Ask HN: Best long-term and marketable web stack for freelance contract devs? - <AUTHOR> I feel like I don't get enough time to deep-dive into one specific programming language / framework, since as a freelance I feel I need to learn 4 or 6 or 10 languages / frameworks and need to keep up-to-date on all of them.
I want to invest the next years learning a few carefully selected languages / frameworks in more depth, without worrying too much about breaking changes in the underlying software, so that (optionally) I can easily pick up other languages / frameworks on-demand, since I understand the underlying concepts better.
Do you have any go-to web dev languages / tools / frameworks that you feel will be a good investment of your time in the long-term?
Here's some stuff I like: Python / Flask, PostgreSQL, AWS (incl. ElasticBeanstalk) / Netlify,  Mithril.js, npm / Makefile / Parcel.js. (Currently I use a lot of PHP / Laravel / Symfony, Vue / Angular in addition to the previously mentioned.) Still undecided on Docker, but I do use it quite regularly, but also still use Vagrant as well.
(Re: My background: Freelance web developer / software architect in Western Europe, mostly working with agencies and SMEs; I've been doing this for about 10 years, 6 of them full-time, but have been developing websites or doing IT admin work on the side for about 20 years.) <comment><USER2> In my opinion a very important skill to have as a freelancer is to have an understanding of the whole picture. Clients hire you to _solve their problems_. How you do that and which tools you use is mostly irrelevant.

I suggest a backend language (Python, Rails, etc), then Linux system administration & networking skills (play around with some bare metal servers & hardware, see if you can turn an old desktop into a router, etc - that's how I got started) and then potentially a native mobile language like Swift or Java or Kotlin. These few solid basics will last you for decades without having to "keep up with the Joneses" learning every day's new Javascript framework.

The main marketable thing is your portfolio/resume and client testimonials, if any. Approaching it from a language/stack perspective instead of a solution perspective is IMO wrong unless you want to limit yourself to being a "code monkey" for hire.

</comment><comment><USER3> I think @Nextgrid hit the nail on the head. If you're being brought in to use a customer specified stack/platform, you're just contract labor. That makes you a commodity, and you're likely to draw commodity compensation for same. Your goal should be to position your self as somebody who is qualified - no, _uniquely_ qualified - to __solve a problem __for the customer. Get yourself in that position, and you 'll be the one dictating the technical details of the solution, and you'll be able to charge more.</comment>


Open Launchd - <AUTHOR> https://github.com/rtyler/openlaunchd

<comment><USER2> Is this related to the recent "OSX 10.10 OpenSource" post? Someone did claim that Apple stopped posting the source code for launchd...

<comment> vezzy-fnord I don't think so, no. A launchd port to FreeBSD is a project that has been hanging around and attempted multiple times by various parties with differing success (I linked to a working, though early launchd_xml port below).

This one in particular is the openlaunchd port first started by R. Tyler back in 2005 when he was a GSoC student, but was abandoned and restarted 8 years later in 2013, announced here: [http://unethicalblogger.com/2013/12/03/scratchiest- neckbeard...](http://unethicalblogger.com/2013/12/03/scratchiest-neckbeard- freebsd-x200.html)

        [...] FreeBSD unlocks some hacking that I've wanted to
        do, such as:

        Restarting my work with launchd on top of FreeBSD as a
        viable alternative to rc.d (aside: systemd which many
        Linux hackers are familiar with can be considered a
        poor impersonation of launchd, which is, in my opinion,
        a pretty stellar job management daemon)

That said, I don't think openlaunchd is entirely dead yet. I think a launchd port to FreeBSD is inevitable, whether it's this, launchd_xml or some other one (I'm fairly certain there's some non-public ports), but as a whole it's been a protracted ordeal.

</comment></comment><comment><USER3> Being that I am a Mac guy, I always sort of wondered about launchd as a reasonable middle ground between the godawful current init mess and the looming all-encompassing Stygian Lovecraftian systemd mess.

<comment><USER4> Apple originally wanted other Unix-likes to consider launchd. Ubuntu was considering it and I think even had it briefly as an option, but ultimately they decided to go with Upstart. This was mostly because the original license terms for launchd were deemed too restrictive (Apple Open Source License had some extra terms that were somewhat unpopular). Apple changed the license terms a year or two later, but it was too late.

I would love to see this on BSD though.

</comment></comment><comment><USER5> link to the project homepage: [https://wiki.freebsd.org/launchd](https://wiki.freebsd.org/launchd)

Not really an apple user, can anyone tell me what the benefit to porting this is? Is it much better than rc.d or sysvinit?

<comment> Tuna-Fish Yes. Launchd is arguably the first modern unix init system, with systemd and upstart being it's conceptual children.

It eschews shell scripts in favor of non-turing complete launch configs, manages process lifetimes in addition to just starting them and does bootup in parallel using pre-created sockets for synchronization.

It is quite barebones compared to systemd, but fundamentally it uses similar approaches to fulfill the same goals.

<comment><USER6> Solaris SMF came out at around the same time as launchd, which looks a bit more like systemd. I don't think there is one single origin to these systems.

</comment></comment></comment><comment><USER7> Was there any work done to replace XML for configuration? You may call it superficial, but I'd make that a priority over pretty much everything else. Many people won't get past that bullet point.

</comment><comment><USER8> Last commit made 5 months ago, and no updates on the project anywhere. Seems abandoned.

<comment><USER9> The FreeBSD wiki page[0] has an updates page, with this, from a month and a half ago:

> 20140910: Outback Dingo has made available an older port of pfSense's > launchd_xml.

[0] [https://wiki.freebsd.org/launchd](https://wiki.freebsd.org/launchd)

<comment> vezzy-fnord And a link to the repository: [https://github.com/outbackdingo/launchd_xml](https://github.com/outbackdingo/launchd_xml)

<comment><USER10> Note that the pfsense / outbackdingo launchd did something rather naughty -- it put the xml parser back in pid 1 which was intentionally not there by design at Apple.

tl;dr even if you could convince the FreeBSD devs that launchd is a great idea they wouldn't accept this as-is.

<comment><USER11> doesn't launchd on osx also parse plist xml files? How are those handled?

<comment><USER10> There's another binary that does the processing and the data is sent to the launchd daemon over a Mach-specific IPC channel that FreeBSD doesn't have.

</comment></comment></comment></comment></comment></comment><comment><USER12> I wonder if this could be used as an alternative to systemd?

<comment><USER13> It does most of the same things - the objections to systemd around covering multiple overlapping areas in a single project would also apply to launchd (and the Solaris SMF).

The best way to make cron / at / sysvinit / syslog / daemonize / xinetd / supervisord fans happy is to let them keep using cron / at / sysvinit / syslog / daemonize / xinetd / supervisord.

<comment><USER14> The biggest difference is that Apple hasn't demonstrated hostility/irrationality/utter dickery at people who report bugs on their tracker. The same cannot be said of systemd.

<comment><USER15> Is there even an open bug tracker for launchd?

<comment><USER14> Not really "open", it's write only.

[http://bugreport.apple.com](http://bugreport.apple.com)

<comment><USER15> Thanks, I tried searching for a launchd bug tracker but didn't find this. I'm still not sure if this is a fair comparison as we can't actually see how apple has responded to similar concerns (if any).</comment></comment></comment></comment></comment></comment>


Norway Used NSA Technology for Potentially Illegal Spying - <AUTHOR> https://theintercept.com/2018/03/01/norway-nsa-victory-garden-surveillance/ <comment><USER2> Indiscriminate dragnets are essentially standard tools, possibly the primary tools, of signals intelligence these days.

They're, well… indiscriminate. Since intelligence operates in secret, I think it's fairly disingenuous to consider their use governed by guidelines about _who_ can be spied on. You don't even know who the person is, until you've already spied. All oversight will be conducted in secrecy, and we already know that in the US, the NSA they made a mockery of the concept.

We could ban the dragnets entirely, but I can't see many militaries agreeing to handicap themselves relative to adversaries who _will_ continue to use them. The very best a Norwegian could hope for at a long shot is that Norway won't spy on them, but Norway's allies will and share the intelligence. Also, every other country in the world (and private companies) will be spying on them.

I think this may be a lost fight.

<comment><USER3> I have no problem with using dragnets to identify and disrupt activities that threaten national security.

I have a very big problem with the use of dragnets to get convictions in court by circumventing people's rights.

I don't see the need banning dragnets as a realistic option.

We need is a much stronger interpretation of fruit of the poisonous tree doctrine.

FWIW a metadata dragnet/haystack can be used to search for parallel construction needles the same way it's used to search for terrorist or insider trading needles, all three are just varying types people working together to get something done in secret. I'm not sure how to make incentives align so that actually works out in practice but it's technically feasible.

<comment><USER2> _I have a very big problem with the use of dragnets to get convictions in court by circumventing people 's rights._

This is doable, I think. It's kind of the case now, and all it would take is a momentary parliamentary majority to enshrine it. But, it's honestly hard to see a consistent legal/theoretical justification for it, if all the data is sitting on a government server.

Are you saying that a court/prosecutor should not be able to demand someone's emails? What if they could be used to exonerate?

Somehow, I just think that once these datasets exist (they do) we will eventually get used to them.

<comment><USER4> I think "parallel construction" is the issue at hand, they can illegally search your emails with no cause or warrant, and then pretend they didn't and came by the evidence through other means. They can do this to _everyone_ , and if you're targeted there's very little (nothing?) you can do about it.

[https://en.wikipedia.org/wiki/Parallel_construction](https://en.wikipedia.org/wiki/Parallel_construction)

>In August 2013, a report by Reuters revealed that the Special Operations Division (SOD) of the U.S. Drug Enforcement Administration advises DEA agents to practice parallel construction when creating criminal cases against Americans that are based on NSA warrantless surveillance. The use of illegally obtained evidence is generally inadmissible under the fruit of the poisonous tree doctrine.

<comment><USER5> I've been wondering for quite some time just how much of Bob Mueller's investigation into the President and Russian collusion is a meticulously produced example of parallel construction.

I'm not saying Trump and his people are innocent or that there's no Russian involvement, I just think it's highly unlikely that the set of evidence that we will see in these cases was obtained or produced with the publicized methods.

