A Tale of Two Pwnies (Part 1) - <AUTHOR> http://blog.chromium.org/2012/05/tale-of-two-pwnies-part-1.html

<comment><USER2> What's amazing about this bug is that at every step you learn something that makes Pinkie Pie more terrifying while _simultaneously_ making the Chrome security model sound more and more forbidding.

<comment><USER3> And the worst is yet to come....

\---

In an upcoming post, we'll explain the details of Sergey Glazunov's exploit, which relied on roughly 10 distinct bugs. While these issues are already fixed in Chrome, some of them impact a much broader array of products from a range of companies. So, we won't be posting that part until we're comfortable that all affected products have had an adequate time to push fixes to their users.

<comment><USER4> The post is great in itself (clear and easy) but the constant marketing speech about how great Chrome is regardless of the bugs gets on my nerves to be honest. Yes Chrome is a very good browser, but I don't have to read that every paragraph in various forms... specially for tech articles.

It also looks like to me that devs commit code in a more lazy way since Chrome has a strong sandbox model for various components. But as a result, it seems easier to find many bugs that, when combined, bypass the sandbox, as show.

Just my 2cts ;-)

<comment><USER2> There is no way to explain how awesome Pinkie Pie's exploit is without simultaneously explaining how intricate Chrome's security model is.

A great way to market a browser is to have a security model so interesting/effective/intricate that any description of a working exploit will also serve as marketing.

<comment><USER4> I disagree. Marketing does not have to be in _every_ _damn_ _blogpost_.

It's just annoying ;-)

While they attempt (and apparently succeed) to make you believe that exploiting Chrome is exceptional and it's such a super high security program:

The bottom line is, 2 guys showed up with a complete remote exploit of Chrome. And there are more exploits that are obviously unreleased, and some that will get released each year.

That is the true bottom line.

So again, while the article is _nice_ and _clear_ , the exploit is a _good_ pony job as well - the marketing behind it makes the read annoying. It's a trend and it's not just Google. You even justify is as if marketing was a _required_ thing to have and if you don't try to do it, you're just missing out. Well, I digress.

<comment><USER5> The only place I see some rhetoric is the second sentence of the first paragraph, the second paragraph, and the first sentence of the second to last. It's tame: it emphasises the exploit being very involved, which is well supported by the rest of the report. Everything else is necessary detail that describes the progression of the exploit from Pinkie Pie's point of view.

Your contributions, on the other hand, are much more content-free, being mostly value judgements against Chrome's PR or the supposed overconfidence of their programmers. And while you do brush on more technical matters, you do so by name-dropping products rather than being informative and describing the relevant security property.

</comment></comment></comment></comment></comment></comment><comment><USER6> In the end it all boiled down to old-style plugins. All the exploits were used to finally install and run an old-style NPAPI plugin.

Just like ActiveX, these are binary code that usually runs outsidE of any sandboxing due to compatibility reasons.

With NaCL or just the advances in HTML and related technologies, this kind of plugin really should have outlived its usefulness by now and maybe it's time to drop support - at least support for all plugins but a few whitelisted ones from the older ages.

Like Flash and maybe QuickTime (though both have a terrible security track record).

Though considering the persistence of piling up bugs that was happening here, for all we know, there would have been a different exploit somewhere else that could have worked even without NPAPI. It would just close one more attack surface.

<comment><USER7> Wait until you see the other one. There are a surprising and depressing number of ways to get a browser to run native code on legacy operating systems.

Yes, plugins should go away. No, that won't stop this kind of thing :/.

</comment></comment><comment><USER8> I'd love to see a writeup from Pinkie Pie on the steps and tools he used to find these bugs. Reversing write-ups are always entertaining to read.

</comment><comment><USER9> So for about $120K+ they had more than 16 significant bugs discovered in Chromium. That's really cheap!

</comment><comment> mark-r If you don't have a young girl you might not appreciate the link between "Pinkie Pie" and "Pwnie": <http://mlp.wikia.com/wiki/Pinkie_Pie>

<comment><USER10> Somewhat OT, but the show has a fairly sizable periphery demographic (males 13-35), which I would guess the hacker considers himself a part of. More information: [http://knowyourmeme.com/memes/subcultures/my-little-pony- fri...](http://knowyourmeme.com/memes/subcultures/my-little-pony-friendship- is-magic)

<comment><USER11> Pinkie's not the only brony hacker either. Consider this Rainbow Dash fan: [http://www.reddit.com/r/IAmA/comments/sq7cy/iama_a_malware_c...](http://www.reddit.com/r/IAmA/comments/sq7cy/iama_a_malware_coder_and_botnet_operator_ama/) ... and in general, there are a plethora of bronies scattered across the startup world and CS academia (full disclosure: myself included).

</comment></comment></comment><comment><USER12> This really takes you into the mind of a hacker(the malicious kind). Judging from what I saw it seems they combine a ton of small exploits to produce a major security breach. The amount of understanding of the underlying system you need to have in order to put these exploits together is mind boggling.

What do we do against people like this?

<comment><USER13> I don't like how you vilify him and call him malicious. Nothing about this was malicious. He even gave it to google for far less than it was worth. This was a legitimate audit and demonstration and it is wrong to associate anything negative with it.

 _What do we do against people like this?_

You're asking the wrong question. Remember, he didn't put those bugs there. He didn't break anything. It was already broken. He just found the hole by reading exactly what you gave him.

What you should be asking is, how do we stop making software with vulnerabilities. The goal is to make it so that there is no hole to find, not to get rid of the hole-finders.

<comment><USER14> Just to play angel's advocate, your parent could have been referring to an abstract malicious hacker, who would probably think the same way and use the same techniques as Pinky. The "mind of a hacker (the malicious kind)" is probably very much like the mind of Pinky, except for the parts governing ethics. And he asks what to do "against people like this", not what to do against Pinky himself.

But you are right, and it is valuable to point out that neither Pinky nor Homakov nor any other talented whitehat are in no way malicious.

</comment></comment></comment><comment><USER15> This is a _real_ hacker. I wish I had this kind of passion and intelligence myself. :)

</comment><comment><USER16> So crazy. I wonder how long it took to come up with that attack? There must have been a ton of dead ends along the way.

<comment><USER17> Well, if you start from the last step (I want to load an NPAPI extension because I can gain control from one) and work backwards it seems a little less like stumbling in the dark.

I liked the confirmation prompt bug though, that was icing on the cake.

<comment><USER16> Backwards... smart!

</comment></comment></comment><comment><USER18> It is scary that once you have a foothold it just becomes a matter of time until someone figures out how to use it to piggyback on to more unrestricted space.

</comment><comment><USER19> "a low level interface to the GPU command buffer"

This sounds cool. Is this a standard feature in Chrome?

<comment><USER5> It's available for extensions I think (there's also the higher-level WebGL which you must be aware of), and requires whitelisted graphic drivers. As you can see, graphic acceleration offers a huge attack surface (memory-unsafety in C++ code, plus logic bugs at highly privileged levels like graphic drivers, firmware, and the hardware itself). Some of these layers realistically won't be protected until they have proper IOMMU support.

</comment></comment><comment><USER20> Just... sick! Wow. Speechless.</comment>


Comparing Google Maps 3D with Singapore's OneMap3D - <AUTHOR> https://tongwing.woon.sg/blog/comparing-google-maps-3d-with-singapores-onemap3d/ <comment><USER2> This is how Google Maps (or earth, to be precise) used to have 3D models in it. Everyhting was handcrafted.

Modeling was partly outsourced for anyone willing to do it with Google Sketchup, back when Google still owned it. It however, was really labour intensive and one could see a lot of human mistakes.

Using aerial images to generate 3D models is way cheaper and faster. I'm interested to see where this project is going, but i'm a bit sceptical for a long time success.

<comment><USER3> I used to contribute to Google's 3D Warehouse (which was acquired by Trimble/Sketchup) to add few 3D buildings around Delhi in Google Earth. Teenager me was quite heartbroken when google switched to the auto generated 3D models, but clearly, as you said, manual modeling wasn't feasible at world scale.

I was most proud of a railway bridge in the Himalayas that ended up in Google Earth for a while. [https://3dwarehouse.sketchup.com/model/8f5b83eb14588a6dd3816...](https://3dwarehouse.sketchup.com/model/8f5b83eb14588a6dd3816365deb2b4a2/Chenab- River-Railway-Bridge)

<comment><USER4> > I was most proud of a railway bridge in the Himalayas that ended up in > Google Earth for a while.

Nice job! That looks great.

</comment></comment></comment><comment><USER5> Singapore govt had been in news with the development of TraceTogather app for COVID-19 detection and now this. Typically, governments, with all its bureaucracies, are not expected to build things efficiently and with quality, especially complex software which is hard to build even for a supercharged startup. So this is surprising. Someone needs to figure out what are they doing right.

<comment><USER6> Let's not forget Singapore is pretty autocratic. That surely makes it easier to cut through any bureaucracy and privacy regulations, for example when you quickly need an app to track people and COVID-19 infections.

