Stack Overflow Private Beta Begins - <AUTHOR> http://blog.stackoverflow.com/2008/07/stack-overflow-private-beta-begins/

<comment><USER2> Jeff Atwood has said that stackoverflow.com is partially a response to the massive suck factor of sites like Experts Exchange. One of the most annoying things about researching programming topics is trying to find something on google and accidentally clicking an Experts Exchange link. I really wish that site would just go away.

<comment><USER3> What's the problem with Experts Exchange, exactly? I'm speaking from mainly a .Net point of view, but I've found solutions to many, many problems there.

<comment><USER4> My problem with the site is twofold.

One, they're deceptive. Top of every page says you to pay to join to see the answer, shows scrambled answers, etc. Bottom of the same page shows the actual answer.

Two, the ratio of crap to goodness on their page is astoundingly high. If I counted pixels, it's like 20:1. Painful to use.

Stackoverflow is also trying to tackle issues like out of date answers, the anonymous user experience, etc.

<comment><USER5> Also who picked the name ExpertSexChange. I mean come on....

<comment><USER6> It's better than an amateur sex change.

</comment></comment></comment></comment></comment><comment><USER7> "I'm sure it'll still suck at the end. But with your help, less. Much, much less! With any luck, we might even flirt with.. wait for it.. not sucking! A man's gotta dream."

Cuil probably should have had text resembling this in all their press releases. Nothing like setting expectations where you have a chance to exceed them.

</comment><comment><USER8> Their weekly podcast on it is good fun to listen to. Nothing earth shatteringly technical, but an interesting view of things.

</comment><comment><USER9> [http://blog.stackoverflow.com/wp- content/uploads/stackoverfl...](http://blog.stackoverflow.com/wp- content/uploads/stackoverflow-beta-design-large2.png)

<comment><USER10> Is it just me, or does this look like a cleaner version of DZone, if DZone were .net focused?

<comment><USER11> From what I've heard from the podcasts, two points. First, it's not a link submission site, it's question/answer with digg-like voting for questions and answers. Second, the mockup has all .NET content, but it is not specifically .NET-focused.

<comment><USER10> Thank you for the clarification - I'd not listened to the podcasts, and was judging just based on that screenshot.

</comment></comment></comment></comment><comment><USER12> It is fantastic to see a programming community venture between Joel Spolsky and Jeff Atwood take off.

I am so looking forward to this and my expectation is already very high which is amazing considering there is no hype (yet).

<comment><USER6> _It is fantastic to see a programming community venture between Joel Spolsky and Jeff Atwood take off._

Why? Because they talk about themselves a lot?

<comment><USER13> I think Spolsky often has interesting things to say about the business of programming. Atwood... well... not my cup of tea.

<comment><USER6> I agree completely. Spolsky's essays are pretty enjoyable.

But neither are necessarily qualified to actually write software anymore.

<comment><USER4> Well, proof is in the pudding - apparently Atwood is doing a good chunk of the coding on stackoverflow.com.

Joel seems useful for funding, business advice, his community, and to tell Atwood that he really should learn C.

</comment></comment></comment></comment></comment><comment><USER14> Damn didn't sign up for the beta....looks good though, cant wait for it to go live!

</comment><comment><USER15> Ack. Trebuchet everywhere.

</comment><comment><USER16> Is this some kind of peculiar blend between Digg and Yahoo! Answers?</comment>


Ask HN: Which free email provider for custom domains? - <AUTHOR> I have several personal domains that I have self hosted until recently at SoYouStart. With the ongoing pandemic, it becomes hard for me to access my funds through the payment card so I have to cancel the server. I've been researching the free email hosting options last few days and it seems like Yandex offers the most for custom domains but wanted to ask if anyone uses anything that can be recommended. I don't need more than 5 emails addresses per domain (plus few aliases).
I was looking also at Zoho Mail, but they allow only web mail access with the free tier plan. <comment><USER2> Zoho's founder is an ultra-right winger. I recently cancelled all my subscriptions to Zoho.</comment>


Let Google do the patching with new managed base images - <AUTHOR> https://cloud.google.com/blog/products/containers-kubernetes/exploring-container-security-let-google-do-the-patching-with-new-managed-base-images <comment><USER2> I'm Tech Lead/maintainer for these images. Happy to answer any questions!

<comment><USER3> Why is 18.04 not an available-at-launch image choice?

<comment><USER4> I think Ubuntu 16.04 is used internally a lot with Google, as they have hardened it themselves. I believe GKE On-Prem will also be based on Ubuntu 16.04 for this reason.

<comment><USER5> Not that much anymore. [https://www.zdnet.com/article/google-moves-to-debian- for-in-...](https://www.zdnet.com/article/google-moves-to-debian-for-in-house- linux-desktop/)

</comment></comment></comment></comment><comment> rob-olmos "The CentOS managed base image uses `yum` and `rpm` for package management, and these pull RPM files only over HTTPS connections."

That's interesting. Is there a reason for that?

IIRC the stock CentOS doesn't use HTTPS for its yum/rpm repos and I figured it wasn't necessary to use HTTPS since the package signature is verified.

<comment><USER6> a MITM can trick your server into thinking there are no updates, and no error will be raised

<comment><USER7> That, and an attacker could do a replay attack, and potentially send you to an earlier (vulnerable) version.

</comment></comment></comment><comment><USER8> The Ubuntu base image is Ubuntu 16.04, which is an interesting choice. 18.04 LTS has been out for _awhile_ now, so I would have expected it to at least be an option.

<comment><USER2> Whoops, that looks like an oversight. 18.04 is definitely available as well.

</comment></comment><comment><USER9> What's the difference between this and pulling an official image from dockerhub? For example [https://hub.docker.com/_/ubuntu/](https://hub.docker.com/_/ubuntu/)

<comment><USER10> It's betting that Google are better package maintainers than Debian/CentOS/Ubuntu, especially when it comes to maintaining container images. From a purely technical, and financial, point of view, it's likely true.

Of course, they could have bolstered the distro teams. And the fact that the repositories are within GCR, not Docker, is just convenience.

It brings you closer into Googles warm, technototalitarian embrace, is what I mean.

<comment><USER11> I would suggest you look a little deeper into Debian's history and work on reproducible builds: [https://wiki.debian.org/ReproducibleBuilds](https://wiki.debian.org/ReproducibleBuilds)

They've been at it (looks like) since ~2014, and their goals and motivations seem 100% in line with google, but at the package/distro level, not the container-base-image level (highly related): [https://tests.reproducible- builds.org/debian/unstable/amd64/...](https://tests.reproducible- builds.org/debian/unstable/amd64/stats_pkg_state.png)

<comment><USER10> > goals and motivations seem 100% in line with google,

It's been a long time since I've believed in their idealism, yes, but I still think accusing Debian of being in the advertising and surveillance business is a bit harsh.

<comment><USER11> > Google are better package maintainers than Debian

My intent was to challenge your statement that google are better package maintainers than Debian, specifically w.r.t. reproducibility of builds.

It's disrespectful to Debian to think that they haven't been pushing for secure, auditable, trusted software running on trusted computers.

It's practically their reason for existing: taking open, auditable software, packaging it in reproducible fashion for use by anyone who wants it.

[https://www.debian.org/social_contract.html#guidelines](https://www.debian.org/social_contract.html#guidelines)

Imagine if Debian had similar financial support available compared to Google/RedHat? The best info I could find is here: [https://www.spi- inc.org/corporate/annual-reports/2017.pdf](https://www.spi- inc.org/corporate/annual-reports/2017.pdf)

`This covers the Period January 1, 2017 – December 31, 2017`

`Gross Income </comment></comment></comment></comment></comment><comment>-- 635,311.59`

...and in that way, yes: google can afford more package maintainers, more scrutiny, but if they are "better package maintainers" it's at those margins and due to economics rather than ability or desire.

<comment><USER10> > My intent was to challenge your statement that google are better package > maintainers than Debian, specifically w.r.t. reproducibility of builds.

Ah, I believe there's a misunderstanding coming from misreading of my statement: what I wrote is that the _reason to upgrade_ would be the _belief_ that they are better, and that if you restrict yourself to _certain measures_, they probably can, by throwing more money at the problem. I hoped that he latter part of my comment probably makes it rather clear that Google wouldn't actually be better as far as I'm concerned. Even from purely technical perspective, I'm fairly sure Debian is willing to support many architectures Google will ignore.

</comment></comment><comment><USER12> This is awesome - is there any thing similar for Azure? Or possible 3rd party solutions that do the same? We don't leverage GCP but I am very envious of this feature. Would love the community to help point me in the right direction to get same functionality - mainly not having to maintain and patch Ubuntu 16.0.4 images

<comment><USER13> The good news is you don't have to use GCP! The very nice people over there have made them available for anyone -

[https://cloud.google.com/container-registry/docs/managed- bas...](https://cloud.google.com/container-registry/docs/managed-base-images)

So, to be clear, no matter what cloud you use, if you create a Dockerfile like the following:

       FROM launcher.gcr.io/google/ubuntu16_04:latest
       CMD echo "foobar"

This should work fine.

