Ask YC: Best website to form a Delaware C-Corp Online? - <AUTHOR> My cofounder and I are looking to setup our DE C-Corp online and are wondering if anyone here has had experience with any of the websites that do it.
Here are some that we've looked at: www.thedelawarecompany.com www.incfile.com www.incorporate.com www.companiesinc.com etc...
Any recommendations?  Anything to make sure is included? <comment><USER2> That's funny, I just did this on Friday! I used Harvard Business Services, URL delawareinc.com, which is not on your list. After reading about a dozen of these sites, they seemed really credible and I liked their tone and demeanor. Bonus: their registered agent pricing is the lowest I'd seen at $50/yr.

<comment><USER2> It's now Wednesday, and they just emailed me PDFs showing that my company has been formed and everything has been filed with the state of Delaware and the IRS. I'll get hardcopies of everything by next week. You can pay more to have the stuff mailed faster, but this is pretty good as far as I'm concerned. I started the process on their website on Friday night. On Tuesday they emailed me an IRS form to print, sign, and fax back, which I took care of right away. Today I already have a Delaware LLC with an EIN. Not bad at all for $400 total.

</comment></comment><comment><USER3> incorporate.com, a bit expensive but reputable company

<comment><USER3> and yeah, don't pay them for EIN. you can do that for free.

<comment><USER2> I paid for EIN because I'd rather have my teeth pulled than sit on hold with the IRS. It was only $100 extra.

<comment><USER2> Looking at my receipt, it was $65 extra, not $100.

<comment><USER3> I don't understand why one can be so scary of filling a questionary for 15 mins and ready to pay, hm, premium for an easy thing?

<comment><USER2> I don't understand why one can be so scared of cutting his own hair with garden shears for free in 15 minutes.

Hey, if you don't want to pay, do it yourself. I prefer to pay someone else to do it for me.

<comment><USER3> /me shrugs. Online application is just an equivalent of form that you might probably filled with your incorporator; and in case of an online application you get your EIN right away.

Though if you have extra money without an idea how to spend it, then yes, sure — there is a reason to pay for thing that is basically free :)

<comment><USER4> <https://sa1.www4.irs.gov/modiein/individual/index.jsp> is the online free EIN form, by the way

<comment><USER3> that is what I was talking about, basically</comment></comment></comment></comment></comment></comment></comment></comment></comment>


It makes nothing but sense - Mobile Payment - github-cat http://www.pixelstech.us/article/1518410696-It-makes-nothing-but-sense-Mobile-Payment <comment><AUTHOR> I remember you can even use QR code to pay when shopping online. It is a great one since I never need to type my credit card information again and again...</comment>


Anyfi.net turns any Wi-Fi network into a small cell - <AUTHOR> http://gigaom.com/broadband/swedens-anyfi-turns-any-wi-fi-network-into-a-small-cell/

<comment><AUTHOR> Disclosure: I'm co-founder and CEO of Anyfi Networks, so I'm touting my own horn here. ;)

The article doesn't go into enough technical details for the HN crowd but extensive documentation and even firmware images are available at <http://anyfi.net>. If you know something about Wi-Fi and like system architecture you should check out <http://anyfi.net/documentation#architecture>. It's quite nice if I may say so myself. :)

<comment><USER2> Hey Björn, you're definitely one of the most interesting companies in the Malmö/Lund area right now! Very excited to see this take off. Two thumbs up =o)</comment></comment>


How to use metrics in a startup - <AUTHOR> http://swombat.com/2011/2/10/how-to-use-metrics-in-a-startup

<comment><USER3> >So, when you put in a new feature, don't measure "how many people used the new feature", measure "whether people who had access to the new feature were more likely to pay"

I like that part. Jim Collins ("Good to Great") recommended to have one metric that "drives your economic engine". For a startup, you may not know what your economic engine is yet (still be pivoting an all that) but at least be measuring for a metric that relates to your economic, not popular, appeal.

<comment><USER4> In most early web startups, the biggest challenge (and the most common reason for death) is acquiring and retaining customers. User metrics are completely valid as your primary metrics early on.

<comment><USER5> I think you're getting at a very interesting conflict here that the author of the article attempted to explain. While user metrics can gauge the success of a web startup, that's often all they can do. Those metrics will (potentially) tell the company if they're improving or declining, and if they should be taking action.

However, it will not tell the company what actions to take. They're nowhere near as useful as a targeted, action specific metric in determining what to do. If my website's # of visitors drops 50% over a week, there might be something wrong, but I don't know what action to take without more information. Figuring out what engages users on the site and what keeps them coming back and measuring those things would be way more useful than simply knowing how many users are visiting.

<comment><USER4> If you track traffic sources with high granularity and get lots of traffic from ads or viral channels, you can get actionable data from traffic metrics.

Overall I agree - actionable metrics are the most important. I just take issue with the idea that only revenue related metrics are important.

</comment></comment></comment></comment><comment><USER6> I was expecting an article on how to measure performance in a startup - <USER2> interesting topic in itself given the fluid nature of the environment which makes it difficult to measure many important aspects - but the article seems to conflate web stats and metrics and does not offer much that is interesting or actionable.

Interestingly, the word metric is used 55 times in the article.

<comment><USER7> Perhaps you missed the point. Using metrics is important to decide what actions to take, or, more accurately, measuring whether a taken action lead to an important outcome.

It's no good just measuring visits or even conversions. What is important is measuring whether action a increased visits/conversions better than action b. The fluid nature of a startup means that most people probably don't know - there's no corporate history to lean on - and thus making careful use of metrics even more important.

</comment></comment><comment><USER8> No discussion about metrics can be complete without mentioning the GQM approach. <http://en.wikipedia.org/wiki/GQM>

<comment><USER9> That's a great point. My thinking about metrics got noticeably clearer after I discovered GQM.

</comment></comment><comment><USER10> > When not to use metrics... If your traffic is too low for metrics to be > meaningful, then measuring metrics is largely a waste of time, and making > decisions based on statistical noise is potentially harmful.

This is very very true. However, this should not deter you from making sure you have all the data tracking in place very very very early on. It's a HUGE pain to add metrics tracking later when you're growing like crazy.</comment>


New Patent Pool Wants 0.5% of Content Owner/Distributor's Gross Revenue for HEVC - <AUTHOR> http://blog.streamingmedia.com/2015/07/new-patent-pool-wants-share-of-revenue-from-content-owners.html <comment> A-F1V3 Daala can't get here fast enough.

<comment><AUTHOR> But seriously, if this actually comes to pass, HEVC is dead in the water. No matter how terrific the gains may be, usage terms this egregious will drive a _lot_ of adoption for Daala or VP9's successor.</comment></comment>


Most Printers Secretly Add Their Serial # to Everything They Print - <AUTHOR> http://www.eff.org/wp/investigating-machine-identification-code-technology-color-laser-printers <comment><USER2> Note: As of October 13th, 2005, some information in this paper may be out of date. Please visit <http://eff.org/issues/printers> for the most up-to-date information on this project

(in other words, be more careful with your titles relating to papers that are REALLY out of date)

</comment><comment><USER3> This only applies to color laser printers and color copiers. Your inkjet printer is just fine.

The wikipedia article on laser printers links to a nice sample on a 1cm ruler... [http://en.wikipedia.org/wiki/File:Printer_Stenography_Illust...](http://en.wikipedia.org/wiki/File:Printer_Stenography_Illustration.png)

The part of this that I find most interesting is that these have been known since the 90s and in 2005 there was a flurry of interest as some of the schemes were decoded, but I have never seen an authoritative reason why they are there. Does some entity in the US government require them? By what legal mechanism? Are the printer manufacturers trying to avoid liability for manufacturing counterfeiting equipment?

</comment><comment><USER4> Most qulity copiers won't xero you a banknote bill: <http://en.wikipedia.org/wiki/EURion_constellation>

</comment><comment><USER5> Sensationalistic and bad title for this submission. It's not 'most printers', it's color laser printers. And that's not even going into it being a 4 year old article.

</comment><comment><USER6> Even if the Secret Service can find the manufacturer and serial number info in a document, how can they match this information with the end user if he/she does not turn in a warranty card?

I can think of a couple of scenarios:

1) During the driver installation process, the serial number and the user info stored on the system is (edit: could be) sent to the manufacturer. This might be defeated by using an open OS and drivers. The user could also use the printer with a system that is never connected to the Net.

2) The Secret Service would be able to track the printer down to the store where it was purchased. The retailer would be able to supply credit/debit receipts, but what if the buyer pays for the printer with cash? The Secret Service would have to rely on the store's video surveillance system (who knows how long they keep these records?) or on eyewitness descriptions from the store clerks and cashiers (which may not be too reliable).

<comment><USER7> Even without the ability to trace to an exact purchaser, to be able to correlate multiple documents to the same person, or use the printer as corroborating evidence after finding a suspect by other means, would be very valuable to law enforcement.

And unless the printer is _only_ used for disfavored purposes, its other output is in circulation. Who's to say there's not a ad hoc registry maintained by paper samples culled from filed forms or even trash dumps and recycling bins. ("That serial number was never registered but it was sold from a retail store in Cleveland in 2002 and its printouts were seen in recycling flows in Maryland in 2006.")

<comment><USER8> Uh, I think you're giving the government's tracking and cataloging abilities _way_ too much credit. They have trouble keeping track of a list of terrorists.

It think it's for confirming that a particular printer made a particular note (and determining how many different printers are involved in counterfeiting). Nothing more.

</comment></comment></comment><comment><AUTHOR> With regards to the constructive criticism about the date of the article, thank you and I will keep that in mind next time.

I submitted this article because I genuinely thought it was interesting and wanted to share it with like minded tech savvy people. (My real life friends wouldn't really care about this :-p)

I chose to submit this page rather than the newer version ( <http://eff.org/issues/printers> ) because I found the image of the dots on this webpage very interesting. I figured if people were interested they could click the "For up-to-date" information link. I will save everyone a click next time.

</comment><comment><USER9> Do these "watermarks" survive a photocopying?

If not: print out one copy and photocopy from it as many as you need before destroying the original.

</comment><comment><USER10> Wait, you mean that my yellow ink consumption is artificially high because of some serial numbering scheme secretly put on my printer?