However, that also makes it easier to do the same in times of peace.

<comment><USER7> No, let's not prematurely chalk up to ideology what is more reasonably explained by a capable government and a smaller country. Autocracy didn't help China nip the pandemic in the bud. Conversely, democratic Taiwan is managing the crisis excellently as well.

I observe this reaching for ideological explanations extremely frequently in US media and citizens, and these lazy rationalizations seem to me to be one of the ways the US public sphere collectively hallucinates that that they are the freest and first in the world, while promoting ideological tribalism and partisanship, as citizens vote away their interests to protect their ideological delusion.

<comment><USER8> I've long thought this, but you've articulated it way better than I ever could, so thank you.

I'd argue that the "smaller country" explanation is also over-used.

For example, when single-payer healthcare, gun control or effective government comes up, I often hear the excuse " _The US is way more populous than $nation_x so it would never work here!_ ".

When asked to further explain their reasoning, many (certainly not all) can't seem to. It's like they never think past the nation-size excuse because it's simply accepted as fact.

<comment><USER7> I agree that "smaller country" really is also overused.

I suppose what I was getting at was the distance of the highest levels of government from the citizen. Taiwan certainly isn't a small country, but its government is certainly in a closer relationship with its citizens concerns than the federal government is with US citizens.

</comment></comment></comment></comment></comment><comment><USER9> The words of the article say that OneMap3D is better but, to me, the images clearly convey that Google Maps 3D is better. Yes it loses some fine but they are clearly actual images of the real buildings. In contrast, OneMap3D seems to have computer-rendered models of what the buildings ought to look like.

As you look around it will presumably feel like you're playing a 3D game (one with poor lighting and texturing at that!), whereas looking around in Google Maps feels like you're actually exploring the city from above.

</comment><comment><USER10> I thought that progressive meshes don't lend themselves well to GPU buffer objects. Always assumed that Google Maps just have a huge number of static mesh LODs for everything (which they could have generated using progressive meshes) and are okay with mesh popping.

</comment><comment><USER11> For modern buildings, the 3D models actually already exist in an architecture firm's computers. Imagine if the city/country mandates that building plans also be submitted digitally, and the architect has to allow it to be licensed for 3D maps...

<comment><USER12> This would be very undesirable for some people. People for example who get construction permit for one thing (with bribes) but build a bit different things. "A bit different" could be additional floor, or apartments instead of office space. And yes this is happening in some places. I think reality is far better source of truth than architectural drawings. So i'm voting for google approach. And heres example of my city in 3D constructed with google approach, but higher resolution.

[https://3d.vilnius.lt/scenos/realaus- vaizdo-3d-modelis](https://3d.vilnius.lt/scenos/realaus-vaizdo-3d-modelis)

</comment></comment><comment><AUTHOR> This is a preview of the data provided by OneMap3D programme that Singapore Land Authority is launching soon. [https://geoworks.sg/onemap3d-developer- programme/](https://geoworks.sg/onemap3d-developer-programme/)

</comment><comment><USER13> OneMap3D's approach won't handle natural landscapes, e.g. trees and rocks.

Ok, it's not really useful but fascinating to explore [https://earth.app.goo.gl/Ld1b8R](https://earth.app.goo.gl/Ld1b8R)

</comment><comment><USER14> Both looks great but I am use to having and seeing Google Maps. This is the first time that I have heard about SG's OneMap3D

<comment><USER15> > Both looks great

Do you really think so? I think the handcrafted models look completely out of place, due to the flat lighting.

Visually, even with the artifacts, Google's approach is better and it will get even better with better data and better reconstruction algorithms.</comment></comment>


C++ reflection in under 100 lines of code - Stack Overflow - <AUTHOR> http://stackoverflow.com/a/11744832/375343

<comment><USER2> this is very very impressive</comment>


Ask HN: Is an ecommerce saas platform a good idea? - <AUTHOR> I am thinking about creating a saas ecommerce (like shopify, bigcommerce, selz etc.) platform and I would like to know some opinions from the HN community regarding the business model and features.
1. Do you think there is room for another player? There are a lot of platforms out there, some better than others and with different pricing and business model (fixed subscription, transaction fee etc.). 2. What are the main features that would convince you to ditch the platform you are using now (including OSS like WooCommerce and PrestaShop)? 3. What is the business model that would attract you? Would you pay more for a subscription and no transaction fee, or lower subscription and a small transaction fee (like 2%)?
Thanks! <comment><USER3> What would be the perfect ecommerce platform? One that sent me very large checks and required no work at all. No dealing with transactions, no listing merchandise, no managing inventory, no dealing with suppliers, no upfront costs, etc.

If that happens, I wouldn't care about rates...except maybe in some abstract manner where money is a way of keeping score. The reason I wouldn't care all those activities create first order problems when they fail and the rate is only relevant once all the other pieces are working to the point I'm making sales.

Further down the list of things that matter are the business model of the ecommerce platform. I probably care about my business model many many times more.

Anyway, what I see is that successful ecommerce platforms are successful not due to their business model but because they solve problems for the seller. Etsy, Amazon, Alibabba, Ebay, etc. solve problems related to transactions for a specific type of seller. In the cases where logistics are important, the platform has expanded to handle those.

Good luck.

</comment><comment><USER4> There is some room for Enterprise platform built on a modern stack. We were actually planning to build one few years back but funding fell through. ATG, Hybris & Websphere Commerce are all riddled with tech debt and take a very long time to customize and deploy. You are unlikely to do this with VC funding though it requires very sizable investment and it would take close to 2 years to build an MVP.

<comment><AUTHOR> I was thinking about bootstrapping business and target the small - <USER2> businesses. If I want to tackle the enterprise business it might take 2 years for an MVP, but an alternative for a WooCommerce store shouldn't take that long.

<comment><USER4> It's so crowded unless you have some special angle you will need to spend a truckload on marketing

</comment></comment></comment><comment><USER5> [https://moltin.com/](https://moltin.com/) are a YC company who have raised a couple of rounds to do ecommerce in an interesting way, so clearly someone thinks there's a market for new SaaS platforms in that space.

(I have no affiliation, but I've met them and they're nice guys.)

<comment><AUTHOR> I know about moltin.com.

They basically offer you a backend and a set of APIs to create your store. It's a great tool to use if you want to be in control of your store behaviour. On the other hand it requires you to have some technical knowledge.

</comment></comment><comment><USER6> Oracle is out with a version of this called Commerce Cloud ([https://cloud.oracle.com/commerce-cloud](https://cloud.oracle.com/commerce- cloud)). It is based on their existing market leading ATG/Oracle commerce product.

<comment><AUTHOR> To be honest I don't really trust Oracle software. They are usually very expensive and they kinda lock you in their products.

In the case of Commerce Cloud I don't see any pricing information, so I can only presume it's going to cost a lot.

Also a few days ago Oracle bought NetSuite for $9.3 billion. One of their product is SuiteCommerce ([http://www.netsuite.com/portal/products/netsuite/suitecommer...](http://www.netsuite.com/portal/products/netsuite/suitecommerce.shtml))

<comment><USER6> Agree with most of your points. I was only pointing out that Oracle now wants a piece of that pie. BTW, they support both revenue share and number of click model.

From [https://cloud.oracle.com/en_US/commerce- cloud?tabID=14306513...](https://cloud.oracle.com/en_US/commerce- cloud?tabID=1430651320096)

Usage Model - Tiered-pricing structure based on annual storefront page views Revenue Share Model - Percentage of GMV</comment></comment></comment>


FOSS Developers: Make Your Products Easy to Build - <AUTHOR> http://blog.amir.rachum.com/post/23873814181/foss-developers-make-your-products-easy-to-build

<comment><USER2> I use vim, git and a build script. I add new plugins as github links for pathogen. All of my plugins and settings are deleted and rebuilt using the build script and git pull. No issues setting this up between home and work and I have too hold back from laughing when I see what my coworkers using eclipse have to put up with every day.

</comment><comment><USER3> Basically he went from "I don't know how to build Eclipse plugins" to "they are too hard to build". I don't know how hard they are to build, but it seems there are some steps missing.

And most FOSS uses Autotools these days, so installation is just ./configure && make && sudo make install

<comment><AUTHOR> I'm not saying it's particularly hard, I'm saying it _should_ be easy as hell.

</comment></comment><comment><USER4> Until recently, this was the number one reason keeping me off of Linux. (The nightmare of recompiling PHP just to get support for specific extensions) Fortunately with the popularity of package managers, I rarely run into a project I can't build from source.</comment>


Halley: Lightweight Game Engine Written in C++14 - <AUTHOR> https://github.com/amzeratul/halley <comment><USER2> I grew up with the author of this library. He was absurdly intelligent. He started studying quantum physics in high school because he was bored with the "normal" content of our classes. And, of course, he always dreamed on working in the games industry :)

<comment><USER3> Hmm maybe your friend has forsaken physics. He did not implement any physics in his engine! (not yet?) =D

<comment><USER2> He has a famous blog post somewhere teaching beginners how to do physics on 2D platformers.

<comment><USER4> Link?