Disclosure: I work at Microsoft on Azure.

<comment><USER14> You moved to MS?!? Your about section still mentions your Google address. Good luck!

<comment><USER13> Whoops! Updated :)

Thanks!

</comment></comment></comment></comment><comment><USER15> Does Google (or any of the other cloud vendors) audit/review the actual source code of packages used in the images? such as apache, nginx, openjdk, etc? or do they just run a scanner that test for known vulnerabilities?

</comment><comment><USER16> wow. why would anyone want this? in a production environment you want tight control over software versions, not surprise updates.

<comment><USER17> I generally agree with you. However I also feel that the ABI guarantees by Red Hat, Canonical and the Debian project are fairly trustworthy. Rolling forward automatically is much less risky, taken overall, than a rotting pin.

</comment></comment><comment><USER10> "Let Google do the patching"

Also replace your shepherd dogs with wolves, wolves are bigger, faster, and will do it for free[*].

<comment><USER18> I don't understand this comment, what are you suggesting Google will do? Surreptitiously insert code into your binary during a patch?

If you are running in Google cloud, its their machines and they have power to do pretty much whatever they want anyway. How would this feature affect anything?

<comment><USER10> Once you're dependent on their packaging process, why would they ever have to introduce whatever tracking or restriction they want "surreptitiously"? It'll be a part of their internal monitoring and diagnostics package.</comment></comment></comment>


Obama Wants Kids To Make Video Games - <AUTHOR> http://gizmodo.com/5640744/obama-wants-kids-to-make-video-games

<comment><AUTHOR> I love it! I was part of the "where in the world is Carmen" team. What a fantastic way to motivate kids in science, technology, engineering, and math.</comment>


Amazon's New Brand Pages Built with React.js - <AUTHOR> https://medium.com/@blairanderson/amazons-new-brand-stores-utilizing-react-framework-a22f56e9e206?source=linkShare-fa32a1e0cb0a-1500348422 <comment><AUTHOR> Given the constantly heated discussion about Patents, I was surprised to see Amazon using Reactjs for a very public interface.</comment>


World Backup Day - Today - <AUTHOR> http://worldbackupday.net/

<comment><USER2> And don't forget to perform a diff too, it helps me lots before or after backups.</comment>


Santa Cruz decriminalizes magic mushrooms - <AUTHOR> https://kion546.com/news/2020/01/28/santa-cruz-decriminalizes-magic-mushrooms/ <comment><AUTHOR> I used magic mushrooms back in the 70's, not knowing that they would someday be used to treat severe depression. Mine was debilitating so I had to drop out of college. Magic mushrooms really helped me put my life back together.</comment>


MIT Digital Drawing Board - <AUTHOR> http://www.youtube.com/watch?v=df8wAla57PI <comment><USER2> The core of that demo is the Working Model 2D physics engine (<http://www.design-simulation.com/WM2D/index.php>), which wasn't produced at MIT as far as I know. MIT added the whiteboard interface. The recognition of circles, arrows, and other symbols is also part of Working Model. One of my friends (a Stanford prof who teaches ME) coded a large part of the engine, and he told me it worked like a charm on Intel 486 chips. I'm helping him look for some seed money for a related venture, so interested angels should drop me a line. (YC isn't a good fit for him.)

<comment><USER3> In the Steven Levy book Hackers, I gather that the MIT hackers in the 60s/70s could do tasks like shape recognition with hands behind their back, in assembly, in less than 30 lines of code.

I'm not sure if current MIT hackers can do amazing robotic/visual recognition coding that efficiently, but I haven't got any books on modern-day MIT.

</comment></comment><comment><USER4> The technology is quite old.. seems to be born out of a pre-2001 project called ASSIST ( <http://rationale.csail.mit.edu/project_assist.shtml> ). Microsoft has a Power Tool for Tablet PC's called Physics Illustrator that does something similar: [http://www.microsoft.com/windowsxp/downloads/powertoys/table...](http://www.microsoft.com/windowsxp/downloads/powertoys/tabletpc.mspx)

</comment><comment><USER5> That's truly an amazing piece of technology with a wide range of potential. MIT certainly holds just as much (if not more) of the proportion in innovation by introducing the whiteboard. I'm extremely interested in seeing what kind of work is currently being done on this piece of tech. I'm curious as to why they're sticking strictly to 2-dimensional space.

any links?

</comment><comment><USER6> Wile E. Coyote sure could have used this.

</comment><comment><USER7> even on a video like this, the YouTube comments are absolutely retarded

</comment><comment><USER8> Wow that is the coolest thing ever. Would love to have one of those for my mechanics classes. Great work.</comment>


Wealth and Religion on Flickr [graph] - <AUTHOR> http://www.flickr.com/photos/jurvetson/2275614130/

<comment><USER2> As a religious person, I don't find the graph itself to be anti-religion. The teachings of Jesus recorded in the Christian scriptures repeatedly warn that material wealth can interfere with one's relationship with God, and other (many? most?) religions make similar observations. So one way to look at this data is that it simply confirms this precept.

</comment><comment><USER3> Anti-religious links come up occasionally on reddit and elsewhere. Reddit commentors aren't a good sample of the population, but they are a good sample of the population that is 1) youngish, 2) professional, 3) media-aware, and 4) intellectually self-conscious.

And their attitude toward religion? Contemptuous, resentful, cheeky, mocking. ...it lends me to believe that the 1-4 things I described above simply raise people to a cynicism that won't tolerate the more obvious fairy tales. Nothing too complicated. You aren't dealing with Spinoza here, but just kids who got out of Mayberry.

Anyway, those same 1-4 things (when present in large amounts) are exactly what produce wealth in society.

<comment><USER4> >Contemptuous, resentful, cheeky, mocking. ...it lends me to believe that the 1-4 things I described above simply raise people to a cynicism that won't tolerate the more obvious fairy tales.

Not to defend religion, but young people tend to be "Contemptuous, resentful, cheeky, mocking" of pretty much anything that isn't centred around their own world.

<comment><USER5> Yes, even in Plato's Laws the speakers remark how being an atheist is a young person thing. CS Lewis was an atheist until around his late twenties.

</comment></comment></comment><comment><USER6> _Respondents were given a +1 if they believe faith in God is necessary for morality_

Is that really a measure of religiosity? Is someone who believes that necessarily more religious than someone who doesn't?

</comment><comment><USER7> Make sure you don't miss the US data point.

</comment><comment><USER8> Causation, correlation, or coincidence?</comment>


The Product Death Cycle: Why it happens, and how to break out of it - <AUTHOR> http://andrewchen.co/this-is-the-product-death-cycle-why-it-happens-and-how-to-break-out-of-it/

<comment><USER2> Pretty obvious on reading but so easy to forget when you're designing a new product.

We go through this where I work with finished goods. If we don't get traction on a product immediately we start to get all kinds of suggestions from Sales Reps on what their big customer wants. In the end we end up with a list of features "we should add/support" that's 50 miles long. Plus invariably some feature request conflicts with another so even if we were willing to take all the feedback and run with it we won't ever be able to make everyone happy.

Despite this though it seems like every few years we repeat the process all over again on some new prototype.

</comment><comment><USER3> This problem becomes even more complex and expensive in the enterprise world.

Asking users (or IT) for features will only lead to "can I send an email from this screen?"or something non-trivial involving architectural changes.</comment>


Hawaii Supreme Court Rules in Favor of Building Thirty Meter Telescope - <AUTHOR> http://www.staradvertiser.com/2018/10/30/breaking-news/supreme-court-rules-in-favor-of-tmt/ <comment><USER3> The actual legal issues in question are barely touched on in the article:

> But some environmentalists and Native Hawaiian groups say the spread of > observatories on the summit has polluted the mountain, interfering with > traditional cultural and religious practices, or are actually infringing on > the sovereignty of the Hawaiian kingdom.

The links in the article to the actual decisions are broken (for me at least) The article [https://bigislandnow.com/2018/08/08/supreme-court-rules- in-f...](https://bigislandnow.com/2018/08/08/supreme-court-rules-in-favor-of- state-in-appeal-relating-to-tmt/) implies that the issues were largely procedural and this decision isn't actually deciding if any of the above are true.

So I'm left seeing big claims, but no real idea on if those claims are true- but-ignored, mostly-not-true, or a fringe-group-only-viewpoint. (While the media coverage IMPLIES that those claims ARE decided, and it's that implication that bugs me)

<comment><USER4> > infringing on the sovereignty of the Hawaiian kingdom

Is there actually any legally recognized sovereignty for Hawaii or native Hawaiians? Tried doing a quick search but it all came back with an ongoing sovereignty movement but nothing similar to the Native American tribes.