</comment></comment></comment></comment></comment><comment><USER6> I am disappointed beyond words. If they indeed surveiled Norwegian citizens I except all responsible will be severely punished and that examples are made. These days I feel examples are made of people that did much less to impact personal freedom and democracy. Obviously the Rechtsstaat has cumbled already... I believed Norway to be above such dystopian practices. </rage>

<comment><USER7> Why would you think that? It was a "public secret" in Norway for decades that the security services engaged in illegal surveillance mostly of the Norwegian left wing. E.g. I have personally talked to people who were the subject of surveillance well in excess of what the law allowed - one was a trade union organizer and member of the communist party that was followed to and from work every day for many years - his only explanation (after all they did not put every member of the communist party under surveillance) was that his route to work led past the Soviet embassy.

Another was the longtime editor of the communist newspaper Friheten ("Freedom"), Arne Jørgensen [1], who told me about how he for a period regularly had agents of the security services stop him in the streets to rattle him by e.g. commenting on details of private conversations he had the previous day with his wife at home.

This was reported regularly for years, but was laughed off as conspiracy theories, until it got a point where it could not be denied any more, and the Lund report[2] revealed extensive illegal surveillance.

Former prime minister Willoch defended the illegal surveillance against e.g. AKP-ML (Maoists ) with arguing they were an illegal organization. But no decision to outlaw them have ever been made.

During the writing of the Lund report, it became clear that one of the members, Berge Furre [3], a theologian and former Socialist Left (SV) politician, was still under illegal surveillance _during_ his work on the report into the illegal surveillance.

None of the people involved were charged with anything. The security services changed name from POT to PST, and everything else remained largely unchanged.

Years later, when the first reports of Norwegian complicity in NSA surveillance was reported, the paper that reported it was pushed into a retraction after Grandhagen, the then leader of the notoriously tight-lipped military sercurity service uncharacteristically "took the blame" for reported surveillance that for every other country in the same document had turned out to be civilian surveillance of their own citizens, and claimed that Norway was somehow feeding the NSA metadata on phone conversations in Afghanistan of a volume that meant Norway somehow must be tapping every phoneline in the country.

Nobody in the press admitted to asking follow up questions about why military intelligence would suddenly gie out details like that, nor about why the US would be interested given reports that the US at the time themselves did not just capture meta data, but full voice recordings from Afghanistan.

Nobody reacted. Both Dagbladet and Aftenposten (major newspapers) deleted a slew of comments in their forums asking why nobody had asked questions about this of Grandhagen.

Like with the surveillance uncovered by the Lund report, any questions about this now gets met just with a shrug.

Then a couple of years ago, Aftenposten reported about a lot of unregistered IMSI catchers in Oslo. Again the intelligence services just insisted they were looking into it, after which the IMSI catchers "disappeared".

There's decades of history of this bullshit in Norway, and decades of experience showing that most people just refuse to question the official stories until things like the Lund report, and then go back to quietly accepting the official stories.

Part of it is probably that it has been _relatively_ benign in Norway. No secret prisons, very little government interference in the press, etc. - it's mostly been just surveillance, so few people have been affected, and those who have been affected have been far out on the political fringes.

But I see no reason why that would change now.

[1] Norwegian wikipedia entry as I don't think he's covered in the English one: [https://no.wikipedia.org/wiki/Arne_J%C3%B8rgensen_(redakt%C3...](https://no.wikipedia.org/wiki/Arne_J%C3%B8rgensen_\(redakt%C3%B8r\))

[2] [https://en.wikipedia.org/wiki/Lund_Report](https://en.wikipedia.org/wiki/Lund_Report)

[3] [https://en.wikipedia.org/wiki/Berge_Furre](https://en.wikipedia.org/wiki/Berge_Furre)

<comment><USER8> > security services engaged in illegal surveillance mostly of the Norwegian > left wing.

IMO how you put it is perhaps a bit misleading -

You should probably point out that it was the left wing surveilling each other. More specifically it was the Socialist Labour party (AP) which conducted surveillance of the communist AKP-ML (and NKP) for the reason of being in control of the left-wing agenda in Norway.

Considering that AKP-ML was part of the stay-behind groups, known as "Gladio" (something that ironically (?) sprung out of NATO [0]), armed and trained PLO and marxist revolutionaries in Israel, and had networking with other similar ideological extreme radical left groups such as Red Army Fraction (Germany, Japan, Italy), Black Panthers and Weather Underground in the US, as well as IRA in Ireland and close ties with Pol Pot[1] and other groups in Asia. And they were actually planning armed revolution in Norway - the surveillance was called for (ref. Willoch). However, the labour party's close ties with the IC and media in Norway was peculiar (at the time there were only a single national government owned TV/radio broadcaster, NRK, rooted in the labour party) and these three "fractions" held meetings frequently.

> No secret prisons

Partly correct - in Norway some people were thrown into mental hospitals instead. A famous case would the Kaare Torvholm [2] case which got arrested, together with the sheriff and a deputy (the equivalent of) and sent to mental institution which lead a local newspaper to raise the question if a "schizophrenic epidemic" had reached the shores (later picked up by VG, a national newspaper). This for reporting discrepancies with money (pension funds and more) in the fishing industry which was used as part of intelligence networks (at the time).

As the original thread topic:

Norwegian military has been conducting surveillance for a long time, illegally and including Norwegian citizens. The process right now is to push through laws which allows for this sort of surveillance (and let them keep the data they have, which is already shared with US and UK). These laws will just "harmonize" the Norwegian laws to those of the UK and partly US. These operations centers are located several places, not just in this region, but from the west of Norway (Haakonsvern) to Troms in the north (Setermoen) and involves what is called "svarte operasjoner" ("black ops" in English). One of these operations got public attention some years ago when it was revealed that they were spying on the King's email traffic [3].

[0]: [https://en.wikipedia.org/wiki/Operation_Gladio](https://en.wikipedia.org/wiki/Operation_Gladio)

[1]: [https://cambodiatokampuchea.wordpress.com/2015/08/30/norwegi...](https://cambodiatokampuchea.wordpress.com/2015/08/30/norwegian- delegation-1978/)

[2]: [https://www.fiskersiden.no/forum/index.php?/topic/22444-fisk...](https://www.fiskersiden.no/forum/index.php?/topic/22444-fiskeren-k%C3%A5re- torvholm-og-fraglene/)

[2]: [http://detsomstatennorgeskjuler.origo.no/-/bulletin/show/548...](http://detsomstatennorgeskjuler.origo.no/-/bulletin/show/548522_kaare- torvholm-saken-historien-om-stay-behind-amp-fi?ref=checkpoint)

[3]: [https://www.vg.no/nyheter/innenriks/forsvaret/forsvaret- bekl...](https://www.vg.no/nyheter/innenriks/forsvaret/forsvaret-beklager- snoking-i-kongens-e-post/a/576167/)

<comment><USER7> > You should probably point out that it was the left wing surveilling each > other. More specifically it was the Socialist Labour party (AP) which > conducted surveillance of the communist AKP-ML (and NKP) for the reason of > being in control of the left-wing agenda in Norway.

AP is centrist social democrats, and while an AP government _started_ the surveillance, it continued through governments that included every single one of the right wing and centre-right parties. It's misleading to suggest it was "just" one left wing party keeping an eye on the others.

> Considering that AKP-ML

... notably the security services never managed to prove that they constituted a threat in any way - if they had, they'd had justification under the law to carry out legal surveillance of them. Their "training" consisted pretty much of running around in the forest with toy weapons - you get much more relevant training as part of the compulsory conscription (at least back then when most men did serve).

It was right to keep an eye on them given the company they kept, but there was never any legitimate basis for more, as the total lack of evidence of anything criminal even despite the invasive illegal surveillance they were subject to found.

But focusing on AKP is also misleading in that they were by far the smallest of the groups subject to illegal surveillance. By the early 90's - when they were still subject to various surveillance - they were (as were NKP) down to a membership of about ~500 or so (for AKP my knowledge of that is indirect; for NKP I saw their data first hand at the time).. SF/SV surpassed both of them in size very early on (the different trajectories was one reason why the attempt at merging SF and NKP failed - NKP pushed for too much influence relative to their declining membership base, and the trends continued on both sides.

Both AKP and NKP merited surveillance at various points, and SF probably did too for a short while, but the important point is that we know from the illegal surveillance that the illegal surveillance never uncovered evidence that they actually posed any risks, and we know that it uncovered nothing of note that wouldn't have been uncovered with legal surveillance. That is the big problem - they kept up invasive surveillance for decades even after their own results showed it served no purpose, and escalated it to the point of openly harassing people.

If anything, the evidence is clear that the Soviets for example focused on people with ties to AP, because they were the ones with power, and much more useful.

As for AKPs various sympathies, they certainly had "contact" with lots of nasty groups, but having met people that were centrally involved in AKP at the time, it's pretty clear most of their "contact" with various groups was severely exaggerated - they were much less prominent than they wanted people to think. But the security services would have known this given the level of surveillance they were under. They'd have known with just legal surveillance too.

They were academics that talked a lot and did little, and were idealists with wildly unrealistic ideas about how the rest of the world worked. A story that illustrates just how naive they were involves when they sent a delegation to Albania, which under Enver Hoxha was the "shining light" of Europe for the Maoists. But the problem was most of them at the time were hippies and had long hair, and Albania did not tolerate long hair on men at the time. So they had to cut it at the airport. But then the border guards refused to let them in as their passport photos no longer matched their appearance, so the delegation was not allowed entry and had to return. That's the type of thing that happens to unwanted groupies, not well respected guests.. I have no reason to doubt that story, as I heard it told in front of one of the people that was part of said delegation, and he did not correct any of it.

The worst part given this that for all the security services obsession with the small left wing groups, the vast majority of political violence in Norway during the entire period was from the far right directed at the left (the exception being some violence directed at neo nazis predominantly by anarchist groups tied to Blitz). AKP in particular was the victim of multiple terror incidents, and e.g. the security services have in retrospect admitted they for example made use of the firebombing of one of AKPs book stores as an excuse to go through AKP documents under the guise of investigating it, rather than focus on solving the crime. When AKP claimed that documents had gone missing at the time, they were ridiculed for it in the media, because "everyone" blindly accepted the police claims that nobody would that.