<comment><USER5> I'm not the OP, but here you go: [http://higherorderfun.com/blog/2012/05/20/the-guide-to- imple...](http://higherorderfun.com/blog/2012/05/20/the-guide-to- implementing-2d-platformers/)

It looks quite nice.

<comment><USER6> This is probably the most comprehensive single written guide to how platformers are implemented. Definitely worth a read.

</comment></comment></comment></comment></comment></comment><comment><USER7> For those interested in what was built with build with this engine, in the docs it says wargroove:

[https://wargroove.com/](https://wargroove.com/)

Definitely, a 2D game engine, but the game looks fun enough.

<comment><USER8> As a sibling to this post said, it reminds me of Advanced Wars (Sturm!), and also a little of Tactics Ogre.

I love the art style quite a lot.

<comment><USER9> This is basicaly a huge love letter to advance wars. The gameplay of capturing income producing buildings, then making unit types, and the units themselves all map directly to advance wars units.

There are a few key innovations (COs as units on the map, archers can fire and move in the same turn (which are more like rangers from Warbits than artillery because they are infantry), some units have abilities that cost money, units have crit conditions, and the building capture mechanic). But the basic loop is there: Swordsman are infantry, pikemen are heavy infantry/mech, dogs are recons, knights are tanks, mages are anti air guns, trebuchets are rockets and ballista are missles, etc etc. Terrain bonuses are similar, costs are tweaked, but it plays exactly like advance wars.

And that is a really good thing. Can't recomend the game enough.

<comment><USER10> Eh--I tried a little Wargroove but I thought its maps were pretty unbalanced. It became really easy to end up in a meat-grinder fight where in Advance Wars you had to _mess up_ to find yourself in that state.

The art style (particularly the human portraits) also did not work for me.

<comment><USER9> I mean, the reason there was less meat grinding in advance wars was broken CO powers IMO. I'm more of a fan of the wargroove balance and slow pushes.

</comment></comment></comment></comment></comment><comment><USER11> If nothing else, providing a clean implementation of a working Entity system will be a great boon to those learning gamedev. Kudos!

<comment><USER12> I found entt to be a good, reasonably approachable entity system for C++. It written in a modern, very generic style, but I don't find it to be obscure.

[https://github.com/skypjack/entt](https://github.com/skypjack/entt)

<comment><USER13> yep its great and very active

</comment></comment></comment><comment><USER14> This is great.

I usually roll my eyes at game-engine posts. But seeing an open source engine that has successfully shipped on multiple platforms, including console, is fantastic.

</comment><comment> Const-me Video playback is inefficient.

The code uses media foundation for decode (this part is good), but then it downloads NV12 data to system RAM, then uploads back to VRAM.

Better approach is making it work entirely on GPU. The simple way to implement that is to drop Windows 7 support already, and use IMFMediaEngine interface. That object decodes video directly into D3D 11 textures, with very little work required, doesn't even need any custom shaders.

Here's a working example: [https://github.com/Const- me/vis_avs_dx/tree/master/avs_dx/Dx...](https://github.com/Const- me/vis_avs_dx/tree/master/avs_dx/DxVisuals/Effects/Video)

</comment><comment><USER15> its a 2D engine. (just clarifying because it wasn't immediately clear)

<comment><USER16> Even better!

<comment><USER17> well said! +1

</comment></comment></comment><comment><USER18> Does Starbound use this engine?

<comment><USER19> I don't think so. I believe the Starbound development was led by someone else. This is an interesting article written by that person. [https://kyren.github.io/2018/09/14/rustconf- talk.html](https://kyren.github.io/2018/09/14/rustconf-talk.html)

<comment><USER18> > Chucklefish games that are made 100% in house: Starbound obviously, also > Wargroove (made with the generic C++ engine halley, but the main dev for the > engine is the main dev of Wargroove).

Hmm...

</comment></comment></comment><comment><USER20> link to samples is broken (octo-cat 404) [https://github.com/amzeratul/halley- samples](https://github.com/amzeratul/halley-samples)

<comment> irq-1 [https://github.com/galegosimpatico/halley- samples](https://github.com/galegosimpatico/halley-samples)

<comment><USER21> Doesn't compile - header files are missing from the project.

</comment></comment></comment><comment><USER22> I like it but having to fiddle with dependencies makes it harder to get started, maybe submodule them?</comment>


Tubi TV – Free freaking movies (Is the end of cable near?) - <AUTHOR> http://tubitv.com

<comment><AUTHOR> We now have so many choices from Netflix, Amazon, and Hulu to now these guys.

I wonder how many users here are cord-cutters?</comment>


Never Lie About Who You Really Are - <AUTHOR> http://blogs.hbr.org/pallotta/2012/12/never-lie-about-who-you-really-are.html <comment><USER2> The inference of this paragraph bugs me:

"Last week, the pest control guy came to the door. "Are you Mr. Smith?" he says. "No, I'm Mr. Pallotta, Mr. Smith's partner," I reply. "Partner?" he asks. I'm being questioned in my own home. "Yes, partner," I answer. "We're a gay couple." "Oh," he says, trying to process this and maintain his composure."

The writer assumes that because the pest control guy doesn't immediately grasp the context of the word "partner" and questions it that he's being interrogated. Then he assumes that the pest control guys is somehow disturbed by the open admission of sexuality and is trying to maintain composure.

There's a good chance these perceived slights are in Mr. Pallotta's head; he's misinterpreting the pest control guy's confusion as some type of muted bigotry.

There's a lot of ambiguity when the word "partner" is used. I run a business with a partner, so when someone says they're someone's partner, my brain assumes it's meant in a business context because that's the world I spend 95% of my time in.

When I'm informed otherwise, I'm sure there's a noticeable hesitation as my brain processes the change of context from business to relational and re- establishes the rules of social interaction from "this is so-and-so's business partner" to "this is so-and-so's significant other." It's _definitely_ not because I'm "disturbed by the open admission of sexuality and am trying to maintain composure."

<comment><USER3> Yeah, I agree! I bet the pest control didn't actually say those exact words, either! You know, I wonder if there actually _was_ a pest control guy at all-- I bet it was really a _plumber_!

Man, I just can't trust this author at all anymore. Thanks for pointing this out. Thanks also for explaining the ambiguity of the English language to all of us, as well as some of the really interesting machinations people sometimes go through for conversational hesitation. It's information very few people realize and really contributed a lot to the discourse here on HN.

<comment> qu4z-2 The details of wording or occupation aren't really key to the story though. It is however relevant whether his pause was due to being uncomfortable with the author's sexuality or due to his determining which interpretation of an ambiguous statement was correct. Although I suppose in the end the author's experience of the situation is the main point.

In short, your comment was less constructive than that you criticize. (as is mine)

<comment><USER3> It's not relevant, though, because the author himself didn't imply either one. The awkwardness, the _otherness_ , of his situation is the point. He said nothing about bigotry, or about the pest guy being "disturbed", which means the commenter I responded to is the one bringing all the baggage to the conversation.

</comment></comment></comment></comment><comment><USER4> I'm gay and this analogy is strained and opportunistic.

The charged moment when you're buying flowers for a same-sex partner is charged psychologically, not because of external fears. I live in a very liberal city, and there's almost zero chance I'm going to get bullied by the lady at the flower shop. It's charged because of how I grew up, because of the other people who made me feel like an outsider or a freak, because of what it means more broadly that the world, even this city, is set up for other people.

None of that comes into complaining about the speakers being on the wrong side of a TV. True, you can use slippery language to say that these are both "standing up for truth" or something, but in reality the motives behind each gesture are totally different. Standing up for quality as a person in a supply chain might be admirable, but it is not a "coming out" and it is not emotionally charged in the same way that revealing your homosexuality, over and over again, still is.

He talks to the cab driver because not doing so would mean rejecting himself. You mention the speakers because you want your company to do well and you're frustrated that the person who's job it is missed something blatant.

<comment><USER5> There is some fundamental truth here though.

I'm not in college you see. Even though I went for three years and was doing perfectly fine GPA wise, and was on track to a "dream career" with the admiration of everybody around me even though I knew I was not learning very much in school.

I decided to take that another path, where I actually try to measure what I learn beyond the grade inflation that was rampant at school and the mind- numbing pace at which things were offered and the lack of curiosity with which most things (not all) were perused.

I have not rejected my family though, nor their friends, nor any of my friends and everytime I get asked, at least once a week or so (or used to), "What are you studying?"

I tell them, "Nothing."

People don't believe it and usually I am being bullied into going back. (I wanted to say it was a discussion, but these people usually never listen to me.)

Sometimes I get the feeling that I should lie to them, but to do so would be to deny the legitmacy of what I am doing. I usually hope the mention of that comes off with little reaction and we can go on as if everything was ok.

That usually never happens and I have to risk the chance of getting bullied one more time, often by people whom I like and care about. To say something different however, that's out of the question.

A "let's talk about that later" is sometimes considered, but when you say that, the other person ALWAYS gets real curious and wants to ask you again. I'm in Latin America you see, and privacy here is not as respected...

