JavaScript's ecosystem is heading into the wrong direction. Thoughts? - <AUTHOR> The Javascript pendulum has swung from restrictive, monolithic frameworks to modular, boilerplate-hindered libraries.
I personally know many newbies who find it extremely hard to dive into the React/Redux realm because there is a serious learning curve.
I think we need to strike a balance. Too much of an unopinionated ecosystem can do more harm than good. What are your thoughts? <comment><USER2> Javascript for a while was full of MVC/MVVM frameworks, and React came along and only gave you the V and some basic hooks, expecting you to supply the rest yourself. This worked well for some specialized use-cases, but you couldn't replace Angular/Backbone/Ember with it, which is what people also want.

Speaking as someone who started off as being dismissive of 'enterprisey' programming but later went on to write a lot of Java, problem domains are actually fairly complex, and a framework is designed to restrict the things you have to think about so you can get work done.

When you chain minimalistic libraries together, you have to do all the work yourself; and some newbies are put off by this. On the other hand, it makes most quickstarts really simple, so I think it hits both ways.

I think having a choice of high-quality libraries is nice; some are backed by big corporations unlikely to disappear overnight; some are hobbyist projects crafted by a loving community. I believe React+Redux is a good thing, causing people to think about all the complexity that goes into MVU, MVC, MVVM and is generally hidden beneath a monolithic framework.

<comment><AUTHOR> That's the problem. Most 'people', such as budding developers, do not want to wire-up the internal components. They don't want to think about the complexity.

<comment><USER2> Independently discovering that you need 'foo' when you start off dismissive of 'foo' is a great way to learn. And in many ways, is natural. Applications evolve in complexity, just as our understanding of them does.

Until you need a tool that your current toolchest doesn't offer, you're fine, and likely benefited from having simple, easy-to-understand tools. Switching to a different toolchest will not be trivial, but it alters which problems are easy, and which are hard.

I understand what you're getting at, but there is real architectural choices right now that didn't exist in 2012. It's true that React enjoys good mindshare and attracts new talent based on name-recognition alone, but there already is a next wave of alternatives to React (like Vue, Mithril, Aurelia) that are borne out of lessons learned from React _and_ Angular/Backbone/Ember. If someone discovers that React doesn't in fact meet their needs, there's others to turn to, organically.

<comment><AUTHOR> Valid point.

</comment></comment></comment></comment><comment><USER3> Configuration boilerplate isn't always so necessary. For those who want to have their cake and eat it, too:

1\. [https://github.com/facebookincubator/create-react- app](https://github.com/facebookincubator/create-react-app) 2\. [https://github.com/mozilla/neo](https://github.com/mozilla/neo)

<comment><AUTHOR> Sweet tooling. But I mean the ideas behind this whole new ecosystem, like the reactive paradigm. Multiple tools for transpilation, Babel/Buble etc. Just adds a layer of confusion.

<comment><USER2> The transpilation thing is actually an entirely separate concern from your original post. It's a subpar solution to an unfortunate situation that people want to use the latest version of the language, but not all target platforms run it yet.

For lack of a better term, treat ES.Next like a compiled language, and Babel as your compiler. It's the status quo until the platforms we run code in catch up to natively executing the code JS devs want to write.

<comment><AUTHOR> I know, I just didn't mean to deviate away from my original post. By the way, I use Buble with Webpack. Buble has a cleaner output than Babel. [https://gist.github.com/angus-c/feea4e4cd0b853dc04c71fa4e7d2...](https://gist.github.com/angus-c/feea4e4cd0b853dc04c71fa4e7d2f83f)

</comment></comment></comment></comment><comment><USER4> > I personally know many newbies who find it extremely hard to dive into the > React/Redux realm because there is a serious learning curve.

As opposed to… classical OO frameworks where it's easy to dive in and build something that no one in the can maintain six months later? The failing in this this scenario is actually exactly the same as in javascript's unopinionated tools:

Training.

I wouldn't expect a new developer to be adequately prepared to contribute effectively to any system and in some cases I wouldn't expect an experienced developer to contribute effectively to a complex system that they are new to. So what do we do? We standardize training. A walk through the code base that every new developer partakes in upon joining the team. Required reading, a document detailing the architecture of the system with pointers to files which implement the pieces which are critical to understand and code reviews.

Another critical part of training, or perhaps just learning how to get around the world in general, is that at some point you have make a call and use what's right for you. Here's the kicker: this decision that so many want someone else to make for them, the down sides of making that decision poorly aren't that bad. Don't want to spend time forming your own opinions about how to go about using otherwise unopinionated tools? There are opinionated tools for you! Ember and Angular are both great frameworks. If they happen to be wrong for your application will the project just flat out fail? No, of course not. It'll get done. You'll bend the rules(which are only opinions) in a few places and get what you want in the end.

I'm a React user myself but my experience has given me the understanding and empathy to know that it's not for everyone. I wouldn't recommend it to someone who is truly new to JS or software engineering in general. I'd hand them something that would guide them up the ladder.

<comment><AUTHOR> Nice point about training!

</comment></comment><comment><USER5> If you want to know what the future of Javascript looks like, look at the present of Java.

It's a monster language with maximum bureaucracy, but it's not going anywhere, since most large companies already have legacy systems built with Java.

But I also am not a fan of this direction just like you. My personal thought is, JS will never lose its dominance just like Java, and it will grow and grow until it becomes a monster like the Java ecosystem, and it will become shittier and shittier.

But that is only until something disruptive comes along that will decimate the influence of the desktop web browsing experience as we know it.

<comment><USER2> It's worth noting that WASM will (eventually) enable other languages to run in the 'browser VM' and this loss of JS' monopoly (whether as a source language or a compilation target) will cause some of the pace of innovation to shift away from JS and onto WASM.

Right now, the ecosystem has a lot of churn for exactly three reasons:

\- browser vendors keep adding 'web platform' APIs that are only callable through JS

\- new spins on paradigms are popping up on how to structure single-page applications

\- the JS language itself is getting new features after being stagnant for years

When any one of these quiets down, the churn will slow.

</comment></comment><comment><USER6> Why should an ecosystem be judged exclusively on how well it caters to newbies?

<comment><AUTHOR> If an ecosystem is approachable to more people, it could increase the likelihood of innovation in the industry.

<comment><USER6> Does that outweigh other considerations, like how well the ecosystem helps professionals get work done and/or maintain projects?</comment></comment></comment>


NASA holds press conference to discuss finding that impacts search for life - <AUTHOR> http://www.nasa.gov/home/hqnews/2010/nov/HQ_M10-167_Astrobiology.html

<comment><USER2> Duplicate: <http://news.ycombinator.com/item?id=1952218>

</comment><comment><USER3> ah, ic, sorry, only searched 1 day ago :]</comment>


WebSockets: Stable and Ready for Developers - <AUTHOR> http://www.sitepoint.com/websockets-stable-and-ready-for-developers/ <comment><USER2> At Review19 - <http://review19.com> \- we are primarily using web sockets but we have fallback / failover transports in place.

What helps is the very awesome Socket.io abstraction, just mention websockets and a bunch of fallbacks in the config and get coding.

Must say having JavaScript on the server, the client and the data store is a huge advantage as well from a programming context perspective!

<comment><USER2> And.. umm.. discovered couple of hours ago that things surprisingly work great on IE9 and apart from CSS disabilities fairly well in IE8.

Of course, hard to say its production ready for all kinds of web apps, you must still choose based on your specific situation.

</comment></comment><comment><USER3> "Stable and ready for developers" and mixing it with links to the .Net framework 4.5 beta documentation seems off.

Sure, it can be stable. And ready is kind of subjective. But the 'Use this, now' feeling I got from the title was quickly nowhere to be found.

That said: I liked the whole walkthrough and general depth of the article.

<comment><USER4> It seems "off" because it is:

<http://caniuse.com/#feat=websockets>

I would love to use web sockets in my app to replace long polling but without IE/Android, it's a non-starter.

<comment><USER5> <shameless plug>

That's exactly what I thought and that's why SockJS is there: <https://github.com/sockjs/sockjs-client>

       a) start using SockJS

       b) wait until enough browsers supports it

       c) drop SockJS.

SockJS has a websocket-like API so no need to do major code changes when you switch.

</shameless plug>

<comment><AUTHOR> Great idea. Exactly what somebody should have done with HTTP Long-Polling and Streaming (XHR, IFRAME, ActiveX etc.) but without a standardised API it was difficult. The WebSockets API let's us do this.

