tabs from my laptop on the phone is great when I'm sitting in the bus.

<comment><USER16> I really hope the persistent sync bugs get worked out soon. I'm told that the final, and big, fix was in alpha, which makes me think that it's not in 8.0. Soon, soon.

</comment></comment></comment><comment><USER17> s/is released/has been released/;

</comment><comment><USER18> Just got the notification, but didn't upgrade because a lot of my very useful extensions for HTML dev weren't compatible.

I don't think the new features in 7->8 make up for the lack of my extensions.

<comment><USER19> Use this extension to "make" your extensions compatible [https://addons.mozilla.org/en-US/firefox/addon/add-on- compat...](https://addons.mozilla.org/en-US/firefox/addon/add-on- compatibility-reporter/?src=api)

<comment><AUTHOR> This is great, thanks for posting it. I manage my passwords with 1Password, and while they're good about pushing updates, I've never seen their Firefox extension marked as compatible when a new version of Firefox is released.

<comment><USER6> Why 1Password rather than Firefox Sync?

<comment><USER20> Probably because 1Password doesn't support just a specific browser and it's also available for tablets and smartphones.

<comment><USER21> The Sync API is documented, and Mozilla encourages development of outside server and client implementations. Sync is available for tablets and smartphones.

</comment></comment></comment></comment></comment></comment><comment><USER22> In 5 weeks they are going to be shipping Firefox 13.0.

</comment><comment><USER23> It would make more sense (to me) that they focused on fixing some of the many bugs filed in the bug tracker. Just saying, but then Chrome is my browser of choice anyway...

<comment><USER24> You do realize that there were tons of bugs fixed between 7 and 8, right?

It's just that bugfixes never make the news.

</comment></comment><comment><USER25> Dear Mozilla. Why do you keep doing all these full version releases? Seriously it's just annoying. Just because IE is on version 10. Doesn't mean you have to be. Why are you doing this.... You've gone from 3-8 in a year. That's not right.

<comment><USER26> I sort of understand their reasoning. It's easier to get people interested in a "full" release, than some 3.0.21 version every three mongths.

It also was more wrong to stay on 3.6.* for over _two_ years.

A middle road might be to start a year with a full release and then do point- releases doing that year, so in 2013 we would have, for instance: 13, 13.0.1, 13.1, 13.2, 13.2.1, 13.3.

<comment><USER27> This is a valid, on topic, cogent post. Why is it getting downvoted?

<comment><USER28> Because version numbers are irrelevant, what's important is keeping people on the newest version. "Solving" the problem of large version numbers is like solving the problem 1/0.

<comment><USER26> At work we have a web application purchased about 18 months ago that officially don't support Firefox above 3.6. There were rendering differences between 3.6 and 4 that were serious enough to enforce that restriction for certain users. Apparently, it has begun working as expected again in FF7 (might have worked in FF6, not sure).

The application also uses jQuery 1.2.6 (released May '08) - I guess I'll be the one to QA the migration to the present day.

Hence I am not yet a believer in "latest version is the greatest version", in all cases. In principle, yes, but there are exceptions that makes version numbers necessary.

<comment><USER21> Let's be clear.

"The version number is too high" is one complaint.

"I have compatibility issues across releases" is another. They are not the same. They are not interchangeable.

What happened here perfectly exemplifies what happens every time a release is brought up. One of these complaints is brought up, then in the next breath it's switched to the other, as if we're still discussing the same thing.

We are not.

Conflating the two by bouncing between them _multiple times in a discussion, every time the discussion occurs_ results in massive, unproductive churn.</comment></comment></comment></comment></comment></comment>


Yammer Enterprise about to be ditched - <AUTHOR> Might look at switching to something like cronycle.com or Facebook at Work?<p>http://venturebeat.com/2016/09/26/microsoft-is-killing-yammer-enterprise-in-january-2017-will-start-integrating-office-365-groups-first/ <comment><USER2> Welcome to Hacker News. Can you submit the article as URL with the articles title (unless it's misleading or click-bait) and your comment as comment after the submission? Currently you're mixing the article with your opinion.</comment>


What Will Life Be Like in the Year 2008? (Nov, 1968) - <AUTHOR> http://blog.modernmechanix.com/2008/03/24/what-will-life-be-like-in-the-year-2008/ <comment><USER2> Basically, we got the things that depend on electronics (web, cell phones) and not the ones that depend on other technology (flying cars, domed cities, artificial organs).