What we've seen is that the illegal surveillance has validated strongly that the laws were flexible enough as they were: The illegal surveillance uncovered no risks that there's any indication would not have been known if they had stuck to the legal surveillance. Meanwhile the far right went basically unchecked in the 70's and 80's until the level of violence escalated too far to be possible to ignore. It took years to establish the same kind of overview of the neo nazi groups that were actually violent as they had on a continuous basis for irrelevant pretend-revolutionaries who never posed a threat.

But if they'd stuck to the law they'd have been unable to e.g. harass people in public by telling them to their face how they'd taken all privacy away from them.

</comment></comment></comment></comment><comment><USER9> > "Despite a hefty price tag of more than $33 million paid by Norwegian > taxpayers, the Norwegian Intelligence Service has kept the operations at the > site beyond public scrutiny"

They wouldn't be much of an intelligence agency if they didn't.

<comment><USER10> Why must intelligence be secret?

<comment><USER9> Why doesn't Apple release their internal roadmap? Because others would take advantage of that information.

Same thing with intelligence. People don't know your gaps in intelligence gathering if it's all secret. If they do, they'd take advantage of of that information and just work around them.

</comment></comment></comment><comment><USER11> This may not be illegal at all. Like all other countries, we have foreigners living in Norway. A small subset of these are bad actors. Most notable we have a history of Russian agents and ISIS members in the country. Intercepting all communications filtering for these non-Norwegian citizens/terrorists is not illegal.

<comment><USER12> How do you know they only "filter for non-Norwegians"? According to some people in this thread, the intelligence agencies should operate in complete secrecy.

<comment><USER13> I don't think OP made that claim - merely that _if_ that is how they were operating with the dragnet, it would not be illegal.

</comment></comment></comment><comment><USER14> Can anyone with better knowledge of satellite tech explain why exactly this article mentions use against Norwegians and draws a parallel with illegal spying?

The source documents they provide seem to be about targeting satellite traffic (Inmarsat, RU civ/mil traffic, etc) from certain foreign satellites.

</comment><comment><USER15> If i know my fellow countrymen, most people in Norway will shrug this off. That is if the news reach them at all -- I haven't seen this reported in any Norwegian mainstream media so far. We live in discouraging times.

<comment><USER16> NRK (government-owned broadcasting corp. - about as "mainstream" as it gets) covered it yesterday [0], and has published comments [1-2] today.

[0]: [https://www.nrk.no/dokumentar/xl/antennene-som-samler-inn- da...](https://www.nrk.no/dokumentar/xl/antennene-som-samler-inn-data-om- norske-borgere-1.13881286)

[1]: [https://www.nrk.no/ytring/sviket-mot- grunnloven-1.13940422](https://www.nrk.no/ytring/sviket-mot- grunnloven-1.13940422)

[2]: [https://www.nrk.no/ytring/e-tjenesten-folger-norsk- lov-1.139...](https://www.nrk.no/ytring/e-tjenesten-folger-norsk- lov-1.13941834)

<comment><USER17> To be fair, neither VG, Dagbladet or TV2 have covered this, at all. These are all major news agencies.

</comment></comment></comment><comment><USER18> "Potentially" from the headline was was dropped from the title.

<comment><USER9> And not "Norway Potentially Used NSA Tech..." but "Norway Used NSA Tech for Potentially Illegal Spying".

<comment><USER19> The intercept is known for previously having some sensationalist in an anti- surveillance and anti-US way

As for the title here being edited by mods to further be more sensational, Ycombinator has interesting backers. See previous discussion about ycombinator and other tech companies having funding from Russian oligarchs: [https://news.ycombinator.com/item?id=15631084](https://news.ycombinator.com/item?id=15631084)

</comment></comment></comment><comment><USER20> There is no illegal spying. There cannot by definition be illegal spying, as if you are caught, it is retroactively made legal. Go back to sleep.

<comment><USER21> You're telling people to go back to sleep, we should be telling you to wake up.

<comment><USER22> I think your sarcasm detector is malfunctioning this morning.

<comment><USER10> Sarcasm is low form of communication. It doesn't work.</comment></comment></comment></comment>


In the body, the coronavirus is even more sinister than scientists realized - <AUTHOR> https://www.latimes.com/science/story/2020-06-26/inside-the-body-the-coronavirus-is-even-more-sinister-than-scientists-had-realized <comment><USER2> This is sensational. It's a virus. They're all sinister.

Look into the absolute nightmare that the filovirus that destroys your blood vessels. Or retrovirus that integrate into the hosts genome.

Any disease with a pathology can be considered sinister. Sinister then loses its meaning. Sensational.

</comment><comment><USER3> I'm finding that I can't scroll the page at all. I've had to use wget to retrieve the text, then lynx to render it.

Anyone else having this problem? Am I doing something wrong?

How am I supposed to scroll? (Using Firefox on Ubuntu on a laptop)

 _Edit: I have now read the content via the process I mention above, but I was curious as to how one was supposed to read it ... the comments below explain it ... thank you._

<comment><USER4> Firefox reader mode works great as it often does for this type of thing.

<comment><USER3> Super ... thanks. I always forget to try that.

</comment></comment></comment><comment><USER5> Scientifically speaking, what is the most probable estimate of how this emerged? From the news (and I know it's hyper sensationalized, so YMMV) it feels like this virus attacks the body in bizarre ways we have never seen from the coronavirus family before.

Were those earlier theories that it was made / escaped from a lab thoroughly debunked, or has there been more evidence since then? I know that WIV released a genome very close to SARS-CoV-2 (RatG-13) that supposedly came from the SARS-CoV-1 bat cave, is it highly likely that cave was the origin for SARS- CoV-2 as well?

<comment><USER6> It's not really that this virus is strange, it's more that we've never really dug into the subtler effects of a lot of viruses that humans suffer infections from.

Herpes is another virus that when're just now finding far removed links to, alzheimer's disease being one.

<comment><USER7> My take is because we developed vaccines for most seriously bad human infectious diseases we've just forgotten how deviously sneaky they can be.

If you read up on measles, mumps, polio, typhus, etc and look at the various complications, you'll realize there is nothing that special about covid19.

<comment><USER8> I was just reading about how Measles basically wipes out your acquired immune system's memory of everything its fought before and developed a resistance to, and more or less sets you back at square one. "Immune Amnesia" as its called sis pretty terrifying, as is the fact that Measles should absolutely be nowhere near first world countries right now, yet there's outbreaks in some of the richest zip codes in USA

<comment><USER7> Yeah does that. Also in a small number of patients causes a fatal neurological syndrome months to years after infection. Est 1:2500 to 1:10000 no one really knows.

Lot of these diseases have far milder courses in children than adults. Polio I think is also often asymptomatic. Mumps can cause sterility. Even consider after the Spanish Flu in 1918 there was a 10 year long epidemic of sleeping sickness. That might, might not be related.

Also now I'm in my 50's I have half a dozen friends who used to be healthy and vibrant who now appear to have some sort of chronic fatigue syndrome. Old age? Post viral syndrome? No idea but makes me nervous. And there are the two older people I knew who had lingering effects from polio who both died in middle age.

</comment></comment></comment></comment></comment><comment><USER9> Got called a sheep for posting this article to Facebook. :(

<comment><USER10> Block whoever called you a sheep. Problem solved.</comment></comment>


Is Internet Addiction Real? - <AUTHOR> http://www.redding.com/news/2013/dec/28/nerd-chick-adventures-is-internet-addiction-real/

<comment><USER2> I feel it's pretty real. It's a social thing. People sort of get a light weight kick out of it. I am sort of addicted to HN, TechCrunch, Techmeme, reddit and YouTube. I have to know what's going on in the internet world.</comment>


The U.S. tried to build a new fleet of ventilators - <AUTHOR> https://www.nytimes.com/2020/03/29/business/coronavirus-us-ventilator-shortage.html <comment><USER2> I find it strange that all we hear about these days is the shortage of ventilators (okay, PPE too), as if it's the only bottleneck. The reality is ventilators are useless without intensivists to operate them, and you need anesthesiologists and probably other skilled personnel too.

I learned through a personal connection who was actually on the ground in Hubei (but not Wuhan) caring for serious but non-ICU patients that doctors and nurses in their ward outnumbered patients, and they were at capacity. The staff-to-patient ratio should be higher in the ICU. With an overwhelming number of patients you simply can't care for them, whether you have the machines or not.

It's relatively easy to ramp up production of machines. It's much harder to ramp up production of medical professionals.

<comment><USER3> > It's much harder to ramp up production of medical professionals.

I have a mixed opinion on this. In particular, I don't think we really need to create more skilled medical professionals, we just need to change the way they work.

Most of doctors have exposure to the basics of intubating and ventilation through medical school. Those without direct critical care experience would likely be absolutely terrible at it. However, they all still have the baseline knowledge. They're able to assess patients, read charts, and report on vitals.

I just asked my wife (a psychiatry resident) if she could intubate/ventilate a patient. Here response was, "If I were the last person alive, I could intubate. You wouldn't want me to do it, but I could do it. I don't know how to run a vent, but I'm sure I could figure it out if I consulted with a doctor/therapist that does". I think most non-critical care doctors would express the same opinion.

What I'm getting at is we have a large amount of doctors that can act as multipliers for intensivists, hospitalist, ER docs, and pulmonologists. They are able to do much of the time consuming work while relying on specialists to guide overall care plan and intervene the on most challenging cases.

\----

Given how medicine works, the chances of actually seeing this in action are low. But....it's an options.

<comment><USER4> The question in a lot of ways is how many exponential doublings do we have to have before this situation switches in peoples' minds from a peace-time inconvenience to essentially real war.

Right now, the death rate still isn't higher than a flu epidemic but just the number of known infections promises a lot worse and the potential doublings after that are terrifying.

It seems like there's an endless dialogue of:

A: How would you accomplish X? B: I wouldn't, X is not what I do.

But we need to give the final answer: A: I didn't ask whether you can do X. I'm telling you, "do X or many people die, you are all we have at this point. Think outside the box".