<comment><USER3> My understanding (based on visiting hawaii as a tourist and not much else) is that no, there's not a US-legally recognized sovereignty, but there is a step back from:

* "They voluntarily joined the US" language

* the repression of culture - in particular but not limited to language, which was apparently ruthlessly quashed for a long while and is enjoying a lot more respect today, relatively speaking.

In a courtroom I doubt this would count for much, but in a war of PR releases it can be significant, and most of what I found about this case was press releases.

<comment><USER5> There's a rich history of corporations and the us government screwing over Hawaiians. The monarchy was overthrown by a group of businessmen and sugar planters after they forced Queen Liliuokalani to abdicate. Two years later it became a US territory against the wishes of the natives. Then the sugar industry help keep it a territory for 60 years because they could import cheap foreign labor.

<comment><USER6> History of Hawaii is all about using force to take land from the population. First settler where from the Marquesas Islands and they were conquered by the Tahitians.

<comment><USER7> What's your point?

Are you saying that it doesn't matter that sovergty was taken violently from the Hawaiians because their ancestors conquered the original inhabitants hundreds of years ago?

Would it be fair if Russia came in and took Hawaii from the US because the "History of Hawaii is all about using force to take land from the population"?

<comment><USER8> But how far back in history do you want to go? Why is it that pre-US owners are the real ones and not the pre-pre-US ones?

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> I'm glad this got pushed through - environmentalists in Hawaii can be an interesting bunch, and often choose to blockade things that are high profile simply to get their message out, even if the ecological impact is highly minimal. A great example of this in the past was the Hawaii Superferry[1], which was blockaded by environmentalists who said that it would damage the reef. Which while it might be true, standard shipping freighters already travelled the same route and had a higher ecological impact than the lighter dual-hulled ferry, which would have taken a lot of the shipping volume of the more damaging ships. By blocking the ferry, the environmentalists got a lot of publicity, but ultimately the reef ended up suffering more as the ferry got shut down.

With this, the ecological impact will be highly minimal (based on the impact of the existing observatory and the environmental studies done after the plans were drawn up), but it's very high profile so a natural target for them. I'm very glad that the court pushed it through as they had no data to back up their claims that that it would pollute the mountain. The claim that it interfered with traditional and cultural practices has some merit, but that's only because the entire mountain of Mauna Kea is considered sacred - <USER2> about the peak itself is special. Also, there's already a ton of observatories up there[2], so it wouldn't be changing the status quo in any way. Overall I personally saw their protests as more political than based on arguments with merit.

[1] [https://en.wikipedia.org/wiki/Hawaii_Superferry](https://en.wikipedia.org/wiki/Hawaii_Superferry) [2] [https://i.imgur.com/7TjQd52.png](https://i.imgur.com/7TjQd52.png)

<comment><USER10> The "SuperFerry" was a huge boondoggle that tried to endrun around the EIS process which dozens of other ferrys around the country seemed to have no trouble complying with. The economics never supported a passenger ferry and the whole thing was a smokescreen to milk DoD.

</comment></comment><comment><USER11> I visited the top of Mauna Kea a couple of months ago, as a tourist. It is a fascinating place, already so populated with telescopes that it is tough to imagine how adding another (likely built more carefully than older ones) could cause grave damage, interference with other uses of the area, etc.

On the other hand: some of the telescopes have been there many years and are probably somewhat obsolete by today's standards, producing little new science. Perhaps one of the existing structures could have been removed to make room for the TMT, to lessen conflict.

<comment><USER12> > Perhaps one of the existing structures could have been removed to make room > for the TMT, to lessen conflict.

TMT project will in fact remove three old telescopes.

<comment><USER13> _The Governor_ decided that three telescopes would come down. One of these is the tiny UH Hilo education telescope, so it's not really anything like the others. Many people think that this particular telescope, the only one whose purpose is directly aimed at educating the local astronomy students, should _not_ be the one sacrificed on the altar of the TMT, especially since its local impact is practically zero.

</comment></comment></comment><comment><USER14> I don't think this ruling changes much. The TMT project had permission to start construction 3 years ago. They could not even hold the ground-breaking ceremony, because protesters blocked the access road. Every time the TMT construction crews tried to drive up the mountain, protesters would stand in the road, and block the vehicles. A couple of hours later police would show up. They would stand around for 3ish more hours, and then arrest perhaps 5% of the people blocking the road. By the time that was done, it was too late for the construction crews to get to the summit and do any work, so everyone drove back down. The few people who were arrested were immediately released once they arrived in Hilo, so they'd be ready to do it all again the next day if the crews tried to return to the mountain. No significant fines were ever levied on the arrested protesters.

The only way the TMT construction will be able to proceed is if local law enforcement is willing to arrest dozens of protesters (including "aunties" \- photogenic elderly Hawaiian women) every week day, and not release them immediately. There is absolutely no reason to believe that will happen.

Even if the local law enforcement officials are willing to perform mass arrests, there are lots of other pressure points that the protesters could attack. I would not be surprised to see the protesters shut down the University of Hawaii, which hosts the Institute for Astronomy that runs Maunakea Observatory, because that university has a very active Hawaiian Studies program.

I worked for an observatory on Maunakea when the the first set of TMT construction protests took place. The protesters were allowed to build an unpermitted shelter building, to make blocking the road more convenient for them. If they spend half a day piling rocks in the road, they can declare that it is a sacred shrine, and the road maintenance crews cannot simply remove it. Meanwhile, our observatory had to go through a formal review process with an outside board if we wanted to move a small weather station from one side of our building's roof to another side.

</comment><comment><USER15> This is great to hear! Mauna Kea is a far better location for the kind of science TMT will be doing [1], especially when it has to compete with the European Extremely Large Telescope in the southern hemisphere.

[1]: [http://casca.ca/wp-content/uploads/2017/03/CATAC-Report- Fina...](http://casca.ca/wp-content/uploads/2017/03/CATAC-Report-Final.pdf)

</comment><comment><USER16> This is actually a fun case to read, I was mainly looking for what the dissenting opinion was, since it was 4-1.

I think at least one of the points can be appealed in the federal courts, if the US Supreme Court would be down to hear it - so there would be several gambles.

> In any event, as held by the Ninth Circuit Court of Appeals in Navajo Nation > v. U.S. Forest Serv. , 535 F.3d 1058, 1077 (9th Cir. 2008) RLUIPA "applies > only to government land-use regulations of private land such as zoning laws > not to the government's management of its own land. Therefore, this point of > error is without merit.

Not that the government would ever cede control over its own land, I just feel like the current Supreme Court would be more lenient to religious arguments.

All the rest of this particular case ignores the religious arguments and focuses on the procedural stuff, which was all done by the book and expected of a state and federal permitting agency, at least compared to arbitrary claims by religious folks.

Now on to the dissenting opinion:

I gather no real rebuttal, just a partial affirmation to "points I-III" and no comment on the other points. hm.

Applauds from me.

</comment><comment><USER17> I'm sad that some native people are upset.

I wish it was easier to build things like this off of the Earth, in space or on the Moon or Mars, etc.

<comment><USER18> In recent decades, many large and important observatories have been constructed in the desert of northern Chile ... pretty much uncontested.

[https://en.wikipedia.org/wiki/Category:Astronomical_observat...](https://en.wikipedia.org/wiki/Category:Astronomical_observatories_in_Chile)

<comment><USER14> There is something to be said for having at least one 30 meter class telescope in the Northern hemisphere. There are parts of the sky which are never visible from Chile.

</comment></comment></comment><comment><USER19> >Thirty Meter astronomers had said if they didn't get a green light to build on Mauna Kea, they would build it on La Palma in the Canary Islands, off Africa.

Good for them

<comment><USER20> Mauna Kea is 6000 ft higher though.

<comment><USER21> Altitude is not everything, and higher altitude does not automatically translate into better performance of the instrument. There are many, many factors that matter, including light pollution, transparency, cloud cover, air turbulence, jet streams, etc.

<comment><USER15> A report by the Canadian Astronomical Society (Canada has a ~15% stake) found that with taking all these variables into play, Mauna Kea is still the best site for TMT. See page 35 for the final recomendations: [http://casca.ca/wp- content/uploads/2017/03/CATAC-Report-Fina...](http://casca.ca/wp- content/uploads/2017/03/CATAC-Report-Final.pdf)

<comment><USER21> Of course. I was not saying Mauna Kea is not a good location. I was just saying there is a whole bunch of factors that matter besides altitude.

</comment></comment></comment></comment></comment><comment><USER22> Feel good compromise: Eminent Domain a spot of Zuckerberg's 750-acre property.