<comment><USER6> I'm dealing with this all of the time, and I have a go-to solution for you (try it) – bury them in evidence. They aren't trying to argue YOU into something. They are trying to argue THEMSELVES into it, you just knocked their value-system over, after all; they want to KNOW they're STILL OK.

So, give them some more.

"I quit school, didn't seem that important. Oh, and I'm planning on trying the gay thing, seems people are more and more into it, maybe there's something there, my Imam said so himself. Do you have any plans for the summer? I need someone to help me build a base-jumping tower outside the town, and sell tickets."

As long as you're talking they are not. My life is weird enough for me to go on like that for hours, and all of it can be true, too.

Cheers. :)

</comment></comment></comment><comment><USER7> It's so easy to compromise, or cover up. I see it all the time in software dev. For every dev who cares enough to pursue an issue diligently to its root cause there are a dozen other devs who are perfectly willing to patch up symptoms of deeper problems or jump to faulty conclusions without bothering to seriously understand what's going on. Everyone wants the quick fix. They want the pain (the bugs, tickets, pages, scrutiny, etc.) to stop.

And it's easy to say that something is "almost done" or "mostly done" when in reality there are huge roadblocks in the way. It's hard to tell people you're struggling with a problem, or that you don't know how to do something, or that you don't know the meaning of a word your coworker just used, or you don't understand exactly what they're saying. It's easier to avoid embarrassment in the short-term even if it makes everything harder in the long-term.

<comment><USER8> > It's so easy to compromise, or cover up. I see it all the time in software > dev. For every dev who cares enough to pursue an issue diligently to its > root cause there are a dozen other devs who are perfectly willing to patch > up symptoms of deeper problems or jump to faulty conclusions without > bothering to seriously understand what's going on. Everyone wants the quick > fix. They want the pain (the bugs, tickets, pages, scrutiny, etc.) to stop.

There's a word for these types of people - 'liabilities'.

<comment><USER9> There's another word for these people: management.

</comment></comment></comment><comment><USER10> I hope I'm not insensitive, but if I'm having a bad day and my cab driver (or just about any total stranger) asks "how is your day" I am not compelled to tell him about the intricacies of being me. It's not about fighting for "the truth", it's simply practical. This is generally how to behave for all matters of sex, politics, religion, and anything else personal. Small talk is small talk.

<comment><USER11> I don't mean to be presumptuous, but are you straight? Not feeling compelled to tell people about your sexuality is a luxury afforded to people who fit into the norm. It's what LGBT activists would call "privilege", and it's something that we as straight/white/male/other dominant group need to be aware of if we don't wish to alienate minority groups.

<comment><USER12> Why would my "sexuality" be a topic for anyone other than those close to me? If my wife and I like to dress up as robotic ninjas in order to get satisfaction, well then that's between my wife and I despite how "out of mainstream" it is and is no business of anyone else. I tire of the "acceptance" desire of so many people in so many areas of their lives. Tolerance != acceptance, it merely means that someone can tolerate an alternative without resorting to an attempt to suppress it. I don't have to accept the choice of people to paint their cars in zebra stripes, but I don't reach for an orbital sander and remove the paint because I can at least tolerate such a choice.

<comment><USER13> Your sexuality doesn't come in air-quotes, and you're teetering dangerously close to the word "choice" in a topic where no such thing exists.

Your sexuality informs and alters 100% of your life.

<comment><USER14> _Your sexuality informs and alters 100% of your life._

No it doesn't. And choice exists in almost everything.

<comment><USER11> Too bad you chose to be ignorant :/

The scientific evidence is not on your side, if you're interested in that sort of thing.

<comment><USER15> Too bad you chose to misread the comment :/

The choice is in your actions, not your feelings.

<comment><USER11> So you think gay people shouldn't act on their feelings?

<comment><USER15> I think gay people have control over their emotions just like everyone else and it doesn't automatically impact 100% of their lives.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> In the UK I've run into people who use the term `partner' for whomever they are in a non-married exclusive relationship with, regardless of whether they are gay or straight.

I don't know how common that is, or how it got started. I wonder whether it will ever catch on in the US?

<comment><USER17> It's common, but daft. It makes every relationship sound like a firm of solicitors. I don't see what's wrong with wife/husband/boyfriend/girlfriend.

<comment><USER18> Many people over the age of, say, 30, feel weird about using the word "boyfriend" or "girlfriend", because they feel that it implies a young person.

<comment><USER19> This describes me (I live in the UK). I'm 31 I've been in a lovely heteronormative relationship for eight years. We aren't married, and we've called each other 'partner' for years. In my head it lives in the linguistic space between '[boy|girl]friend' and the state-sponsored '[husband|wife]'. I also enjoy its gender neutrality.

<comment><USER20> "I've been in a lovely heteronormative relationship "

Are you kidding? My sarcasm detector is failing here.

</comment></comment></comment></comment></comment><comment><USER21> Just because you shouldn't have to lie about it, doesn't make it good advice to never lie about it. There are, sadly, many places in the US (and many in the rest of the world) where expressing your true self will cause you (physical/emotional) harm. If you live in such a place, be careful.

<comment><USER22> I'm not a Baptist. Or any stripe of Christian. Or Jew. Or some other checkbox on the list of tolerable beliefs. I live in Alabama. There's a price.

Impeded relationships. Reduced opportunity.

Yet, the emotional harm of lying about who am is significantly greater than what one person can inflict upon another. Because like truth, that harm is permanent.

People inclined to fuck up someone because they are different, don't deserve a free pass. It is their fucking up which is uncivil, not my choice to abstain from praising Jesus before eating chicken fingers at a business lunch.

<comment><USER23> > _Yet, the emotional harm of lying about who am is significantly greater than > what one person can inflict upon another. Because like truth, that harm is > permanent._

What about if there's no harm? What if you ENJOY lying about who you are?

Or, in another twist, what if lying about who you are opens a new world to you, and makes you a different person, perhaps even who you lied about being in the first place? (In the sense that you invent a new identity for yourself, like a Nothern Jewish family boy like Robert Zimmerman emerged into scene as the "wretched hobo poet" Bob Dylan).

<comment><USER24> If you enjoy lying about anything, that's a serious red flag regarding you as a person.

<comment><USER25> Poker, anyone?

<comment><USER24> The OP didn't say lying about his hand, he said lying about _who he is_ , which is what I'm responding to.

</comment></comment></comment></comment></comment></comment><comment><USER26> Maybe I'm reading too much into it, but is he telling us that we should _try_ to be offended?

I'm referring to the second to last paragraph: _You can't know if your values are being violated if you're ambiguous about what they are. Second, learn to develop a sixth sense for when your line is being crossed. It may be a gut feeling. A nervous laugh. A habit of rationalizing._

Maybe I'm reading too much into it because some people (especially in the media) seems to set out to be offended, and they're really annoying.

Of course there are many valid reasons to be offended and we (as individuals and societies) should treat everyone with respect and try to offend no-one. But it _is_ possible to be too easily offended, and I'm afraid one might end up in that category by following his advice.

</comment><comment><USER27> _People have the misconception that a gay person comes out once. It's not true. If you're gay and you're authentic, you're coming out constantly. You're on a business trip, for example. A cab driver asks if you have kids, and you say that you do. Then he asks about your wife. Even though you may be exhausted, you find yourself summoning the energy to have a transformative conversation with a total stranger on whom you are depending to get to the airport and whose reaction you have no way of predicting._

The author's own situation is clouding his judgement. It is entirely easy to predict that asking if you have kids is going to lead to asking about a wife. This is the way family life has gone on for centuries. It's only recently (in generational terms) that gay couples could adopt children or even be openly gay and married... yet the author thinks that there's no way to predict how someone is going to steer a conversation. I wouldn't take offense if someone steered a conversation in the wrong way because it's more about their reaction to the surprise news ("oh, i have a husband not a wife") than to how the conversation found itself. Maybe I perhaps steered the conversation the wrong way instead of the cab driver.

As an aside: I had to rewrite this many times because I didn't want to come off as being homophobic, discriminatory, or what have you. I really don't like walking on egg shells, but some topics really cause other people to pounce.

<comment><USER28> I'm getting tired of my current HN account so let me trash it.

Fuck Gays.

I'm Jose Gutierres from the Bronx in case you want to beat me up. There, no more walking on egg-shells.

In all seriousness, being too PC is also harmful. I'm not homophobic but really dislike that you cannot have a conversation without somebody getting but hurt.

And to finish it off. Fuck muslims, hindus, christians, mexicans, jews, scientologists, hispanics, etc. If you feel I left you out then fuck you too.

<comment><USER15> Your account is a week old with 9 posts!

</comment></comment></comment><comment><USER29> "Your ability to stand up for your truth is a muscle, and the more you exercise it the stronger it gets."

His attitude is commendable and helpful in a lot of different situations:

\- people with stand-out religious beliefs \- people with strict diets \- people who don't drink

It makes me very appreciative that I don't have anxieties over anything that would require me to correct people or divulge personal information.