Class action lawsuit anyone?

</comment><comment><USER11> this should not be news

</comment><comment><USER12> Interesting article. I'm glad that the EFF tries to reasonably present its arguments and provides not only supporting evidence, but also does some work towards decrypting the information added to laser printouts.

Unlike, um, _some people_.</comment>


Ask HN: Would you pay for instant devops help? - <AUTHOR> Would you pay for instant devops help?
I'm good at developing apps and writing code. But when it comes to deployment and devops, I find myself wading through documentation, lost in sheer volume, infuriated by UIs. I understand the concepts, but actually configuring and running servers, containers, cloud compute, aws, docker, kubernetes, etc: it's often just a big tedious pain. I can do it, but it isn't pleasant.
And whenever I do it, I always think: if I could just 'talk to a guy', who already knows it, for an hour or two, it would save multiples of those hours for me.
If there were a service in which I could, in a short time, talk to a human expert in these things for an hour or two, without signing any sort of services agreement or going through much of a signup process, I think that'd be useful.
Agree? Disagree? I know there are similar marketplaces, but many seem to be oriented to projects, bids, longer-term things. Anybody use something similar? Did it help? <comment><USER2> Yes it would be helpful to bounce ideas off an DevOps expert. I sometimes use AWS support for this and I have received some helpful advice from them but it would be nice when my questions don't necessarily revolve around how to use services but what process I should implement or when it comes to on-premise installations for example.

What sort of business model are you thinking? Kind of like Pushdoctor but for DevOps?

<comment><AUTHOR> Huh, I didn't know of that - is that UK only? But from a quick perusal - yeah, exactly like that!

<comment><USER2> Yes I think it's UK only but I imagine there will be similar services in the USA.

</comment></comment></comment><comment><USER3> Yep 100% As a small business I sometimes feel like I would like to pay for day or two of someone to allow me to pick their brain, rather than them doing it all instead of me. My way of learning is asking stupid questions so that I get answers which fill in the gaps so I get a good foundation of knowledge. If I ask a targeted question I get fishing rod and line but miss out the wider more crucial stuff about angling. Asking stupid questions is usually a bit embarrassing though, and is inappropriate in irc/stack/discord / help forums.

I have tried our local dev ops meeting, but they seem to be mostly composed of people in full time positions in large companies, or if they are freelancers they are in the wrong tech stack.

One could go to the monthly freelance thread on HN and see if there are any freelance dev ops folks for hire with the appropriate technology knowledge you/we need.

</comment><comment><USER4> Not for devops, personally, but I love the idea of a service where I can just 'talk to a guy' who's an expert in $DIFFICULT_TOPIC.

</comment><comment><USER5> AWS Fargate would be and easy entry point for you..!

</comment><comment><USER6> I'd be available as a DevOps helper

<comment><AUTHOR> Really? Well then, at least a handful of folks here would be on the buy side. Re sell side: what would it take to sell your expertise on such a service? I've done freelance work in another programming field, and for very short things like this (an hour or two here or there), I'd envision wanting to charge quite a bit. I dunno. Feel free to dm me - email's in profile.

</comment></comment><comment><USER7> Yes, I'd find that useful.

</comment><comment><USER8> Yes.</comment>


Mozilla is funding a way to support Julia in Firefox - <AUTHOR> https://www.zdnet.com/article/mozilla-is-funding-a-way-to-support-julia-in-firefox/ <comment><USER2> I like this "language of libraries" story that the compiler developers have really been pushing towards. You can argue between Julia/Python/MATLAB/R which of the interactive scripting libraries you like to use libraries from, but that's missing the point: Julia's main asset is that it's great for writing libraries. This focus on package compilation, output to WASM, and integrating Julia packages into Python/R workflows allows one to use Julia as a high productive C++ replacement, which IMO is where it does best. I think the next phase of Julia will be about sharing its unique libraries through these bridges, making it be a tool that both acts like Python and like C++ in modern workflows.

</comment><comment><AUTHOR> JuliaLang + WASM issues:

[https://github.com/JuliaLang/julia/search?o=desc&q=wasm&s=up...](https://github.com/JuliaLang/julia/search?o=desc&q=wasm&s=updated&type=Issues)

</comment><comment><AUTHOR> [https://discourse.julialang.org/t/julia-in- firefox/26156](https://discourse.julialang.org/t/julia-in-firefox/26156)</comment>


Firefox Preview adds support for recommended extensions, including uBlock Origin - <AUTHOR> https://twitter.com/Aissn/status/1224588783657439234 <comment><USER2> Firefox needs to take its recommended extensions program more seriously. They have been recommending a copy-cat extension for over two years now, despite the reports of users and major developers (including gorhill himself).

[https://mobile.twitter.com/Pythux/status/1154403982342852609](https://mobile.twitter.com/Pythux/status/1154403982342852609)

<comment> GuB-42 Is that extension malicious or illegal?

It looks like it is just a repackaged a AdGuard in a way that complies with the GPLv3 license of the original project.

Sure, morally, it is questionable at best. But it looks like it is legal, does exactly what it says, and doesn't harm users in any way. Furthermore, it is highly rated with a lot of downloads.

While I admit I'd rather not be supporting a ripoff, I don't think it is Mozilla's job to check the morals of developers unless there is a direct risk for users.

<comment><USER3> No one's claiming that it's malicious or illegal. It's just that a recommendation engine that recommends an old, unmaintained, copy-cat extension which wasn't exactly great back when it was new and maintained is not very trustworthy -- it's either very bad, or vulnerable to rigging.

It's like a movie recommendation engine that preeminently features Howard the Duck or something. It's not malicious or illegal but its recommendations are probably useless.

<comment><USER4> Howard the Duck was A+

<comment><USER3> I mean, I didn't hate it, but my taste when it comes to movies is so bad that serious cinemas would ban me if they knew what kind of movies I watch.

</comment></comment></comment></comment></comment><comment><USER5> Question for HN: What will happen to the web when uBlock Origin becomes prevelent enough? Currently the vast majority of the internet is completely (or mostly) ad funded: Twitter, Facebook, newspapers, Reddit, YouTube, etc etc. Adblockers like uBlock Origin hurt these sites by deriving them of revenue. Currently, there hasn't been too much of an effect because the adblock usage rate is low enough that adblocking free riders don't cause enough harm.

However, this calculus changes quite a bit when adblock penetration reaches high enough levels. Once 80-90% of users use adblock I don't see how these sites will survive. And that adblock penetration rate increases year over year due to efforts like this.

The real question is what will happen next. Will the government move to rule adblocking illegal? Will websites engage in sophisticated technical anti- adblock measures? Will companies like Google and Twitter give up on advertising and shutter their existing businesses? All I can say is that the current situation doesn't seem sustainable.

<comment><USER6> Even if Mozilla were to bundle ublock into the standard Firefox install, it probably wouldn't matter. As much as I love using it, its marketshare has been on a slow spiral for a while, down to 4-8% right now. I'm willing to bet a decent proportion of those users already use some form of adblock due to the frequency of obscure Firefox only issues I've seen, which tend to push away non tech folk. I've never met a non technical person who prefers Firefox. Because every now and again, you'll run into a website that renders wrong or shows you a scary popup for having a non Google user agent. Or you'll run into issues with proprietary drm solutions that were only tested under Chrome. Or you'll get lots of the obnoxious "click on all the sidewalks" captchas, which won't happen on Chrome unless you use a sketchy VPN service.

<comment><USER7> I've been using FF on mobile + uBlock for over two years with zero issues; I moved to FF on desktop a few months ago, with also zero issues.

<comment><USER8> While I am technical, I also use FF exclusively on all platforms. I actually find it more performant than Chrome and way less of a memory hog.

<comment><USER9> It doesn't seem to run as well as chrome for me on a pixel 3a. I'm assuming you have a faster phone?

</comment></comment></comment></comment></comment><comment><USER10> uBlock Origin is one of (if not _the_ ) best browser extensions. I want to support websites, I really do. And I don't mind non-intrusive ads either.

But all the tracking and privacy invasion that comes along with that? No thank you.

<comment><USER11> Just a few days ago I visited a site that was begging me to turn off my adblock. I naively tried it and... the site became literally unusable. Things like the download button were hijacked to a random ad site. The text of the site was replaced by an ad that wanted me to fill in a survey.

It makes me wonder how people without an adblocker can even browse the web.

<comment><USER12> I would like a thing separate from an adblocker, that doesn't block ads per se, but instead disables most of the APIs that the tab can use to interact with the browser, e.g. opening new windows, modifying history, disabling right-click, navigating to a different domain from a whole-page click handler, etc. Javascript could still run, but it'd pretty much be limited to just modifying the loaded document's DOM.

Better yet, make it so that, when I "turn off" my adblocker, it's turning on this restricted-browser-API sandbox instead. Then, if the page _still_ doesn't work, I could turn on a "compatibility mode" that would load the page with full API permissions.

<comment><USER13> I would add some CSS limitations as well. All sticky headers scroll out of the way as soon as you scroll down. No obnoxious full screen stickies, especially those appearing after a timeout or detecting that my mouse goes up. Proper contrast, font size and line width. So basically extended reader mode.

<comment><USER14> To implement this, you would have to prevent JavaScript from reading how far down you've scrolled or which element your mouse is hovering over, or else JavaScript could repeatedly insert absolutely-positioned elements over the part of the page you're looking at.

</comment></comment></comment></comment></comment><comment><USER15> Remember this discussion 7 month ago on the release of Firefox 68 [1], in which many people were worried about Fenix not getting support for extensions?

Enjoy the happy ending :-)

[1] [https://news.ycombinator.com/item?id=20392546](https://news.ycombinator.com/item?id=20392546)

</comment><comment><USER16> The tweet says that addon support has been merged in Firefox Preview, which I understand as the ability to install addons in general. Then it follows with a reply showing how uBlock Origin can be installed easily.

The title of this post could be clearer, lest people (like me) get confused and think of it as uBlock Origin being merged into Firefox Preview.

<comment><AUTHOR> After tests I found that only uBlock Origin could be installed for now, since it's the only "Recommended Addon". So the HN title is in fact, clearer than the tweet.

 _Edit_ : I clarified by saying that uBlock Origin can now be installed.