</comment></comment></comment></comment><comment><USER6> Huh? Android default browser (and most importantly, WebView) does not support WebSockets, and has no visible plans to support it. IE8/9 do not support WebSockets.

<comment><AUTHOR> Some expect Chrome for Android to become the default browser (<http://www.wired.com/gadgetlab/2012/02/chrome-android/>) and if that happens the WebSockets will be supported. Firefox for Android also supports WebSockets.

I can't 100% confirm Chrome will become the default but Google are very pro WebSockets so it would be very strange for them not to support and encourage their use.

There are fallback options in place that mean WebSockets can be used on Android but that tends to mean Flash lite also has to be installed.

</comment></comment><comment><USER7> One of the very _real_ issues with WebSockets is that they don't work often over mobile networks, with invisible proxying, etc.

Unless you go with something like Socket.IO, WebSockets alone would never be a viable solution.

<comment><AUTHOR> From my experience, working at Pusher and dealing with support for the past year, WebSockets do work over a mobile 3G connection when you use an SSL (wss://) connection. I tether (laptop -> mobile -> mobile data) quite a bit whilst travelling and my mobile data provider, O2, do all sorts of annoying things with dat (stop whitespace, inject JavaScript), but my WebSocket connections work flawlessly.

In the same way that a WebSocket library can fallback from a WebSocket connection to a HTTP-based connection it can also first try ws:// and then fallback to wss:// - it's what our library does. The potential problem here of course is that you need an SSL certificate. When using Pusher that's not a problem, because we've bought one, but when using your own hosted solution that might mean dishing out money that you'd rather not.

</comment></comment><comment><USER8> Websockets are great, but apache and nginx are still yet to support them out of the box. You have to recompile nginx with a module and apache has to have a custom mod.

When it's a case of writing in a line in nginx.conf for a proxy bypass or commenting out an apache module then it will be ready. Using port HTTP/port 80 is one of websockets strengths.

<comment><AUTHOR> When it comes to nginx and apache you can always go down the hosted realtime infrastructure route. That way you can use WebSockets in your client (app) but you don't need to worry about installing mods or handling the persistent connections on your server.

See: [http://www.leggetter.co.uk/real-time-web-technologies- guide#...](http://www.leggetter.co.uk/real-time-web-technologies-guide#hosted- services)

</comment></comment><comment><USER9> Does anybody know how fast connecting to a WebSockets server is? How does it compare to connecting over http? I was interested in the ws:// uri scheme as I was unaware of that. Is there a future scenario where we could connect to a WebSockets server directly through the browser without first connecting over http and then with js?

</comment><comment><USER10> I would really love a free C# implementation of a Socket.IO WebSocket, with as few external dependencies as possible.

<comment><AUTHOR> Are their commercial versions of socket.io for C# available? When it comes to .NET people tend to go with signalR (which I think has WebSocket support but not within ISS - until Windows 8 server), SuperWebsocket or XSockets.

</comment></comment><comment><AUTHOR> By a guy from Microsoft so plenty of MS examples/links, but a good overview of WebSockets never the less. I'm interested to hear how many of use will ever actually use the `WebSocket` object? Will we (developers) always use a library offering a layer of abstraction and the real core functionality that we need.

<comment><USER11> The WebSocket API is very simple, there wouldn't be much need to abstract it.

<comment><AUTHOR> The point in abstraction in this case is to add additional functionality.

The most obvious option, and something I thought might have become part of the WebSocket API, is auto-reconnection. To reconnect you need to create another WebSocket object and reattach all your event listeners. So, I'm convinced that the majority of people who use WebSockets will have to write their own custom code for this and will probably put it in their own little library which wraps around using WebSocket objects.

More info in the comment here: [http://www.sitepoint.com/websockets-stable- and-ready-for-dev...](http://www.sitepoint.com/websockets-stable-and-ready- for-developers/#comment-1043114)

</comment></comment></comment><comment><USER12> On a related note we put out a tech demo showing nodejs and socketio recently. <http://www.webdigi.co.uk/fun/space/> It uses iPhone accelerometer to control the ship on your browser game!

</comment><comment><USER13> I was hoping to read an article about how WebSockets are more stable and ready today than the last time I checked.

</comment><comment><USER14> Microsoft technology examples. I am a-feared. Are there wrappers in jQuery or Prototype (et al) for browser side WebSockets access yet, so I only need to worry about _if_ it is supported, rather than how?

Similarly, what does it take to support this on the server side? (in a *nix environment)</comment>


Fukishima is Worse than Ever - <AUTHOR> https://cringely.com/2017/02/16/no-fracking-way-fukishima-daiichi-worse-than-ever <comment><USER2> His entire rant is based on _fake news_.

The whole "The radiation levels inside Japan's damaged Fukushima Daiichi nuclear reactor No. 2 have soared in recent weeks" is _bogus._

The new, higher readings are from areas _never measured before_ [0]; levels measured from consistent points are _falling consistently!_

Also note: there are far more comments on this subsequent dupe[1].

[0] [http://blog.safecast.org/2017/02/no-radiation-levels-at- fuku...](http://blog.safecast.org/2017/02/no-radiation-levels-at-fukushima- daiichi-are-not-rising/)

[1] [https://news.ycombinator.com/item?id=13667470](https://news.ycombinator.com/item?id=13667470)

</comment><comment><USER3> "Your connection is not secure" \- Firefox

(The certificate is only valid for the following names: *.wpengine.com, wpengine.com)

<comment><USER4> ...and if you proceed anyway, you get a 404

<comment><AUTHOR> I can't edit the URL. It used to be possible in the past but apparently posters are unable to make that change now.

The URL I am seeing is: [http://www.cringely.com/2017/02/16/no-fracking-way- fukishima...](http://www.cringely.com/2017/02/16/no-fracking-way-fukishima- daiichi-worse-ever/)

Maybe a moderator can fix the URL?</comment></comment></comment>


Seagate NAS Remote Code Execution Vulnerability - <AUTHOR> https://beyondbinary.io/advisory/seagate-nas-rce/

<comment><AUTHOR> And the response from Seagate:

[https://beyondbinary.io/opinion/seagate-nas-rce-response- ana...](https://beyondbinary.io/opinion/seagate-nas-rce-response-analysis/)</comment>


There are no mom and pop oil rigs in Norway (2002) - <AUTHOR> http://groups.google.com/group/comp.lang.lisp/msg/b3b24fb7512f220f?pli=1

<comment><USER2> What the post really says is, if your big business really depends on the results of days of computation, do your software in the language most efficient for the developers and throw money at hardware, because the value of the results is way more than the savings in hardware costs from using the most efficient language. He is arguing the case of lisp vs FORTRAN in the context of oil exploration in Norway.

<comment><USER3> He is not arguing purely for throwing money at hardware:

 _A good engineer would balance the tradeoffs and solve the problem within the existing resource constraints. A theoretical computer scientist would whine until he got a big enough machine to implement the mathematical solution with the least amount of fussing about the constraints of the real world._

The post at the start of the Usenet thread asks if any Lisp implementation can handle inverting a 20,000 by 20,000 matrix. Naggum is arguing that if you _really_ had that problem, you are probably working in an industry where the choice of Lisp implementation is irrelevant, because solving the problem is so lucrative that you could afford to write your own Lisp implementation, if needed. He's saying that you will throw money at _both_ hardware and developers to get the job done.

Edit: He also does not compare Fortran and Lisp.

</comment></comment><comment><USER4> I do AI. I used to live by McCarthy's quote that "Real AI was probably possible on the computers from 30 years ago, if only we'd known how to program them". So I bought my latest computer thinking: I've got 1000 times more processing power than _necessary_ , so why buy a top-of-the-line computer? Why care about the mere factor of 2 that I could get for an extra 2000 bucks?

What happens is this: today I had to solve software mini-problem #403 to put in experiment #14. I coded the naive O(n^2) algorithm, and damn it, it started paging, and performance crashes. I can't finish the experiment, unless I spend a few days looking up the right way to do it, O(log(n)); implementation, debugging, screams. Then I'll throw away the whole thing when I see that it doesn't work.

 _Ah_ , I think, _if only I'd have a 64 bit Common-Lisp_.

<comment><USER5> Sbcl and Ccl both have 64 bit implementations. I guess you just need a 64 bit machine?