Being gay in his situation, and in general having anxieties attached to information you must always carry, is a pain in the ass. This might be a good reason to act "flaming" (when its an act): get the information out there immediately. I do that in certain situations too.

</comment><comment><USER30> _> First, know what you're coming out about. Identify your truths. Write a personal values manifesto. You can't know if your values are being violated if you're ambiguous about what they are._

most people would come out about the fact that they don't give a shit about the value of the product their employer produces.

many would have to admit they delight in sabotaging the system they hate.

<comment><USER31> "I enjoy rebelling against authority, and I will make fun of you for not knowing how to type formulas in excel."

I'm looking forward to my next interview.

</comment></comment><comment><USER32> Okay, how do you do what he's saying _without_ being the guy who bitches about everything and is all up in everyone's business thinking he knows better than everyone how to do their jobs?

<comment><USER33> In any situation, you don't want to be the lone wolf of honesty. Your company or team needs a culture of honesty. It's simpler than you realize. Have a conversation, make an event out of it. Say, "Look, for this to work, we have to be outspoken and honest. Our success depends on it. It will be uncomfortable at times. It will be frustrating at others. But there's no reason to invest this much, to work this hard, just to stop short of honesty. If you can take a startup, you can take honest feedback. And we should all expect a ton of it."

The TechStars program does this really well. They promise you brutal honesty. They tell you to brace for it. You are guaranteed to be told when your idea sucks. You can see this in practice each week as the teams present their pitches. Because honesty is the expectation, the quietest guy in the room will raise his hand and say, "For the first ten minutes, I had no freaking clue what you were talking about." Ouch! But the permission was there. The guy wasn't a jerk, he was embracing the culture. And you know what? It needed to be said.

In the early days, Rackspace had a saying: "Bad news first, full disclosure, no surprises." More than a slogan, it was permission to be honest. People would say, "It sucks to bring this up, but as we say, bad news first and full disclosure..." Again, amazingly effective.

People want to be honest. And in the end, they want you to be honest, too. There just needs to be permission.

</comment></comment><comment><USER12> Seems to me this suffers from the lack of defining "lie", be it of omission, commission, or in the case of simply remaining silent whether one has committed any act at all.

If I say "the product is GREAT!" when I believe it to be otherwise, then I'm very obviously lying by commission and that's obviously not a good thing. I do however often cause social consternation when I don't engage in the usual "white lie" that is generally accepted as "correct" for many people. "Do these pants make me look fat?" asked by wife elicits a truthful answer, which she's used to but many who witness the exchange are not.

A lie of omission would be something on the order of "is the product ready for market?" with a response of "we've done focus groups and the response was positive" leaving out some useful information like "positive by +.1%", which would be a valuable piece of information to have for the questioner but one in which the respondent does not want to provide since it would probably negate the response.

Remaining silent seems to me often to be none of the above. CEO declares a new initiative, I may at first blush disagree but lacking any real information or thought-out objection, and also understanding that he may have more information than I and certainly a different set of responsibilities, I remain silent rather than blurt out an objection with no real argument with which to back it up. My silence in this instance is neither an endorsement nor an objection.

</comment><comment><USER34> I have been reading HN for half a year without ever bothering to login, but this post was so inspiring for me that I had to chime in and say 'thanks'. Never compromise. This is just what I needed.

As well, I really like the muscle metaphor. :)

</comment><comment><USER35> Wish I'd seen this a bit earlier. I read a great article today from Leo Babauta from Zen Habits on essentially the same topic.

Set a value system, and stick to it. That's exactly what this author is encouraging. I think it's unfortunate that the context the author chose to illustrate the point is distracting to many, but it doesn't change the validity of his message.

Check out the article from Leo here at Zen Habits: <http://zenhabits.net/12rules/>

</comment><comment><USER36> Big fan of this article. The world asks us to sell out our integrity for such a pittance on almost a daily basis. "Convenience," "convention," "getting along." These are the meager rewards for our silent assent. It's great motivation to read someone standing up and saying "stop it. Your integrity is worth more." Need the reminder sometimes.

</comment><comment><USER37> Isn't the idea of "coming out" a bit old fashioned now?

(Straight people don't "come out")

<comment><USER38> > (Straight people don't "come out")

Well yes they do, it's just that they can do it by bringing home the boyfriend/girlfriend to meet the parents or whatever you want to consider normal first steps in expressing your sexuality.

In a large part of the world though, probably most of the world where you can, if you are gay you basically have to explicit come out to your closest friends and relatives to get over whatever initial shock, embarrassment, anger, violence, or whatever may occur.

Far too many don't take it well.

<comment><USER39> _bringing home the boyfriend/girlfriend to meet the parents or whatever you want to consider normal first steps in expressing your sexuality_

Saying that this is "coming out" doesn't make it true.

<comment><USER13> But it is true, so think about it until you get it.

<comment><USER40> Except it's totally not, being straight in most places in the world is the default and everyone is seen through a lens of being straight. Coming out refers to revealing to people that you are not straight.

<comment><USER13> Fine, I'll yield the semantic argument. "Coming out" in the context of sexuality typically refers to homosexuals publicly expressing their preference for the first time and adjusting their public identity to match.

I was attacking the idea that most aren't judged upon first expressing their sexual desires. It's important anywhere and everywhere. Bringing home a partner of a different color? Size? Class? "Looks"? Judgement is issued. In some cultures the kind of partner you're able to pull speaks directly to the honor or worth of the family. It's never not a big deal.

<comment><USER41> People are judged for their relationships in general.

People are judged for who they have sex with based on all sorts of physical characteristics (sex, skin tone, size, looks, etc.) as well as social attributes (economics, religion, behavioral awkwardness).

People are also judged for _not_ having sex with certain people (being monogamous, or especially being a virgin over age 30). Or for people they hang out with in non-sexual relationships in general (friends from different race, class, religion, or sports fandom).

Relationships of all sorts are important anywhere and everywhere and never not a big deal.

</comment></comment></comment></comment></comment></comment></comment><comment><USER42> Well, this thread is a new low.

</comment><comment><USER43> I'm not so sure this advice is generally applicable. At the same time, I understand the author probably doesn't mean for it to be, but maybe that is a problem with the inherent vagueness of language. I don't care to do philosophy of language here.

When I behave as I truly am, stuff like this applies:

[quote]

b) Poor Understanding of Social Situations: Their good verbal skills enable adults with WS to initiate superficial social contacts. However, they tend to lack understanding of the underlying, 'unwritten' rules governing all types of social intercourse. They are often too open, direct or personal in their interactions with others, and do not recognize the social constraints that would be apparent to other people in the same situation. In other cases their social naivetŽ and lack of inhibition can lead them to tell tales or to say things that might hurt or embarrass other people. Such behaviour is rarely intentional or malicious, but occurs because the individual may not understand the social implications of his or her utterances. Similarly, adults with WS will not hesitate to try and gain other peoples' attention with comments and questions, or to reprimand others. Consequently they may give the impression of being rude, bossy or attention seeking, which again may antagonize others if they are not fore-warned.

\-- ADULTS WITH WILLIAMS SYNDROME: GUIDELINES FOR EMPLOYERS & SUPERVISORS By Orlee Udwin, Mark Davies, Chris Stinton & Patricia Howlin

[/quote]

Generally I get asked if I'm stoned or something like this, when I'm only trying to be myself. And if I tell people about my Williams (like my heart conditions and other obvious elfish features, including psychological), it doesn't matter how much truth or scientific backing or reading I bring to the table. Given the linguistic problematic of Williams, everyone just gets frustrated since there is the unfortunate problem that if you self-diagnose, and talk about it, you have to present symptoms/evidence/whatever-makes-you- think-you're-X in a sequential fashion.

I'm learning that this hypermetropolitan-supraurban lifestyle is too fast- paced for a conversational exchange where Demonstration is feasible in conversation. It's like presenting evidence has been restricted to purely scientific settings. It's unfortunate.

<comment><USER17> I had no idea that was even a thing. I have learnt something new today.

<comment><USER43> If you're interest'd, I believe I've been given some cool coghacking/body hacking opportunities: [http://webjournal.nerdfiles.net/2013/01/09/hacking- the-willi...](http://webjournal.nerdfiles.net/2013/01/09/hacking-the-willies/)

</comment></comment></comment><comment><USER44> So many people missing the point of the gay analogy in this thread and once again, at the mere hint of the concept of privilege, people race to get defensive and shut their ears before even understanding the issue at play; further showing that people continue to have knee-jerk reactions to the phrase "privilege" just as some think that "feminism" = "hates men" instead of "wants gender equality".

To explain further, there's two issues:

1\. That my sexuality is a topic that I constantly have to correct people on. It hurts because of internalized homophobia from two decades of growing up in the Midwest. It hurts because it's a constant reminder that I'm a minority and that people make incorrect assumptions about me. It hurts because it's annoying. I had a friend that would introduce me as "DriveBy, my gay friend". That's the sort of feeling I get when I have to stop and say "No, I'm gay". Hell, I even have some awkward feeling when it's someone I suspect is homophobic because _I_ don't want to make _them_ uneasy.