<comment><USER17> The HN title still misrepresents the plan described at the linked document:

[https://support.mozilla.org/en-US/kb/add-compatibility- firef...](https://support.mozilla.org/en-US/kb/add-compatibility-firefox- preview)

> _We are currently building support for an initial selection of Recommended > Extensions for Firefox Preview. These extensions are expected to be > officially supported for Firefox Preview during the first half of 2020._

<comment><AUTHOR> I can no longer edit the title. I'd welcome a modification by the mods to make it more clear. The document is linked in the Twitter thread as well.

<comment><USER18> I've taken a crack at it. Does it work now?

<comment><USER19> Sounds like you need a verb before "support". Maybe "Firefox Preview adds support..."

<comment><USER18> I didn't think there was room for that, but there is. Thanks!

</comment></comment></comment></comment></comment></comment></comment><comment><USER20> Oh, shit, I am the only person browsing news.yc who doesn't know about uBlock Origin, and I am so fscking excited!! I've installed this and have no idea how to use it so I'm about to dip into uBlock Matrix instead wish me luck~

<comment><USER21> I like using both uBlock Origin and uMatrix.

uBlock I run with near-zero configuration tweaks, only enabling a few additional lists.

uMatrix I run in a much more restrictive mode (block _all_ 3rd party, along with first party scripts and XHRs). Then I selectively unblock to unbreak sites.

In this way, uMatrix is my primary line of defense, and uBlock is a backup, in case I accidentally unblock an ad/malware domain when trying to unbreak a site. It also allows me to temporarily allow all with uMatrix if I just want a site to work, without enabling ads, etc.

<comment><USER22> > uMatrix I run in a much more restrictive mode (block all 3rd party, along > with first party scripts and XHRs). Then I selectively unblock to unbreak > sites.

That's exactly what I do too. You get better at knowing the likely candidates for what you need to unblock, but payment on a new site (or a modified since you last used it site) can be annoying.

Incidentally it has also led to me being both undercharged (client-side upping of the price wrt quantity) and double charged ('failed' transaction, unblock something, try again, turned out they actually both went through).

</comment></comment></comment><comment><USER23> Firefox preview is really great. Performance is much, much better than the regular Firefox for Android. Now that it supports the most important extensions, there's really no reason not to switch.

<comment><USER24> Fenix (Firefox Preview) is not currently free software, as it contains proprietary Google libraries like com.google.android.gms and com.google.firebase. F-Droid currently maintain the Google-free fork of Firefox that is available on F-Droid, but they have said they lack the resources to do the same for Fenix as well. Until this is resolved, there is an _excellent_ reason not to switch.

[https://github.com/mozilla- mobile/fenix/issues/162#issuecomm...](https://github.com/mozilla- mobile/fenix/issues/162#issuecomment-575199313)

<comment><USER25> How is this different from linking against Direct3D on Windows?

<comment><USER24> Because a) it's uneccesary and b) the proprietary libraries are _in the app_ , unlike Direct3D where you could theoretically run the program without the proprietary libs (eg in Wine).

</comment></comment></comment></comment><comment><USER26> Maybe the title should give a hint that this is the _mobile_ edition of FF. It took a me a minute to realize that, and how big a deal it is.

<comment><USER27> Firefox for Android has had addon support for ages, this is addon support for the Firefox for Android redesign - Firefox Preview.

</comment></comment><comment><USER28> I've been using Firefox Preview as my daily driver for a couple months now. I have the strict privacy settings all turned on and find that it does a pretty good job of blocking ads to the point that I haven't really missed uBlock origin. I even get the occasional 'please disable your adblocker' message even without any additional extensions.

</comment><comment><USER29> Personally I'm looking forward to Stylus. Hard to enjoy the web without userstyles.

<comment><USER30> Definitely a hack, but I've been using uBlock Origin to do minor CSS tweaking on websites I use ([https://github.com/gorhill/uBlock/wiki/Static-filter- syntax#...](https://github.com/gorhill/uBlock/wiki/Static-filter- syntax#style)).

<comment><USER29> Thanks for the tip. Should work for hiding fixed headers, my biggest "quality of life" improvement and maybe swapping fonts.

</comment></comment></comment><comment><USER31> What is Firefox preview? Desktop nightlies? One of the alternative mobile browsers Mozilla is working on?

<comment><USER32> Mozilla is rewriting Firefox for Android from scratch. The new version is released as Firefox Preview until it is feature-complete enough to replace Firefox for Android.

[https://blog.mozilla.org/futurereleases/2019/06/27/reinventi...](https://blog.mozilla.org/futurereleases/2019/06/27/reinventing- firefox-for-android-a-preview/)

[https://github.com/mozilla-mobile/fenix](https://github.com/mozilla- mobile/fenix)

uBlock Origin is currently available in the nightly channel of Firefox Preview:

[https://play.google.com/store/apps/details?id=org.mozilla.fe...](https://play.google.com/store/apps/details?id=org.mozilla.fenix.nightly)

<comment><USER33> _The new version is released as Firefox Preview until it is feature-complete enough to replace Firefox for Android._

And that will be pretty soon: [https://blog.mozilla.org/futurereleases/2020/01/17/a-brand-n...](https://blog.mozilla.org/futurereleases/2020/01/17/a-brand- new-browsing-experience-arrives-in-firefox-for-android-nightly/)

</comment></comment></comment><comment> Digit-Al Does anyone else have big problems with Firefox preview? It used to work absolutely fine for me then a couple of months ago it just started crashing every time I tried to open a website. This includes sites and pages that had previously loaded with no problem at all. It has become pretty much unusable for me. And this is on two different devices by completely different manufacturers :-(

<comment><USER34> It crashes for me too. I can deal with that. I find it much more annoying when it loses my tabs that I keep open to read later.

After the last update the "undo" notification at the bottom sometimes doesn't disappear, which is annoyingly placed over the address bar and menu button. There's also no way to manually dismiss the "undo" notification.

Despite all this it has by far the nicest user experience of an Android browser so I stick with it in the hopes one day it won't be super buggy. I'm sure that day will come.

</comment></comment><comment><USER35> Build artifacts for the curious:

[https://firefox-ci- tc.services.mozilla.com/api/queue/v1/task...](https://firefox-ci- tc.services.mozilla.com/api/queue/v1/task/b0F1rHGTSseQEfa2mamr-g/runs/0/artifacts/public/build/arm64-v8a/geckoNightly/target.apk)

</comment><comment> m-p-3 Which build has it? I'm using the Nightly from Google Play (#20350606) and I don't see any mention of add-ons.

<comment><USER36> My build (just downloaded as a fresh install) is #20351804. Add-ons are a menu option now, with UBlock Origin as the only recommended one. Actually, it might be the only one available at the moment?

<comment><USER37> Judging by the previous topics about Firefox Preview, uBlock is by far the most requested one.

Worth pointing out that Firefox Preview is set to replace current Firefox within the next 5 months, add-on support will probably arrive a version or two after that.

<comment><USER38> Is it definite that Preview will replace the current default before it gets full add-on support? That's surprising.

<comment><USER39> Yes, it's definite. [https://support.mozilla.org/en-US/kb/firefox-preview- upgrade...](https://support.mozilla.org/en-US/kb/firefox-preview-upgrade- faqs#w_add-ons)

"Full add-on support will be available in late 2020." "The Firefox for Android Beta and general release migrations will follow and the final migration will occur in Spring 2020."

Mozilla were cagey about this for a while, but this doesn't come as a surprise to any of the many people who predicted they would do this.

</comment></comment></comment></comment></comment><comment><USER40> App Store: Firefox preview nightly access for developers

</comment><comment><USER41> Firefox Previews still does not support to add tags to Bookmarks.

Those of you unaware what FF bookmarks has to offer see [https://support.mozilla.org/en-US/kb/address-bar- autocomplet...](https://support.mozilla.org/en-US/kb/address-bar-autocomplete- firefox?redirectlocale=en-US&redirectslug=awesome-bar-find-your-bookmarks- history-and-tabs#w_changing-results-on-the-fly)

Otheewise FF preview is since 6 months my android go-to browser. I missed nothing during that time.

</comment><comment><USER42> Is this Android only or iOS too?

<comment><USER43> Android only; Apple policies do not allow non-WebKit engines to be distributed on iOS.

<comment><USER44> Oh interesting, I just learned that firefox for iOS is basically a wrapper around webkit inbuilt into iOS

[https://en.wikipedia.org/wiki/Firefox_for_iOS](https://en.wikipedia.org/wiki/Firefox_for_iOS)

But does this mean that extensions will never work on iOS ?

<comment><USER45> Basically, yes.

</comment></comment></comment></comment><comment><USER46> yet still no pull down to refresh as option despite users asking for it for years</comment>


JWT tokens authenticate the client, not the user - <AUTHOR> https://blog.moodio.co.uk/the-most-important-jwt/ <comment><USER2> The distinction between client vs user is semantic quibbling - it's not possible to authenticate the user, only the agents, or clients, which act on behalf of the user. We can't interact with the user directly. We can only talk to the user's agent. JWTs just cache the verification of some secret which we hope the user has supplied.

What the article actually seems to be asserting is that permission checking should be done via calls to an IAM and not via claims in the JWT (if I'm understanding it right).

I don't buy this either. Tokens can cache permissions, albeit with the same staleness issues that JWTs have for authentication. It's not much different than how a driving license is both evidence of identity and evidence of a permission.

The claims might be stale, but we have the same problem for revoking JWTs.

<comment><AUTHOR> Well yes, but sometimes its not the user that authorizes the JWT token holder to perform the action to begin with, which is why there is the distinction between authenticating the user and authorizing a service to perform an action. JWT tokens don't tell you what the user is allow to do, they tell you what the service/client is allowed to do on behalf of the user. There still needs to be a seperate check to see if the user themselves are even allowed to perform a particular action to begin with, to have even allowed something else to do it on their behalf, and thats what solves some of the stateness issue, in that, if you have for example an admin, who gets fired, even if they still have a valid JWT token that says the client is allowed to perform certain actions on their behalf, there is still a check to see if the user can perform those actions, so as soon as they are fired or demoted, the backend will instantly stop performing actions on their behalf regardless of what the JWT token says they can do.