<comment><USER5> "The question in a lot of ways is how many exponential doublings do we have to have before this situation switches in peoples' minds from a peace-time inconvenience to essentially real war."

The millions of people who would die in a worst-case scenario are mainly demographics that society is already used to neglecting: the elderly, the terminally ill, those with lifelong chronic illnesses where any infection could be a killer, etc.

Therefore, I would expect this to continue to be considered more of a peacetime inconvenience than a real war. A frequent response to this is, "But they could overwhelm the healthcare system so you or me couldn't be treated for our needs!" Well, if the bulk of the population is left inconvenienced and unemployed for too long, I can imagine some ugly scenarios where the population demands, broadly speaking, that those demographics simply be triaged out of treatment so that they don't overwhelm the healthcare system for everyone else. This is said to be already happening in Italy to a degree.

<comment><USER4> _Well, if the bulk of the population is left inconvenienced and unemployed for too long, I can imagine some ugly scenarios where the population demands, broadly speaking, that those demographics simply be triaged out of treatment so that they don 't overwhelm the healthcare system for everyone else._

People imagining such triaging seem to think that a willingness to be appalling brutal means such brutality could be achieved with limited costs.

Italy's situation is far from the worst-case scenario. It's death rate is not that much higher than a seasonal flu, it's just the death-process that is far more messy.

Which is to say, let the infection rate get high enough and you'll have hospitals crowded with the young and healthy even if carry the old directly to the morgue.

Moreover, authorities shouting "all clear" in the midst of this dreck isn't going just summon a phalanx of consumers ready to go to restaurants, death chance or not.

In short, just because you're evil doesn't mean you aren't stupid too.

<comment><USER6> The death rate is in no ways comparable to the seasonal flu. It's quite higher:

[https://ourworldindata.org/coronavirus#case-fatality-rate- of...](https://ourworldindata.org/coronavirus#case-fatality-rate-of- covid-19-compared-to-other-diseases)

<comment><USER4> Indeed,

If you read my parent post in context, I hope it's clear that I mean currently in Italy, people are not dying at a rate higher than the seasonal flu BUT _this has a big potential change_ if the infection rate were to shoot up (we know this is prevented by extreme quarantine measures, enforced by the army).

<comment><USER6> Your point still isn't clear or accurate. The worldwide CFR is over 4%. In Italy, it's currently at over 11%. The flu is nowhere near that level of risk. It's normally around 0.1% depending on demographic. Are you saying that the seasonal flu in Italy normally kills 11% of those who become infected? If that's the case, the facts don't bear that out.

<comment><USER7> But the CFR is mostly just a function of how many people get tested, no? And Italy seems to only be testing at hospitalization.

<comment><USER6> And how does Italy test the flu? In the US, there's minimal flu testing and most of the metrics are based around surveys.

<comment><USER3> I'm not disagreeing with you. However, at this point, some of the flu estimates are actually inferred/modeled by the CDC.

The flu is a well-enough study disease that they're able to, relatively accurately, model population statistics based on a sub-set of tested patients.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> I always criticized the idea that "radical technology could exist but the competition buys it up" as a naive conspiracy theory.

It's pretty remarkable that the government paid for this but somehow the international medical corporation can swoop in, buy the competitor who is threatening their margins, and void the contract.

<comment><USER9> > somehow the international medical corporation can swoop in, buy the > competitor who is threatening their margins

Perfectly normal and common in the US low-regulation economic system.

> and void the contract

Most likely the government officials with the ability to allow this cancelation were bribed, or rather lobbied, to allow it.

<comment><USER10> It does not look like a regulation problem, but a contract breach: the buyer corporation should be held accountable to execute the contract as agreed, it bought the company with everything - assets and obligations.

<comment><USER9> The government often makes decisions about companies buying other companies.

If a company has a contract with the government, then the government should have (specified already in the contract, perhaps) the right to prevent the sale of the company (with some specific exceptions).

The primary problem here is that in theory, the government works for the people; but also in theory, the (publicly traded) corporations work for the shareholders.

But yes, even without regulation, the government should have made more effort to enforce the contract. Perhaps the key government people with the power to do so were influenced somehow... But even if the contract had been upheld, there's certainly no guarantee that the new big company would have put their best effort into meeting the original goals of the contract (especially if it was against their "best" (profit) interest).

</comment></comment></comment></comment><comment><USER11> The original "Iron lung" prototype was built by a tinsmith and used vacuum cleaner parts:

[https://jamanetwork.com/journals/JAMA/articlepdf/403323/jama...](https://jamanetwork.com/journals/JAMA/articlepdf/403323/jama_255_11_030.pdf)

(or course, it didn't need to be sterile because unlike modern positive pressure ventilators, the air it pumped didn't go inside the patient).

</comment><comment><USER12> It's ironic that Covidien was the name of the company that screwed up the ventilator supply.

</comment><comment><USER13> Does anyone know the survival probability of a covid-19 patient once he requires the assistance of a ventilator? I have heard people mention it is fairly low but haven't seen any figure on that.

<comment><USER14> it's not good.

in on study, 24/26 of pts with non-invasive mech ventilation and 31/32 of pts with invasive ventilation died.

[https://www.thelancet.com/journals/lancet/article/PIIS0140-6...](https://www.thelancet.com/journals/lancet/article/PIIS0140-6736\(20\)30566-3/fulltext)

note that the study demographics were skewed to the more vulnerable cohorts (avg age = 56, range = 46-67, 62% male, 48% with a comorbidity).

<comment><USER15> Wow... I had no idea it was so low.

Since you seem to be knowledgeable, if ventilating isn't a big-impact intervention, what's the point of flattening the curve? Is there some other intervention that hospital is doing that actually makes a more meaningful difference that can't be done at home?

Or is it maybe just psychological?

<comment><USER14> i'm not sure. i'm not a doctor. at minimum, flattening the curve is buying time for therapies and vaccines.

that study may be overly pessimistic. elsewhere, i think i saw 50/50 survival rates for ventilated patients but i don't have a source at hand.

</comment></comment></comment></comment><comment><USER16> what is so complicated about ventilators? Serious question as I don't know enough about this. I see a lot of DIY posts that are probably not 100% the same thing but are they even close?

This opens up a bigger question too, is there such a thing as a path for open source medical devices to be built and certified and deployed? Is there a company that supports something like this? I follow Scott hanselman, a Microsoft employee who's diabetic, and there is a big movement within that community to build open source artificial pancrea, using insulin pumps and software and such. Is there a play like that for ventilators? And other critical medical devices?

<comment><USER17> There is a narrow range of pressure where you're not damaging the alveoli from underpressure, but not bursting the lungs from overpressure. You need a mechanical scalpel, not a butcher's knife.

<comment><USER18> Honest question: is the pressure range actually that narrow?

People can survive at high altitudes, which will see pressure of 70% sea level (or less, especially when considering mountain climbing). Additionally, when SCUBA diving, something like 30 feet of depth = 1 atmosphere.

I feel like I'm missing something here. Any ideas?

<comment><USER19> Covid patients in the ICU probably don't have healthy lungs. The people you're talking about at those pressure ranges are probably all young, healthy and athletic.

I know a bit about scuba diving, and you absolutely are not supposed to go diving if you have a lung injury.

I would speculate that if you put a person with serious covid on a mountain top or 30 meters under the ocean it would kill them pretty quickly..

</comment></comment></comment></comment><comment><USER20> [https://archive.md/ZmW5l](https://archive.md/ZmW5l)

</comment><comment><USER21> In the meantime COVID19CZ created an open source version - [https://news.ycombinator.com/item?id=22724130](https://news.ycombinator.com/item?id=22724130), crowdfunded the first batch of 100 ventilators, and they start producing them in the first week of April

</comment><comment><USER22> Covidien. If I had heard the company name in a sci-if film I'd have groaned.

</comment><comment><USER23> We changed the URL from [https://dnyuz.com/2020/03/29/the-u-s-tried-to-build- a-new-fl...](https://dnyuz.com/2020/03/29/the-u-s-tried-to-build-a-new-fleet- of-ventilators-the-mission-failed/) to that of the article that it fully ripped off (and banned that site).

<comment><USER24> They acknowledge the New York Times at the end of the article. Perhaps they licensed the content. I don't think that anybody aside from legal staff at the New York Times can determine if anybody was fully ripped off. If you have concerns about copyright and want to do something about it, you could report the issue. I assume that the New York Times is fully capable of hunting down violations without any help.

The site is much nicer than the New York Times. I'd prefer that the New York Times be banned, both for the paywall and for severe political bias.

<comment><USER23> Normally I use less emphatic language. However, I looked at the submission history for the site. Of 11 articles posted to HN, every one was a copy. They've copied from NYT, bgr.com, Polygon, FT, and Fast Company. That's a lot of "licensing".

True, they were nice enough to link to the originals, but for some reason the vast majority of blogspam sites do that. Only the very bottomest of the barrel do not. I assume there's a reason for this other than invariable last-minute scruples, but who knows? Maybe an HN user knows that business and can explain.

The paywall question is a separate one, and decided here as follows: if there's a workaround, it's ok; if there's not a workaround, we bury the submission. Users usually post workarounds in the threads. The result is that more or less everyone can read more or less every submission that makes HN's front page, just with varying degrees of annoyance. I think that's the right tradeoff. The annoyance is real, but HN would be worse without links to these publications. Paywalls suck ([https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...](https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20paywalls%20suck&sort=byDate&type=comment)), but this is the best we can do until the publication industry sorts itself out the way music eventually did.

All publications are biased. We're not going to ban the NYT.

<comment><USER25> For the NYT, using a browser extension to disable js works like a charm.

</comment></comment></comment></comment><comment><USER26> This seems to be the cutting edge of capitalism, emboldened by legal force and lobbying.

Once you allow incumbents to rewrite the rules, they will do so to entrench and enrich themselves.

"Too big to fail" "Too big to jail" "Lower interest rates to fix covid-19"

</comment><comment><USER27> Lateral comment:

I am starting to hate publishers who produce COVID-19 articles and post them behind a paywall or registration form.

<comment><USER28> Media are suffering at least in this country. Not much interest in buying ads these days.

If the newspapers get more people to pay for their stories, they will have to fire the journalist hard at work on the Corona stories.