2\. When I correct people on my sexuality, I've challenged their assumptions. I've changed their perspective and reminded them that not everyone is straight, even the people that "oh my god, I never would have guessed". This isn't about "shoving sexuality in peoples' faces". It's not about evangelizing LGBT issues every day just to force it.</comment>


5 million Dropboxes - <AUTHOR> http://blog.dropbox.com/?p=339 <comment> matthew-wegner Anyone else notice that Dropbox globally indexes files? If you upload a large file already elsewhere on their servers (Linux distro ISO, scene-made TVRip or DVDRip, etc), it "uploads" instantly, and will begin downloading immediately on your other linked Dropbox machines.

Makes me wonder how hard it is to download a file by hash (via the Linux client, parts of which are open-source), without having the file, or how easy it would be for HBO or some other media company to say "here are the hashes for scene rips of The Wire--please furnish matching account emails, thanks".

<comment><USER2> The good news for video pirates is:

\-- Every time a video is encoded, it hashes differently. So a studio could find a torrented file and find people downloaded that exact copy, but they couldn't just ask for every copy of a show.

\-- If this became a problem, you could toss some random metadata on a file and it would hash differently. Or zip a file/program with a text file containing a guid. Etc.

<comment><USER3> _Every time a video is encoded, it hashes differently._

Really? Even with the exact same source file and exact same codecs/methodology? Why is that, is there an "encoding time" metadata field or something?

</comment></comment></comment><comment><USER4> Awesome. Dropbox is an _awesome_ product. I install Dropbox on every single machine I have.. it's one of the first things I install. And it's saved me countless hours.

Now if only they could sort out the folder sharing model so large folders shared by someone else (who upgraded) don't use up my personal space... (yeah, I know they're working on it.. hurry up!)

<comment><USER5> Little bit of adjective inflation here? I mean, it basically just uploads and downloads files.

<comment><USER6> Yeah, it basically just uploads and downloads files.

Except I didn't have to teach my mom how to use it.

Except that I never have to worry if it's working correctly.

Except that it works on every platform I use.

Except that it's just a folder on my computer.

These aren't features you put on a retail box, but they are the features that set Dropbox apart. "Just works" is incredibly easy to say but incredibly hard to engineer.

<comment><USER5> My god people, he just described a toaster. Is a toaster _awesome_ because its operation is straightforward?

Or, if you don't like that example, compare it to just about any online game. Consider the incredible complexity and operation requirements of Call of Duty (or whatever you like) and then come up with an adjective for it. How about "awesome". Well, no, that won't do, because Dropbox is "awesome" and Call of Duty is several 1000 times more awesome, by far.

Not to mention that most games are also playable by non-technical people.

Get some perspective people. Fanboyism is really pathetic and there's a lot of it going on right here.

<comment><USER7> > Is a toaster awesome because its operation is straightforward?

Yes. We all own one don't we? Ever tried to toast bread _without_ a toaster? It takes far more effort, is far less efficient, and the results are usually far less consistent.

<comment><USER5> There's a possibility that this guy's opinion is also the consensus opinion in which case I'm not going to win any arguments. This was all a semantic misunderstanding. When I think of the word "awesome" I think of something that inspires "awe", which I think is beyond the scope of file syncing.

Let me ask you guys one thing though: Is there anyone here willing to admit that they would be incapable of making a workable clone of dropbox in a reasonable amount of time--not on the same scale, of course. The fact that almost everyone who comes to this website could produce something of that complexity is maybe a clue into all this irrationality. Most of us, by contrast, couldn't make Call of Duty (a game which, actually, I've never played). Maybe we're setting our standards where our capabilities are?

<comment><USER7> > When I think of the word "awesome" I think of something that inspires "awe", > which I think is beyond the scope of file syncing.

I see your point. But having struggled with file syncing for literally _decades_ , having somebody come along and make it so easily that it seems unimpressive and obvious really is very cool.

It's kinda like the old adage, "the best special FX in a movie are the ones you don't notice."

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Side note: does anyone know what visualization tool was used for the dropbox- client-data-traffic-globe-thing video? I've seen that same visualization all over Google's campus in various buildings showing the location of their searches. Is it an open-source visualization library?

<comment><USER9> Check <http://processing.org> .. This globe seems to be one of the first data visualizations used in several projects. Here's a cool one that uses Flickr geotagging info: <http://www.flickr.com/photos/revdancatt/3398050524/>

</comment></comment><comment><USER10> The users by nationality statistics are interesting. Australia has a population of about 21 million whilst the Netherlands has about 17 million, and yet the former doesn't rate a mention whilst the later does — why? My theory - bandwidth:

<http://xs4all.nl> \- € 29,95 per month for 4M Internet.

<http://internode.on.net> \- $49.95 per month for 1.5M Internet; 50 gigabyte cap - downloads and uploads are counted.

<comment><USER11> Xs4all is actually the most expensive consumer ISP in the Netherlands. The cheapest ISPs offer 20 Mb DSL for 20 euros per month. DSL is slowly becoming legacy technology due to high speed fiber and cable connections.

<comment><USER10> Oh, I thought it was middle of the range like Internode. The equivalent of Xs4all in Australia would be Telstra who's ADSL services start at 1.5M with 2gb (upload/download) for $39.95; additional usage charged at 15¢/MB and capped at an excess of $300.

<comment><USER11> That's pretty bad. Bandwidth caps and charges create a different mindset that hurts many providers like Dropbox. If i transfer a large file i only think about how long it will take, not how much it would cost. Unfortunately bandwidth caps are often due to a lack of competition between ISPs.

<comment><USER12> Which is exactly how it is in many parts of Canada. I can choose between cable and DSL, and both have bandwidth caps. While mine is a fairly generous 100 GB/month (good enough for me), I still keep a watch over my current totals, so I stay a little bit paranoid.

</comment></comment></comment></comment></comment><comment><USER13> This could be an MIT alumni composite - <http://www.dropbox.com/about>

Scary smart folks.

</comment><comment><USER14> They've edited the post so that it no longer includes anything about 5 million users. Apparently it was premature (still love Dropbox though).

<comment><USER15> Looks like it's 4 million, which is still worth announcing.

With more users, I'm curious if paid accounts are growing at the same rate as free accounts. I also pretty much assume that a much higher percentage of all users in the US will be paid accounts versus other countries, but would be curious what their actual experience is.

<comment><USER16> They already stated that they had 4 million users a month ago: <http://blog.dropbox.com/?p=289>

</comment></comment></comment><comment><USER17> Would be interesting to know what % of those users are paying any money.

I really hope they get their API sorted soon, i've been holding off looking at alternatives because it's always "close" but now i'm starting to consider other options.

</comment><comment><USER18> has dropbox gotten acquisition offers? i feel like if I was microsoft I'd be chomping at the bit to integrate this into windows as a major selling point.

<comment><USER19> Microsoft does already have Live Mesh ( <http://www.mesh.com/> ) which is a very similar product/service. Live Mesh does per folder synching and you can invite other users to share or read only on an individual folder basis.

<comment><USER20> They also acquired Foldershare years ago and it was remarkably similar, even had Windows/OS X integration, although they haven't done much with it since the acquisition. Dropbox feels like the much better designed younger sibling - the Web version is a first class citizen rather than some clunky admin panel, for example.

</comment></comment></comment><comment><USER21> I really like the dropbox experience but I really wish they didn't limit the download bandwidth.

My dropbox is about 35 GB, I just installed dropbox on a brand new computer and the download speed is 7KB/sec. It will literally take almost 20 days to sync my files.

That's terrible.

By the way, I'm an early adopter and have introduced dropbox to many people, I just hope download speeds were somewhat decent.

<comment><USER22> Where are you getting 7KB/s? Did it start that way, or decelerate after a while? I usually get ~700KB/s, at least.

<comment><USER21> By the way I just ran this speed test:

<http://www.dslreports.com/speedtest?flash=1>

My network downloads 4MB/sec

The computer has a fresh install of snow leopard and everything else is fast.

<comment><USER22> Very interesting; try downloading a file from your Dropbox public folder via HTTP, and see if that's any faster. If it is, your ISP is probably throttling/QoSing Dropbox, the ports it uses, or the kind of traffic it generates specifically, and you should get in touch with them about it. If it's slow as well, your ISP might be having a peering problem to Dropbox's colo.

</comment></comment></comment></comment><comment><USER23> Thanks for the Linux Dropobox Client.. we exist!

</comment><comment><USER24> I just wish Apple will let to save the files you create on the iPad your Dropbox account. Sadly they will probably do that with Mobile Me (I have an account already), but it doesn't work as smoothly as Dropbox, especially for sharing with other users,IMO.

<comment><USER25> Isn't there already an iPhone / iPod touch app? I would imagine access to the new file area might not be a huge adaption.

</comment></comment><comment><USER26> Just in case someone from the Dropbox team is reading this, I wanted to compliment on the web UI. Really, it kicks some serious ass. I'm usually very picky when it comes to websites and their design, but this one is just a piece of art.