<comment><USER2> > _Well yes, but sometimes its not the user that authorizes the JWT token > holder to perform the action to begin with, which is why there is the > distinction between authenticating the user and authorizing a service to > perform an action._

I think you're talking about delegation now.

> _JWT tokens don 't tell you what the user is allow to do, they tell you what > the service/client is allowed to do on behalf of the user._

This is delegation, not authorization.

> _There still needs to be a seperate check to see if the user themselves are > even allowed to perform a particular action to begin with, to have even > allowed something else to do it on their behalf, and thats what solves some > of the stateness issue, in that,_

Services which are acting on the user's behalf (delegated) can pass the user's claims through too; can pass the whole JWT through. That services act on the user's behalf with delegated authority is a red herring, as far as I can see.

You can still cache permissions (e.g. role) in the JWT. You don't need to do a separate check using the user's identity, as long as you either have mechanisms to deal with the staleness of the cache, or you're happy that the cache lifetime isn't long enough for it to be a problem (nothing happens instantaneously in distributed systems, after all).

> _if you have for example an admin, who gets fired, even if they still have a > valid JWT token that says the client is allowed to perform certain actions > on their behalf, there is still a check to see if the user can perform those > actions, so as soon as they are fired or demoted, the backend will instantly > stop performing actions on their behalf regardless of what the JWT token > says they can do._

This is why you have things like the Refresh and Access tokens pattern. In the absence of revocation blacklists, claims shouldn't be put into long-lived tokens.

<comment><AUTHOR> >I think you're talking about delegation now. > Services which are acting on the user's behalf (delegated) can pass the user's claims through too; can pass the whole JWT through. That services act on the user's behalf with delegated authority is a red herring, as far as I can see.

Whether its delegation or authorization, a JWT access token is the result. Keep in mind this isn't about the mechanism to how the IAM decides whether or not to issue a JWT token and to whom, but just what that JWT token means to the endpoint that will consume the token and decide what to do based on it. > Services which are acting on the user's behalf (delegated) can pass the user's claims through too; can pass the whole JWT through

Services acting on a users behalf should not be resending the same JWT token, if they do you've set it up incorrectly. Each service has its own unique identifier, as part of the audience claim. A service that gets a JWT token with a different identifier should reject it, even if the JWT token is valid.

</comment></comment></comment></comment><comment><USER3> That's a really poor and incorrect blog post. The author has a very poor understanding of JWT, has described just one small use case, has decided this is the only one and thinks everyone else has misunderstood them. That's not the case. (I agree putting user permissions in a JWT is poor design though.)

Strictly speaking JWTs don't have to be used for authentication at all. They are just signed tokens containing JSON. You could have a shopping list in there if you wanted to be sure it was definitely your wife telling you to pick up milk on the way home.

<comment><USER3> Sticking with security though - a JWT certainly can be used to identify a user. The author quote a case where an application have obtained a token on behalf of the user and that's valid too, but it's a less common (in my experience) scenario.

A user token tells you (the relying party) that the user has been authenticated to the satisfaction of the issuer (often Google, Microsoft, Facebook but it can be anyone inclusing your own authority). You can be sure the token has been issued by the issuer due to the signature. If you trust the issuer then you can trust the time-limited token.

As far as how the issuer has confirmed the user's identity and whether it represents a person, service, etc. can vary.

There 's obviously way more to federated authentication that I want to post in a comment, but there you go. I believe the OP was getting slightly confused between some OAuth2 implementations and proper security implementations like OpenId Connect.

<comment><AUTHOR> > The author quote a case where an application have obtained a token on behalf > of the user and that's valid too, but it's a less common (in my experience) > scenario.

quite common in mine, especially when dealing with service oriented architecture. the public api is given a token, and it should use that token to authorize itself to use other services, or a cron job that performs actions on behalf of users.

> A user token tells you (the relying party) that the user has been > authenticated to the satisfaction of the issuer (often Google, Microsoft, > Facebook but it can be anyone inclusing your own authority). You can be sure > the token has been issued by the issuer due to the signature. If you trust > the issuer then you can trust the time-limited token.

But my point is (and the point of the article) is thats not what the token tells you. The token tells you (and the reason its called a bearer token) that whoever holds this token, can perform the list of actions defined within the scopes array. Which is completely different to saying we are 100% sure the user is who they say they are. If the token told you the user is who they say they are, then why do you even need scopes? You could just assume the user is allowed to do anything they wanted to to their own resources.

<comment><USER3> That's really not what scopes are for either. There are a few people on this thread who are trying to politely explain that you haven't quite got what can be a reasonably tricky subject. You'd be well advised to step back a bit and read up on OpenID Connect rather than just digging in on your position and insisting everyone else is wrong.

<comment><AUTHOR> Ok... Getting a bit rude, so if you prefer we can end the discussion here, however first lets take a look at 2 links: [https://oauth.net/2/scope/](https://oauth.net/2/scope/) "Scope is a mechanism in OAuth 2.0 to limit an application's access to a user's account."

Literally the first sentence in the definition. If you prefer take a look at the definition on OAuth definition at [https://auth0.com/docs/scopes/current/oidc- scopes](https://auth0.com/docs/scopes/current/oidc-scopes). Now which part of that exactly anything about authenticating the user or goes against what i've said? You'd be well advised to take your own advice.

<comment><USER3> > if you prefer we can end the discussion here

Yeah - let's do that. You're now quoting things that directly contradict your position, so I'm starting to think we're all just being trolled.

</comment></comment></comment></comment></comment></comment><comment><USER4> I've never seen any claims by authors behind JWT claiming the purpose of JWT is limited constrained delegation, and I highly doubt that is the case.

The fact that RFC specifies a subject claim (for the authenticated principal), but not claim for clients or scopes, shows quite clearly that delegation was not the immediate goal behind JWT [1].

JWT and JOSE annoy cryptographers and security researchers so much _precisely_ because they're trying to be a generic cryptographic format that's supposed to solve everything under the sun. The tragedy of JOSE is that instead of trying to solve a small set of problems well, it is basically failing at solving any kind of problem in a satisfactory manner.

JWT can be used in the way described above, but it doesn't seem like particularly a good fit for this purpose. If we can't trust the clients not to lie about their users and their delegated claims, we need to make calls to some mutually trusted STS (or a Token Exchange) anyway. But if we already call an STS, we can just let the STS produce any type of opaque tokens for any type of server and let the backend verify the tokens (delegated or not) with the STS.

[1] Yes, these claims appear in the draft for OAuth 2.0 Token Exchange, but they came a few years later, and that draft is still not standardized.

</comment><comment><USER5> > there are far more secure and efficient ways of then verifying what the user > is allowed to do, such as calling the IAM directly from the backend service > or by implementing a more complex permissions service.

Making another call over the network for auth is by definition vastly less efficient by several orders vs having been handed the information in the first place. The bottleneck of a centralized permission service is actually what pushed us to JWT in the first place.

Using JWTs to authenticate the user allows actual decentralization of your endpoints. We have services that speak directly to nothing else in the ecosystem and it's a major win.

The security argument is valid to a small extent, but I'll trust a well salted SHA256 with my life until I'm told otherwise.

<comment><AUTHOR> Depends on where the permissions logic is stored, but to add information such as the example of can user a access the data of company x, then the IAM provider has to make a call back to the service where this information is stored. Its unlikely you'd want to store logic like that within the IAM provider, nor is it necessarily possible. But if you are relying on the IAM provider for user permissions, then you still have the bottleneck of a centralised permission service, its just now your IAM provider. The only scenario i can think of where its more efficent, is in role based authentication.

</comment></comment><comment><USER6> > Blog posts, sign-up pages, and other reading material can't be tried out, so > can't be Show HNs.

From [https://news.ycombinator.com/showhn.html](https://news.ycombinator.com/showhn.html) Edit: The title has removed show hn now

> JWT tokens authenticate the client, not the user

I think it's both. It just doesn't _authorize_ the user for anything special.

<comment><AUTHOR> Ah thanks. I disagree though, with JWT tokens and especially assuming you're using the redirect flow, for the server especially, the server doesn't need to know if the user was even authenticated as it could be another service calling it, it only needs to know that whoever is calling it is allowed to act on behalf of the user and perform certain actions. An example of this would be if you connect your email to a CRM system, the crm system at that point might have been authorised by the user to send emails on their behalf, or might have been authorised by an admin to send users on everyone's behalf. In the case where an admin has given permission then the CRM system can send emails on everyone's behalf even if the user themselves were never authenticated. I believe it is the role of the IAM provider to authenticate the user, JWT tokens authorise callers to perform actions.

</comment></comment><comment><USER7> This is kind of a mess. The title says it authenticates the client not the user, but it doesn't actually talk much about authn. What it actually seems to argue (with some detail, but incomplete to remotely make the case) is that the JWT should be used only to validate user->client authz, not user authz.

It fails to really do this, as it notes some IAM systems can be used to transmit user authz information in it, and it provides no substantive _reason_ to reject that use, it just asserts that it's wrong and that there are (unspecified) better alternatives (which it also fails to explain how they are better concretely.)

Waving a hand at more efficient and secure is nice, but show me a concrete security concern or evidence that another way is more efficient given that I'm already paying the cost to decode and parse the JWT and maybe I'll believe you.

</comment><comment><USER8> If you start calling other IAM servers to verify the permissions of the user, aren't you throwing away the usefulness and advantages of the JwT woken being a form of stateless auth (isn't the use case of jwt exactly to avoid calling the IAM upon request?) ?

<comment><AUTHOR> Well no, JWT tokens are there to validate a call can be made. e.g., that whoever has made the HTTP call to your API server has been allowed to do so by the user. JWT tokens aren't there to tell you what the user themselves are allowed to do. What the user is allowed to do is an entirely different thing and you shouldn't rely on bearer tokens to tell you that.

</comment></comment><comment><USER9> i think this is conflates the common use of jwts vs their possible use cases. jwts are just standard signed information after all! Open ID Connect, probably the best extant user authentication protocol leverages JWTs to build the 'ID Token' that actually encapsulates user identity.

Some conflation between authorisation and authentication here too — the description of JWTs here describes authorisation, not authentication, I think 'authorizing the client' vs 'authorizing the user' would typically just be 'authorization' and 'authentication' respectively.