<comment><USER27> Here's the fallacy with what you are saying:

Click-through-rates are not going to increase because people signed-up for a free account with an email address. Greater revenue comes from greater traffic. Simple as that. If every time I see an interesting link from the NY Times and try to read it I am hit with a modal subscription request, well, very soon I just stop clicking NY Times links.

The other side of that is paid subscription to these newspapers-turned-web- news outlets. My guess is this is a bad (or let's just say, non sustainable) approach. If these outlets had to survive on paid web subscriptions they would likely shrink severely or evaporate. There's a reason for which television can still garner massive audiences. Imagine if every single TV channel demanded a subscription or registration.

<comment><USER29> All nytimes articles related to covid19 are free, but you do have to sign in

<comment><USER27> That's my point, you should not have to sign in. Not to read articles about a world-wide pandemic. Normal stuff, sure.

Imagine if every media outlet and publisher took advantage of the crisis and required registration for access to information.

</comment></comment></comment></comment></comment><comment><USER30> I've always said that governments should use our tax money to design and validate key health and infrastructure components and only outsource manufacturing and only to local businesses. Governments are so utterly broken and inefficient that they can't do it.

However even if they produced a design now we have supply chain problems globally.

Edit: I seem to have stirred up capitalist defence here. To clarify: The government runs healthcare here in the UK. They have a responsibility for making sure there is supply of equipment available for us. This isn't some car pooling company that says "there's no cars available until next Wed", this is healthcare. And as for production, the government should have agreements in place with manufacturers to switch to infrastructure build out.

We've screwed up flood defences, energy, healthcare so far. Lets stop now.

<comment><USER31> _> Governments are so utterly broken and inefficient that they can't do it._

Exactly. Which means we should not be _depending_ on governments to do it. This is exactly the sort of thing that _private_ startup companies should be doing, without trying to involve the government's bloated and inefficient bureaucracy.

 _> even if they produced a design now we have supply chain problems globally_

For this particular crisis, yes. But not for the next one, if we start now.

<comment><USER32> I completely disagree.

If the government had done it in house they could have succeeded.

The problem here was the profit motive. Cheep ventilators endanger profits.

It is a side effect of free markets (I like free markets) that big firms get bigger, get more market power, kill off competition then price gouge. Health is a bad bad place to have free markets as the incentives are almost all wrong (exceptions: E.g. running clinics as a service for state run health systems turns out to work well here in Aotearoa - but even that is under pressure from consolidation)

Nationalise the whole ball of wax. Use waiting lists not wealth to ration access. FFS the richest country in the world is heading to a health catastrophe. What a bunch of idiots!

<comment><USER31> _> If the government had done it in house they could have succeeded._

Ok, so how do we get the government to do it in house, and stick to it long enough so that the stockpile is there when the next disease crisis happens, which might not be for another 10 years? That's five Congressional elections and at least two changes of Presidential administration.

<comment><USER30> Party politics is a separate shit show. It should be an elected council with no single representation. That would allow smaller, manageable policy changes rather than burn the entire universe every few years.

<comment><USER31> _> Party politics is a separate shit show. It should be an elected council with no single representation._

Ok, so your plan for solving the ventilator issue is to change the entire system of government. Good luck with that.

</comment></comment></comment></comment></comment></comment><comment><USER33> Open-Source, Adruino-controlled, Proof of Concept Prototype

[https://simulation.health.ufl.edu/technology- development/ope...](https://simulation.health.ufl.edu/technology- development/open-source-ventilator-project/)

as people commented yesterday, there are also other projects but that one from University of Florida doesn't need 3D printing

</comment><comment><USER34> "Companies submitted bids for the Project Aura job. The research agency ... chose Newport Medical Instruments, a small outfit in Costa Mesa, Calif"

This is the problem. Instead of allowing several companies to compete for a large order of new ventilators, the $ were given to one company to be spend on design not on the product.

<comment><USER9> No, that is specifically not the problem. The problem is that the company had demonstrated a working design and was near production... but then the wheels of finance (by way of publicly traded company) stepped in with a profit-only motive.

If three companies were all competing, there's absolutely no guarantee that each of those three would not have been bought in the same way. No large company would have gone for such a contract unless it had no other way to make money; there wasn't enough profit incentive.</comment></comment>


HTTPS adoption has reached the tipping point - <AUTHOR> https://www.troyhunt.com/https-adoption-has-reached-the-tipping-point/ <comment><USER3> This is very misleading, because it's overwhelmingly skewed toward large websites run by Google, Facebook, etc.

The statistic is that 50% of page loads are HTTPS - the majority of those page loads are going to be visits to a very small subset of extremely popular (and well-resourced) sites, so this stat gives no indication that the remaining 50% is or will move to HTTPS anytime soon.

The real tipping point will be 50% of unique domains visited being HTTPS. And a more interesting statistic would where that figure is now, and trend data on that. I wonder can that stat be extracted from public Mozilla data...

<comment><USER4> What this is, is another accidental slide down the slope towards centralisation of the web. Yes, it's easy for a techie to add a letsencrypt cert, but browsing with https-by-default I still hit a _lot_ of sites that lack https - mostly the sort that run with practically zero maintenance for a non-technical business or community.

Browsers are going to show scary warnings for these (indistinguishable to the average user from any other warning), and then stop loading them altogether, and the sites will die only to be reborn (if at all) on facebook.

<comment><USER5> > _What this is, is another accidental slide down the slope towards > centralisation of the web._

Sorry, can you explain? (Not playing "gotcha", I really don't understand.)

<comment><USER6> He means "a small number of websites by big players" vs "a big number of websites by modest people".

</comment></comment></comment></comment><comment><USER7> I just upgraded our blog site this week to a new Digital Ocean Ubuntu instance, and used LetsEncrypt to install an SSL certificate on it. I couldn't believe just how easy and QUICK it was!

Certainly a far cry from 15 years ago when I used to go through the Spanish Inquisition to get an SSL certificate, not to mention the cost. LetsEncrypt has been a game changer.

So too has AWS, with their Certificate Manager. I've been rolling out their own issued SSL certs to our various Elastic Beanstalk instances as they come up for renewal. Saving a pile of money, but more importantly, TIME, doing this.

For me personally, that is the tipping point - making SSL installs on server a couple of mouse click and less than a minute. Not surprised that it is becoming increasingly popular given this.

</comment><comment><USER8> IIRC porn sites receive significant traffic and almost all porn sites serve content over http only. The post mentions that https is faster than http and also utilizes resources better than http. Is the statement still valid when streaming video? (Please note that I visit porn sites only to check if it has https enabled or not)

<comment> Ono-Sendai HTTPS is not faster than HTTP.

<comment><USER9> [https://www.troyhunt.com/i-wanna-go-fast-https-massive- speed...](https://www.troyhunt.com/i-wanna-go-fast-https-massive-speed- advantage/)

This is by the same author, and there are critics that could be made against it. In some cases it is faster it seems.

<comment> Ono-Sendai HTTPS is basically HTTP, on a different port (443 instead of 80), with TLS encryption on the socket connection. TLS encryption adds overhead, it doesn't reduce it. Therefore HTTPS is slower.

<comment><USER10> Troy's title could be argued to be misleading. The perfomance improvement he's discussing is actually HTTP/2 against HTTP.

Typically browsers that support HTTP/2.0 require the use of TLS, so with a little mental gymnastics he's claiming that HTTPS is faster.

Edit: Apologies, I agonised over the wording for so long that 4 other people answered before me.

<comment><USER11> What kind of mental gymnastics are you talking about? HTTP/2 is faster than HTTP/1\. In practice, HTTP/2 requires TLS. Therefore, in practice, to get higher performance, you can achieve better performance with HTTPS than with HTTP.

<comment><USER10> None of what you've said is incorrect. HTTP/2 over TLS is faster than HTTP/1.1 over SSL/TLS.

I referred to Troy's assertion that "HTTPS is faster than HTTP", which is at best an incomplete statement and to some people completely misleading.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Here's a question: how are captive portals going to present the login site if the user never uses HTTP? I know Android and other mobile OSs probe the network by requesting a HTTP site. On my laptop, I have to load something like `example.org` to get redirected.

<comment><USER13> The solution is for captive portals to go away. Captive portals should absolutely not exist.

<comment><USER14> iOS already prints a security warning when connecting to such networks, my hope is that Apple will simply have phones disconnect from MitM'ed networks in future, breaking captive portals but making the situation right.

They only really exist where people have no other choice (e.g. hotel). They're often broken, or unusable on mobile devices with tiny UI. Captive portals are an abomination and misuse of technology, not to mention a terrible user experience. And any brand using a captive portal just diminishes my view of the brand.

<comment><USER15> I totally agree that captive portals suck and we should name and shame anybody using them, especially ones that are poorly built.

But, there has to be some reason that these exist right?

To get rid of captive portals, there needs to be this functionality in the underlying protocols:

\- Requiring Terms of Service

\- Showing a special site from the service provider (like the page Starbucks takes you to after "Accept and Connect")

\- Selecting what kind of connection you want (like at airports and hotels where there's free and paid)

\- Login to some system the service provider controls (also airports and hotels w/ paid plans)

\- ... and, potentially other things I haven't seen

Edit: Somewhere else in this thread, kelleboo mentioned this [0]

[0] [https://tools.ietf.org/html/rfc7710](https://tools.ietf.org/html/rfc7710)

<comment><USER14> > To get rid of captive portals, there needs to be this functionality in the > underlying protocols

Not really - I don't think implementing legal considerations into technology is the way to go. Mainly because laws vary by country and laws also change independently from technology.

For example, in Germany, EULAs only valid if agreed on at the time of purchase of the goods or service. If presented after purchase, even if you have to click some "I agree" button, they are not valid. (And even then, they can't contradict German consumer law.) I don't believe anybody has sued because of WiFi, but then the question becomes when does service start? When you connect, or when you click accept?

Keep in mind that some devices like Nintendo DS' or Kindles can't use captive portals, better implementations of portals recognise these devices and let them connect.

In reality, what does the ToS really way, anyway? Don't do illegal stuff - <USER2> that's illegal with or without ToS. For free WiFi, you only have X amount of traffic - well, it's free WiFi, there's no obligation for for service.