[https://www.theguardian.com/technology/2017/jan/23/mark- zuck...](https://www.theguardian.com/technology/2017/jan/23/mark-zuckerberg- hawaii-land-lawsuits-kauai-estate)

</comment><comment><USER23> Off-topic: the publication is named "staradvertiser". (The adds do seem unusually well-targeted to me.) It's the first time I see a publication whose name is clearly trying to appeal to advertisers rather than viewers. Has anyone else seen any others? Any insights about their counter-intuitive decision?

<comment><USER24> Advertiser was a common name for newspapers at the time. It's an old publication (although I'm pretty sure it was called SomethingElse Advertiser). I'd guess it's using the older definition of advertiser "call attention to". The fact that the ads were well targeted was coincidence.</comment></comment>


My project: CSVGet -- Get structured data from sites as CSV - <AUTHOR> http://github.com/fizx/csvget/tree/master

<comment><USER2> The real magic behind this gem is another one called Parsley, which is an astounding library for screen scraping.

<http://github.com/fizx/parsley/tree/master>

They've even built an entire app on top of the library: <http://parselets.com/>

</comment><comment><USER3> Use <http://selectorgadget.com> to help make the selectors, too.

<comment><USER4> But why mess with the selectors by hand? <http://search.cpan.org/~vbar/HTML- ListScraper-0.05/> can discover the structure automatically (well, sometimes :-) - some pages just aren't regular enough, but it does work on HN, for example)...

</comment></comment><comment><USER5> Wow, incredibly cool. I did the same thing with collection of curl / grep / sed / awk, and it was awful. I later redid it with some python library, and then with hpricot, and most recently with scrubyt. Each step was a little bit better, but I really should have been looking towards making a more generalized solution like this.

Well done!

</comment><comment><USER6> A flag to output JSON would be nifty, then you could pass it through a filter [1] and get interweb-grep on steroids.

[1] <http://goessner.net/articles/JsonPath/>

<comment><AUTHOR> Um, you got it. :) I just added a "jsonget" binary to the package.

<http://gist.github.com/177304>

<comment><USER6> Now that's service!

</comment></comment></comment><comment><USER7> Oh my, this rocks. What would be even cooler is a library to use these functions. That would beat me to it, since I was thinking about a general data interface for websites too. If I could implement your effort into my code (PHP) that would be so awesome. Anyhow, nice idea though.

<comment><AUTHOR> <http://github.com/fizx/parsley/tree/master> is a C library which represents the core of the parsing functionality. A PHP binding is quite possible, and indeed, there already are bindings for Python and Ruby. In fact, I might just go look at how PHP bindings are done in general...

</comment></comment><comment><USER8> This is fantastic. I do a load of data scraping of the web and this (plus selector gadget) is going to make my life sooooo much easier.</comment>


War on Sony – 102 million accounts compromised - <AUTHOR> http://www.bandwidthblog.com/2011/05/03/war-on-sony-102-million-accounts-compromised/ The story behind the biggest hack in history. Sony crippled as 102 million people have their accounts compromised. <comment><USER2> I prefer to fight my battles legally: I'm not giving Sony any more money. They have proven time and time again that they have no regard for their customers and now that they have no idea what security means.

I don't approve of what these hackers are doing, but I thank them for showing me just how bad Sony is.

As for the hackers being Anonymous... People keep trying to treat Anonymous like a terrorist group, but it's not. It's any random person who wants to call themselves that. There's no leader. There's no leadership. There's no spokesperson. Nobody can deny Anonymous involvement.

Sure, there's someone that claims to lead them... But the name itself means he can't deny involvement other than his own.

<comment><AUTHOR> Agreed. It's becoming more apparent that individuals within Anonymous or outside are taking credit or making threats on behalf of the group. No one else has yet taken credit for the attack officially though.

Sony is ultimately to be blamed for what is happening here, they were not paying attention to security and now a hundred million people have fallen victim.

</comment></comment><comment><USER3> Scary...</comment>


Technology May Rescue Male Baby Chicks from the Grinder - <AUTHOR> http://www.npr.org/sections/thesalt/2016/10/28/499613622/technology-may-rescue-male-baby-chicks-from-the-grinder <comment><AUTHOR> This is part of an encouraging larger trend of using tech to make food production both cheaper and more humane. A choice quote from the end of the article:

> According to Chad Gregory, from the United Egg Producers, there's huge > demand within the egg industry for a way to solve this problem, and the > first company to create a solution could earn a lot of money. "Over time, > worldwide, it could be worth billions of dollars," he says.

</comment><comment><USER2> The grinder is technology too :)</comment>


The SEC's Fraud Case Against Goldman Seems Weak - <AUTHOR> http://www.businessinsider.com/henry-blodget-hold-on-the-secs-first-major-fraud-allegation-against-goldman-seems-very-weak-2010-4

<comment><USER2> Why is the headline in caps?

<comment><USER3> Not my submission, but I would assume because:

1) It's in the original.

2) While not in Hacker News style, the caps really do belong in this headline because if the analysis is correct it is a very weak case and that's pretty significant.

E.g. WRT the financial industry regulation bill that's being worked on, the one that zaps angel investing among many other things. It would be a shame if an abusive prosecution helped push that over the top.</comment></comment>


Unit Testing Translation Strings in Laravel - <AUTHOR> https://www.leonelngande.com/unit-testing-translation-strings-in-laravel/ <comment><AUTHOR> If your Laravel app uses multiple locales, it can get tedious keeping track of translation strings that are yet to be added to appropriate translation files. To automatically make checks so we know when a translation string is missing, unit tests can be added.</comment>


Passwords Are Dead - joe-mccann http://subprint.com/blog/passwords-are-dead Ask yourself this question: Is entering your username and password on your smartphone to log into your Facebook account a pleasant or annoying experience? The latter is typically the response from most people. I would agree. <comment><AUTHOR> If passwords are dead in part because people use the same passwords for different sites, and because password databases keep getting leaked... why would we replace them with biometrics? People will use the same biometrics for different sites, and the biometrics will keep getting leaked.

The only problem it solves is that of people choosing weak passwords... but it suffers from the problem that people cannot change their biometrics.</comment>


F# introduction for my coworkers - <AUTHOR> https://simendsjo.me/fsharp-intro/ <comment><AUTHOR> I've written an F# introduction for my C# coworkers. It haven't been reviewed, so it probably has many faults. Might still be useful for others. Any feedback is appreciated.</comment>


Lightweight and modern terminal animations using async/await - <AUTHOR> https://github.com/ines/termynal <comment><USER2> Fancy.</comment>


Google's Sergey Brin explains why he paid $330,000 for lab burger - <AUTHOR> http://www.nbcnews.com/science/googles-sergey-brin-explains-why-he-paid-330-000-lab-6C10853442 <comment><USER2> What are the cells for the burger fed on? In tissue culture it's normal to feed cells Foetal Bovine Serum. Is this the case with these cells? If so we haven't fully removed the need for living, breathing animals from the equation.

<comment><USER3> maybe this is not the objective, rather having a more efficient way to produce meat, you're taking out of the equation the farm, meaning less space used, maybe healthier meat (without all the antibiotics and less fat) from one cow you can produce 10 tons of meat without all the space needed not only to raise the cows, but to grow their food, the lab can also be closer to consumers having obvious implications on that.

<comment><USER4> Well, if efficiency is the endgoal here, than bean cultivation seems way more logical answere to beef alternatives than fake meat. You basically take the the food you would otherwice feed your cows, stew it together with some saffran and beet juice (the same colorants as for the fake meat) and you have your economy-burger.

No intermediate step which takes 10 times the space of a traditional meat- farm, no anti-biotics, fat-free and no need for any living, breathing animal slughtering.

Honestly I cant find a single logical reason why this artificial-meat buisness is a good idea except for "just because we can"

<comment><USER5> > Honestly I cant find a single logical reason why this artificial-meat > buisness is a good idea

You can't find a single reason why people would rather eat a replacement that eventually looks and tastes like a burger, rather than cow-food mixed with saffron and beet juice?

If that sounds good to you, more power to you, but to think that people would pay for the mush the same way people currently pay for burgers is ridiculous.

<comment><USER4> No, I can't find a single _logical_ reason. Saturating peoples appetite for overmarkeded type of food doesn't seem logical to me.

Just because people will pay money for it, doesn't make it a good idea.

<comment><USER6> Why do people always confuse logic to mean we ignore all sociological concerns? Just because they are harder to reason about doesn't mean they don't matter.

It's not logical to pretend that they don't matter.

<comment><USER4> Im sorry for the misuse of the word 'logic'. By 'logic' I ment 'makes human sence'. But I was wrong there too. For investigating in means to satisfy our tastebuts, more economly, sound really human to me.

I guess, what I'm saying is simply that the time and effort going into artificial meat, and the promise it is going to generate will probably end up in continued overcomsuption. Totally overshadowing the social consernes.