<comment><AUTHOR> Well the point is, Authenticating the user happens before the JWT token is issued, and authorizing an action happens after the JWT token is viewed. Authorizing a user on the backend to perform an action is an entirely different thing.

For example, a user signs in and gets a JWT token that has the permission Delete.Everything which in this example is the permission required to delete all a users resources, the client takes this and passes it to the backed. On the backend however, the user might not even be allowed to delete everything. Maybe they're under investigation, or maybe this particular service just doesn't allow it. But its not the role of the JWT to tell you whether or not this particular user is allowed to perform that action, all the JWT token tells you is that this user has allowed the bearer of the JWT token to perform that action on their behalf. But, doesn't mean the user is allowed to perform that action to begin with, so the user has given the client permission to perform an action they themselves aren't allowed to perform.

<comment><USER9> > Well the point is, Authenticating the user happens before the JWT token is > issued

In the case of OIDC, the ID Token _is_ the contract of authentication. So when I login via Google, both the consumption of my username / password to produce the ID Token JWT, _and_ the consumption of the ID Token by the third-party are authentication.

> For example, a user signs in and gets a JWT token that has the permission > Delete.Everything which in this example is the permission required to delete > all a users resources, the client takes this and passes it to the backed.

This is again confusing a common use case of JWT with what it actually is. A JWT is just a signed token. The concept of a 'permission' used here is an abstraction upon what JWT really defines, which are 'claims' (i.e. signed information).

> On the backend however, the user might not even be allowed to delete > everything. Maybe they're under investigation, or maybe this particular > service just doesn't allow it. But its not the role of the JWT to tell you > whether or not this particular user is allowed to perform that action, all > the JWT token tells you is that this user has allowed the bearer of the JWT > token to perform that action on their behalf.

This is a usage detail for which there are several valid approaches. It's not uncommon to see a JWT used as an authentication token _be_ the source of truth, with only invalidation based on unique id (jti).

The concept of the JWT being correlated with a user authorization is an entirely synthetic one. It's a common use case. Check the original RFC.

> But, doesn't mean the user is allowed to perform that action to begin with, > so the user has given the client permission to perform an action they > themselves aren't allowed to perform.

Consider this counterpoint: if the JWT itself is not itself a statement of authorization, what's the point in signing it at all? We could just be sending a unique id corresponding to this token (like a circa 200x OAuth token) and get the same effect. JWT is used for a common pattern, but it's important to understand why that pattern is chosen.

</comment></comment></comment><comment><USER10> permissions are regularly included in scopes and you should be driving access based on permissions, not roles, roles are just a bucket for permissions.</comment>


What It's Like to Drink Bulletproof Coffee Every Morning for Two Weeks - <AUTHOR> http://www.fastcompany.com/3034539/coffee-week/what-its-like-to-drink-bulletproof-coffee-every-morning-for-two-weeks?utm_source=facebook <comment><USER2> _" Among Bulletproof coffee's listed benefits: It triggers weight loss by way of ketosis..."_

Just having bulletproof coffee for breakfast won't put you into ketosis (the state of using fat-derived ketone bodies for energy). You'd also need to have a radically low amount of carbs in the rest of your your diet. Otherwise, you'll have ample supplies of glycogen in your liver that will be providing you with glucose to fill your energy needs between breakfast and lunch.

According to Wikipedia, it takes about 48 hours of carb deprivation to make your body switch to burning ketone bodies for energy:

[https://en.wikipedia.org/wiki/Ketosis#Diet](https://en.wikipedia.org/wiki/Ketosis#Diet)</comment>


Eureka: A New Era for Scientists and Engineers - <AUTHOR> http://steveblank.com/2011/07/28/eureka-a-new-era-for-scientists-and-engineers/

<comment><USER2> FYI, Steve will be discussing this program at the San Francisco Lean Startup Circle:

<http://www.meetup.com/Lean-Startup-Circle/events/27379661/>

</comment><comment><USER3> Kudos Steve! This is a wonderful thing for entrepreneurship and innovation in general. The NSF is the largest "VC" in the world. Their "fund" is $8B per year! And they give out 10,000 grants to the smartest scientists in the country. Minus overhead, that's an average of 400-500K per grant! I can't wait to see what type of companies this program produces.

</comment><comment><USER4> Q What is I-Corps?

A NSF Innovation Corps (I-Corps) is a public–private partnership that provides grants to determine the technology disposition of concepts developed by _previously or currently funded NSF grantees_.

<comment><USER5> In other words, they spend money to review the success of projects they've funded. Makes sense to me. How else will you improve your process?

</comment></comment><comment><USER6> > a program to take the most promising research projects in American > university laboratories and turn them into startups

I don't think any additional incentives are needed for this.

<comment><USER5> I disagree. I think there are a lot of promising projects that don't get enough attention because there isn't enough focus on using the research. It's all ivory-tower stuff. There's something magical that happens when you try to turn pure research into actual product: More knowledge!

It's rarely a straightforward thing to do, and I can understand academics not wanting to tackle it. But it really does matter.

<comment><USER6> When it's possible to put scientific results to practical use, the researchers themselves can start a company. My wife worked for a firm founded this way (Coverity) and a friend of mine was an early employee at another (Audience). As well, existing firms and entrepreneurs can and do use published results all the time. The rewards are high if the results are valuable. The problem, as hard as it may be to believe, is that most published results have no direct practical use. This comic rings very true

<http://xkcd.com/664/>

The NIH is finding this out with their recent push to turn NIH-funded results into drugs. Collins is already backpedaling from earlier this year (you'd think he would have learned this lesson after being beaten to the genome by an organization of 1/10th the means).

At Apple, I worked closely with battery engineers. Lots and lots of battery research is going on -- we hear about nano-virus-assembled anodes all the time. But approximately none of it is useful to battery engineers. Batteries must have energy density, power density, good recharge time, and high cycle life. Press releases about gee-whiz battery chemistries typically quote one or two of these figures, but never all four. That's because all of them have a huge problem with one or more of these things, and no horizon for fixing them. And the instant a breakthrough is made -- like graphite anodes at Bell labs in the early '80s -- everyone will be working on it. There are approximately no 'forgotten breakthroughs' in human society. The incentives provided by contributing to wikipedia are enough to disclose almost everything known.

The whole point of funding basic research is to discover such things, which are too important to be proprietary. Markets are very good at the details that are appropriate to keep under one roof.

</comment></comment></comment><comment><USER7> So, its a form of Ycombinator for academia.</comment>


Show HN: httpstatus.es, directory of HTTP Status codes - <AUTHOR> http://httpstatus.es

<comment><AUTHOR> I have submitted this before but it's now open source and anyone can contribute new codes or changes to specific codes so I figured I should resubmit it.

Repository on Github where changes can be submitted: <https://github.com/citricsquid/httpstatus.es></comment>


Designing a scalable API on AWS spot instances - <AUTHOR> https://blog.adapty.io/designing-scalable-api-on-aws-stop-instance/ <comment><USER2> There's an excellent implementation using AWS lambda to manage spot instances at [https://github.com/AutoSpotting/AutoSpotting](https://github.com/AutoSpotting/AutoSpotting)

What's fantastic about the autospotting implementation is:

1\. It dynamically replaces existing instances with spot instances just by setting a tag

2\. Rather than replacing the instance with a fixed spot instance type, it will choose the cheapest that fits the requirements.

3\. If there are no spot instances available that fit the requirements, it will spin up on demand instances until spot instances are available.

If you have experience working with spot then you will know that these are really outstanding features that hopefully amazon will bake-in in the future.

</comment><comment><USER3> Turns out this is about EC2 spot instances for ECS. How would it compare to ECS Fargate spot these days?

I'm also missing a discussion about designing for interruption, either by not keeping state, or by being able to shed state quickly, to be picked up by other instances.

Also, if you set up EC2 spot with a launch template or ASG with very differently-sized instance types (to reduce risk of running out), is there a way to even out the load coming through an ALB? The least-connections scheduling can help in some cases, but a connection might not map 1:1 to one unit of load. The ALB can use weighted balancing, but on the target group level. Dunno how easy it would be to allocate different instance sizes to different target groups and weigh them accordingly.

<comment><USER4> AFAIK with Fargate a lot of this is handled for you, as long as you have the auto scaling group.

We have this setup with two capacity providers (FARGATE_SPOT and FARGATE) with a 75/25% split, meaning that even if there are no spot instances available we will still be up.

The benefit of Fargate being that we don't need to care if certain instance sizes are not available as that is handled by AWS.

<comment><USER5> Cool, when fargate launched they didn't have a spot possibility (AFAIK) and since we run ECS on Spot instances it would just be a massive increase in cost to switch to FG, but if it now can use underlying spot instances, it might be worth looking at again..

<comment><USER6> Yeah spot capacity providers for Fargate only got added a few months ago, been running well for us in production.

</comment></comment></comment></comment><comment><USER7> For service type workloads (e.g API service with 99.99% uptime SLA) we keep comparing on-demand vs. spot.

In reality, you would like to compare Reserved Instances as you can get 60% discount.

So in us-east-1:

\- spot costs: 35-43% of on-demand

\- RI 1 year standard: 60% of on-demand

\- RI 3 year convertible: 46% of on-demand

So if you have some base load that you can commit to running for 3 years, the price gets often at spot range while not having to worry about losing capacity.

In-reality sometimes combining reserved for some base capacity 60% + 40% spot for spiky seems to be the winning combination for many companies.

<comment><USER8> Good point, thanks! We're looking at saving plans, probably will use them too. But when you're doing prototypes it's pretty much impossible to commit to 1 year of usage, let alone 3:)

<comment><USER9> You can still reserve classic instance for one year and when you don't use it anymore you can sell it in the market

</comment></comment></comment><comment><USER10> Seems like amazon has long been transitioning spot instances away from being a method of efficiently utilizing excess capacity, towards being a discounted service for less risk-averse businesses(businesses that can accept the risk of their service being terminated at any time).

Even if in practice AWS never sees large spikes in compute demand and corresponding large scale instance preemption, most businesses I've worked with won't accept the risk of having OLTP systems be taken down at any time.

No longer does spot seem to be a service where one can get a bargain for their compute intensive offline/batch workloads that are much more tolerant of preemption.