<comment><USER4> Arh, I was hoping this wasn't true... I'm already using SBCL. The point is: software and hardware constraints limit your flexibility, and Naggum's argument that "a good engineer works around those constraints" is true if you have a fixed problem to solve and a lot of time, but it's not when rapid prototyping, which is what most of us should be doing. He says that no one should need a 64-bit CL (in 2002); I took his line back to make a crummy newspapery punchline, which turns out to be false as well.

Stupid penchant for the dramatic.

<comment><USER6> Naggum's argument is that if you're working with a large dataset, it must have taken you a lot of time/money to obtain it and so you should be able to afford custom hardware and software to deal with it.

<comment><USER4> I say that naive, brute force methods on modest datasets will generate huge memory and CPU requirements. The solution is either: waste some programmer time coding a better solution, or get better hardware/operating system. There's a tradeoff. Modern programming is super wasteful by the standards of 30 years ago. We traded computer ressources for programming convenience. There's still a lot of _that_ to be done before we have all the convenience we want.

Computers will be fast enough when I can do arithmetic with Church numerals.

</comment></comment></comment></comment></comment><comment><USER7> I'm disappointed. I hoped that the link went to an article about why there are no wildcatters in Norway.

</comment><comment><USER8> Is he seriously saying that nobody needs to use large matrices in these days of internet data? Google uses online implementations of some algorithms because they can't hold the whole matrices in memory at the same time. Maybe Google is not the average hobbyist, but hell yeah there are some large data sets out there for free, exhibit A the World Wide Web.

<comment><USER9> The post is from 2002, and he's saying that if you really need to work with large data you can afford to write your own tools like Google does.

<comment><USER10> I don't necessarily disagree with him about this, but I do take issue with his disdain of academic or hobbyist projects.

The internet is increasingly providing free access to very large and very interesting data sets, and so of course we're seeing more and more people take advantage of this to do interesting things with this data. And as working with these sorts of datasets becomes more and more common, it is silly to think that we should have to reinvent the wheel every time instead of having tools evolve around their uses.

Moreover, we're in an age where a couple people can successfully take an idea from a hobby project and turn it into a working business with little more than time, effort, and knowledge. Given this, I would ask where the line is drawn between "I need to work with this data" and "what sorts of cool things can I do with this data". My personal belief is that the line is very fine and blurry, and that the work of "jerkoff hobbyists" today is likely to lead to the serious uses of the future.

</comment></comment></comment><comment><USER11> Better than average Naggum rant. Anybody know what happened to that guy?

<comment><USER12> From his website, <http://www.naggum.no/>

"I am unable to keep my company in operation for health reasons, but it is one of those things I just cannot give up. Instead of being a commercial undertaking, it is now only a hobby. Until my health improves, which it might never do sufficiently, I am generally unable to accept programming projects, teaching opportunities, or requests to advise students, although I would really like to see what I can do if you would like my input."

If you're looking for more of his, ahem, observations try his page on wikiquote : <http://en.wikiquote.org/wiki/Erik_Naggum>

<comment><USER11> I've read the website - I'm wondering what it was that actually happened to him. He was a character and although acerbic in the extreme made some interesting points.</comment></comment></comment>


The Art Gallery Problem - <AUTHOR> http://en.wikipedia.org/wiki/Art_gallery_problem

<comment><USER2> The wonderful book, Proofs from THE BOOK,

[http://www.amazon.com/Proofs-BOOK-Martin- Aigner/dp/364200855...](http://www.amazon.com/Proofs-BOOK-Martin- Aigner/dp/3642008550/)

discusses the art gallery problem, among many interesting mathematical problems, and then exemplifies the playful spirit of mathematical proof by including in that discussion a photograph of what is quite possibly the ugliest art museum ever built--on the campus of my alma mater university.

<http://www1.umn.edu/twincities/maps/WeismanArt/photo.jpg>

(The photo shown in the book is different from this official photo, but you get the idea.)

For the rest of my life, I will always smile when I think of the art gallery problem, because it will remind me of what the authors of Proofs from THE BOOK asked their readers about the Weisman Art Museum (which I refer to as the "Ugly Art Museum"). Thanks for making me smile by submitting this link to the Wikipedia article.</comment>


A Developer's Worst Nightmare (The TinyGrab Story) - <AUTHOR> http://cocoacoding.com/2011/04/03/developers-worst-nightmare/ <comment><USER3> If anything this is a cautionary tale about how to screw up your startup.

I have no idea what TinyGrab's architecture looks like, but I can say with full confidence that backups were an afterthought, and they find themselves in deep shit because they did not have a proper backup in place. It is inexcusable to have the current situation and still claim they have good backups.

"The issues lays with the server being compromised and being forced to shut down. The old API and apps relied on a fixed IP address. It would have taken us months to get TinyGrab v1 back up to scratch"

Ok, computer scientists reading this: To which of you does this make sense? It's hard to keep counts of all the fails in here:

\- If your problem is a corrupted server, replace it and assign the same IP address.

\- Why would anyone hard-code IP addresses for an API to work? Were you born yesterday?

\- It should take at the very most hours to recover from a truly catastrophic failure. "Months" you say? You do not know what you're doing, I say.

\- They have a bunch of backup and not one works, specially when there is no data loss? Smells to me like no source control; no off site backup, and absolutely no testing of the backup. If you have lived a single day in system admin work, you know that it is not enough to do a backup. You need to test the damned restore.

Maybe this could be a story about when _not_ to self-finance your startup. Get outside funding and hire people that know more than you do about the technology involved.

Sorry for being an asshole in my comments, but this situation is full of fail at every step.

<comment><USER4> You said it - you are indeed being an arsehole in your comments.

Firstly:

"...this could be a story about when _not_ to self-finance your startup"

That's easier said than done. There is absolutely no point in over analysing the situation and then concluding that TinyGrab should have got "outside funding" and "hired people that know more than they do" about the technology involved - because what is done, is done. You are seriously insulting the intelligence of everyone behind TinyGrab if you think they don't already know that version one was problematic. The point here is that the popularity of TinyGrab was never predicted or planned and that it grew from strength to strength entirely organically. At no point did they think about scalability from the outset - so they acknowledged the problem and were rectifying this with a full rewrite in TinyGrab 2. They we're simply unlucky in that they were unable to roll this update out quickly enough - they were hacked before they could complete TinyGrab 2, and therefore did the right thing and released TinyGrab 2 which was very nearly complete anyway. With the lack of income and voluntary manpower they had, they couldn't have changed anything in hindsight at all. So in that respect this was not "full of fail" as you so crudely put it.

Secondly:

What you need to do is put yourself in the shoes of those battling to actually keep TinyGrab online, and realise that they are actually trying their best to respond to every support request and resume the excellent level of service their users have come to expect - and frankly they've almost achieved that now.

What you also need to realise is that those behind TinyGrab are not in it for commercial gain - they are in it because they love the product and their users.

Since this is a completely free service they could have very easily - <USER2> might I add completely legally closed TinyGrab as of today, with no risk of litigation against them. They would also most probably refund existing premium users, but would not be legally obliged to.

What they have instead chosen to do, is keep this service online, do their best to get TinyGrab 2 to the bare minimum in order to roll it out completely, and work day and night as a team to respond to every support request and @mention on Twitter to keep users informed and solve their issues individually. I think this is absolutely admirable given their 300,000+ user base and could never be described as "full of fail" especially since the vast proportion of their users do not pay them a penny - and especially since those behind TinyGrab work in their own free time on the project whilst receiving no commercial gain whatsoever.

TinyGrab will easily recover from this over the coming days - all they need at this moment in time is some moral support and some understanding - a bit of slack if you like - not a bunch of anonymous, cynical, patronising and moronic nobodies trying to tell them how it should have been done in hindsight. As I said above, it's frankly just insulting the intelligence of those behind it - any reasonable person can see that they were fully aware of the pitfalls of TinyGrab version one and were trying their best to roll out version two. Give them a break.

<comment><USER3> Maybe the problem is that I _have_ been in these guys shoes (anyone that has been awakened at 3am with your system completely off line and bleeding money raise your hands).

The fact that it is a volunteer effort is pretty much irrelevant. One does not make worse decisions when one volunteers his/her time.

Rather than nitpick your points against my "full of fail" comment I will say this: The people involved had several choices to make in all of this, before and after the hack. Pretty much the key choices were mistaken: Not having a good backup in place. Not giving a second's thought to how to restore. "Taking the opportunity" to perform a major version change (to an unfinished version, no less) while the system was completely down. And on and on and on.