</comment><comment><USER27> For anyone who hasn't used it before, dropbox is great if you're in college. I use it to sync notes and assignments across all of my machines. I take notes in class on my laptop, and I can access them on my desktop. Furthermore, I can start assignments on my desktop at home, and work on them on my laptop between classes.

</comment><comment><USER28> They gave nice stats by country and platform.

I would also like to see stats, by free vs paid accounts? How many of the free account actually use their account are close to their quota limits?

It would be nice to know how big can Dropbox scale, how many servers they can afford, etc ... .

</comment><comment><USER29> I especially liked the video. Just wondering: I see no activity in China. Does Dropbox work in China & is it just a matter of not enough traffic to show up? Can anyone confirm this?

</comment><comment><USER30> Wow, 5 million is impressive. More impressive, that the US is not even 1/3rd of their user base. Talk about global adoption!

</comment><comment><USER31> Congrats to them. I really like dropbox myself have it on most all my computers.

</comment><comment><USER32> Awesome work, guys. I propose that, at least in HN circles, the official plural of _Dropbox_ should be _Dropboxen_.

<comment><USER33> Dropboxen /drɒp'bɔksn̩/ (German): (lit.) candy boxing. Compound word of "Drop" (old fashioned) and "Boxen".

<comment><USER29> same in Dutch ... Drop as in licorice-like candy ... the black evil stuff ;-)</comment></comment></comment>


The Improbable Origins of PowerPoint - <AUTHOR> https://spectrum.ieee.org/tech-history/cyberspace/the-improbable-origins-of-powerpoint <comment><USER2> Definitely worth reading to the end. Some amazing history is woven into an unlikely startup story after succinctly covering the modern legacy of PowerPoint.

A company built on dreams of what I can only describe as a GUI enhanced "smalltalk machine" that could run on regular computers to enable regular people to do things, is also responsible for shepherding the earliest days of the now venerable FileMaker database AND created PowerPoint.

Amazing stuff.</comment>


Google proposed Web Bundles could threaten the Web as we know it - <AUTHOR> https://www.ghacks.net/2020/08/30/google-proposed-web-bundles-could-threaten-the-web-as-we-know-it/ <comment><USER2> Fyi... Web Bundles and Signed HTTP Exchanges are confusing topics so I think it's worth reading 2 previous threads with comments from 2 Google employees (spankalee, jefftk) [1].

One may still choose to discount their explanations because they may be biased sources but I still think everyone should try to _understand_ what they're saying. Hopefully, being familiar with the technical details will _elevate the discussion_ so people who disagree can point out _specific and concrete technical flaws_ of those explanations rather than just restating a generalized version of _" Google is trying to take over the whole web."_

[1] previous threads:

[https://news.ycombinator.com/item?id=24275752](https://news.ycombinator.com/item?id=24275752)

[https://news.ycombinator.com/item?id=24278068](https://news.ycombinator.com/item?id=24278068)

[https://news.ycombinator.com/item?id=24324120](https://news.ycombinator.com/item?id=24324120)

<comment><USER3> > Hopefully, being familiar with the technical details will elevate the > discussion so people who disagree can point out specific and concrete > technical flaws

Asserting that an elevated discussion should center only on technical flaws and disagreements is a myopic way to look at a topic.

There's more to the web than the technology used to power it. How a technology is used, and what it enables (good or bad) is an appropriate topic for this forum and constitutes elevated discussion.

<comment><USER4> I think you misunderstood the point you were replying to. The idea is that you can't really have a discussion about what it enables or how it's used unless you already understand the technical details. And that shows as a lot of the comments/blog posts about this topic are using underlying technical assumptions that are entirely incorrect.

<comment><USER3> The plain language of the comment doesn't say that:

> so people who disagree can point out specific and concrete technical flaws

That's the basis of my reply. I think you have a good point; but it isn't what the parent said.

<comment><USER5> The criticism the original post has of WebBundles is fundamentally technical. All of their privacy and anti-adblocker claims stem from the idea that the bundles have special URL randomization powers that the current one-resource- per-request model can't replicate.

If that technical basis is incorrect, the whole thing just collapses. There's nothing left. Not allowing disproving the technical basis of these kinds of posts would mean that we have to just accept conspiracy theories at face value. That does not seem like a healthy outcome.

(Or to put it another way: you wanted to discuss "how this technology will be used". But how can we possibly have that discussion without agreeing on "what the techology can do" first?)

</comment></comment></comment></comment></comment><comment><USER6> I think their idea is to combine that with signing the bundles, so a page from www.someserver.com can be served by anyone, aka Google. I guess this would mean Google can serve all content on the web.

There seems to be a strong urge in Google to cut the connection between then endpoints of the web and become the central authority. Make all traffic flow through their machines. Let no information arrive at the endpoints.

Right now, requests on the web are kind of p2p. A user requests a website, the publisher serves it any way they see fit. Directly via their servers or via a CDN of their choice.

Google seems to have a strong focus on ending this. Turning the web into Googlebook / AOLoogle.

I wonder why. Do they see their business model threatened on the open web? Or do they see a chance to increase their profit with a closed web?

<comment><USER7> The article seems to give some clue. The format would allow serving unblockable ads using random urls, or urls that look legitimate. Google's goal is to have full control over the user experience so that they can serve more ads.

<comment><USER8> You could already use random URLs to serve ads and track, not sure how a bundle changes anything

<comment><USER9> Browsers like Safari are increasingly enabling privacy features that, among other techniques, block third party cookies by default. So this could be Google's way of reacting to this change.

<comment><USER10> I don't see how. Web bundles don't affect whether a cookie is considered third-party or not. Either the content is provided and signed by the actual website, which cannot place cookies for the advertiser's domain, or it's provided and signed by the advertiser, at which point it would be subject to blocking just like normal web traffic from the advertiser. Is this any different with bundles?

<comment><USER11> The third-party cookie will be blocked, but when both sites are served via the same proxy server, over the same TLS/QUIC connection, the third-party can get similar tracking information they would have had with a cookie, without needing a cookie. It's not exact, but it's good enough for inference.

<comment><USER12> Assuming that the third party in this scenario is distinct from the party serving the bundle, they wouldn't be involved in the TLS/QUIC connection, right?

So it seems like a third party wouldn't even know that their resource was delivered, unless the party delivering the bundle notified them, or their script makes a separate request to their own server. (And those are options already, so AFAIK bundles wouldn't give third parties any new capabilities.)

<comment><USER11> In the scenario, the third party is the advertising broker, Google, who are also the entity serving the signed bundle.

<comment><USER10> Yeah, I think this is a compelling argument, but also, it's a decent argument against using Google Search itself, is it not? They can almost certainly _already_ correlate a click on a search result on google.com with the Google Ads subrequest from the target page.

And, on the other hand, the fact that web bundles are signed and can be delivered by any origin means that a privacy-focused user agent could try to fetch the bundle indirectly via some privacy-preserving CDN - essentially DoH for web bundles. If you are about to load a site via some known web-bundle host (like [https://www.google.com/amp/](https://www.google.com/amp/) probably), try sending a request to some Cloudflare Workers setup or something first.

<comment><USER13> This would be like opera turbo (and similar from other browsers), but with fewer privacy concerns, so it's not even new design space.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> Let's call a spade a spade. The only real world problem that WebBundles (and Signed Exchanges) really solve is to allow AMP to impersonate your website.

Google wants all the click data and the click through navigation data about users (by way of passive logs) so they can sell more ads.

There are no other real world problems that web bundles solve.

<comment><USER15> The real world problem web bundles solve is distributed caching. Right now sites have pick one or a few CDNs and have a trust relationship with them and allow them to impersonate your site.

Web bundles changes this relationship so that anyone can cache sites if it benefits them to do so. If you share a link on Twitter or Facebook or Discord or Slack they can cache the page on their servers and deliver it through the connection you already have open to them.

Web Bundles also open the door for network-local caches that don't require MitM or trusting the cache.

<comment><USER14> This feels contrived. Rarely do I, as a brand or content creator, want it circulating without my control. It doesn't make business sense.

<comment><USER15> This feels like such a weird stance. I can't imagine someone saying something to the effect of "I don't want my DNS records just circulating without my control." This isn't like AP giving CNN republishing rights, this is getting a magazine from the stand at the convenience store rather than having going to the Condé Nast corporate HQ.

Like it's your site, exactly as it would be if it was delivered by your server just delivered by someone who already had a copy on hand rather than fetching a new one every time. This is what HTTP proxies used to do, what DNS caches and browsers still do. TLS broke web caches because TLS secured the connection instead of the content.

<comment><USER14> DNS is not content.

HTTP caches were always problematic from a business perspective. Great for downloading large binaries (installs) but problematic when they don't expire as expected, or if content needs to change for contractual reasons.

<comment><USER13> Tell that to cloudflare.

It's not like you're forced to cache things if it doesn't work for your business case.

</comment></comment></comment></comment></comment></comment><comment><USER16> I am really curious what's the general opinion on Googler's as a web developer. I have seen a long while ago some nice articles from Google about site optimization.