Given that the spot prices seem to be very flat, and preemption is rare, amazon presumably have a fair bit of underutilized capacity, does anyone know if amazon uses this capacity themselves, or offers more aggressive spot pricing to select clients?

</comment><comment><USER11> Great article. Cutting ec2 costs is important, especially for companies with heavy data engineering / data science workflows. Spark service providers make it easy to spin up huge clusters (100+ nodes) to perform ad hoc analyses. The costs can quickly spiral out of control, even if you're getting 3x cost savings on the spot market.

Some tangential thoughts:

* Is there an AWS API that returns the cheapest availability zone in a region for a given instance type? Or is the GUI that's screenshot in the blog the only way to see?

* I have seen the 90%+ cost savings for certain instance types

* Sometimes you lose a spot instance, look at the pricing history graph to confirm the price spike, and don't see any spike that was above your bid price... it can be frustrating

<comment><USER12> I'm not aware of any API (surprising for AWS), but you use Spot Fleet to get an array of spot instances optimized for cost.

Having a bid above spot price does not guarantee you'll keep the spot instance. AWS can terminate a spot instance at any time if they need the capacity—That's the deal. It used to be more closely tied your bid price, but they've been moving away from that.

</comment></comment><comment><USER13> "Our backend system is built on AWS. Today I'm going to tell you how we had cut costs"

This is a recurring topic here on HN and it boggles me and makes me wonder if people know that there are other platforms than aws, azure and google cloud out there that are very capable and much much cheaper.

Unless any of the big 3 has a feature or certification you need I don't see any reason to use them at all due to the insane complexity and cost.

So why do you or your company who uses any of the big 3 use them if you had to cut cost at some point?

<comment><USER14> Always this poor argument pops up. 1st AWS and big 3 is much more reliable. 2nd AWS is not only a VPS provider. Changing vendors is not the answer to all cost related problems.

<comment><USER15> > 1st AWS and big 3 is much more reliable.

I think that's a myth. People assume it's true because it _should_ be true. I don't think it is true.

> 2nd AWS is not only a VPS provider.

It's a _glorified_ VPS provider. Most of the stuff doesn't matter to most of the people using AWS, but they go for it so they can put it on their resume and because they don't want to get fired for choosing something that's not a big name.

<comment><USER16> EC2 might be a glorified VPS provider, but you seem to be ignoring the vast array of managed services in modern cloud providers (or unaware of their utility beyond padding resumes).

Load balancing, fault tolerance, high availability, arbitrary scale, messaging, orchestration, autoscaling, warehousing, big data processing, identity management, desktop management, secrets management, container registries, source code management, build tools, hardware test suites, gpu hardware, observability tools...

Those of use that use cloud providers know full well why we use them (and certainly know when not to).

<comment><USER15> If you _really_ need any of that stuff you probably shouldn't use Amazon's managed version of it.

<comment><USER17> Why? I run both on prem and cloud workloads (on more than one provider) so I'm wondering what's wrong with Amazon's managed services?

</comment></comment></comment></comment></comment></comment><comment><USER18> Very useful article! waiting a terraform best practice

</comment><comment><USER19> interesting article!

</comment><comment><USER20> Very well written article!

If someone is interested in learning all the AWS concepts, here's an awesome e-book which is written by the legend Daniel Vassallo himself.

[https://gumroad.com/a/238777459/MsVlG](https://gumroad.com/a/238777459/MsVlG)</comment>


Tell HN: Startup School 2011 emails are out - <AUTHOR>

Seems like they were just sent out. Who got in? <comment><USER2> Yay, I'm in.

I'll be coming down from SF, which is a bit of an epic journey for people who don't drive, but I'm hoping there'll be crews of carpoolers from here.

The Caltrain stops around midnight and socializing often begins around then.. so I'm guessing I should plan to stay the night in south bay.

Looking forward to meeting you guys -- I'll try and dye my hair some ridiculous color before then to be uber recognizable. Maybe orange, just to suck up to YC. ;)

</comment><comment><USER3> Hum… didn't get invited this year. That's too bad because I feel like I would have benefited from it more this year than the previous ones. Disappointed but I'll survive :)

It's nice that it will be on Justin.tv, but IMO the best thing about Startup School isn't the speakers (though really great) but meeting the people.

<comment><USER4> In all fairness (going by past years), the networking is held outside in the open.

</comment></comment><comment><USER4> Dang, I had gone the last two years but was rejected this time around. The rejection was a bit surprising as my startup is much further along. I guess YC figured I should have learned startups by now. :)

More seriously, does anyone know how the criteria worked this year? Did it hurt ones' chances to be a part of a VC backed startup, as ycom was trying to get more novice entrepreneurs who could benefit more? My cofounder did get in: were there limits on number of attendees from each company?

<comment><USER5> Accepted :) feel very grateful again I do wonder how the "balance" is between new people and those who've attended 1 or more times before, as well as people from other countries. I also wonder if there might be a time to choose a larger venue to accommodate more people, or the current limit is a good way to maintain the character of the school.

</comment></comment><comment><USER6> I'm in! One question for the people that already went to SS: I am flying in from South Florida that Friday and I was wondering if there were any post event hangouts/meetups or if I should be ok flying back that night. I wished I could stay a couple nights in the valley but Sunday night is my limit.

Thanks!

</comment><comment><USER7> Didn't get in. I was really hoping to go and learn a lot, especially after not getting into YC Summer '11. :( Oh well, there's always next time I suppose or maybe I'll get lucky and meet more people through Hacker Dojo that could help me learn even more about being successful in the tech startup world.

</comment><comment><USER8> I'm still waiting for my email, but the rsvp page (<http://news.ycombinator.com/susrsvp>) indicates I've been accepted. Anyone else in the same situation?

<comment><USER9> If you're on Gmail, check your Bulk mail folder. I was waiting for an hour and it turned out it's been in my Bulk folder for a while.

<comment><USER8> Wow there it is. Arrive an hour and ten minutes ago. Thank you so much for that suggestion. I had checked my spam folder multiple times, but I didn't even think about the bulk mail folder.

Also, in!

</comment></comment></comment><comment><USER10> I read the email that I got in while at the ER waiting for x-ray results for my sprained ankle. I know, could have been a much better story if this was the YC interview invite which I initially thought it was :).

</comment><comment><USER11> I got rejected. The application was so long ago that I don't even remember it. Does anyone have a link to the original application form so I can see where I can improve it for next year?

<comment><USER8> Here's what I have saved:

* Education (schools, degrees, majors)

* If you're out of school, where do you work, and at what?

* What software tools do you like?

* What's the coolest thing you've built that you can tell us about?

(edit: Misread as "the application was so long", so removed irrelevant bit, and formatting)

</comment></comment><comment><USER12> Bah. Rejected. Oh well, gives me more time to keep going forward.

</comment><comment><USER13> Got in, I went last year too and it was absolutely amazing... looking forward to another great experience!

</comment><comment><USER14> I'm in.

Coming all the way from Newcastle in the UK.

My first start up school. Extremely excited.

</comment><comment><USER15> i got in, too. for the very first moment, i thought it was my YC application. oh well..

</comment><comment><USER16> got in on the second try. sadly, i didn't save any of my answers, so i don't know what i did better this time. maybe following everyone's yc application advice of being interestingly concise helped!

</comment><comment><USER17> Does anyone know how many people were invited and how many people applied

<comment><USER18> From the rejection e-mail, 2400 applied and 716 got in. So you had a 1 in 3.35 chance of getting in.

Congrats to everyone who did, looks like I need to actually start accomplishing something and try again next year :)

</comment></comment><comment><USER19> I got in as a first-timer. Is anyone else from Vancouver heading down?

<comment><USER20> Does Calgary count? lol :)

<comment><USER19> Close enough. :)

</comment></comment></comment><comment><USER21> I didn't. :( C'est la vie.

</comment><comment><USER22> In. Watch out for the crazy-looking redhead :)

</comment><comment><USER23> I got in, my first time. Can't wait!

</comment><comment><USER24> Got rejected this year. To next!

</comment><comment><USER25> got accepted too! any tools we can use to see a list of participants coming?

<comment><USER25> also looking to meet a potential technical cofounder - email me

</comment></comment><comment><USER26> Got in. Now, where to stay?

<comment><USER27> <http://www.airbnb.com/events/startup-school-2011>

</comment></comment><comment><USER28> Accepted! See you there..

</comment><comment><USER29> I got in! very excited!

</comment><comment><USER30> I got in. Can't wait!

</comment><comment><USER31> I'm in! So excited!!

</comment><comment><USER20> In :). Can't wait.

</comment><comment><USER32> and how can apply for this startup school event?

</comment><comment><USER33> Did not get in!

</comment><comment><USER34> I did.

</comment><comment><USER35> w00t!

</comment><comment><USER36> we didn't make it but we gonna keep marching forward..</comment>


Crawling Billions of Pages: Building Large Scale Crawling Cluster, part 1 - <AUTHOR> http://engineering.bloomreach.com/crawling-billions-of-pages-building-large-scale-crawling-cluster-part-1/

<comment><USER2> I guess this fits in here:

Once upon a time I wrote my thesis on building a web crawler. The (tiny) blog post with an embedded preview:

[http://blog.marc-seeger.de/2010/12/09/my-thesis-building- blo...](http://blog.marc-seeger.de/2010/12/09/my-thesis-building-blocks-of-a- scalable-webcrawler/)

The PDF itself:

[http://blog.marc-seeger.de/assets/papers/thesis_seeger- build...](http://blog.marc-seeger.de/assets/papers/thesis_seeger- building_blocks_of_a_scalable_webcrawler.pdf)

It's mostly a "this is what I learned and the things I had to take into consideration" with a few "this is how you identify a CMS" bits sprinkled into it. These days I would probably change a thing or two, but people told me it's still an entertaining read. (Not a native speaker though, so the English might have some stylistic kinks)

</comment><comment><USER3> Part 2, is already there [http://engineering.bloomreach.com/crawling-billions- of-pages...](http://engineering.bloomreach.com/crawling-billions-of-pages- building-large-scale-crawling-cluster-part-2/)

</comment><comment><USER4> > The Windows operating system can dispatch different events to different > window handlers so you can handle all asynchronous HTTP calls efficiently. > For a very long time, people weren't able to do this on Linux-based > operating systems since the underlying socket library contained a potential > bottleneck.