(Put simply, EULAs and ToS' also need to die - but that's a different discussion.)

Billing is more interesting. One argument is it's 2017 - should we really encourage billing for basic WiFi when bandwidth is cheap? One solution could be to give users x amount for free, and only if they use all that use a captive portal. It's not ideal, but at least it doesn't happen right at the start. You could also simply have different SSIDs for paid and free.

<comment><USER15> > Not really - I don't think implementing legal considerations into technology > is the way to go.

I think that's totally fair to say. But just know that the immediate answer from Starbucks or whoever at that point is "Ok, then we'll continue doing what we have to do".

With the ToS/EULA, I think it's really a cover-all protection measure. So, if there's something that the user is doing that is illegal, the service provider is not liable for the user. For example, I go to Starbucks and torrent Star Wars; Disney sues Starbucks for facilitating me or whatever.

But I think your last point is where the argument breaks down. Yes, WiFi should probably be free at this point. But, there are tons of reasons that are valid (even marginally) someone would want to have someone connect to some website before connecting to the rest of internet. Without providing some way to do that, the terrible hacks will continue.

</comment></comment></comment></comment></comment></comment><comment><USER16> If my little web page containing a few photos of flowers is never moved to HTTPS, is that bad in any practical sense at all?

Is there any plausible scenario whereby visiting such a basic site without any forms or data collection over HTTP is in some way a disadvantage to HTTPS?

<comment><USER17> Sure. A MITM can inject javascript into the HTML the user receives from your site (just like the Comcast bandwidth cap example in the article) that causes the browser to open phishing or browser exploit pages.

<comment><USER16> Ok, fair enough. MITM attacks seems to be the consensus and good enough reason to move the flower page over to HTTPS.

</comment></comment></comment><comment><USER18> What is the situation with available Adsense ads? Do I still have to except lower inventories of HTTPS enabled ads and thereby less income if I switch to HTTPS? I understand that this depends on the target audience. Did anybody experienced a drop at the beginning and later recovering?

</comment><comment><USER19> I'll believe we've hit the tipping point when I type "example.com" into the browser address bar and it takes me to [https://example.com](https://example.com) rather than [http://example.com](http://example.com).

</comment><comment><USER20> For us this came with cPanel started including it by default. All you needed to do was a few lines in your .htaccess to forward all http requests to their equivalent https ones. Almost all our sites except for a few edge cases are switched over now.

</comment><comment><USER21> It's definitely hit a tipping point for me. I installed HTTP Nowhere a couple of weeks ago and hardly ever run into a site I can't at least load up in the Internet Archive!

</comment><comment><USER22> Services like cloudflare make it dead-easy to set up https. The more one-click https setups there are the faster we'll vault right over the tipping point.

</comment><comment><USER23> Sorry but I disagree.

Please install PanicMode browser extension for Chrome ([https://chrome.google.com/webstore/detail/panic- mode/lamdafc...](https://chrome.google.com/webstore/detail/panic- mode/lamdafciglhnjofdfejeepoemldmblkb)) and try to surf the web for a day. You will know what I mean as soon as you go through this experiment.

Disclaimer: I am the author of this extension. I wrote the extension for personal reasons and it is very simplistic in nature. If you turn PanicMode on it will replace every outgoing [http://](http://) url with [https://](https://). It does nothing else besides that and unlike HTTPS Everywhere it has no exceptions list or special handling of the top 100 sites, etc. The site you are visiting should either support [https://](https://) or it will blow up in your face, which is exactly what happens 90% of the time.

Edit: Besides just because Firefox is seeing more HTTPS traffic means nothing if all the traffic comes from Facebook, Google, YouTube and a few others. Yes, there is more traffic and yes it is encrypted but does it really say anything about the state of the web? Someone needs to put this data out to make it clear.

<comment><USER24> "HTTP Nowhere" is a Firefox extension that blocks all non-HTTPS requests. It doesn't try to rewrite HTTP requests to HTTPS, though.

[https://addons.mozilla.org/en-US/firefox/addon/http- nowhere/](https://addons.mozilla.org/en-US/firefox/addon/http-nowhere/)

<comment><USER25> I can easily configure NoScript to only use HTTPS on, say, ¤.cn . Sites that downgrade-redirects to [http://](http://) gets stuck in a loop. Annoying for everyone, so it raises awareness.

The prefs.js syntax is, noscript.httpsForced "¤.cn\n¤.ru\n __*.uk "

Edits: ¤ characters are asterisks.</comment></comment></comment>


Cloudflare launches - Instaflare - <AUTHOR> http://www.instaflare.com/

<comment><USER2> Great sense of humor!

...

So how can I invest in this?</comment>


IE9 deletes stuff - <AUTHOR> http://techno-weenie.net/2011/8/19/ie9-deletes-stuff/ <comment><USER2> I think this is more Rails encouraging somewhat sloppy use of return values, since Rails (and the community) claim to be kind of slavish about REST-y code but in practice tend to template off of well-known Rails-y code samples rather than thinking "What am I really doing here?"

Rails _happens to function_ under browsers popular at development time, but what do the standards (see nbpoole's comment) or logic suggest is the correct response for this? Asking the user agent (which in this case essentially means Javascript running on a page the user is browsing) whether /widgets/32 is equivalent to /widgets/ so it should know whether it should nuke it or not? That's a tough question for Javascript and an impossible question for the actual human who is trying to get this year's widget catalog ready.

"User requested a delete, server doesn't say delete is impossible, we'll try deleting until we get back confirmation or get told it is impossible" seems like a fairly sensible decision for me. (It is non-compliant with the specs, but GETing the new URL is _also_ non-compliant with the specs, and that is the non-compliance that _Rails relies on to actually function_.)

There were similar issues way back in the day back when the Rails community was enamored with redirect_to prior to finding out important constituents on the Internet like, say, Googlebot think there are hugely meaningful differences between 301 redirects and 302 redirects.

<comment><USER3> Sure, the code is sloppy. For whatever reason, that action wasn't using "newer" rails practices to return different responses to form and ajax requests.

        respond_to do |format|
          format.js   { head 200 }
          format.xml  { head 200 }
          format.html { redirect_to '/' }
        end

We do something like this in every other case in the code base. This is actually what's more encouraged to Rails developers.

There was another similar issue with Rails and the Google Web Accelerator: [http://37signals.com/svn/archives2/google_web_accelerator_he...](http://37signals.com/svn/archives2/google_web_accelerator_hey_not_so_fast_an_alert_for_web_app_designers.php). In this case, the GWA was "clicking" links on the page to pre cache them. Sucks to be you if your application's delete links are straight GET links!

In this situation, the community encountered the problem and immediately started advocating better practices to get around these problems. Such as using form buttons (and later, ajax-enabled links) for unsafe actions. There's a clear standard practice in the web development community here, and these early Rails apps weren't following it.

However, every other browser with XHR support for years has handled redirects the same way. Even though the spec is ambiguous, it certainly suggests being cautious and only automatically redirecting with safe HTTP methods. IE9 breaks this trend for some reason. I'd feel much differently about this if every version of IE worked this way. At least there would be some consistency with itself. And it surely would've been encountered and added to the encyclopedia of weird IE behavior that web developers have to deal with.

</comment></comment><comment><USER4> > _This works great in all modern browsers, except IE9. We discovered that not > only does IE9 send a real DELETE request, it also follows the redirect with > another DELETE. If that redirect points to another resource, you can get a > dangerous cascading effect._

redirect_to issues a 302 redirect. According to <http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html>, this is what a 302 redirect means:

 _The requested resource resides temporarily under a different URI. Since the redirection might be altered on occasion, the client SHOULD continue to use the Request-URI for future requests. This response is only cacheable if indicated by a Cache-Control or Expires header field._

 _The temporary URI SHOULD be given by the Location field in the response. Unless the request method was HEAD, the entity of the response SHOULD contain a short hypertext note with a hyperlink to the new URI(s)._

 _If the 302 status code is received in response to a request other than GET or HEAD, the user agent MUST NOT automatically redirect the request unless it can be confirmed by the user, since this might change the conditions under which the request was issued._

 _Note: RFC 1945 and RFC 2068 specify that the client is not allowed to change the method on the redirected request. However, most existing user agent implementations treat 302 as if it were a 303 response, performing a GET on the Location field-value regardless of the original request method. The status codes 303 and 307 have been added for servers that wish to make unambiguously clear which kind of reaction is expected of the client._

There was another discussion about the use of 302 versus 303 redirects on HN about a month ago: <http://news.ycombinator.com/item?id=2791663>

<comment><USER5> Good find. I was about to post a link to that very same discussion, because the same thing crossed my mind.

Interestingly there was a lot of negativity in that discussion about the author's idea. Criticism was mainly along the lines of "it's too risky" and "it won't work with old browser" along with "the old way works fine, I don't get what the big deal is."

Well, now we have at least one very _good_ reason to pay closer attention to the spec and consider that the use of 303 may be more appropriate.

</comment></comment><comment><USER6> It's funny - about a month ago there was a discussion here that you should be using the 303 redirect in response to a post.

The discussion was here: <http://news.ycombinator.com/item?id=2791663>

In there, I commented (<http://news.ycombinator.com/item?id=2792357>) that I would recommend against 303 because of possibly broken proxies and mainly because browser were already doing the right thing in response to a 302.

How wrong I was as we now have an instance where at least one browser is doing it the way the spec has probably intended for it to be handled.

I would assume they are still handling 302 in response to a POST like every other browser but for 303 they are doing it the way the spec was initially worded.

This is, IMHO, not an IE issue but an IE standards-compliancy-feature at least until somebody here tries whether it works as expected with a 303 status code. If it does and you want it to work differently with a 302 code, then it's probably your turn to get the spec fixed :-)

</comment><comment> EricLaw-MSFT Please see [http://blogs.msdn.com/b/ieinternals/archive/2011/08/19/under...](http://blogs.msdn.com/b/ieinternals/archive/2011/08/19/understanding- the-impact-of-redirect-response-status-codes-on-http-methods-like-head-get- post-and-delete.aspx) for a complete discussion of behavior.