I only wish an investigation into how to behaviorally modify our species from doing wastefull and damaging stuff on mass scale, would get as much funding and attention.

<comment><USER5> How does this research _not_ have the goal of keeping humans from doing "wasteful and damaging stuff"? The long term point is to have only a few cows that can create tons of beef without being slaughtered. Sounds much less wasteful, more efficient, and less damaging to me.

If your only other problem with this is that they're working on changing the product rather than the behavior of an entire population, without actually giving a hint on how you would go about changing that behavior, you're just complaining for the sake of complaining.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Yesterday: [https://news.ycombinator.com/item?id=6159743](https://news.ycombinator.com/item?id=6159743)

</comment><comment><USER8> ...And what happens when we no longer need cows? It's not going to be happy fun time for the species, because as soon as there's not a reason to breed them then we'll have a few cows kicking around in zoos and that's it.

Good for the environment, possibly, but bad for the species.

<comment><USER9> Do you think they are having fun now? They are bred to be eaten, if we don't need them we'll stop breeding them.

<comment><USER10> Why wouldn't they have fun? They get a comfortable life up until the horrible end. Most cattle is not kept inside huge industrial buildings like chickens or pigs.

<comment><USER11> Comfortable life: if it weren't made illegal, cows bred for meat would be locked in cages where they can barely move. After all, all energy spent on movement can't be spent on gaining weight.

Also, cows bred for their meet are slaughtered at 7-8 months of age. If cared for, a cow could live for 20 years, but economics prevail.

Cows held for their milk have it a bit better, as they get to live for 5-6 years. Also, things have improved. For example, the milking robot not only improved yield, but also allowed each cow to select the time it wanted to be milked, and does not require farmers to chase their cows towards their milking place two or three times a day.

Not kept in buildings: That depends on the level of industrialization of the farms and on the quality of your grassland. For example, in the Netherlands, mowing grass mechanically and feeding it to your cattle which is kept inside year round is the way to go, if you look at this purely economically (cows destroy too much grass by trampling it and by dropping cow peas on it)

Consequently, there is now talk of paying farmers to let their cows go out on the meadows.

Not in huge buildings? Go to [https://www.google.nl/search?q=cow+stable+design](https://www.google.nl/search?q=cow+stable+design) and click on 'Images'. Fewer cows per stable than we do with pigs or chicken, but not small stables, either.

</comment></comment></comment></comment><comment><USER12> The real cool thing is that they are making great advertising to stem cells, by doing something that has a very positive ethical connotation (which is the typical argument against using stem cell in medicine).

<comment><USER4> Stem cells don´t sell unless they come with hamburgers

<comment><USER12> That's another way to put it :D

</comment></comment></comment><comment><USER13> The timing on this is amusing:

Jeff Bezos buys a newspaper for $250,000.

Sergey Brin buys a burger for €250,000.

Each smart in its own way.

<comment><USER14> The inaccuracy on this is amusing as well.

<comment><USER13> Gah. Coffee, why hath thou forsaken me.

Thanks for not downvoting this as mercilessly as it deserved.

/me slinks off

</comment></comment></comment><comment><USER15> This guy could pay $330k for a burger for lunch every day and not care.

</comment><comment><USER16> It seems like this is all for solving the wrong problem. Why isn't there a shift away from the perceived need for more meat.

<comment><USER17> Could you elaborate? I don't understand what you mean by perceived need for more meat - to me this seems like a project geared at creating more ethical, future proof meat products.

<comment><USER4> Humanity has never -- with the exception of extreme cases, historical or modern -- eaten as much meat as the western man does now [1]. The only reason we eat as much meat as we do, I think, is out of marketing. The perceived need for more meat is therefor to saturate the marked.

The problem arising from growing meat consumption include, pollution, maldistribution of food, animal suffering, wasting of land and resources, wasting of water, etc.

[1] I suppose I need a reference for this claim, but think in terms of economy and you'll find that no other culture can afford this much land and resorces to go under meat-farming other than current western cultures

\--edit--

I forgot about humans living in extreme environments that live (by necesity) almost exclusively on meat, like the inuits in Greenland, before major western influence. It doesn't change the fact that the majority of all culteres do, and have in the past, eaten but a porportion of the meat that the average westerners eat today.

<comment><USER18> > Humanity has never -- in no culture, historical or modern -- eaten as much > meat as the western man does now

Absolutely incorrect. There are several well known groups of humans who survive off of a diet of principally animal products.

 _edit -- apologized for snark_

I agree. In most places historically with good arable land, meat is not nearly as prevalent in a meal as today's Western diet. In many places, meat is pretty much just used as a flavoring in dishes like you might find in Chinese- American Szechuan String Beans (the little salted pork bits).

<comment><USER4> You are right, and I edited me original comment accordingly

<comment><USER18> Sorry, I realize my reply came off a bit snarky and pedantic as well. I think my inner-neck beard was choking me.

</comment></comment></comment></comment></comment></comment><comment><USER19> Was that with or without a tip?

</comment><comment><USER20> A complete waste for $250,000. Lab meat? Why? Why would any one want to buy artificial, lab processed meat? Why do people insist on complicating food? Our supermarkets all already filled with things that can be barely classified as "food" and now we have this.

<comment><USER21> Well, it's a good indication you chose to make a throwaway account for that post, as it suggests that you yourself are aware to some extent how uninformed and ignorant the question is.

But, to answer: These animals are brought up in very inhumane conditions -- in crowded spaces, with no light, no freedom. The whole process is unsustainable, what happens when the world population reaches above 10 billion and demand for meat keeps getting higher? Do we have enough space to keep these animals, enough food to sustainably feed them without having bad environmental implications?

It turns out there are alternative methods, and they may prove to be well worth the cost of investigating them. So here we are, doing science, in the hopes of a brighter future. Experimenting with food, to make it taste better, healthier, cheaper, more environmentally-friendly.

<comment><USER22> _These animals are brought up in very inhumane conditions -- in crowded spaces, with no light, no freedom._

It isn't accurate to paint an entire, very diverse industry with the paints of the worst offenders (e.g. Texas factory fattening houses).

<comment><USER21> That's missing the forest for the trees. There are probably lots of factories that treat animals more humanely than others but we still should be investigating alternative methods of creating meats. Ultimately you're going to have to meet problems of scalability down the road in some years, and/or other unforeseen problems with antibiotics and such. It's probably best to start heavy research/experimentation in preparation now than later.</comment></comment></comment></comment>


Dropping Webhooks - <AUTHOR> http://blog.runnable.com/post/142092495506/dropping-webhooks <comment><USER2> Title is really misleading. Read the whole thing expecting it to conclude "So we decided to drop webhook support".

<comment><USER3> The blog post talks about how the api server was dropping web hooks, and there is no re-try mechanism built into most web hook senders.

Scaling out an api server is not resilient enough, and there needs to be a queue-based system fronting your web hooks so they aren't dropped

<comment><USER4> Yes, but the title implies that they will stop using or supporting webhooks. A more accurate title would be "Handling Dropped Webhooks"

</comment></comment></comment><comment><USER5> The tl;dr is basically to handle webhooks asynchronously. This is easy to accomplish with any background processing system you may have lying around in your infrastructure, and the author happens to have RabbitMQ already running.

</comment><comment><USER6> Shameless self-promomtion here. The Wishbone framework ([http://wishbone.readthedocs.org](http://wishbone.readthedocs.org)) enables you to construct event pipeline servers which can do exactly this sort of thing.

The parent's use case could be handled by connecting the Wishbone modules in the following way:

Accept webhook data over http(s) ([https://github.com/smetj/wishbone-input- httpserver](https://github.com/smetj/wishbone-input-httpserver)), parse the JSON data ([http://wishbone.readthedocs.org/en/latest/modules/builtin%20...](http://wishbone.readthedocs.org/en/latest/modules/builtin%20modules.html#wishbone- decode-json)), validate the event data against JSONschema ([https://github.com/smetj/wishbone-flow- jsonvalidate](https://github.com/smetj/wishbone-flow-jsonvalidate)) and eventually submit the event data to to RabbitMQ ([https://github.com/smetj/wishbone-output- amqp](https://github.com/smetj/wishbone-output-amqp)).

Super easy to start a server:

      $ wishbone start --config bootstrap.yaml

Depending on the modules you hook together you can build the event processing pipeline suiting your needs.

For example: [http://smetj.net/processing_webhooks_using_wishbone_part_1.h...](http://smetj.net/processing_webhooks_using_wishbone_part_1.html)

</comment><comment><USER7> It seems that Github should eventually retry delivery on transient faults, like connection time outs or 500 errors.

<comment><USER8> I'm surprised to see that they don't - it seems standard to retry on failure, waiting longer and longer between each attempt.