What? select()'s biggest issue is if you have lots of idle connections, which shouldn't be an issue when crawling (you can send more requests while waiting for responses). epoll() is available since 2003. What bottlenecks?

<comment><USER5> Turns out crawlers spend a lot more (wall clock) time waiting for a complete response than they do requesting it. However, scheduling is a much (much, much, much) harder problem to deal with than async i/o but it's not what many people here need to worry about.

</comment></comment><comment><USER6> The challenges with crawling on a large scale still persist as is evident by bloomreach and many other companies building custom solutions because available open source tools cannot handle the scale of such products. SQLBot aims to solve this problem. Product a few weeks from launch. If any is interested: [http://www.amisalabs.com/AmisaSQLBot.html](http://www.amisalabs.com/AmisaSQLBot.html)

</comment><comment><USER7> From part 2 of their article:

> Currently, more than 60 percent of global internet traffic consists of > requests from crawlers or some type of automated Web discovery system.

Where is this number from and how accurate can you make it?

<comment><USER8> It currently feels like 60 percent of global internet traffic is actually crawling their blog right now. Still waiting for it to load.

</comment></comment><comment><USER9> I wish there were more articles about determining the frequency at which one page should be crawled. Some pages never change, some change multiple times per minute, and we do not want to crawl them all equally often.

<comment><USER10> This is a problem I've researched fairly extensively the last few months. My ideal solution looks something like:

* Initial pull * Secondary pulls x time later, where x doubles each time, up to a maximum value, y

y is the one that's tricky to define. For us, it's a value computed based on the frequency of update of similar URLs for that domain, the domain as a whole, similar content, and a few other bits and pieces. Essentially, our thinking is that if we can understand how alike any page is to another cluster of pages, we can use their average frequency of update to give reasonably likely initial values for x, and sensible thresholds for y. We also temper this with how much change there is, to determine whether the differences are something we care about.

Obviously, should the system notice that if its change timings are particularly outside where it'd expect given the cohort assigned, it's then able to start moving around its comparison. An example would be a blog category page which updates so infrequently that it's particularly unusual, or a page with a lot of social feeds on it where there's a lot of flux constantly.

Works pretty well, but if anyone's got a better solution I'd love to hear of it.</comment></comment>


Wall Street Firm Uses Algorithms to Make Sports Betting Like Stock Trading - <AUTHOR> http://www.wired.com/magazine/2010/11/ff_midas/all/1 <comment><USER3> How is this news? Have they not heard of Betfair, which has been allowing this kind of thing since 2000?

The only thing required to make betting like a market is for the gambler to be able to take the bookie's side as well. Many bookie's use Betfair to hedge their positions in fact.

In financial markets terms, a gambler is much like a prop trader. They're betting on a particular position. That position, unlike a more traditional financial instrument, will be the outcome of a race, game, etc. But this isn't really all that different to, say, betting on oil futures.

A bookie on the other hand operates much like a spread trader. They (try to) take a neutral position and just make money on the spread as the difference in the odds between taking and making a bet is really a bid-ask spread.

<comment><USER4> > Have they not heard of Betfair, which has been allowing this kind of thing > since 2000?

Is Betfair really the same thing? Everything I heard about it while reading about prediction markets made it sound like the Vegas bookies that Cantor is being contrasted against - a limited set of bets run at specific times. Not arbitrary dynamically-generated bets at arbitrary times in the game. To me, that's quite different. Like the difference between a video game which is a shooter on rails, and _Halo_ with decent AI bots fighting you.

<comment><USER5> In running and peer to peer betting (Betfair style) are indeed different. You can place in run (live) bets on Betfair.

Interesting anecdote, apparently Betfair had one of the busiest Oracle installs on the planet. They were (are?) creating some pretty neat infrastructure to get away from it: [http://www.infoq.com/presentations/matt- youill-betfair-flywh...](http://www.infoq.com/presentations/matt-youill- betfair-flywheel-tradefair)

</comment></comment></comment><comment><USER6> Cantor Fitzgerald, the firm in the article, previously tried to create a market in box office futures:

[http://www.nytimes.com/2010/04/08/business/media/08futures.h...](http://www.nytimes.com/2010/04/08/business/media/08futures.html)

Cantor is a brokerage firm at heart -- I dealt with them frequently when I worked on Wall Street. Their entire reason for existence is to match buyers and sellers, and take a cut of the transaction. More markets to do so means more money for Cantor.

<comment><USER7> Something like a real-world Hollywood Stock Exchange?

<http://www.hsx.com/>

Used to play that a long time ago...

</comment></comment><comment><USER8> I've been to the M Casino. It's not entirely unique, because other casinos are adding the "in game" betting using the same system, which was rolled out initially at the M. This is very different from the normal sports betting because you can bet during the game. Traditional bookmaking will take bets before an event (sometimes even a long time before, for example, the winner of next year's Super Bowl is already a bet you can make in Vegas) but not during it.

I am not sure if a "in game" system ever existing before in Las Vegas casinos to the extent that the M is doing it. The gambling radio shows seem to think it's a novel thing.

I should add that this market (sports gambling) has long had "traders" (people looking to arbitrage games and do other technical actions), "brokers" (people who tell you what to bet on, similar to a stock broker) and "value" players (in the betting case this is guys who look for an imbalance in value, undervalued positions usually caused by too many people betting on one side of a game, similar to Buffet looking for undervalued companies). Recently, I've heard of one of these brokers advertising themselves as an investment group, particularly to the extent that insider trading isn't illegal in gambling (for example, if you have better information on the seriousness of a injury to a key player you have inside information, but instead of it being illegal as it would be in the stock market, it's actively encouraged).

This market is huge. I heard on the radio that Vegas did ~$85 million in bets on the Super Bowl alone.

As a final note, if you don't think you're gambling when you put money into the stock market, then I'm not sure what to tell you.

<comment><USER9> Regarding insider information in sports betting - yup, no rules against it. The professional gamblers who make a living betting share this kind of information, there are secondary markets that distribute such information (for a cost) etc..... These types of bettors, who generally win are interesting - thier actions cause bookies to change their offerrings immediately. They are on watch lists at various bookies. Bookies look for patterns of syndicate betting (where one guy who's known to be a pro gets a bunch of others to get a bunch of bets in as fast as they can before the bookies move the lines - <USER2> the bookies are all watching each other, both in vegas and around the world).

Guys known to be pros also end up sometimes with different odds offered to them, with lower limits than the average person as to how much they can bet, etc.

</comment></comment><comment><USER9> Well.. sports betting is basically a market where you buy and sell risk. (You don't often sell at your traditional bookie, but you can hedge to not loose too much).

At it's heart it's just a futures market - the instrument being bought is the bet the bookie is offering you at that moment, and that's that.

There's a built in commission in the price you pay to bet. The offerings are set based on both the bookie's view of overall market conditions (he wants customers to bet with him, not with someone else) and his view of the outcome of the wager. And idea book is balanced so that no matter who wins an event, the losers pay the winners and the bookie keeps his 10%. In practice, this generally doesn't happen, and, especially on big events, bookies and the public don't see eye to eye.... there are outcomes in the game that mean the bookie makes no money, or ends up losing quite a bit.

Various companies have presented this as both a person to person market, where you can set up your own pricing and odds (betting exchanges) - and I recall one (out of irealand I think?) that was actually set up like a real futures market where you could buy/sell at any point.

From the professional bettor's point of view it might not look like the stock market, but it's a market, and there area a lot fewer factors to take into consideration than the stock market - so you get a lot of professional bettors who win, consistently, season over season and make a living at this. All they have to do is statistcally beat the bookies. They do their own calcualtions, their own estimations, all that magic, and watch when the books open for a place where they see an advantage. (The pros usually bet early when the odds are posted, the guys who bet for fun bet up until the last second.)

</comment><comment><USER10> As long as there's winners, losers, and a rake, it's gambling. I don't see a buy and hold option.

<comment><USER11> With average "hold" times in the same range as spinning a roulette wheel, it's all gambling.

</comment></comment><comment><USER12> I'm more interested in their ability (or the ability of the folks they partner with for data processing) to pass along events in real-time; or at least close enough to make a bet/prediction prior to the next play when even the official web-based PBP apps of the four major sports (I.E. MLB at-bat, NHL Gamecenter etc.) are often considerably behind the actual play.

</comment><comment><USER13> I think what happened here is a shooting in the foot event. WS has always tried to avoid that HFT and algo trading is not gambling. Or even vanilla or more complex derivatives.</comment>


TINC VPN configuration made easy - <AUTHOR> https://blog.dob.sk/2016/02/18/tinc-vpn-configuration-made-easy/ <comment><USER2> Unless tinc improved vastly its protocol since nine years ago, it should not be used for anything, as the protocol was custom-defined by a cryptographic amateur. It used the same key (bitstring) for encryption and HMAC authentication, or didn't do control messages authentication or integrity protection. There were several more problems with it.</comment>


Ask HN: Open Philosophy? - <AUTHOR>

I just asked about people's philosophies, and someone linked to an article that PG wrote on the subject.  I thought it would be an interesting idea to have an open directory of various philosophies that people could create or follow/revise.
Does this currently exist anywhere?  A place where people write their philosophies on life?  Possible leave it open to others to suggest changes to.  Might be an interesting experiment.  Like a Wiki or something.  I could see myself writing a very lengthy one, and I think it's also interesting that PG compares the current philosophy field as being as new as math back in the 1500s.  I also think it's interesting that some poeple like Steve Pavlina actively go out and search for philosophies, comparing them to "the brain's operating system" which sometimes "needs software upgrades."
Possible topics to cover: meaning of life, political stances, religious beliefs, best computer languages (might be a stretch), people admired/role models, the type of person the philosophy would work best for (college student vs married adult), etc. <comment><USER2> I've thought about starting a wiki just for the purpose of personal theories and philosophies. The caveat in this takes the inherent nature of the Internet into affect: someone disagrees, things will get difficult.

<comment><AUTHOR> I definitely see your point. But I think if someone disagreed, they would simply look at a different philosophy.