<comment><USER7> Its funny that you can trot out the standard in your defense, cut and pasting a relavent paragraph, yet seem unable to read the _immediately preceding paragraph_ of the spec:

 _If the 302 status code is received in response to a request using the POST method, the user agent_ must not automatically redirect* the request unless it can be confirmed by the user, since this might change the conditions under which the request was issued.*

<http://www.ietf.org/rfc/rfc1945.txt>

IE _does_ redirect automatically. So IE isn't doing it right either. Since nobody is doing it right, I'd pick the guys doing it wrong that make the most sense. What a surprise: that's not microsoft.

<comment><USER8> I would wonder what the proper thing to do in this case is anyhow. As a user I'd hope I'd not be asked with a random interface to repost when some background JS runs XHR asynchronous from my interaction. That's obviously not workable. In this case the user of the agent is more like the application code and XHR doesn't really have the API to support this sort of event AFAIK.

Regardless, that is a separate issue to what is being discussed, and the article does mention it; I'm sure it's not that it was forgotten. Standards documents aren't always perfect in predicting every possible scenario so there must always be room for practical implementation and I think IE has a very good argument to make in its favor for this specific case.

<comment><USER7> Its pretty standard that "MUST NOT" in specs really means "MUST NOT".

 _I think IE has a very good argument to make in its favor for this specific case_

Great. What is it?

<comment><USER8> ... and magically breaking 10 years of web applications is also a big MUST NOT. Why else would the spec itself dedicate an entire paragraph and add two response codes just for legacy cases? The article, if you read it, also explains why. All old browsers map POST so they stuck to that for forms and XHR's broader capabilities map to the standard when possible. That's a pretty good argument, unless you have better ideas, again, make your suggestions heard.

</comment></comment></comment></comment></comment><comment><USER9> You _must not_ issue redirects to AJAX requests anyway, because Firefox will reset every single header you set on the request (custom or not), which has very annoying side effects (content negotiation will be broken post-redirect, if you're trying to use a RESTful API with content dispatching for browsers and API clients you're hosed)

<comment><USER10> What do you mean reset every header? Not set them on the redirect? Is there a bug outstanding for this?

<comment><USER9> > What do you mean reset every header? Not set them on the redirect?

When sending a request via XHR you can set request headers. Some are standard headers (Content-Type, Accept, etc...), others are not but widely used (X-Requested-With), and others you can make up on the spot. The web server will get those and can act on that to, for instance, customize what will be returned, or do cache work, or whatever.

If the XHR request returns a redirection, browsers will follow it automatically. That's what XHR does. Now most browsers will also re-use the headers you set (minus those for which it makes no sense maybe, not sure about that one actually but I'd expect things like ETag or Last-Modified could be re-set by the browser or stripped off).

Not Firefox. On the other side of the redirection, your new XHR request will not have _any_ of the headers you set. No standard ones (like Accept) and no custom ones (X-Requested-With). All of those will disappear and Firefox will solely send its default sequence of headers. Which definitely are not the ones you want since you bothered customizing that.

> Is there a bug outstanding for this?

Yep: <https://bugzilla.mozilla.org/show_bug.cgi?id=553888>

it looks like it might be fixed. In Firefox 7.

<comment><USER11> This is 'fixed' however in a bunch of server-side frameworks. (I'm not sure about rails, I don't use it)

I've used a hack (I think lifted from django) whereby if you are running firefox and and your request came in with an x-requested-with header and we redirect you, we keep a marker in your session that we just redirected you to url x via xhttp request and store any other custom headers we might have set.

Then when your subsequent request comes in (with all its custom headers including x-requested-with missing) we re-add the headers that were stripped out and route your request based on the infered headers. We only keep this lookup entry around for a very short time (like 30 seconds) and remove it after the first time it is used.

It is a total hack, but it works in most cases. Not using redirects on xmlhttp requests is pretty limiting - it is a real shame that the FF devs took so long to fix this bug as it now exits in tons of installs that will probably be around for years to come.

<comment><USER9> > It is a total hack, but it works in most cases.

yeah I had to do that kind of stuff as well.

> Not using redirects on xmlhttp requests is pretty limiting

I don't agree. The reality is that it should not be needed, redirect-after- post (let alone DELETE or PUT) is a workaround for browser UI issues ("Do you want to re-send this POST request" popups on refresh) and URI localization (bookmarkability of the landing page). There are reasons for redirects in xhr scenarios, but they have to do mostly with clients "caching" old URLs and the service changing its URI structure.

There's little to no reason to send a redirect (let alone a temporary one) to an XHR.

</comment></comment></comment></comment></comment><comment><USER12> IE (and pretty much every browser as far as I can tell) has always supported DELETE in XMLHttpRequests (or MSXML as the case may be). Presumably Rick is talking about DELETE working in <form>s.

<comment><USER4> I just tried it out myself: I can't get DELETE to work in IE9 forms.

My code (I've tried it with both upper-case and lower-case DELETE):

        <form action="http://example.com" method="DELETE">
          <input type="submit" />
        </form>

<comment><USER2> HTML 4 and HTML 5 both define method as either "get" or "post", mapping to GET and POST, with no other valid options. This _compliant behavior_ is widespread, which is why Rails uses Javascript magic to fake the presence of a method POST or GET parameter in some of the built-in magic. (I only know this because I've special-cased it for an app I built.)

<comment><USER13> Though, it should be noted that at one point HTML5 did plan to support PUT and DELETE, however that was then removed[1] again. Could be part of the confusion with some people.

I would reference when it was added, but since it's a working draft spec, it's been removed and I can't find the original addition date - but I believe it to be mid to late 2009.

[1] [http://www.w3.org/TR/2010/WD- html5-diff-20101019/#changes-20...](http://www.w3.org/TR/2010/WD- html5-diff-20101019/#changes-2010-06-24)

<comment><USER10> It may go back in at some point, it was reopened a couple of months ago...

</comment></comment></comment></comment></comment><comment><USER14> I don't have the time to investigate right now, but I wonder if returning a 303 rather than a 302 would yield the expected behavior. I.e., a redirect without cascading effects.

</comment><comment> guard-of-terra The problem here is that you can't change the standard, even you know that it states a silly thing or doesn't state an important one.

You're writing a standard at the time when you know the least about how and why the thing you spec would be used. You can't get it right (you still can do "mostly right"), but you desperately need to sneak some fixes.

So yes, you should have hot-fixes to standards just for those cases. One would state that the response of 302 for POST/PUT/DELETE should unconditionally trigger GET. And it should be in the spec years ago.

And no, you can't just "increment version number". Realistically you can't, pretending you can is silly too.

There is the same problem with laws: you first pass them, then you discover some flaws but no easy way to patch.

</comment><comment><USER15> As someone not too familiar with HTTP -- given that you're redirecting them to a an actual page and not some user-associated resource the page needs to grab, why would the redirected DELETE request be honored in the first place? Or am I misunderstanding what's going on here?

<comment><USER16> I think what you are suggesting is that a DELETE request to a resource that should not (in the application developer's mind) be deleted should be disallowed by said developer.

While this protection is a good idea, it doesn't change the fact that a redirect to a resource that _is_ DELETEable would have an unexpected and unpleasant side-effect if the application developer was expecting the browser to issue a GET request.

Think about, e.g., a "delete this message and go to the next in your inbox" kind of functionality being implemented like this. Not that such an implementation would be the best idea, but it's a thought experiment.

<comment><USER17> Request method specificity in defining API endpoints is common because it allows the re-use of the same URI for different purposes.

So in some cases you could get a 404, or the endpoint treats everything as a GET request, or as you say the redirect URI actually has its own delete method that you assume won't be used after a redirect.

It seems easy to blame the browser, not least because it's also IE, but your code should take stuff like that into account, _especially_ when dealing with destructive requests.

To be honest though, and this may be through ignorance on my part, I don't get why you'd issue a redirect on an AJAX request after performing a delete or whatever.

If I sent an AJAX request to delete a widget I wouldn't expect to get any data back, because I'm not asking for it. I'd want at least an empty 200 OK response for a successful delete or a relevant error code. And then I could react accordingly based on the result.

The design that allows IE9 to do this appears to just cut corners.

</comment></comment></comment><comment><USER18> It seems that IE behavior is correct, and rails should return 303 redirect.

<comment><USER3> It's a vague spec, and IE behaves differently than every other browser out there. It's vague enough that they added additional redirection codes (303 and 307).

<comment><USER18> I see your point. Although, I've been using 303 redirect for this purpose in my app after reading the specs, and haven't experienced any problems yet. So maybe you should consider switching to 303.

</comment></comment></comment><comment><USER19> +1 for planetary references</comment>


Nude web designers wanted - <AUTHOR> http://www.nude-house.com/jobs.html

<comment><USER2> 18k GBP (29k USD) for web devs? Is that the market wage half an hour from London, or an experiment in how much people will sacrifice to get their preferred working environment? The product itself sounds a lot like an imagemap except completely dysfunctional without javascript—the image itself is missing, not a promising start. I hope they review progressive enhancement or something like <http://www.alistapart.com/articles/sprites/> for a better design.

I also wouldn't have expected a nudist to be so uncomfortable about menstruation. Stay home until it's over, seriously?

</comment><comment><USER3> UK based. Breaches of the 1975 Sex Discrimination Act in more than a dozen places, truly _mental_ attitude towards female employees, no product and no web skill.

Men are 'men'. Women are 'girls'. Apparently he's having trouble finding women who want to work for him.

I'm flagging this shit so hard I just broke a mouse button.</comment>


Mark Zuckerberg: Facebook Will Not Go Public Anytime Soon - <AUTHOR> http://techcrunch.com/2010/09/10/zuckerberg-ipo/

<comment><USER2> When Google was considering the timing of its IPO back in 2003/2004, I remember reading about an SEC regulation that requires private companies to make regular public disclosures (10K filings) if they hit certain shareholder and asset thresholds. There was some speculation that this regulation may have played some part in forcing Google to go public sooner rather than later.

I don't know where/how it figures into Facebook's thinking, but it may be that the same issue may arise in which a private Facebook might face some of the public scrutiny a public corporation might and decide that if they must disclose, they may as well reap some of the benefits of going public.