I really don't get why it matters if it is a volunteer effort or not. Volunteering does not mean "do low quality work", nor does it mean "not mission critical".

Had this all been handled differently, it would have been a "why we were doen for a couple hours yesterday" blog post instead of "why were barely working, and will be for the next few weeks".

</comment></comment></comment><comment><USER5> "TinyGrab was attacked and the attacker was able to gain access to one of their servers. Although the details are scarce, the attacker corrupted the codebase for TinyGrab 1. The TinyGrab team was forced to migrate their entire userbase to the newest version, a version which wasn't completely ready for yet."

I didn't find any mention of it in TFA, but do people just not do backups anymore? Or rolling, dated backups? My wife owns a small retail/web store, and I backup her Quickbooks, the database, and the source code nightly, and keep at least a few weeks of those backups on the drive where it's stored, 2 different backup drives, and and offsite place.

Is this overkill? Perhaps, but it would have saved us from _that_.

<comment><USER6> Apparently part of Web 2.0 is deploy and forget? How could no one have at least a snapshot of the code and database?

</comment></comment><comment><USER7> I must be missing something. How is it possible that they don't have umpteen copies of the sources checked out of whatever source control system they are using? Even if the central repository was destroyed, every developer should have a more or less recent version checked out somewhere.

<comment><USER8> Looks like a PHP site. I'm guessing they weren't using version control and were instead just editing the files over FTP.

<comment><USER9> so php == ignorance? are we really going to make that assumption? thats just foolish.

<comment><USER10> No, but PHP easily allows a "edit source on server" as a deployment model.

<comment><USER11> Seriously, You dont even need a security attack for losing the changes with this model. A nice little "harddisk" failure would do the trick for you. :)

</comment></comment></comment></comment></comment><comment><USER12> We have more backups than you can shake a stick at. The issues lays with the server being compromised and being forced to shut down. The old API and apps relied on a fixed IP address. It would have taken us months to get TinyGrab v1 back up to scratch, or a few weeks to perfect 2.0. No data was lost, what would you choose?

Chris Leydon TinyGrab Founder and Project Manager email@example.com

<comment><USER13> Now I'm even more confused. What was stopping you redeploying the server side app onto a new box and changing the hardcoded IP over to the new machine?

<comment><USER14> Exactly. As a lot of other comments have mentioned, using URLs would have been a better idea, but its irrelevant now. Assigning the same IP to a different machine would have been a perfectly acceptable (and most straightforward) solution. I fail to see why they didn't choose to do that.

We're all interested here in learning from tinygrab's mistakes, not criticize them after the fact. Why patronize us with that "would have taken _months_" quote instead of giving some technical details about what really the problem was?

</comment></comment></comment><comment><USER15> They did an extremely poor PR job. My account is no longer working. I would expect an email of apologies that explains the problem and buys them time. Instead, I got an account that mysteriously doesn't work anymore, and a password reset link that claims my account doesn't exist. I had to learn about what happened from a random HN post.

<comment><USER12> If you can shoot me an email, email@example.com, I'll deal with your account and help get you set back up again.

<comment><USER15> Thanks Chris. Just sent an email.

</comment></comment></comment><comment><USER16> "Like all premature babies, TinyGrab 2.0 just wasn't ready for mainstream usage"

What the fuck?

<comment><USER17> Yes, this seemed like a particularly offensive metaphor. I suppose it works at a logical level, but to compare a human life to a piece of software seems kind of extreme.

</comment></comment><comment><USER18> I used to use TinyGrab all the time, it was a pretty indispensable part of my workflow, which is why, after nearly a week of it being dead, I got fed up and wrote my own:

<http://dl.dropbox.com/u/651972/ScreenDuck-0.1a.zip>

It's obviously very rough right now, but it actually works. Later on I'll write a website for it and put it up on screenduck.com.

<comment><USER19> This is the first I've heard of TinyGrab, but for Mac users looking for something else Cloud seems to do the same thing (that is, it can automatically upload screenshots and put the URL in the clipboard for you). <http://getcloudapp.com/>

</comment></comment><comment><USER20> Why wouldn't they just put the old code base and fix the security hole? Why go to a new code base? Now you have two problems!

</comment><comment><USER21> This situation makes no sense at all based on the explanations here by chrisleydon.

You have backups of the code - can you explain why it isn't a pretty straightforward process to set up a new server? The fact that you have a fixed IP address has no importance as far as I can tell, and that's the only explanation offered.

> It would have taken us months to get TinyGrab v1 back up to scratch

Really?</comment>


Show HN: Using AI to Summarize Terms and Conditions - <AUTHOR> 88% of people never read the terms and conditions of websites or services they use. However, most people want to know what they are agreeing to in those terms. That is why we created Legal Leaf. We strongly believe that everyone should have easy access to those agreements, in language they can understand.
Legal Leaf works behind the scenes, in your browser, to read and summarize these terms using powerful AI. We're constantly working to improve the accuracy of these summaries. The results are displayed in the top right corner without affecting web speeds.
Legal Leaf is a beta product still going through development, but it's improving rapidly and we would love a group of willing beta testers.
http://leaf.legal <comment><USER2> One concern that comes to mind if my company uses this: A user reads the auto generated summary but not the actual ToS, then does a thing that violates the ToS. The summary didn't say the thing was against the rules, so the user consciously made their choice on that fact.

Not being a lawyer, this raises some questions. Some companies go the extra mile to make their ToS quite short and readable for their users, but that text is still reviewed by a lawyer (presumably). But if the summary is auto generated, that review isn't necessarily in place unless leaf.legal is just a summary tool subject to lawyer review before approval and publication to my website.

Also, how do we keep track of which version of the automated summary that is seen by which user? This seems like it could have legal ramifications. For example, the user who violates the ToS because something isn't in the summary. Tomorrow legal.leaf updates its algorithm and regenerates all the summaries for its clients and now the missing ToS article is in the summary.

I imagine there are some pretty solid answers on how to handle these situations. Would love to hear how you are approaching them.

<comment><AUTHOR> This is an awesome question, and one that was raised by the lawyer on our team. Since summarization is not a lossless process, there will be some information that the user doesn't see.

For now, we have a blanket disclaimer that our product is merely for summary and should not represent the will of the company whose terms you are reading.

However, you're absolutely right, we want to make sure that the companies are also well represented. We are building out an avenue for companies to "contest" the summary on their page to be more accurate, or write a personalized summary.

The question can be looked at for any one, what happens if they don't read the ToS at all, and then do something that violates those? We think Legal Leaf is a step in the right direction towards education, but there is still lots of work left to do.

</comment></comment><comment><USER3> I can see the next progression being something like:

You're about to upload a photo. The T&C of this website gives them irrevocable legal rights to use this photo in [social media settings, advertising campaigns]. Click No to stop the upload, Yes to continue, or Always to stop warning for this website.

<comment><AUTHOR> Oh that's awesome! I hadn't thought of that. This would really allow people to change behavior based on the information they get. That's great. Thank you!

</comment></comment><comment><USER4> This looks really interesting! Two points:

1) A quick side-by-side of a sample Terms/Conditions versus Leaf's summarized version would be helpful. It would help me understand the product more before I install it.

2) What ML/NLP tools did you use for this? It looks like Sumy for Python summarization, along with a specific list of clauses (will, agree, must, etc). When you get a chance, I'd be curious to know more about the technical process.

Also, I noticed that you are stemming words - you may also be interested in lemmatization, which is a slightly more complicated way of converting words into their base forms (like running -> run or ran -> run). Lemmatization also takes into account part of speech context. Given that legal documents are fairly grammatical (I'm assuming?), lemmatization should work well here. I've been fairly happy with Spacy's lemmatization results ([https://spacy.io/](https://spacy.io/))

<comment><AUTHOR> Great feedback! 1) That is an awesome idea, I hadn't thought of that. We'll put that together. 2) Right now its sumy/regex/bs4 for our tech. As you can see, it's nothing complex, but we're hoping to had some real ML to warrant our use of buzzwords. The hardest technical challenge was actually working within the Chrome Extension framework, the actual summarization (currently) is fairly straightforward. 3) Spacy lemmatization looks like exactly the next step! Thank you for that. link.

</comment></comment><comment><USER5> A small resource, which may help you - [http://thescipub.com/PDF/jcssp.2016.178.190.pdf](http://thescipub.com/PDF/jcssp.2016.178.190.pdf)

I am currently (and for some time actually) interested into the same problem. Summarization of text. It is a hard one to master. Not a lot of work has been done. I will be happy to be of any help.