From there, I think it would basically involve recommending changes or additions to the theory/philosophy. That would probably be up to the person who "manages" the philosophy, but certainly open discussion and changes would be recommended. Perhaps even a list of recommended public figures that are well-aligned with the philosophy.

I know that Steve Jobs, for example, is Zen Buddhist. But Buddhism is one of those things (if I understand correctly) that isn't necessarily considered a "religion" and people are also encouraged to change it to their own likings. For example, I believe a lot of Buddhist concepts (4 truths), but I don't believe in reincarnation at least in the physical sense. I believe that reincarnation means someone goes through mental changes, and metaphorically become a different or new person through mental and psychological changes.

Sort of thinking out loud on this. Some of it may make no sense.

<comment><USER3> You can actually ask me more about Buddhism. In my country, we have actually 4 different main religions: Buddhism, Islam, Hinduism, and Christianity. Most of the Chinese here believe in Buddhism. Here, Buddhism is really a religion.

But, I agree with what you have said. You can actually extend what you believe or refuse what you don't believe in basically every religions as long as you "believe" that you are actually doing the right thing.

So, is "belief" actually a religion?

<comment><AUTHOR> Siong, did you take the HIST120 class yet? It look at Buddhism, Daoism, and Confucianism. Very interesting, of the three I was a biggest fan of Buddhism.

<comment><USER3> This is my first semester. But, is it an easy A? I need some As to pump up my CGPA.

<comment><AUTHOR> It's not bad, lots of reading though.</comment></comment></comment></comment></comment></comment>


Insider's story on Dem Iowa election app - <AUTHOR> https://threader.app/thread/1224820389387223041 <comment><USER2> Lots of great quotes in here, but especially: "What should have been done? The app shouldn't have been built. This didn't require an app. There are lots of ways to submit and verify vote counts without needing a custom app. At least they kept the paper backup..."</comment>


Apple Acquires Mapsense, a Mapping Visualization Startup - <AUTHOR> http://recode.net/2015/09/16/apple-acquires-mapsense-a-mapping-visualization-startup/ <comment><USER2> Although with a shaky start, Apple maps has improved in leaps and bounds. A long way to catch up with Google Maps but they are on the right track.

<comment><USER3> Yep. My only issues are the foot navigation and public transport

<comment><USER4> While I do understand that in the USA the transportation culture is very different, my European self can't help but equate that to "My only issues are with the two only modals everyone uses daily" :-)

<comment><USER3> I am German actually, mainly use the app for car navigation</comment></comment></comment></comment>


An Update is available for your computer - <AUTHOR> http://www.stickycomics.com/computer-update/ <comment><USER2> I must have a different version of Mac OS X than the artist -- my credit card never gets billed when Software Update grabs me the latest updates.

<comment><USER3> And Snow Leopard was only $29 if you had Leopard. Microsoft charges you a lot more for Windows.

<comment><USER4> Don't forget though that operating systems don't come out nearly as often for Microsoft--once every 3-5 years, and you don't pay for service pack upgrades.

Apple makes you pay for those service packs (Think Snow Leopard).

BTW upgrades (although more frequent) cost $129 usually, so in the end Mac users pay a lot more for their operating systems because they have to pay for all the service packs, and each OS upgrade (which comes more often) costs as much.

<comment><USER2> So you're saying that less frequent updates is better than more frequent? And when you say MS doesn't charge for "service packs", you're playing semantics. Apple doesn't charge for point updates, either. As to your final point, I don't recall ever "having to pay" for "all the service packs".

Basically, you're not making much sense.

<comment><USER4> 1\. No, I am not saying that. Please try to understand what I'm saying. I meant less frequent updates you have to pay for.

2\. What do you mean "playing semantics"? Its service packs are about as frequent as OS X's.

3\. I am referring to the incremental updates (Like Snow Leopard) despite having already paid for Leopard, which I am comparing to service packs.

Basically you're not making an attempt to understand my point, and instead trying to confuse other readers with your confusion.

<comment><USER2> Both Windows and Mac OS X have major updates that you pay for, and minor updates you don't pay for. You are trying to create a distinction where there is none.

Mac OS X doesn't have "service packs", so I don't know how you can say they are "less frequent" -- they simply don't exist, as such.

That's what I mean by semantics. You're talking FUD like a computer store sales drone.

</comment></comment></comment></comment></comment></comment><comment><USER5> I'll be laughing when Lion is released free of charge. (I have no sources, just a hunch.)</comment>


Neue Haas Grotesk — History - <AUTHOR> http://www.fontbureau.com/nhg/history/ <comment><USER2> So the font hipsters have found something better (older, more obscure, purer, rarer, harder to pronounce) than Helvetica while, helpfully, still being indistinguishable from Helvetica (and Arial for that matter) to the average plebian.</comment>


John Yudkin: the man who tried to warn us about sugar (2014) - <AUTHOR> https://www.telegraph.co.uk/lifestyle/wellbeing/diet/10634081/John-Yudkin-the-man-who-tried-to-warn-us-about-sugar.html <comment><USER2> I think it's not just sugar. We want to single out a single culprit, but it's a multi-faceted problem. We are adapted to digest glucose and fructose, it could trace toxins in the process of making it, it could be a combination of lifestyle plus tons of fructose, it could be the disrupted circadian rhythm - nobody really knows. For sure, we've never had so much vegetable fat. According to Ray Peat, more than a gram of polyunsaturated fat is toxic and cancer-causing. According to a few of his followers, the desaturation of cardiolipin in mitochondria leads to instability and mitochondrial dysfunction, which is now recognized as the cause of many chronic diseases. I read that the iron overload, which replaces manganese with iron in the mitochondria is another possible culprit. Honestly, I have the gut feeling glucose is totally fine - even in large quantities. And Ray Peat thinks the same.

</comment><comment><USER3> with millions at stake, the truth is difficult to discern. When it's billions, you'll never find it.

<comment><USER4> truth eventually was found with regard to tobacco and lead, sugar is just around the corner.

</comment></comment><comment><USER5> Ah yes, a career ended in part thanks to a vindictive propaganda campaign by Ancel Keys. He of the very carefully cherry picked 7 countries study "proving" fat was the culprit.

It's a shame Yudkin didn't live long enough to see his reputation mostly restored.

Also a reminder that the Telegraph was once a half decent paper.

</comment><comment><USER6> > A campaign that calls for sugar to be treated as a toxin, like alcohol and > tobacco, and for sugar-laden foods to be taxed, labelled with health > warnings and banned for anyone under 18.

So, we're, like gunna ban fruits?

Seriously, it's kind of crazy to have the immediate response to "the mainstream consensus was totally wrong" to be "let's use the force of the law to enforce the new consensus!" A little bit of humility is called for, I think. By all means improve the official recommendations, but let people make their own decisions about what they put in their bodies.

Tangentially, I've become convinced that the actual #1 worst ingredient we're eating is too much vegetable oil:

[https://www.breaknutrition.com/omega-6-fatty-acids- alternati...](https://www.breaknutrition.com/omega-6-fatty-acids-alternative- hypothesis-diseases-civilization/)

<comment><USER7> To be fair, _we_ were the ones that selectively bred fruits (and vegetables!) to be so sugar-rich that zoos can't even feed them to some of their animals that traditionally only eat fruit.

If this guy is correct, this would be no different than if we found some other toxic substance in our fruit. The point is that it's toxic and it's bad for us, and decisions would need to be made to account for that.

>but let people make their own decisions about what they put in their bodies.

Again, if this guy is correct, how would this be any different than tobacco? We don't let young people decide to put tobacco or booze in their bodies because science has shown they're not old enough to make that decision well.

<comment><USER8> * To be fair, we were the ones that selectively bred fruits (and vegetables!) to be so sugar-rich that zoos can't even feed them to some of their animals that traditionally only eat fruit.*

I've never heard of this. Got a source?

<comment><USER9> [https://qz.com/1408469/humans-have-bred-fruits-to-be-so- high...](https://qz.com/1408469/humans-have-bred-fruits-to-be-so-high-in- sugar-a-zoo-had-to-stop-feeding-them-to-some-animals/)

<comment><USER8> Much appreciated.</comment></comment></comment></comment></comment>


Ask HN: What is with Rotten Tomatoes' HTML Source? - <AUTHOR>

1. http://rottentomatoes.com<p>2. View source <comment><USER2> If you mean the crazy amount of whitespace, it may be caused by a templating system. For instance, in JSP JSTL:

      <c:choose>
      <c:when test="${!empty article}">
      <c:out value="${article}"/>
      </c:when>
      <c:when test="${!empty comments}">
      <c:out value="${article}"/>
      </c:when>
      </c:choose>

Each of the choose/when tags has a newline after it, so even though the tag is not output into the resulting HTML source, it causes a literal newline to be emitted. This doesn't normally matter, since HTML collapses multiple runs of whitespace into a single space.

However, for places where you can't have any whitespace (like the middle of a word) you can work around that by concatenating all the tags into one long line, or by strange arrangements of opening/closing angle brackets:

      <c:choose
      ><c:when test="..."
      ><c:out ... /
      ></c:when
      ></c:choose>

Some webservers like Tomcat also provide the ability to strip all excess outgoing whitespace, which preserves the readability of the source files.

</comment><comment><USER3> I use smarty, and making the template logic readable sometimes leaves extra newlines and whitespace. You can wrap {strip}{/strip} tags around it to remove it though. This is what I use to get all code in a single line as on <http://www.dealspyer.com>

</comment><comment><USER4> Only time I've seen that happen was with ColdFusion or Java-powered sites that don't strip the lines used by inline logic, eg where you see 10 empty lines, there might be an if/else snippet running. At runtime, the language runs through those parts, but keeps the space intact.</comment>


I've worked the coronavirus front line – and I say it's time to start opening up - <AUTHOR> https://nypost.com/2020/04/27/ive-worked-the-coronavirus-front-line-and-i-say-its-time-to-start-opening-up/ <comment><USER2> >We usually average 240 patients a day. For the last week, we averaged fewer than 100. That means our patients in this diverse, low-income community are afraid to come to the ER for non-COVID care.

It's weird to draw this conclusion. It may be likely that the reduced number of ER visits are instead tied to: less driving, staying home, less work stress, fewer dangerous activities, fewer human interactions, etc.</comment>