Some sort of pubsub queue would be awesome - pull (or have them pushed), and process them on demand. If something breaks, retry when you want.

<comment><USER9> I'd love an open-source appliance that lets me turn webhooks (and polling APIs) into a kind of pub-sub. Being able to inspect, modify, and run events would be an "immediately use this" feature set.

It would be something I would pay for to not have to host myself, but iff there's a clear migration path, i.e. it's open-source.

<comment><USER6> Wishbone could do that [http://wishbone.readthedocs.org/en/latest/index.html](http://wishbone.readthedocs.org/en/latest/index.html)

Some example articles:

\- [http://smetj.net/processing_webhooks_using_wishbone_part_1.h...](http://smetj.net/processing_webhooks_using_wishbone_part_1.html)

\- [http://smetj.net/processing_webhooks_using_wishbone_part_2.h...](http://smetj.net/processing_webhooks_using_wishbone_part_2.html)

</comment></comment></comment></comment><comment><USER10> Due to the nature of our task-monitoring service at Cronitor, missing a ping from a user could result in a false-positive alert. Needless to say, it's bad news. As a failsafe against exactly the situation described here, we run a daemon on every webserver that tails the nginx error log and injects failed messages into SQS. These at-least-once semantics work for us because messages that somehow get delivered twice are idempotent. Somedays I think this is a kludge, other days I'm pleased that it saves our butt (including, when SQS is unavailable or slow which thankfully rarely happens, but rarely is not never).

</comment><comment><USER11> One solution might be for Github to store the details of each failed call, and give each call a number that increments (not just for failed calls). Then, if the server notices that it's missed a call into it, it can call Github and fetch those missing calls. Furthermore, if it notices it's not received a call for a while, it can could call in to check.

</comment><comment><USER12> Don't trying to by cynical, but decoupling calls from external systems is the bare minimum you need to put in place; not only for the problem at hand, but to protect your system from systems you don't own.

For the record, we use beanstalkd[1] with both php and node workers. Getting millions of external notifications every day without any major issue. Internally, we use the same design, this time to completely decouple our workers from the persistence layer. Our major benefit in this case was the ability to perform database maintenance without taking the service down.

Anyway, I good read and a simple, yet effective solution.

[1] [https://github.com/kr/beanstalkd](https://github.com/kr/beanstalkd)

</comment><comment><USER13> GitHub doesn't retry when the webhook fails? Stripe does that for example.

</comment><comment><USER14> I don't understand why Runnable didn't __start __with dumping requests straight into RabbitMQ from the beginning.

It's the obvious right solution for this kind of scenario.

</comment><comment><USER15> Misleading title.</comment>


[] stroke and risk factors [] systematic analysis - <AUTHOR> http://www.thelancet.com/journals/laneur/article/PIIS1474-4422(16)30073-4/fulltext <comment><AUTHOR> From the abstract: "Our results suggest that more than 90% of the stroke burden is attributable to modifiable risk factors [...]"

and

"[...] including 74.2% due to behavioural factors (smoking, poor diet, and low physical activity."</comment>


React-Boilerplate v3: The "JS Fatigue Antivenin" Edition - <AUTHOR> https://github.com/mxstbr/react-boilerplate/blob/master/Changelog.md <comment><USER2> Advice please: I tried to wade into the weird and complicated world of web development a few months ago, but eventually I gave up.

At first I used a boilerplate (in fact I think it was a previous version of this one), but it felt like I was jumping in the deep end. I didn't know what anything was, I didn't understand the configuration or the setup, and nothing was making sense.

So instead I decided "I'll start from scratch, introduce dependencies as I need them, and I'll actually understand what's happening". But then as I started to try and introduce dependencies and pieces of the toolchain and stack (Babel, GraphQL/Relay etc.) and that was a whole different type of confusing. I found it really hard to follow tutorials unless they were written for EXACTLY the stack I was using, because small changes seemed to radically change how I had to go about things.

How do you start? Both situations seem perilous. Bottom up is really difficult unless you follow a tutorial that exactly matches your stack. Starting with boilerplate means that if anything breaks you have no idea how to fix it or how anything works.

<comment><USER3> Modern web development is a bit of a mess. My advice is to start small, and introduce new technology gradually. You should be familiar the foundation (HTML, CSS, and vanilla JavaScript) first, if you're not already. Be able to manipulate elements of a webpage using vanilla JavaScript.

At this point, you might want to get up and running with Babel and the new language features introduced in ES2015, since more and more tutorials are written assuming you're using ES2015.

Then pick _one_ library or framework (e.g., React) and get comfortable with it. Think of a simple project to build, then try building one even simpler than that. Don't introduce a second technology (e.g., Reflux, Relay, etc.) until you have a handle on the first. And even then, try to introduce just one new technology at a time.

You might be thinking that this will be a slow, involved process. That is correct.

<comment><USER4> As a web developer who is not a 'web bro'

React.

Redux.

Reflux.

Flux.

Relay.

Does anyone else see the madness in this ?

<comment><USER5> All these tools exist for a reason, it's not "madness", it's individuals who wrote some code and open sourced it for the benefit of those who might find some use in it. _Just because a tool hits the front page of HN doesn 't mean you need to use it_. I find it ridiculous when people complain about the js tooling ecosystem (especially beginners), "too many tools" is only a problem for someone who doesn't have a real problem to solve. If you were tasked with the job of hanging a window curtain, would you walk into Home Depot and exclaim "omg, hardware is a mess, why are there like 40 different types of drills, why can't they just make this simple??". It is simple, _you_ are the one making it complicated by obsessing over the options instead of focusing on getting the job done. "but I want to pick the best tool for the job", well if you don't know what that is, hire an actual professional, _it 's their job to know_.

<comment><USER6> I'm not sure this analogy works. My brother-in-law is a builder and I would certainly ask him what drill to buy if I needed a new drill, and I'm sure he'd have an answer. (If I didn't have him to ask, I'd probably be able to differentiate by "brands I've heard of" and price, with a sprinkling of research on Amazon.) But if those 40 different drills all had slightly-to- greatly different characteristics and then had a fundamental paradigm shift every six to twelve months, rendering previous drills potentially obsolete, would the professional builder really be able to answer definitively? Can anyone in web development really answer definitively as to whether you should use npm by itself, grunt, gulp, or even make?

(Possibly someone who knows a lot about drills is going to tell me I'm an idiot in a second...)

<comment><USER5> > _rendering previous drills potentially obsolete_

This is the flaw in your reasoning. A better drill does not make the older one incapable of doing the same thing it has always done to meet your needs. For something to be made obsolete, the alternative must be definitively superior by definition, so the reason for picking the superior option is clear in such cases, but even then, _you don 't have to use the superior tool_. If a traditional drill can meet your needs, _you_ are the one creating a problem by using a tool that doesn't provide you with clear benefits.

> _My brother-in-law is a builder and I would certainly ask him what drill to > buy if I needed a new drill, and I 'm sure he'd have an answer._

If you told your brother-in-law you needed a new drill, he'd likely ask "what are you going to be using it for", and then you'd explain your requirements and he'd give you an answer based on that. If you said "I really want to get into building stuff, but I'm not sure which magnetic drill press is the best option for a beginner", he'd probably say "whoa whoa whoa, that's a specialized tool for a specific kind of job, just stick with a regular drill and if that doesn't do what you need come back and ask me again".

> _Can anyone in web development really answer definitively as to whether you > should use npm by itself, grunt, gulp, or even make?_

The crux of my point is that this isn't a useful question to ask. The question should be more along the lines of

Q. "I need a way to run some custodial tasks related to the operation of my application, what should I use to accomplish this?"

A. "Well, you could write some shell scripts and run those directly or with npm's script running capabilities, or if you prefer to use JavaScript to define these tasks since you're already using that for your application you can try gulp or grunt; grunt takes a more declarative 'config file' approach while gulp takes a more imperative 'streams' approach but they basically do the same thing, though, you've been a C programmer for 10 years so you might already feel comfortable with make, so you could use that I suppose, but you won't be able to easily import js code from your application into make so if that's something you want to do then you probably want gulp or grunt...." etc.

These tools didn't just emerge from the ether, they were created in response to specific issues. The existence of some arbitrary library or framework has absolutely zero impact on whether or not your existing solutions are adequate for the problem at hand.

<comment><USER6> Thank you for your thoughtful and considered response. I'll just leave out the bit about drills, because debating analogies is always unwise, especially if the analogous subject is outside of one's area of expertise!

> _The crux of my point is that this isn 't a useful question to ask. The > question should be more along the lines of Q. "I need a way to run some > custodial tasks related to the operation of my application, what should I > use to accomplish this?"_

I think you've just rephrased the question, no? We all know that "run[ning] some custodial tasks" is what a task runner does; but many wise people have expended many words telling you which of these increasingly fancy task runners you absolutely must use, ecosystems have built up around them, and the waxing of one and the waning of another does have a significant impact on the decision-making process.