I notice there's another way to partition that set: we got the things that don't require too much government involvement.

We got the cheap meat-like food, but from an innovation less benevolent than algae farms: factory-farmed meat.

Come to think of it, there turned out to be a similar workaround for the domed city problem: everyone just moved where the weather was good.

What's weirdest about this for me is that 1968 was the year we came to America. I remember 1968. It's kind of crazy to think there were a lot of people walking around then thinking we'd be travelling around in flying cars.

<comment><USER3> I'm still holding out hope for autonomous cars within a decade. Technology- wise we're pretty much there. The hard part will be convincing the public and government regulators to accept them.

<comment><USER4> A coworker of mine who's been in the GIS industry for about as long as said industry has existed gave that very same assessment. The real obstacles at this point are social: people will freak out at the thought of robot trucks driving on the same highways as they do (or stealing their trucking jobs).

I give the example of trucks on highways because that would probably come first, as it's simpler to safely implement than passenger vehicles or city driving.

<comment><USER5> "(or stealing their trucking jobs)"

This was covered in a Simpsons episode. Turns out that all the trucks already drive themselves, but the truckers' union has prevented that information getting out to the general public.

(Couldn't find it on youtube.)

</comment></comment></comment></comment><comment><USER6> Sure it's funny, but just wait until the people of 2045 dig up Ray Kurzweil's "Singularity is Near". Fourty years ago some people thought we'd have automated cars, undersea resorts and climatized, domed cities. Today some people think 40 years from now we'll be immortal, omniscient, omnipotent gods that rule the universe...

<comment><USER7> One of my CS professors is heavy into Kurzweil. He had me read "The Singularity is Near". I decided Kurzweil's arguments are the rhetorical equivalent of those algebra jokes where you "prove" 1=2 but it goes through a step that hides a divide by zero. Similarly, "The Singularity is Near" uses steps that seem logical to come to a ridiculous conclusion.

</comment></comment><comment><USER8> I think the four-hour workday is an interesting idea. I'm still in school but I worked at a real estate development office for a summer, and most of those jobs could've been done in four hours a day if people didn't get away with being so lazy. I bet a lot of companies could reduce the workday to four hours, and if they're quicker to fire people for not making deadlines and such, they'd get exactly the same productivity out of them as they do now (plus, lots of people would probably want to work there).

<comment><USER9> If we all had a 4hr job day, then people will be getting 2 jobs. In a consumer markets, where how much you pay for housing determines the schooling of your kids, or the "want" for plasma tvs, nicer cars, more shiny things will make people work as much as they can.

The only way to enforce a 4 hrs work day will be thru law (goverment mandate not to work more than 4hrs a day, ala EU's 37.5 normal workweek),

Or, if something like that star trek machine that can create everything (you press a button, and food just comes out from it, or any electronics/material need you need). Then people will be working only to teach, design new things, entertain, as material needs will be superflous.

<comment><USER4> > Then people will be working only to teach, design new things, entertain, as > material needs will be superflous.

It's frightening to consider that IP laws would probably outlive natural scarcity...

</comment></comment></comment><comment><USER10> Hey, we still have 8 months to go. Maybe it'll all be true by then.

<comment><USER4> They were obviously predicting the state of the art at the end of President Gore's 2008. ;-)

</comment></comment><comment><USER11> "TV-telephone shopping is common. To shop, you simply press the numbered code of a giant shopping center. You press another combination to zero in on the department and the merchandise in which you are interested."

\--> I find it fascinating that they just couldn't conceive of a massive network of computers to do things like this... some things are so out to lunch still, but things like direct deposit of funds into your bank account, I can't believe that was so far fetched?

<comment><USER12> <http://en.wikipedia.org/wiki/Minitel>

</comment></comment><comment><USER13> People overestimate things on a shorter term, and underestimate on a longer term.

<comment><USER14> That quote (or variation) if often attributed to Bill Gates? is it? or is it older wisdom of some sort.

<comment><USER13> Yes its a quote from gates' book "The Road Ahead". He uses it in may of his interviews. :)

</comment></comment></comment><comment><USER15> Makes me think that the things that are most likely to change are those where entrepreneurs can most easily create products without needing to get around government rules and regulations.

</comment><comment><USER16> "The single most important item in 2008 households is the computer."

A true visionary.

</comment><comment><USER17> Some people are so close to that futuristic 2008, yet most people in the world are so far away. We really should figure out a way to fix all that.