(Bonus - a recently published paper about extractive summarization - [https://arxiv.org/abs/1708.04439](https://arxiv.org/abs/1708.04439))

<comment><AUTHOR> These look like great resources! Thank you!

</comment></comment><comment><USER6> I like the concept, but using both "ai" and "blockchain" on the front page of your website triggers me.

<comment><USER7> Maybe look into the maps.org phase III clinical trials for MDMA? Pineapple fund just gave them another $4MM in BTC ( a blockchain based cryptocurrency).

But to be fair, they were citing an award they were given. "Best use of AI/Blockchain"

</comment></comment><comment><USER8> I believe this is the relevant repo (tangentially linked in the footer): [https://github.com/andrewnc/terms-and- conditions](https://github.com/andrewnc/terms-and-conditions)

</comment><comment><USER9> When you say machine learning...do you mean NLP text summarization?

<comment><USER9> It's a cool project, I just wish its capabilities weren't being misrepresented like this. It's currently just sumy, tokenization, and summarization. Like got2surf said, you'll benefit greatly from lemmatization.

<comment><USER10> For people wondering what Sumy is:

Our students compared and benchmarked Sumy against a bunch of other popular summarization techniques, [https://rare-technologies.com/text-summarization- in-python-e...](https://rare-technologies.com/text-summarization-in-python- extractive-vs-abstractive-techniques-revisited/)

</comment></comment></comment><comment><USER11> Can it create a small faq based on the summary, e.g. q) What happens i upload a photo to this website? a) the website owns it and can use it anywhere q) what happens when i give them my e-mail? a) be prepared to recieve lots of promotional email from them and third party sites, etc..

Also if there was a sample on the home pageit would be great since I'm on a mobile and can't open Chrome store right now

<comment><AUTHOR> Currently we divide it up into 3 categories. 1\. What you agree 2\. What they agree 3\. Other terms

But you're right. There is good room for thought there.

We're working on an example to put on the homepage. It's a good suggestion.

</comment></comment><comment><USER12> Fun fact: Wordpress's permissively licensed terms of service (CC BY-SA 4.0; using it in my product, many thanks to the Automattic folks) has a treat. Just go to the page [1] and ctrl+f for "treat".

[1] [https://en.wordpress.com/tos/](https://en.wordpress.com/tos/)

</comment><comment><USER13> This is awesome! One thing: it would be really cool if clicking on one of the summary text boxes brought you to where the full details are approximately located on the page. That way if a certain clause or something is particularly relevant to you, you don't have to search the full thing for it.

</comment><comment><USER14> There's a claim that you use blockchain technology for your technology. How's it used?

<comment><AUTHOR> If you're referring to the hackathon award. They combined the award to say "best use of AI/Blockchain" we qualified as using AI, but are not using Blockchain

</comment></comment><comment><USER15> How about an example of the results it produces on your website? Might convince more people to give this time if you can show some output, given either a known T&Cs like Apple's or if that's a legal issue, use a T&C template

<comment><AUTHOR> Alright, there is a screen shot of some of our results on the site for now. Thanks again!

<comment><USER15> Nicely done

</comment></comment></comment><comment><USER16> Reading your summary wouldn't mean I've legally read the ToS tho. I like that its sort of when you log in with FB and they clearly summarize what access they'll get.

</comment><comment><USER17> Hey Andrew, cool product! I appreciate the work you all have put into it. I have a few things that crossed my mind:

If the TOS can be summarized into a shortened version that is understandable and readable, then was the original TOS too long and complicated to begin with?

I wonder if summarizing can really distill that which the TOS covers. I further wonder if someone reads a summarized TOS and then violates a part not covered in the summarized version, then who do they blame?

</comment><comment><USER18> Does it matter what is written in website TOS? Are there any cases where a court decided that some surprising term in such a thing was legally binding to the user of a site?

<comment><USER19> There are cases about scrapping and who owns the data, user or owner of website.

</comment></comment><comment><USER20> Reminds me of [https://tldrlegal.com](https://tldrlegal.com), but i guess this has an AI component

</comment><comment><USER21> If this ever becomes the norm, we might see some attempt to obfuscate Terms and Conditions which might be really interesting to see.

I'm also concerned by the fact this tool could miss some important pieces of information or subtleties. How can its reliability be improved ?

<comment><AUTHOR> This is a great question that we're working on. It obviously will never be as good as reading the whole thing, but you're right, how can it be improved?

</comment></comment><comment><USER22> I installed it and tried running it on your site, but it just showed the "summarizing" spinner forever.

<comment><USER22> Also tried it on [https://www.humblebundle.com/terms](https://www.humblebundle.com/terms) (happened to have a bundle page open) - the output wasn't great. Coincidentally the bundle I was looking at is a bunch of ML books.

<comment><AUTHOR> First, thank you for being willing to try it out! The results can be... underwhelming... at times. However, we're working hard to really nailing down the tech and so if you stick with it for the next few weeks, I think you'd be pleasantly surprised at how the summarizations improve over time.

Either way, thanks for the feedback!

</comment></comment></comment><comment><USER23> Please publish it as a Firefox addon!

</comment><comment><USER24> Only 80%? I have totally given up on reading them.

What I really hate is when I get T&C at a credit card terminal.

</comment><comment><USER25> I would guess 88% is nowhere near the actual number. People _never_ read those.

<comment><AUTHOR> You're probably right. That was the number we got from our initial user interest survey</comment></comment>


Europe's Wrongheaded Data Rules - <AUTHOR> https://www.bloomberg.com/view/articles/2018-05-08/europe-s-wrongheaded-data-rules <comment><USER2> If innovation destroys privacy, innovators are a one trick pony.</comment>


Secret Service Paid Hacker $75,000 a Year - <AUTHOR> http://www.wired.com/threatlevel/2010/03/gonzalez-salary

<comment><USER2> And, really, the only thing this yells out to me is that someone interested in computers can earn A LOT more being malicious (luck vs. work-wise) than creative on average. Not that it's particularly smart in the long run, but nevertheless there are countless others that get away with these crimes.

</comment><comment><USER3> And so that's what happens when you underpay your employees :)

</comment><comment><USER4> After taxes, that's about $32K. If hacker lives in California, that's $15.2K. Makes you wonder why more hackers don't run bot farms.

<comment><USER5> <http://www.ehow.com/topic_197_arithmetic-basics.html></comment></comment>


Show HN: How to solve the Rubiks Cube - <AUTHOR> http://slides.com/tobipch/how-to-solve-the-rubiks-cube-1#/

<comment><USER2> I personally found the slideshow having a rather inconvenient format. Good slides though. Very informative.

The content was good as well, great introduction. I am a ~20 second solver myself both with CFOP and Roux, ~30 secs with ZZ. I find Roux to be more fun as it allows for more creativity imo. I know full PLL (21 algs) and around half the OLLs.

Speedcubing is a great way to keep your brain active and your hands as well :) it's fun to toy around with.

This is Feliks Zemdegs, one of the fastest cubers in the world: [https://www.youtube.com/watch?v=bccRDlsSBMM](https://www.youtube.com/watch?v=bccRDlsSBMM)

</comment><comment><USER3> Not the best medium for teaching such kinds of skills. I showed it to my friend who is a beginner and he got frustrated after the first layer.</comment>


Palau, in Western Pacific, Is First Nation to Ban 'Reef-Toxic' Sunscreens - <AUTHOR> https://text.npr.org/s.php?sId=663308800 <comment><AUTHOR> Palau is also going up against the PRC:

[https://news.ycombinator.com/item?id=17563750](https://news.ycombinator.com/item?id=17563750)

Tiny nation, big courage.</comment>


Prep for Data Science Interviews - <AUTHOR> https://datascienceprep.com/ <comment><USER2> I know the guy who made the site - he said that there weren't many prep resources when he was doing interviews. Glad he made this to share with everyone else!

</comment><comment><USER3> Woah was not aware this kind of stuff was out there

</comment><comment><USER4> Super useful resource for data science prep!

</comment><comment><USER5> Hey does this also include ML topics?