> _These tools didn 't just emerge from the ether, they were created in > response to specific issues._

I'm not sure people were really desperate to move from "configuration to code" or thought they really needed streams in their task runner before they were told they did, so for me I struggle a little to see what the "specific issue" was that gulp solved over grunt. The movement away from grunt and gulp to npm scripts and even crusty old make(1) is, of course, at least partly in reaction to the added complexity of these task runners - so in a way that's almost like _unsolving_ a "specific issue".

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Thanks for sharing this here neuling!

We've been working on this complete overhaul of react-boilerplate for several months. Based on the combined experiences of tons of collaborators, we've created the strongest foundation to build your next React.js application with.

The biggest changes are:

\- Revamped architecture: Following a bunch of incredible discussions (thanks everybody for sharing your thoughts!), we now have a weapons-grade, domain- driven application architecture.

\- Scaffolding: Generate components, routes and more parts of your application directly from the command line, skipping all the boilerplate writing!

\- Performance: We've got the best code splitting setup currently available, giving you the leanest, meanest payload. (The fastest code is the one you don't load!)

\- JS utilities: We now include redux-saga, ImmutableJS, reselect and react- router-redux to make sure your application scales to the size it needs.

\- CSS improvements: We use CSS modules for truly modular and reusable styles, code split your styling based on the page the user is on and make sure your code style is in order automatically!

I think this is by far the best boilerplate currently available, both for starting your next project and for simply getting inspiration into what's possible.

Let me know what you think everybody, I'm beyond excited to finally share this with the world!

<comment><USER8> Does this provide universal/isomorphic rendering?

<comment><USER7> Not yet, but it's the next big feature on our roadmap!

We've actively been working towards it, we realise it's a really important one too, so it won't be long.

Chime into the discussion here if you have thoughts about it: [https://github.com/mxstbr/react- boilerplate/issues/174](https://github.com/mxstbr/react- boilerplate/issues/174)

</comment></comment></comment><comment><USER9> The adoption of the approach ember-cli took over a year ago by both React & Angular (angular-cli) is to me the strongest validation of the relative architectural maturity of Ember over its competitors.

Ember has demonstrated singular organisational maturity - stable and consistent release process, standardised build tools, high quality documentation, excellent deprecation warnings & clear upgrade paths. It allows teams to focus on delivering value without prevaricating about build pipelines and trust that the whims of the maintainers won't result in months of rewriting at arbitrary intervals.

Equally it's been pressure and progress from React on render speed that's helped push along Ember's Glimmer engine, long may the ecosystem and healthy competition drive innovation!

</comment><comment><USER10> I've never understand what these kind of boilerplates are for. Well, kinda understand if you're doing projects that takes just a few weeks to complete. Otherwise, you're just better off starting with your own boilerplate.

I mean, how does updating work? If you improve the scaffolding, people need to merge in their changes? Why is this not a CLI tool that would be effortless to update?

Although I must say it's impressive work made on this, and that it's cool to be able to generate many things, I fail to see any big value in using these kind of boilerplates.

<comment><USER11> Boilerplates are used on large projects:

\- so you can postpone learning some of the more esoteric stuff until you actually need it, rather than guessing at the beginning

\- Spending a day setting up boilerplate at the beginning of a 6 month project doesn't seem like a big deal vs spending a day tweaking the boilerplate throughout the project, but early time on a project is important, it let's you get feedback earlier.

<comment><USER12> > so you can postpone learning some of the more esoteric stuff until you > actually need it,

This is the main appeal for me. I want to get something off the ground quickly and start learning the core concepts - not get sidetracked into understanding a peripheral tool.

<comment><USER13> it also lets me learn by example, with a clear ipicture of how a tool or library or whatever fits into the puzzle.

</comment></comment></comment></comment><comment><USER14> Not to beat a dead horse but this boilerplate issue is one of the biggest values of ember-cli, and the main reason I advocate for it over most of the other frameworks.

I don't want to spend days figuring out my asset pipeline, build scripts, and implementation of flux/gulp/grunt/webpack/broccoli blah blah.

It's good those choices exist, but I don't care about the differences enough anymore, I just want to build my app. Plus, you lose the sense of common solutions when there's this much variance.

angular has adopted ember-cli into angular-cli – any plans by the react community to do this?

<comment><USER15> > angular has adopted ember-cli into angular-cli – any plans by the react > community to do this?

First, you would need to define what a React framework looks like, which libraries it needs and which conventions it should use while wiring them together, then build tools around that.

Version 3 of React Boilerplate takes steps towards that by deciding on a set of tools, libraries and conventions and providing code generators for adding to them in a compatible way, but the initial wiring is still done as boilerplate (like it says on the tin).

react-project [1] was heading towards something more like managing this wiring behind the scenes as a dependency rather than a boilerplate, but it's not being actively developed any more at the time of writing.

\---

I think React and view libraries like it also necessitate a slightly different approach in that there's no overarching _thing_ to hook into behind the scenes - you just write a bunch of JavaScript and what it returns (plus side effects) is exactly what you get.

For example, to use Font Awesome icons with Ember via ember-cli, you install ember-font-awesome and the next time you run ember-cli it does... something... such that an fa-icon component is now magically available in your templates. [2]

In React, you install react-fa, import it into module scope where you need it and use it as part of what a render() function returns - your build tools handle it the same as any other JavaScript and CSS you've imported. [3]

[1] [https://github.com/ryanflorence/react- project](https://github.com/ryanflorence/react-project)

[2] [https://github.com/wycats/github-issues- demo/commit/a3358026...](https://github.com/wycats/github-issues- demo/commit/a3358026a42b3438227cff9a3aabb620ce3c09a0)

[3] [https://github.com/insin/react-nwb-github- issues/commit/cad3...](https://github.com/insin/react-nwb-github- issues/commit/cad3abd4ec47f78bf50194ec1bd7cbfb1068e733)

</comment></comment><comment><USER16> I want to understand the appeal of React, I really do. But I open a project like this in my editor and my linter starts going nuts from all the markup in the JS. And my built-in biological linter starts getting queasy just looking at it.

Ugh. I just don't get it. Am I just old and curmudgeonly? And what's with the 200+ line package.json. That's a helluva lot of tooling for a simple web app. GET OFF MY LAWN!

<comment><USER17> What linter are you using? ESLint handles JSX fine as far as I know. And with eslint-plugin-react it actually does some pretty neat validation on it as well.

I will say that I initially disliked the inline markup as well, but it honestly just makes practical sense. When we used Handlebars still, I always had the template open in a split when I was editing a view anyway, why not just keep it all as one contained unit?

<comment><USER16> I'm using JSHint. I know it's just complaining because of the way I have my .jshintrc set up, but this markup-in-scripts thing is a big mental shift for me. But hey, I'll try anything once.

<comment><USER18> It's definitely a big mental shift, but it's worth giving it a proper go.

For those of us who have been coding since before there was even JS, it's hard to let go of the Html / JS split but honestly, it's so much nicer when you just grab the React approach and run with it.

</comment></comment></comment></comment><comment><USER19> This is an excellent tool to compare different React starter kits: _Find your perfect React starter project_ [http://andrewhfarmer.com/starter- project/](http://andrewhfarmer.com/starter-project/)

<comment><USER20> I don't want 60-odd random repos. I'd like to see 3-7 well-chosen options with a few pithy sentences about each.

</comment></comment><comment><USER18> I've been reading through / trying redux etc over the last couple of days. This has come at the right time where I know what all the components they're talking about do and I'm interested in seeing more of how redux apps are architected.

For people coming to this area fresh it's really daunting. There's a new library for every little thing you can think of and it's almost impossible to know where to start. Fortunately Redux itself is such a simple model that it's easy to build on your understanding of it (vs, say, Angular that has a huge surface area - I know, they're different things, but people are probably going to start with one or the other).

Will try this out now to see how I get on. Great timing, thanks!

</comment><comment><USER21> Thanks for this Max! We used it recently to migrate a Backbone/Marionette app[1] to React/Redux and it saved us a great deal of time. We hope to write a full writeup on the migration itself soon but meanwhile we've released the code here: [https://github.com/thebakeryio/openmic](https://github.com/thebakeryio/openmic)

[1]: [https://openmic.io](https://openmic.io), a MediaRecorderAPI experiment

</comment><comment><USER22> We have been working on solving similar problems. Isomorphic rendering was very important to our needs, as was rails like generators. What started as an experiment has actually turned into a really amazing tool. If anyone is interested, in a more full stack solution, check out [https://github.com/TrueCar/gluestick](https://github.com/TrueCar/gluestick)

<comment><USER23> If anyone is interested in seeing a small project built with Gluestick, I have one here [https://github.com/jer-k/phoenix_gluestick_example](https://github.com/jer-k/phoenix_gluestick_example). The Gluestick portion is under the _web/ directory.