<comment><USER18> Why?

<comment><USER19> Inequal distribution of resources

<comment><USER18> Again: why?

 _Why_ should we strive for equality?

<comment><USER19> For now, we can strive for a bare minimum of clean water, 2000 calories a day of food energy, and governments that don't stifle economic advancement. We have plenty of resources to do this now, but it isn't happening because once wealth and capital get concentrated in individuals or groups of people it tends to just make them more wealth.

And the answer to the _why_ is that I believe humans have a fundamental right to life. I have no real justification; it just feels right to me.

<comment><USER18> Funny thing is: people who live in countries with higher levels of equality (think Japan, Finland) are the very same countries with high suicide rates.

Not saying that correlation implies causation, just to show that perhaps this ideal equality is not so fundamental to our overall happiness.

Also, I'd like to know _how_ we can strive for clean water and food for 7 billion people (9 billion until 2050) _while_ keeping civil liberties to people along the process.

</comment></comment></comment></comment></comment></comment><comment><USER20> Large areas of the sea being are indeed beds of "protein-rich" algae - fed by nitrogen in industrial and agricultural waste.

[http://www.latimes.com/news/local/oceans/la-me- ocean30jul30,...](http://www.latimes.com/news/local/oceans/la-me- ocean30jul30,0,6670018,full.story)

</comment><comment><USER21> Most predictions of the future tend to be exaggerated, because that's what people like to read and dream about. That does mean, however, that most of today's predictions about the future can also be taken with a pinch of salt, which is a little depressing.

</comment><comment><USER22> "Heart disease has virtually been eliminated by drugs and diet."

Not really much excuse for the diet part of this one going so far wrong is there.

</comment><comment><USER23> Sort of depressing - basically everything that rings true was possible in '68. Hell, even the internet was almost ready in '68.

</comment><comment><USER4> I love their faith in the National Centralized Single-Point-of-Failure Traffic Computer. ;)

</comment><comment><USER7> I found it ironic that they pegged the population for today (around 350 million), amongst all the other things they got wrong, and then went on to say that only domed cities could support such a large population!

</comment><comment><USER24> Colonisation of the ocean was considered enevitable in that era. It is also covered in the 1970 book Future Shock by Alvin Toffler. However, so far, it has been easier to improve utilisation of land.

</comment><comment><USER25> Ha! I saw "one click" shopping in there. Eat your heart out amazon.

</comment><comment><USER26> I'm frikking depressed now.</comment>


Google search: 'mac screenshot shortcut' displays the shortcut on results page - <AUTHOR> http://i.imgur.com/AGgX16L.png

<comment><USER2> I always wonder how many different things like (specialized results for certain queries) this Google has programmed into their systems.</comment>


Ask HN: How did you get your first 20 SAAS customers? - <AUTHOR>

I created a niche SAAS product, but I'm not sure how to go about getting people to use it. Maybe it's to niche of a product and not a good idea. Or maybe I need to change my sales strategy. <comment><USER3> I believe it depends on who your target audience is, but basically you are facing a marketing obstacle. You need to spread the message about your product. That may be done via webmarketing/social media (Show HN?) or IRL in conferences, for example or the old door-to-door sales.

</comment><comment><USER4> Briefly looked at your site. First thought:

        Couponify helps merchants build coupon sites that are SEO friendly

I get the first part, but "that are SEO friendly" sounds a bit odd. I would take that for granted - it's a bit like if you were advertising a car - <USER2> wheels.

Is this really A) a top priority for your audience and B) a unique offering of your product, compared to alternatives?

<comment><USER5> His target market is people who don't design or code their own sites, but are just looking to check off features (e.g. Need CMS, Must be SEO Friendly, Need e-shopping cart solution, etc.)

Secondly, unlike a car without wheels, its very easy to get a site which isn't particularly SEO friendly.

What does that even mean?

Is it clean human readable URLS? Amazon doesn't have that but its SEO friendly.

Does it refer to on page optimizations and inner link building? Maybe, but you can have a shopping cart/coupon site without the greedy linking structure that Google currently loves.

</comment></comment><comment><USER6> Why don;t you do a "Show HN" post and see if you get anyone from here ? You never know. The first 20 could come from HN.

<comment><AUTHOR> A show HN a good idea. Even if we don't get any signups, the Hacker News community is really good about giving feedback.

The service we built (couponify.com) is mainly targeted toward merchant affiliates. So not exactly the Hacker News crowd. Nevertheless, I'll give this a shot. Thanks for the advice!