</comment><comment><USER6> Hey this looks sweet thanks!</comment>


Online legal publishers squabble over the right to copyright the law - <AUTHOR> http://arstechnica.com/tech-policy/2016/02/online-legal-publishers-squabble-over-the-right-to-copyright-the-law/ <comment><USER2> This is about potentially violating one of the most fundimental norms of Western law, one that's literally 2,500 years old: [https://en.wikipedia.org/wiki/Twelve_Tables](https://en.wikipedia.org/wiki/Twelve_Tables)</comment>


Securing Your Domain Against Seizure: Where Is Safe to Register a Domain Name? - <AUTHOR> http://gun.io/blog/secure-your-domain-where-is-safe-to-register-a-domain-name/ <comment><USER2> UAE and Palestine? Seriously? UAE has a questionable track record insofar as journalistic freedom is concerned. It ranks #112, below Liberia and South Sudan, in RSF's Press Freedom Index. What if one of the Emirs is offended by what I post on the site? Palestine ranks #153, not to mention you'd have to take Israel into consideration when you do anything Palestine-related.

Gandi.net is an excellent registrar, but I'm not sure about them anymore since they now operate in the UK and US as well. They even have a US-incorporated subsidiary.

<comment><USER3> Agree. And all of this is ridiculous anyway. A non-issue for the vast majority of startups who want to do something in the US. Think you're going to get funding and grow your company with a foreign TLD doing something that the US government might disapprove of?

Not to mention the fact that the entire OP is based on the way things are TODAY and that assumes it's even accurate. Which of course it's not (just taking your comment as one of many which makes an important point about UAE.)

Most importantly things in the political world can change overnight.

.ch is Switzerland which is great everybody thinks. Guess what? Check out the way the Swiss caved into US demands on revealing those keeping money in swiss bank accounts. Those accounts were secret for a very long time. Then that changed.

[http://www.time.com/time/business/article/0,8599,1917648,00....](http://www.time.com/time/business/article/0,8599,1917648,00.html)

<comment><USER4> > Think you're going to get funding and grow your company with a foreign TLD > doing something that the US government might disapprove of?

The web's biggest sites right now (e.g. YouTube and Facebook) are doing things the U.S. government doesn't approve of. They haven't been shut down ... yet ... but Megaupload has, and what's the functional difference between what Megaupload does and what YouTube does?

My point is just that the way the U.S. gov't is going, no decent web application is safe from being taken down. Anything with user-generated content is basically wide open for seizure.

<comment><USER5> > but Megaupload has, and what's the functional difference between what > Megaupload does and what YouTube does?

The difference, at an organisational level, is that MegaUpload is run by a very small team and is "foreign". Google/YouTube, on the other hand, is an American company employing a number of Americans.

The majority of voters probably care little about MegaUpload (even if they should care). But you can be sure they'd care if YouTube was shut down/the domain seized.

<comment><USER3> What you said reminded me of an old saying. It goes something like this.

"If you owe the bank $10,000 and can't pay you have a problem. If you owe the bank $100,000,000 and can't pay the bank has a problem".

Size matters.

</comment></comment></comment></comment></comment><comment><USER6> I take issue with the author's criticism of .is. They've recently told most of the world to go fuck themselves, and one of their members of parliament is a Wikileaks spokesperson. I'm thinking they're pretty pro-freedom.

<comment><USER7> As an Irish citizen I must admit I'm a little envious of how Iceland has faced down the rest of the world, even if I don't agree 100% with what they did. I think the authors criticism is primarily an economic one. Like Ireland, Iceland is economically weak and can't afford to annoy major trade partners. Would the government concede certain things if subtly threatened with sanctions, even unofficial ones, over IP etc? Maybe, maybe not. Ireland certainly would fold immediately.

<comment><USER8> They didnt fold when the EU tried to get them to increase tax rates on companies like Google and Intel though did they.

<comment><USER9> Yet.

</comment></comment></comment></comment><comment><USER10> I think the article forgot its own criteria half way through...

> Countries with military mutual defense agreements (NATO, etc).

And then he continues to name both Sweden and Norway...Norway is a NATO-member (though not part of the EU, just the EEA), and while Sweden is not a NATO- member, it is an EU member state, which means it is involved in EU-defence just as well...(and even though Iceland's economy has recovered well, they are _also_ a NATO-member) Norway is definitely not militarily neutral, since they have troops in Afghanistan.

He also doesn't give a definition for what a "small"-sized or a "medium"-sized country is...

[edited for clarity/spelling]

<comment><USER11> Yes, I would not have thought countries gets much smaller than Iceland! :)

Small countries are a poor choice for many reasons, not least because too much can change too quickly and it does not require much capital (monetary or political) to capture such a state. Though, obviously, they can be useful for redundancy.

That said, it could be the author meant the list more as optimization criteria rather than a firm checklist. In which case, both the strongly-independently wealthy Norway and the politically liberal and neutral Sweden, are not bad choices.

<comment><USER10> Oh, I agree, it's not so much that either country is a bad choice per se. And pointing out that a country subject to various bilateral treaties might provide problems down the road is also fair.

Just thought i'd point it out for those that might not know about their degree of international collaboration.

However, especially Sweden is ambiguous at best in my opinion, given their recently enacted strong wiretapping laws. They might not be a problem yet, but they provide the basis for future trouble.

<comment><USER12> I disagree with the .sg suggestion too. Singapore is an ACTA signatory and the government is in discussions with the MPAA for tougher IP legislation ([http://www.channelnewsasia.com/stories/singaporelocalnews/vi...](http://www.channelnewsasia.com/stories/singaporelocalnews/view/1176385/1/.html)).

Not to mention it's a "small" country (you can't get much smaller than an island)

<comment><USER13> Agreed, the author is clearly unfamiliar with Singapore - it's a highly authoritarian country.

</comment></comment></comment></comment></comment><comment><USER14> How about .eu? An obvious choice for any European company planning to expand beyond national borders.

EURid European Registry for Internet Domains) is a non-profit organisation established by the European Commission is a consortium of three European ccTLD operators: DNS Belgium (.be), IIT-CNR (.it) and NIC-SE (.se).

Am I missing something?

<comment><USER15> Lots of online poker sites have been switching to .eu

</comment></comment><comment><USER16> I think a distributed .alt where people can have a "backup" of their domain would be nice. gun.io with gun.io.alt running concurrently on the distributed system. It would be a nice reference to the alt.* Usenet split in response to attempts to control it. The underlying technology and how to arrange it is another question though. Edit: Mcantelon's reference elsewhere in the thread to namecoin looks like a good start <http://dot-bit.org/Main_Page>

<comment><USER17> Repeat after me: NOBODY WILL EVER USE AN ALTERNATE ROOT. EVER.

It took over a decade to get everyone on the same page re: IPv6, and everybody WANTS that. Be realistic. It ain't gonna happen, ever.

</comment></comment><comment><USER18> Speaking of gandi, a while ago, I ran into some problems logging in to their site, and I—finally—got this response from them by e-mail:

        Hello again pessimism,

        Our password field supports only passwords up to 16
        characters at this time. All longer passwords
        are truncated.

        If you have any further questions, please let me know.

        Sincerely,

        [redacted]
        Tier 1 Tech Support
        Gandi US

I checked in with @theharmonyguy who says this is a pretty bad thing, and I originally intended to do an Ask/Tell HN post about it, but life got in the way.

What are your thoughts on this and its implications for using gandi?

<comment><USER19> Speaking of their support, I can see why some people were avoiding Gandi because of it. I'm trying to transfer a domain (from SWITCH, no less) and am having issues. I emailed them a week and a half ago and heard back the next day saying they were looking into it. Still nothing, so I sent another support email two days ago and haven't heard anything.

They have the most TLD offerings of any registrar I've seen (sans Go Daddy) so I'd hate to move away from them because of support issues, but I'm starting to understand the complaints I've read.

<comment><USER18> Their customer is _abysmal_. They never respond on Twitter—fair enough, other registrars do, though—and it took four days to get a response to why I couldn't log in. I even had to go through weird escalations to higher "tiers" of support.

If someone knows a good non-American registrar with a wide selection of domains who also has two-factor authentication like Name.com, please let me know. Until then, I'll probably just postpone the domain purchases.

</comment></comment></comment><comment><USER11> Interesting article.

Shame he did not cover or mention directly the highly popular .EU domain which has no particularly strong requirements.

While individual EU countries may fall under the NATO/ECHELON agreements under varying degrees of importance (Germany for example it is likely highly irrelevant), internet infrastructure tend to be well-protected at the EU level.

</comment><comment><USER20> If you look at this as an uptime issue, it has the same answer as any other uptime issue. Redundancy.