As a note, Gluestick has been iterating and this project is obviously a few months old, but it does show the basic structure of a Gluestick built application.

Disclaimer: I work for TrueCar.

</comment></comment><comment><USER24> Where's the boundary between boilerplate and framework?

I think people have hard times pronouncing framework these days, because it sounds offending in terms of learning curve. Why would you spend X amount of days to learn a framework, when you can spend that time learning about the core technologies and make yourself no-dead-code code base? That's why I dislike frameworks.

With React-boilerplate, having a CLI tool that helps you modify the "boilerplate" I think we are getting more or less to the framework definition.

In any case I've never used a boilerplate without having to use `rm` command after installing it. That's why I dislike boilerplates and avoid them.

</comment><comment><USER25> This boilerplate will have to be rewritten again in a few weeks when react- hot-loader 3 comes out and makes the hmre babel plugin obsolete

</comment><comment><USER26> If this is under the MIT license, doesn't every project that uses it for initial scaffolding have to keep its license around?

<comment><USER27> You can basically do anything at all with it, including include it in a more restrictive licensing setup. The only constraint is that you must include the original license/copyright notices.

[https://tldrlegal.com/license/mit-license](https://tldrlegal.com/license/mit- license)

<comment><USER26> > The only constraint is that you must include the original license/copyright > notices.

Right, that's exactly what I mean.

</comment></comment></comment><comment><USER28> But... It doesn't have horizon.io

</comment><comment><USER29> Just F __ng use clojurescript its 1000 times simpler.</comment>


Getting from 8 Words to Funding - <AUTHOR> http://socalbuzz.wordpress.com/2008/05/28/getting-from-8-words-to-funding

<comment><AUTHOR> From the blogpost:

 _a recent article in Business Week, shows how, at least, one company was successful with their 8 words; that's how many the Google team used with Sequioa Capital ... The bottom line is that you really need to understand your opportunity so well that you can reduce to 8 words and still have people understand what you are trying to accomplish._</comment>


Why don't we expire passwords on the web? - <AUTHOR> http://www.mrspeaker.net/2010/12/14/password-expiration

<comment><USER2> If I really had to choose, I'd prefer people to use stronger passwords than to have them expire.

Quite often in companies I work for, forced expiration leads to passwords written on post-its, because people cannot follow the pace.

Maybe having a biometrics authentication coupled with some kind of 1password would be better!

<comment><USER3> Schneier actually recommends writing your password on a piece of paper in your wallet. (even better, just a hint).

<comment><USER4> I don't think Schneier recommends a hint. That's only good if your password sucks to begin with.

And it's not the 'writing down' part that's a security risk, it's the 'storing in an insecure location' that is. Password in wallet, fine. Password post-it stuck to monitor, not fine.

<comment><USER3> "If you can't remember your passwords, write them down and put the paper in your wallet. But just write the sentence - or better yet - a hint that will help you remember your sentence. "

[http://www.guardian.co.uk/technology/2008/nov/13/internet- pa...](http://www.guardian.co.uk/technology/2008/nov/13/internet-passwords)

</comment></comment></comment></comment><comment><USER5> Because expiring passwords is a horrible idea.

At the place I work at, most everyone just changes their password monthly like: "password1", "password2", etc.. Anything more difficult than that then they are likely to forget their password.

Another awful idea is locking people out if the password is wrong after 3 attempts. Then you have mischievous characters entering in 3 bogus passwords just to lock you out of your account and inconvenience you.

The whole concept of expiring passwords should be gotten rid of everywhere.

</comment><comment><USER6> For about an year and a half I've been using a simple trick that I learned from a friend of mine who is very good at using exploits to enter company websites and find security leaks. He was also very very cautious about security and pretty much didn't trust any software to manage his credentials (not even a notepad or sticky notes).

So his method is: For every domain use separate password which you can simply generate in your head every time you need to log in. For example by the formula f(domain_name)

Ex:

f(domain_name) = "abc"+first_and_third_letters(domain_name)+"123";

f(google) = "abcgo123"

This way if one site you use is hacked and your password stolen, they can't get to any other of your data online.

<comment><USER7> Couldn't someone deduce that his hotmail password is abcho123?

Edit: If they compromised one of his other accounts...

<comment><USER6> yes, they could, if you use something that simple, AND they know you are using such a scheme. I used that just as an example. In reality you'd use something a little bit more complicated raising the bar for them by a considerable amount.

</comment></comment></comment><comment><USER8> First and foremost, we like to tell people that we have 500 million active users using our webapps. Thinking about things such as active users compared to raw signups is negative and we naturally try to avoid negative reports. Expiring passwords would be a very easy way to measure how many active, engaged members a site has. If we start expiring passwords, it will become very clear how effective our leadgen efforts are as well as how strong our communities actually are.

Generally, users come and go. We accept them as engaged, contributing users when they preform an action once every x number of days. Expiring passwords is one more hurdle that must be crossed when a user returns. Any hurdle, even an "email me a login link" will force a percentage of users to re-evaluate their desire to contribute.

People will learn that using one password multiple times has serious repercussions. Already, we're seeing the proliferation of standalone password managers and easy to use bookmarklettes such as SuperGenPass.

I think that the solution to this problem is: Any time that a user requests a new or renewed password, e-mail them a link to a trustworthy, cross platform password manager. Explain that you have no affiliation with the company you're mentioning, but in a short sentence or two, convey that using a strong, unique password is important for their security across the web.

</comment><comment><USER9> Why do we have passwords? I mean, ok, I know why, but he mentioned he's just going to enter random gibberish and then use the recover password links when he needs to log in to sites again. Why don't any sites, as an option, cut out the middleman and just have an "email me a login link"? No need to save a password at all, just a good for a single login link and the usual session tracking.

<comment><USER10> If we're going to do away with passwords, let's at least do it properly with smartcards.

<comment><USER11> I've worked with systems that used USB tokens with X509 certificates for authentication and the tokens still required a password (as with Chip-n-Pin cards).

The "something you have" only really works as an additional authentication factor to the "something you know" of the passwords.

<comment><USER10> (I didn't say smartcards don't need passwords..)

</comment></comment></comment></comment><comment><USER12> Because it's the most annoying thing you can do to torture a user. The University of Texas does this - it's a nightmare.

<comment><USER13> UW-Platteville does this and there is no way to reset your password off campus if it expires before you change it. You can't even call up the help desk to get a reset, they refuse to help you. My brother had to drive 4 hours to campus to get his password reset.

UW-Green Bay (where I went) has the same policies as UW-Platteville but has a remote reset page requiring your Student ID, SSN, and DOB.

</comment></comment><comment><USER14> Okay, we need centralised authentication of some sort. Since everyone seems to hate OpenID, is there a good protocol we can use now? OAuth looks good, but I don't know of any way to have individual servers, like OpenID.

A great solution would be to have what is, essentially, OpenID, but verified by your email provider. You enter your email (instead of a URL), and get sent to your email provider for authentication. Nobody forgets their email...

Regardless, what's a good alternative now?

<comment><USER15> There's nothing wrong with OpenID in my opinion, I use it 9:10 times logging into this very website through ClickPass. The thing that doomed the project, from what I've been reading (and I've done a lot of reading because I thought it was a great idea) was the lack of documentation.

Both technical documentation and soft documentation ranging from how end users should interact with it, and what the best practices are. This seems to be an Achilles heel of a lot of projects like this in various patterns regarding informing users how to use it, versus how developers can develop for it.

<comment><USER14> I love OpenID too, I use it on every single site that supports it. However, I hear that people don't like it very much, probably because of the reason you mentioned. It's very sad, I think it had (and still has) great potential. Another problem with OpenID is that non-technical users can't really understand it :/

</comment></comment></comment><comment><USER16> I haven't yet seen anyone suggest password-sync as a solution to this.

Just set up your browser to sync passwords, then generate random strong passwords and store it. It'll sync to your other browsers and you're good to go, until you use a browser that isn't your own. And if you're really using those sites from computers you don't own, you have other problems to work out first.

<comment><USER17> lastpass.com does sync passwords across computers and devices.

</comment></comment><comment><USER18> I suspect it's because people don't like entering passwords and generally only have one or two for the entire Internet, so forcing them to enter the same one again every so often (or, worse, forcing them to enter a different one!) would not make good business sense.

</comment><comment><USER19> Secure hashing algorithm => problem solved.

<comment><USER20> I made a widget once to hash a unique password for each domain. Just copy- paste the domain into the widget and it automatically copies the password to the clipboard. All fine and dandy until mobile came along... now I'm entering 16 character strings of alphnumeric and symbol characters by hand to log in to my facebook account, etc... security pass, usability fail.</comment></comment>