</comment></comment><comment><USER7> I suggest asking for feedback at sitepoint, Warriorforums and other affiliate hangouts. You'll get some attention.

I also suggest experimenting with PPC advertising.

<comment><AUTHOR> We have PPC setup, but good call on hitting all the affiliate forums.

<comment><USER8> Is it working?

PPC seems like an expensive way to predictably acquire customers.</comment></comment></comment>


Show HN: ClojureScript pixel game engine with Blender live-reloading - <AUTHOR> https://mccormick.cx/news/entries/clojurescript-pixel-game-engine-with-blender-live-reloading <comment><USER2> This is by the way how everything with clojure is developed (If you use the repl/figwheel/shadowcljs/combination of all of these) !

Instant changes and no reload/recompiles.

<comment><USER3> Clojure is the only language I've been excited about since the early days of Ruby. I wish so much that it would catch on, and especially I wish it would supplant Javascript.

Clojure is such a sane, elegant, and expressive language. Elixir is pretty ok, especially on BEAM, but it looks like Perl compared to Clojure. It's just a tragedy that for the best career options one must basically choose between Python or Javascript. (js because that's what everyone uses for front end, and python because that's what's apparently eating the world via AI, ML, etc.). To be nice to Python, it's a very practical language. It just is completely inelegant compared to Ruby and especially Clojure (and even Elixir).

Every couple of years I tell myself, "I'm going to do my next project in Clojure; reality be damned!". But always I give up and fall in line.

<comment><USER4> Try Hy ([http://hylang.org](http://hylang.org)) for a Clojure-ish Python.

<comment><USER5> Without maps or persistent data structures, it won't feel Clojure-ish beyond simple examples. But a lisp on top of the Python ecosystem is an exciting project.

<comment><USER4> Without maps? What's wrong with a Python dict?

</comment></comment></comment></comment></comment><comment><USER6> Yeah okay that's sick, I'm building a Peggle clone in Unity with Clojure/Arcadia at the moment but this looks like it has the potential to be more accessible

<comment><USER7> sounds interesting, is the development of that something joe public can look at? :)

</comment></comment><comment><USER8> I don't want to just pile on with praise spam, but this is really cool. It's great to see people building more tight, simple integrations with Open tools.

<comment><USER9> Agreed! Blender is so good and widely used now that it makes perfect sense to tightly integrate with it for your assets creation pipeline.

The most popular Blender-connected game engine around right now is Armory3D. There is an early WIP successor to that being built in Rust by a former Armory developer: [https://github.com/katharostech/arsenal](https://github.com/katharostech/arsenal)

</comment></comment><comment><USER10> I am constantly surprised and delighted by what the folks over in the Clojure world come up with.

<comment><USER11> Yeah, Clojure community probably has less active members than a number of engineers working say for Google or Facebook. But the awesome stuff and ideas it generates all the time is really surprising.

</comment></comment><comment><USER12> Site seems to be struggling, think this is the repo: [https://github.com/infinitelives/px3d](https://github.com/infinitelives/px3d)

</comment><comment><USER13> This is one of those "exciting mix of tech terms" submissions. Really well done!

</comment><comment><USER14> Guess I will take a look at this, cause this sounds interesting as a casual game jam participant myself

</comment><comment><USER15> I am just learning about cljs landscape. Any reason someone would choose figwheel over shadowjs.

<comment><USER2> none, shadow cljs does everything and seems so far to be easier to get running with full emacs repl-y goodness

<comment><USER16> I think creating libs is one reason, Iirc was not supported by shadow.

<comment><USER17> Afaik this is not true see [https://shadow- cljs.github.io/docs/UsersGuide.html#target-no...](https://shadow- cljs.github.io/docs/UsersGuide.html#target-node-library)

<comment><USER18> This is true. I've asked shadow-cljs creator directly and he recommended using leiningen for library creation.

</comment></comment></comment></comment></comment><comment><USER19> This is great. Always amazing where clojure can put a repl

</comment><comment><USER20> This is very nice and cool.

Would like to try it out sometime.

As far as I could see there's no open source license in the repo though.

If I may I would like to suggest that you release it under the terms of the ISC license. It's a highly permissive and very short and simple license.

</comment><comment><USER21> Really cool project. Nice work!