A single server isn't good for uptime because when it dies you're screwed. At the next level, a single data-center only gives you so much uptime because if that data center goes down you're screwed.

Same thing here. Any single TLD isn't safe for any number of technical and political reasons. If you want to be safe, register multiple tlds with multiple entities so you have redundancy.

<comment><USER21> Right, but your domain is your 'store front.' Depending on your customer-base, you could lose out when it comes time to switch domains from example.com to example.ca or example.co.au...

</comment></comment><comment><USER22> Non-centralized approaches like Namecoin will be more likely offer DNS security than the establish approached.

</comment><comment><USER23> UAE, Singapore and Mauritius are all small countries. Singapore and UAE have a cozy relationship with US and the media is heavily regulated and controlled by the government in both countries. UAE even blocks Skype.

I dont think the top level domains of these countries are secure at all.

</comment><comment><USER24> I have a curiosity. Would it be better to register a domain as a person or as an organization? Are there any major differences in liabilities associated with each entity? (And I'm thinking .ch and the like domains. I don't think for .com would make any difference.)

</comment><comment><USER25> If you want a bulletproof registrar that doesn't bow under pressure and with competitive pricing go for <http://internet.bs/> (yes they have their offices in the bahamas). Also free whois protection is included AFAIK

<comment><USER8> Unfortunately .bs reads as .bullshit to me.

<comment><USER26> This could be a plus, you can register reallno.bs :-) All jokes aside, according to their site, .bs is not on the list of the available TLD you can register with them

</comment></comment></comment><comment><USER27> Internet.bs is a good choice if you want a safe domain name registrar. They are based in the Bahamas and the staff is composed by people from Europe and South America.

Getting a "secure" swiss domain name with a registrar in the USA isn't probably the best idea ;)

</comment><comment><USER28> Or simply register your own tld if you've got hundreds of thousands of $ lying around :)

<comment><USER29> What about .hax? :P

<comment><USER30> .pirate?

</comment></comment></comment><comment><USER31> Can anyone explain why these domains are usually so much more expensive that .com domains? I just looked at .se and most of those run almost $40/year. It seems like demand would have .com domains priced higher than these cc-TLDs.

<comment><USER32> Then you have looked at the wrong registrars. Loopia[1], Binero[2] and Crystone[3] all sell .se domains for around $15. (I'm not affiliated with any of these companies),

[1]<https://www.loopia.com/domainnames/#prices> [2]<http://www.binero.se/doman> [3]<http://www.crystone.com/domainname.aspx>

<comment><USER31> Ok, thank you!

</comment></comment></comment><comment><USER33> How about... we start a kickstarter. Target 200k of which 185k is used for the application for a gTLD and the remaining 15k is for setting up an INC or LLP such that all those who have contributed can register as many domains as they want for "cost" (whatever that works out to be).

Obviously the exact gTLD we chose is subject to a bit of democracy, voting etc etc but I'm sure with a bit of an open forum then they'll be an interesting debate.

</comment><comment><USER34> I've got a .co on namecheap now. No controversial plans but curious as to how safe it is.

<comment><USER35> Even i have got 5 domains with namecheap. As far as i know, there have been no negative incidents with namecheap yet.

<comment><USER36> namecheap primarily operates as a reseller for enom. You'd be subject to 3 layers of policy (registry, registrar, reseller) + ICANN regulation + the laws in the various jurisdictions. Find something cleaner if you are worried about your domains. Complexity can lead to all sorts of finger pointing when something goes wrong. And if that doesn't phase you, be sure you are comfortable with the enom TOS as you'd likely be subject to that as well. (and yes, I"m aware that NC has an accreditation, that said, most of their registrations are held under and managed through enom's accreditation.)

</comment></comment></comment><comment><USER37> This is a great resource. But where should we locate our actual application: where should we host to avoid seizure?

</comment><comment><USER38> I would go with anything .ch

<comment><USER39> Worth pointing out that SWITCH doesn't permit whois "proxy/anonymizer" services. Your real name and address is going to show up there (unless you register under a company name).

</comment></comment><comment><USER40> nowhere is safe...if you become a problem they'll eventually come for you

</comment><comment><USER41> What about .co.za?

</comment><comment><USER26> What about .to ?

</comment><comment><USER42> A lot of this comes down to how badly the Feds want you. Another domain might buy you a thin buffer of protection, but if you're doing anything that really irks the US Government they'll go to great lengths to get you. They got the Swiss to burn a lot of their treasured banking privacy customs just to flush out off shore accounts. If you can get the Swiss to do that, you can get most any country to seize a local domain with a fraction of the pressure.

<comment><USER43> If you have particularly anti-US content, I would think .ru or .ch is a good bet.

</comment></comment><comment><USER36> This is getting a bit silly. Unless you are running a gambling, torrent or porn site, just get a .com and worry about more important things in your life. Asset seizure is something that drug dealers, not startups, should be worrying about.

<comment><USER11> So, Jotform (to name just a recent one) was running a "gambling, torrent or porn site"? Right...

The only thing _silly_ here is not taking into account all business risks. US- owned TLDs are very much now a risk.

<comment><USER36> Jotform was a victim of lax registrar policy and wasn't a seizure by the USG or any of its agencies in any sense.

Using the Internet is a risk. So is crossing the street.

Your single biggest risk in registering a domain name relates to the business practices of the registrar you choose. This has nothing to do with the "nationality" of a TLD.

You also face risks associated with the policy of the TLD you register in, the laws of the local government and the jurisdictions of the registrar, registry and DNS provider you register with.

You also face a myriad of risks associated with the UDRP and various intellectual property law.

You can either worry yourself silly with the boundary cases and outside risks that I see most talked about in recent HN articles _or_ you can cover 99% of your issues by finding yourself a good registrar (one with fair and reasonable policies and practices) operating under a good government (one with fair and reasonable laws and law enforcement practices) and register in a reliable TLD. And then spend the other 23.5 hours in your busy day worrying about running your startup or doing something else useful with your time.</comment></comment></comment>


Show HN: We're building a virtual meetup platform - <AUTHOR> https://app.venu.tv <comment><USER2> a "Virtual meetup platform" confused me. I signed up thinking this was a platform where my coworkers could meet up to discuss things, an alternative to meet or zoom.

But this is actually a premium access streaming platform. You sell tickets for events or seminars or whatever. take a cut of the tickets and host the event. Good for things like training seminars or whatever.

I think that kind of makes the introduction page a bit of a fail, It seems every person who makes the introduction page for their product always suffers HARD from the curse of knowledge. You MUST spend a huge amount effort clearly explaining what your product is and is not. There is simply no latitude for flowery bullshit language like "Explore a world of limitless experiences. Use our platform to discover what drives you. Bring your passions; we'll bring the community." Users don't have the patience to read this, and you don't have the time to be speaking it.

That said. Maybe this is something that only matters for posts like this one. Where the people coming to your site are likely in your target audience. Maybe the bulk of your customers will be coming from referrals which will never even see the introduction page. Maybe it's not worth worrying about?

Well. Best of luck anyway.

<comment><USER3> > But this is actually a premium access streaming platform. You sell tickets > for events or seminars or whatever. take a cut of the tickets and host the > event. Good for things like training seminars or whatever.

This is not an easy problem. It's always intriguing to me how hard it is to write a clear description of your own product that explains WTF it really is.

Yet someone external (as above) can often cut to the chase with a pithy and useful description.

I genuinely don't know what the reason is. In this example, I guess "premium access streaming platform" are not words the marketing team would like (maybe it sounds a bit porn-like ?).

Yet it is certainly way better than "virtual meetup platform", because it clearly conveys who pays what and for whom.

And this is as clear as a bell "You sell tickets for events or seminars or whatever. take a cut of the tickets and host the event. Good for things like training seminars or whatever.".

But again, that's kind of language that the marketing guys/gals might eschew as overly informal/familiar - even though it encapsulates beautifully why I might want to investigate this product.

<comment><USER4> Its definitely not solely a marketing speak problem. There are only two of us at my startup and we've had at least 10 revisions just to get the above the fold text in place. The below the fold we are still working on and will have a new revision soon.

Yet even now if you told me what we do is not clear I would not be very surprised. I mean sure it seems clear to me but how could it not since I already use the product myself?

</comment></comment></comment><comment><AUTHOR> We're building a virtual meetup platform in hopes of bridging the gap between in-person and virtual experiences.