For what it's worth, here's the specific reporting obligation I'm referring to as noted in a Wikipedia article (since I can't find it on the SEC website):

"Companies with more than $10 million in assets whose securities are held by more than 500 owners must file annual and other periodic reports, regardless of whether the securities are publicly or privately traded."

<http://en.wikipedia.org/wiki/Form_10-K>

<comment><USER3> Fenwick and West has long since convinced the SEC to waive this requirement for Facebook's benefit. Why such a waiver is in the public's interest, I don't know.

<comment><USER4> Well, I don't think the requirement itself was in the public's interest, especially in the era of Sarbanes Oxley. Forcing a company to go public could be extremely harmful.

</comment></comment></comment><comment><USER5> In asserting that Zuckerburg's fears are unfounded, the author states, "Google co-founder Sergey Brin also echoed Zuckerberg's "hell no we won't IPO" sentiments soon before Google, yes, went public."

The quoted text is a link to an article whose first line is the following:

"We are profitable, and we don't need the cash. But it might be nice to have the currency" of a public company, Brin said ....

Brin does go on to state that being a public company may be a distraction, but this is hardly a wholesale dismissal of the possibility of going IPO. In fact, Brin is later quoted as saying that "[t]here's a good chance eventually [Google's] going to do it."

I don't know if this has been misrepresented before, but you all may be witnessing the first round in a new game of "telephone"!

<comment><USER6> From Mark Zuckerburg's text: "Since we compensate people at Facebook with stock and we took investment, I view it as my responsibility to eventually make that stock liquid for people, but that doesn't have to happen in the short term".

That's hardly a wholesale dismissal of the possibility of going IPO, either.

</comment></comment><comment><USER4> Most of the negative effects he describes of an IPO could be mitigated by a dual class stock structure similar to Google's. I expect we'll see that when Facebook does IPO.

</comment><comment><USER7> Given the active secondary / private markets for high profile private companies, such as sharespost and DAG ventures, the pressure to go public to give the employees a payout has been greatly diminished. Particularly where companies like Facebook are actively blessing private placements, and waving the ROFR, employees are pretty much getting most of the IPO benefits. I'm not sure how much of this is a result of SOX, and how much is a result of squeamish CFOs not wanting to have to subject themselves to the requirements for transparency and predictability that the street requires - but we're certainly seeing a lot of private companies stay private a year longer than we did a decade ago.

</comment><comment><USER8> As Zuckerberg is a basically a sociopath, I don't consider this particularly meaningful. It's probably intended to be manipulative in some way.

</comment><comment><USER9> Get ready for IPO...

</comment><comment><USER10> Of course not. Then they'd be more open for scrutiny.</comment>


Wireless Startups Searching for VC Dollars - <AUTHOR> http://gigaom.com/2007/04/26/wireless-startups-searching-for-vc-dollars/ <comment><USER2> So many are searching for A round funding.. but are many actually getting it?

Basically, curious on the general opinion of wireless startups among VCs. "Next technology frontier" or "You're still the carriers bitch"...</comment>


See how an ancient computer was recreated using Legos - <AUTHOR> http://www.youtube.com/watch?v=iYyRvd79KT4&feature=player_embedded#!

<comment><USER2> This had a round before... <http://news.ycombinator.com/item?id=1988818>

The most impressive thing to me is that a machine like this existed in 100 BC</comment>


Why our political leaders make terrible decisions - <AUTHOR> https://www.newstatesman.com/culture/books/2019/04/why-our-political-leaders-make-terrible-decisions <comment><USER2> Isn't the real question why do voters elect unqualified political leaders?

</comment><comment><USER3> The very idea of meritocracy has become corrupting. (I clawed my way to get here; I got 50.000001% of the vote; I deserve 120% of what I have...)</comment>


How Bitcoin Ends - <AUTHOR> https://www.fastcompany.com/40537404/how-bitcoin-ends <comment><USER2> This article makes pretty blatant errors:

> We thought the net would break the monopoly of top-down, corporate media. > But as business interests took over it has become primarily a delivery > system for streaming television to consumers, and consumer data to > advertisers.

Weird thing to say about an era where traditional publishers and news networks have been entirely disrupted by random folks posting on twitter/facebook.

> At its core, bitcoin is just an extension of the old PGP, or Pretty Good > Privacy encryption protocol.

I've never seen the word "just" do so much work. Bitcoin, notably, solved the Double Spending problem[0] seventeen years after PGP was created.

> In essence, bitcoin is money built and maintained by nerds, based on the > premise that good nerds will outnumber the bad nerds.

This is patently false. The _entire_ point of bitcoin is that miners and node operators acting in _their own self-interest_ will secure the protocol, not "good nerds". You can argue if the system fails this will be the case, but not that this is the premise.

[0] [https://en.wikipedia.org/wiki/Double- spending](https://en.wikipedia.org/wiki/Double-spending)

<comment><USER3> Yeah I'm also pretty critical of their narrative of how centralized currency came about. Their timeline is _wildly_ wrong. The author makes it seem like states started minting coinage in the middle ages, when the advantages of a standardized coin with a mandated-by-fiat face value (possibly different from the actual value) were well-known - and famously used to great effect by - even the early Roman Empire.

Then there's this sentence, which is just nonsense:

> All money was borrowed from the central treasury, at a rate of interest set > by the king.

</comment></comment><comment><USER4> I have no doubt that Bitcoin will end someday, most likely from QC breaking ECDSA, but this is perhaps the most illiterate and uninformed takedown I have ever read on the subject.

<comment><USER5> That's not really a problem. Addresses aren't the entire ECDSA public key, but a hash digest of it. The entire public key is only revealed once a transaction is made from an address to another. So an address that has only received coins, but never sent any, is entirely immune from QC. (This, by the way, is why you're never supposed to reuse addresses, since once you move coins from an address once, it's possible for someone offline to try and break the key.)

<comment><USER6> It is a real problem. Millions of BTC are locked in addresses with known public key, due to either the formerly popular Pay-to-Public-Key script, or the ever popular practice of addresses re-use that you also mentioned.

</comment></comment></comment><comment><USER7> Aside from the flaws of the article, there are something to be said about how centralized bitcoin has become. Most of the bitcoins are held by centralized exchanges, or "qualified" custodian (locked up in ETF and other exchanges). They essentially act like centralized banks, the exact thing we're trying to avoid. The only saving grace is we can send to native wallet, giving us some freedom from the institutions.

</comment><comment><USER8> This is how Bitcoin ends up...

* Bitcoin and Ethereum are grandfathered into not requiring KYC and AML. They are the rare currency with zero friction.

* All new currencies require KYC and AML. This is happening right now

* Other currencies can have some positives (backed by revenue generating assets, etc.). But they can be confiscated by governments

* Bitcoin always has a place, as the zero friction, no-KYC currency.

EXAMPLE: I did a wire transfer from the USA to India. Since it was sent in Indian rupees, the receiving bank kept rejecting it. They claimed it didn't pass AML. The real reason is that they wanted to take huge fees for the USD to Rupees conversion on their receiving side. So they kept rejecting it, until it is sent in US Dollars and they can scalp me on the conversion rate. I had 8 weeks of failed transfers.

That AML hostage taking can happen across all currencies BUT Bitcoin and Ethereum.

In the future, people in China are taking their money out in bitcoin. People across Africa, South America, also often move it into Bitcoin. They can cross justidictions with nobody to stop them. There is a place to cut around the hostage stakers at the AML level.

<comment><USER9> Have you tried TransferWise? I just tested in app, and they'll convert $1000 USD to INR for $9 USD immediately.

I have their Borderless account and hold balances in several currencies at once, with access using a debit card, wires, ACH (US), SWIFT (EU) etc. Highly recommend!

<comment><USER10> There is plenty of services like this nowadays. I recall TrensferGO and Revolut. There is even a service for fees comparison amongst those services, developed be hackernews fellow reader: [https://news.ycombinator.com/item?id=20819538](https://news.ycombinator.com/item?id=20819538)

<comment><USER9> Excellent resource!

</comment></comment></comment></comment><comment><USER11> So much nonsense in this article, don't know where to start...

<comment><USER12> Yeah I stopped reading after this:

> At its core, bitcoin is just an extension of the old PGP, or Pretty Good > Privacy encryption protocol.

</comment></comment><comment><USER13> This is also about getting out of being "locked into" a larger overall economy run for the benefit of a few and creating local economies.

People with land and/or skills could create new economies by trading directly with each other with what they produce and opt out altogether..

In a way it is the final defence of a people against control and oppression or insane hyperinflation, but is more dificult to do if you are stuck in a city or additcted to modern technology.

</comment><comment><USER14> Are they trying to say Bitcoin will not remain a totally unregulated, totally compromised and idealistic cryptoanarchocapitalist utopia forever? Are they trying to say that Bitcoin won't solve all of the world's problems and bringing on a new utopian era??

I refuse to believe it. Because if that were true bitcoin would surely vanish into thin air.

</comment><comment><USER15> This article makes a good case about Bitcoin but even the original Bitcoin enthusiasts and crypto community as a whole has admitted that it was a great experiment but is now obsolete and settling in for a temporary (years) store of value role.

I would like to see these same discussions after understanding the Ethereum ecosystem which solves most of the problems listed in articles like these. There's a stable form of value in DAI, high velocity and cheap money transfers, and decentralized financial protocols that replace traditional gatekeepers like banks and payment processors.

A long but interesting article by David Hoffman really sums it up in the best way possible and is worth a read: [https://thedefiant.substack.com/p/ether-is- the-best-model-fo...](https://thedefiant.substack.com/p/ether-is-the-best- model-for-money)</comment>


Ask HN:  Shipping code vs learning new tech??  - <AUTHOR>

I'm sure there are others who face the same delima; so for those currently managing tech teams or those working in them, what are some good practices / schedules set up for keeping yourself / your team up to date with newer tech vs shipping code?<p>I just spent the past week learning and building out an admin process for our sales/business team in Backbone and I know I could've taken half the time; if not less to build it out if using the tools I already know. So what are some good practices / habits to setup / fall into now while the company is still new and we're still finding our feet to keep everyone's skill set high but still ship features at a good pace. <comment><USER2> You're running a business, not taking part in a coding competition. Make $$ and then come back to worry about writing cool code.</comment>