</comment><comment><USER22> And this guys seems to have made his own font

<comment><USER23> that's the easy part: [https://www.calligraphr.com/en/features/](https://www.calligraphr.com/en/features/)

</comment></comment><comment><USER24> Really cool, keep up the good work!</comment>


2019: Make Yourself Great Again - <AUTHOR> https://begreat.me <comment><USER2> I find my mind gets pretty screwy and resistant to doing things but a good snort of the old "exercise" drug clears my mind and makes me happy, then I can get on to other stuff. The trick is to get the right intensity. Too easy and there isn't a high, too hard and I'm fried for the day.

<comment><AUTHOR> Totally. I also struggle to do intense workouts in the AM, but 20 min or so gets me in the right headspace for the day.

</comment></comment><comment><AUTHOR> As we head into the new year, this is a good reminder of the things we can accomplish if we spend less time on X and more time on Y, in order to be at Z by 2020.

You can track how your multiplier changes throughout the year and find some tools to help you progress. I originally built this to help me fix my own habits and dedicate more time to learn to code, but I think can be helpful with any goals.</comment>


Show HN: Do you hate salesforce? - <AUTHOR> http://ihatesalesforce.com

<comment><USER2> Watch for trademark infringement my friend.

That said, I also hate sales force. It is extremely clunky, confusing, and dont like the support.</comment>


Ask HN: Can chess be used for crypto communication? - <AUTHOR> Hi folks, I am writing a short fiction, and I came upon the idea to use chess as a medium of communication. Is it possible? I mean, if a person uses an entire chess game to represent a paragraph? I imagine one side of the game is not enough to express the english language as there aren't enough  initial moves in the game. But both sides together could do the job? <comment><USER2> Using normal chess pieces? ....

1)

umm I mean you do have an 8x8 grid (8 bits each row) and you could have pieces make up bits being on or off and make a 8 letter phrase (each row being it's own letter).

(Ascii Wikipedia for your reference - [https://en.wikipedia.org/wiki/ASCII#ASCII_printable_code_cha...](https://en.wikipedia.org/wiki/ASCII#ASCII_printable_code_chart))

2)

Maybe you could also do something like the Where Am I Game?

example:

I stay one night in Denver; four nights in San Francisco; And one night in Washington DC;

Where am I?

1 Denver = D 4 SanFrancisco = F 1 WashingtonDC = W

(DFW) -> Dallas

So you could do something like playing a chess game and for every attempted move (like player 1 moves a Rook but keeps his hand on it and taps the board thinking about the move and then places it down means the letter 'o').

3)

There was also a movie with Bruce Willis (or The Rock Johnson. I always get them confused). Where the main guy tries to escape from a space prison. There was one scene where they communicated over a chess game by only talking when there hand was on the queen. Any word spoken while on the queen was then concatenated to a sentance to convey what they were really talking about.

<comment><AUTHOR> Thanks, but what I had in mind was a chess game played on the internet, using for example, [http://chessboardjs.com/](http://chessboardjs.com/). Can a recorded game communicate a message?

<comment><USER3> How about this: you use an AI to play your side, speed chess, 30 second time limit length of time for your move is a letter- 1-26, anything over 26 seconds is punctuation.

Then arrange an instant messenger software to interface with the chess playing AI so you type up the message and it plays the move using the right length of time for each letter

Then you can translate in real time, or save the moves with times and convert the whole message at once.

Play multiple games to send longer messages...

Then you could use a different shifting cypher for each colour to fool breaking the code, or even implement some kind of one time pad.

Example here:[http://www.chessbymail.com/score.htm](http://www.chessbymail.com/score.htm)

<comment><AUTHOR> Using time as the differentiator is a brilliant insight. Thank you.</comment></comment></comment></comment>


Hints for Computer System Design (1983) [pdf] - <AUTHOR> https://www.microsoft.com/en-us/research/wp-content/uploads/2016/02/acrobat-17.pdf <comment><USER2> Butler Lampson as recently updated his paper.

Slides: [http://bwlampson.site/Slides/Hints%20and%20principles%20(HLF...](http://bwlampson.site/Slides/Hints%20and%20principles%20\(HLF%202015\).pdf)

Talk: [https://www.youtube.com/watch?v=TRLJ6XdmgnA](https://www.youtube.com/watch?v=TRLJ6XdmgnA)

</comment><comment><USER3> Wow, some great stuff in here. Adding to my ANSI color fortune clone @ [https://github.com/globalcitizen/taoup](https://github.com/globalcitizen/taoup)</comment>