We're running open beta now, so any opinions / feedback is welcomed :)

[https://app.venu.tv](https://app.venu.tv)

<comment><USER5> I looked at it for a few minutes and it seems like it is mostly focused on there being a single presenter at a time, and then an audience for them.

In order to better replicate the benefits from meetups and conferences in real life, I think being able to allow users to more organically interact with each other sounds like a nice feature to work on.

Is there anything like this, or anything planned like this?

<comment><USER6> Hey, I'm part of the team at Venu! Initially we only supported the single streamer. Recently, however, we introduced support to have multiple people share their screen and present at one time (as long as they're invited as organizers for the meetup). We're in the process of updating the verbiage on the site to better reflect some of the updates we've made in the past few months!

Eventually we have plans to introduce breakout sessions or another way for viewers to be able to communicate more privately.

<comment><USER5> That sounds pretty cool. It definitely seems like a lot of work was already put into it, but would look forward to that too. Nice work!

</comment></comment></comment></comment><comment><USER7> Congrats! Looks like a pretty crowded space already (can be a good sign - problem is not solved yet). Curious how do you differentiate yourself from other players in this space - tulula, Airmeet, run the world?

We've been trying different tools recently for our needs (we are building opens-source tools for ML - DVC.org, CML.dev and naturally need a solution for online meetups). I liked tulula and I liked a regular Zoom for smaller events where anyone can stream a video, talk if needed, etc.

In your mind what would be a killer feature to compete with Zoom long term?

</comment><comment><USER8> Reminds me of [https://hopin.to/](https://hopin.to/) ! I'm a huge fan of what they've been able to build. Their user experience is bar none for this kind of stuff!

</comment><comment><USER9> > Venu isn't just another live online events platform. We felt like existing > platforms missed an important aspect of events: discoverability

I'm a bit concern about this statement. It sounds like a standard marketplace model, with people's attention on one side and events on the other. As a user what will motivates me to explore events on your platforms but not on meetup.com or even instagram or facebook?

</comment><comment><USER10> What are you using for streaming technology?

Can you allow multiple simultaneous presenters from different locations?

What are your price points?

What are your attendee limits?

What sort of presentation content do you support?

Why are you calling these meetups instead of online events?

<comment><USER6> Hey, Dillon at Venu here!

I'll try to answer in order:

\- WebRTC for video/voice and Websockets for chat (built on Phoenix LiveView)

\- Yes, people can setup sessions to allow for up to 17 simultaneous presenters from all over

\- Still haven't settled on price points. We are going to be using the beta to help decide. For now we're footing the bills ourselves so all tiers are currently free.

\- 17 simultaneous presenters, no hard limits on number of attendees it is up for the organizer to decide how many tickets they want available!

\- Organizers who are streaming are able to share their screens / application windows / webcam.

\- We go back and forth, open to feedback. We use online meetups/experiences/events internally. Since we're all developers our content probably isn't the best at the moment!

<comment><USER10> I'm interested in giving this a test. I'll drop you an email and coordinate.

</comment></comment></comment><comment><USER11> This is awesome. While I agree with @oehpr on some of the details, I love the idea of marketing it specifically for the purpose of running events. Using Zoom for that seems klugey.

</comment><comment><USER12> Is the name inspired by the imperative Esperanto verb by any chance? Se jes, saluton, bona elekto :)

<comment><USER13> I think it is simply "venue".</comment></comment>


A Computer Wanted - <AUTHOR> http://query.nytimes.com/mem/archive-free/pdf?_r=1&res=9F07E0D81438E233A25751C0A9639C94639ED7CF

<comment><USER2> My grandmother's occupation was computer.

She calculated rocket trajectories for for the Woomera rocket range in South Australia.

</comment><comment><USER3> I understand that was common terminology back then. Usually doing rote plug-n- chug calculations.</comment>


Fast money: the battle against the high frequency traders (2014) - <AUTHOR> https://www.theguardian.com/business/2014/jun/07/inside-murky-world-high-frequency-trading <comment><USER2> The boring truth is that average Joes, who interact with the markets only via their retirement index funds, are better off with HFTs. Not necessarily a _lot_ better off, but that's because HFTs really don't affect them much at all.

Certainly some Wall Street firms have been displaced by HFTs. But really, who cares?

<comment><USER3> The average Joe who interacts with the market by picking stocks or day trading (which he shouldn't do) is _substantially_ better off with HFT (though he still shouldn't do it).

<comment><USER4> Why substantially better off?

<comment><USER5> Because hft means the bid ask spread on most transactions has shrunk to trvial/nonexistent (I am a professional investor but not hft...I'm very lft).

<comment><USER4> Doesn't that just mean that all the really attractive offers have been snatched up by the high-frequency traders?

Wouldn't those lucrative, high-spread opportunities otherwise be available to a regular day trader?

<comment><USER6> No... because regular day traders aren't market makers, they are market takers. HFTs are bad for other market makers, because they are basically competition. HFTs are good for market takers, because you get a good price.

</comment></comment></comment></comment></comment></comment><comment><USER7> Disclosure: I know almost literally nothing about trading stocks. (The following will likely prove it.)

Seems to me that automation should be a massive benefit to everyone in stock trading, except for the folks whose jobs are directly displaced by it.

The relatively small number of people in this profession command massive salaries, largely because of their position as a bottleneck for financial dealings. They are gate keepers, highly educated gate keepers, and their relative scarcity means that the management of money is really, really expensive.

If algorithms can do the job, well, it's much easier to duplicate an algorithm. Shouldn't automation increase competition, the expertise and leverage of a relatively small and powerful employment sector duplicated and spread out, to the point that the cost of trading stocks becomes essentially zero?

So while my 401k may be run by a human hedge fund manager who's competing against automation, and is likely to lose this "battle against the high frequency traders," shouldn't I hope that my hedge fund manager is replaced by automation, rather than finds a way to beat it (or make it illegal)?

<comment><USER8> The point isn't that an algorithm is doing it. It's that algorithms are actively poisoning the system with orders that couldn't possibly trade. By stuffing the pipe with these orders, timely information to other traders is delayed; the article states that the delay can be on the order of 30 seconds.

If I'm spending a half billion to colocate in an exchange's data center because it'll trim a few microseconds off my data transit time, I'd be pretty pissed if I was suddenly delayed by 30 seconds.

<comment><USER2> Indeed you would. Which is why this sort of illegal behavior rarely happens. (Keep in mind that none of this is anonymous or forgotten--the exchanges and SEC know exactly who did what when.)

</comment></comment></comment><comment><USER9> Article is from 2014. Probably should be noted in the title.</comment>


Protocol Oriented Programming (in Swift) – WWDC - <AUTHOR> https://developer.apple.com/videos/wwdc/2015/?id=408

<comment><AUTHOR> You don't have to focus on the in Swift part with what the new protocol extensions. The first section is a good general discussion of the downsides of Object Oriented Programming (Class oriented really) and a simple illustration of an alternative approach. Watch the end too where it covers when OOP is appropriate.

The new Swift Protocol extensions are cool but aren't really the right place to start looking at Swift.

<comment><USER2> I was in the room and this was my favorite session so far. I encourage people to watch it even if you don't strictly care about Swift, the concept exposed is interesting and useful, and the syntax introduced shouldn't be a problem to understand.

</comment></comment><comment><USER3> Am I only one afraid that magic of protocol extensions can end up with really hard to figure out behavior between types? As much as these concepts seems powerful to me, they also look like soon-to-be hell on earth for bigger teams working on same project.</comment>


Don't use Java in a nuclear facility (see Section 3)  - <AUTHOR> http://www.java.com/en/download/license.jsp

<comment><USER2> IIRC, the Java license used to forbid use in life critical systems, including explicitly listing nuclear reactors, life support systems and avionics.

I still wouldn't trust any of those things to a virtual machine, or to Java.

</comment><comment><USER3> Well fuck, I've been doing it wrong all these years. Alright guys, shut down the reactor, we're re-building it using Ruby.</comment>


TikTok says it will stop accessing clipboard content on iOS devices - <AUTHOR> https://www.theverge.com/2020/6/26/21304228/tiktok-security-ios-clipboard-access-ios14-beta-feature <comment><AUTHOR> It said the feature was to block spam,

> A TikTok spokesperson said in a statement emailed to The Verge on Friday > that it had submitted an update to the App Store to remove the feature, > which it described as an "anti-spam" measure. The feature was never > introduced to Android devices, according to the company.</comment>