Do they even follow any of their original advice or Google basically keep doing over engineered stuff fixed by adding another set of over engineered staff?

Let's talk gmail. I just refreshed the window and it did close to 400 request, ~8MB download which translates to nearly 40MB resource. And it keeps making more requests even when I'm not doing anything.

And a refresh of Google.com the search page did 33 request and nearly a MB download.

And they are preaching the world about optimizing the web?

<comment><USER17> Yes because heavy pages clog their crawlers. Of course they are not following their advice (neither does FB)

<comment><USER18> This is great: [https://developers.google.com/speed/pagespeed/insights/?url=...](https://developers.google.com/speed/pagespeed/insights/?url=mail.google.com)

I mean, kudos to Google for (probably) not cheating here, but that's a low score.

<comment><USER19> And thats only for the login page.

</comment></comment></comment></comment><comment><USER20> Yet another thing Google wants to fix by serving everything through their servers instead of asking devs to fix their owns sites.

Same problem with AMP. Instead of asking news sites to fix their slow pages, it forced them through AMP by promising better result ranking.

Ask them to make their sites faster within a month or say they'll get booted off search. You'll be surprised at how fast they comply

</comment><comment><USER21> I think this line of criticism of web bundles misses the mark. It looks to me like the issues raised are perfectly possible and just as easy without web bundles -- that is, these may be legitimate issues, but are independent of web bundles.

My issue with web bundles is that it's yet another pile of complexity with very little incremental value over things that already exist. A poor tradeoff.

There's a substantial on-going cost to each web standard added so each one needs to "pay" for itself with broad or deep usefulness. Web bundles are just another way to skin a cat.

</comment><comment><USER22> I don't understand why can't this be blocked by content blockers. I tried open a .wbn in the original article, and tried to inspect the resources using devtool, it still have files listed there. So content blockers can still block something like xxx.wbn:/js/ads.js if browser have such api.

Also, I think web bundle can be a Electron replacement too for some use cases, so that some totally offline JavaScript webapp don't have to use Electron.

</comment><comment><USER23> I was hoping this would be more than a rehash of the article on the Brave blog about the same topic, but alas. Link to that discussion: [https://news.ycombinator.com/item?id=24274968](https://news.ycombinator.com/item?id=24274968)

</comment><comment><USER24> Is there anything in the web bundle standard that forces outdated pages to be refreshed? The spec seems to say little more than "detecting stolen keys is not our problem".

I can imagine this being a problem when news stories turn out to be false alarm and Google happily keeps serving the original content instead of the corrected content.

There's also a risk of vulnerability here, as getting a signed package might very well be used to host phishing pages on web caches.

</comment><comment><USER25> Google should just fork the web already. Let them create their own private platform and do whatever they want.

The massive control Chrome and Android gives them means they can do whatever they want already, but at least with a private platform they won't have to fight people and deal with the negative PR of doing evil stuff. And then the rest of us who like privacy and competition and ad blockers can use the "legacy" web.

<comment><USER26> Then they'll just pay a few journalists to run a couple hit pieces on the open web, saying it's a place where people who kick puppies reside.

</comment></comment><comment><USER27> Interestingly the main quotation in the article is from a Brave team member -- what does Brave do when this is rolled out? Fork Chromium?

</comment><comment><USER28> Web bundles look like a great thing for Electron and PWA like scenarios, specifically due to signature support. We had to drop service workers and reinvent the wheel with APPX (basically a signed ZIP file) in one of our apps, to ensure code integrity.

</comment><comment><USER18> So it's a signed executable, running in a sandbox, served from a federated app store... Isn't the whole JS/CSS/HTML web crap a bit overcomplicated for this purpose?

</comment><comment><USER29> The missing hyphen in the title is really confusing.

</comment><comment><USER30> I for one believe in the specified use cases of Web Bundles, & believe they are worthy.

[https://wicg.github.io/webpackage/draft-yasskin-wpack-use- ca...](https://wicg.github.io/webpackage/draft-yasskin-wpack-use-cases.html)

What we have here is a budding conspiracy theory, not even a theory, just gesticulation. Consensual Delusion, a belief that we are persecuted by secret forces that must be held off, held at bay.

This started months ago with an incoherent rambling ticket by the Brave author that is being cited. He spent months going back & forth with wild accusations & unspecified concerns. After dozens and dozens of exchanges, he finally named one single scenario, that people might "hide" their tracking malware by renaming files as they put them into the bundle.

Color me extremely unimpressed & unscared. Enormous sound & fury, for a capability that is in no way different from the web we already have today. It's not hard to setup a.webserver to randomize asset names. Nothing about webbundles is new or changes that.

Consensual Delusions like this hacked up hoax of a story threaten reality as we know it. As the old civic videos say: DONT BE A SUCKER. Anyone selling fear, uncertainty, & doubt is to be met with skepticism. Increasingly, FUD is how Apple/Mozilla/Brave are selling their anti-feature policy. "Trust us, we won't let the web work with midi" doesn't sound that great, but is much more honest than what we get, which is "these engineers & standards groups working on these specs are secretly trying to undermine this treasured web which we must protect & keep as is at all costs". the involved engineer's histories indicates they obviously care enormously about bettering the web, & in this case are combatting sizable transpiling tool bloat for devs, & enabling offline sharing & offline capable web, and literally fighting censorship, which are truly worthy goals all that will vastly help the web.

This is all super hard to work through. Yes, google used the web to reap enormous profit by means of enormous information control & inventory systems for ads & eyeballs. But Google also would not exist without the web, & historically the web was a small toy that couldn't do much compared to apps. The tables have turned, & the web is clearly ascendant, much safer, & increasingly we understand that the limitations of ux were largely from lack of will to explore & test what limits there really were, so the situation is no longer so obviously tense. But Google Chrome & Chromium & the spec work Google does are, imo, designed to improve a communal shared resource for all humanity, designed to greaten the web, not subvert it. We can see that here, as the engineers working on webbundle have shown a thousand times over their commitment to honest above board clear integrity as they have tried & tried & tried to work with Peter Snyder as he fumbled & plodded his way to a scenario where WebBundles pose any real danger, & Peter has imo failed at presenting anything. We can see the engineers take Peter seriously, try to work with him. And so I feel it is in general. It is intimating as hell that the web is so big, has so many capabilities, that so much keeps getting added, and so much of that comes from gigantic unimaginably huge pools of capital derived from eyeballs-on-screen. But somehow it has been working out, the engineers have genuinely cared about doing the right thing, & usually the standards bodies & TAG can eventually come to harmony & agree, & the web improves.

Peters dissent thread:

[https://github.com/WICG/webpackage/issues/551](https://github.com/WICG/webpackage/issues/551)

Personally I greatly look forward to WebBundles. It will radically improve the JS module situation, yay, a thousand times yay, & giving people the ability to share content directly with one another, without relying on centralized infrastructure, is one of the most genuine pure & true new expanses for the web & one I am greatly looking forward to.

<comment><AUTHOR> Is it "simple coincidence" that "conspiracy theories" almost always come true? I'm about conspiracy theories which are not made up by ____to make fun of conspirators to show them like "idiots" on public.

Anyway, users always lose. Another coincidence and in this case they will not lose, right? :-)

[https://news.ycombinator.com/item?id=24383039](https://news.ycombinator.com/item?id=24383039)

<comment> lachlan-sneff > Is it "simple coincidence" that "conspiracy theories" almost always come > true?

That's quite a statement to make. In no way do "conspiracy theories almost always come true."

<comment><AUTHOR> The main point that there are legit theories that always carry at least a grain of truth. And when such theory come into the public, government/google/etc begin there job to 1) hide them/remove/censor 2) if it still becomes popular they start to make fun of it with misinformation. 3) if it's not help they start to fork the main theory with a lot of alternative views/lies.

</comment></comment></comment></comment><comment><USER31> The only answer is to not click on ads. Do your research via review videos/amazon etc (I know that they are/could be indirect advertisements but atleast the creators get some sponsorship money). Then go to the brick and mortar shop, check it out and then, here is the kicker, pay the extra $5 bucks to buy from them.

</comment><comment><USER32> This is an idea I had, an alternative to web bundles and solves the same issues.

Inside a HTML file, we introduce an attribute for embedded resources called cache="identifier". Script tags, style tags will have this attribute defined. There would also need to be an embedded image introduced. Inline all your resources. The browser will fetch the HTML and add whatever has the cache="identifier" to its cache.

Then when the browser fetches a page, it will send a Cache-Got header, this is a bloom filter serialized of identifiers cached.

The server will check the bloomfilter to see if an item needs to be sent to the client and exclude the contents of those embedded resources with an empty script tag or empty style tag.

EDIT: Why is this being downvoted?</comment>


How to Work Remotely and Live to Tell the Tale - <AUTHOR> http://blog.sugarenia.com/archives/life/how-to-work-remotely-and-live-to-tell-the-tale

<comment><USER2> Very well written and inspiring for us dreaming of working from home but don't even dare to try.

</comment><comment><USER3> Incredibly insightful and honest.</comment>