GoDaddy store your passwords in clear and may access your VPS without permission - <AUTHOR> http://blog.sucuri.net/2010/02/godaddy-store-your-passwords-in-clear.html <comment><USER2> This needs repeating: there is _no way_ for a VPS provider _not_ to have access to the internals of your VM; it is unrealistic to have such an expectation.

It might not be unrealistic to expect them to ask before looking, but if your concern is "one bad apple" then you've already lost.

<comment><USER3> the important part is the difference between a compromised authentication secret and having local control over hardware/software. the password is now out in the open. there is now _one more_ way for someone to root the slice other than getting control over the node(s) running the slice.

<comment><USER4> If they have root on your VM, they have your root password too. We're talking about maybe a couple hundred lines of code, tops.

It's clearly easier to get root passwords out of a database, but in the unlikely scenario where an internal employee sets out to sabotage the whole operation, a couple hundred lines of C code doesn't make the effort that much more unlikely.

Don't get me wrong; storing the passwords in the clear is very bad. The thing that is really going to go wrong? Someone's going to commit a change to their web app that coughs up everyone's password to an outsider.

<comment><USER5> > If they have root on your VM, they have your root password too. We're > talking about maybe a couple hundred lines of code, tops.

The default hash for crypt(3) (and thus /etc/shadow) in newer Linux distributions is salted SHA-512. Shouldn't that be significantly more difficult to crack than the old MD5 hashes? john didn't even support it when I checked a few months ago.

<comment><USER6> You don't have to crack it if you can just replace the login binary with one that logs it somewhere.

<comment><USER5> Oh, of course. I errantly assumed they didn't have root at the same time as you still had access.

</comment></comment></comment></comment></comment></comment><comment><USER7> Sadly, I can't say I'm really surprised, this _is_ GoDaddy after all.

This is a company that has been shown to be consistently anti-customer time after time.

Their founder's latest blog post, on the GoDaddy homepage, is titled '5 things I wish I learned in Business School. Plus ... a smoking HOT blonde.' That pretty much sums up their cynical view of their customers as sheep to me.

</comment><comment><USER8> This kind of freaks me out. If you told me somebody had cleaned out either my brokerage account or my GoDaddy account, I'd pray it was the brokerage account. There are much easier options for recovery from that.

It's not that I don't trust GoDaddy. They've been good to me. It is just that I don't trust every person who might happen to see their data base in the next decade.

Crikey, now I have to treat every password I've ever used there as compromised. Bleeeeeeech.

[Edit: It occurs to me that I probably lose consistency points for this since I've previously argued that plain text passwords are "not that big of a deal." Thomas, I owe you a drink.]

<comment><AUTHOR> That's the problem I have with it... specially if their admins can access that at will to SSH to their VPS boxes.

<comment><USER8> You can tell I've been a SEO too long when the prospect of somebody yanking my domain name hurts a lot more than the prospect of somebody rooting me.

<comment><USER4> Because you know exactly how much money you'd lose if that happened.

</comment></comment></comment></comment><comment><USER9> One thing people should be aware of is that almost no VPS hosting solution is secure.

The worst offender is Parallels/Virtuozzo(which I think godaddy uses).

On the linux side. A root user on the host node can simply run the command vzctl enter 1111 and enter your vps without a password. To make things even scarier, when an admin enters your container this way. It doesnt leave a bash history file. You have a very small chance of ever knowing they entered the container at all.

Even if they dont want to enter your container. They still have full access to all of your files which are located in in the /vz folder on the host node.

Other vps solutions are slightly more secure. But it seems like %50 of the vps hosting industry is using virttozzo and most of them probably have no issue entering your container with or with out your permission.

<comment><USER10> If you don't trust your hosting provider, I think you have bigger issues.

<comment><USER11> Exactly right. Your hosting provider has physical access to the machine. There is no such thing as security under those circumstances.

<comment><USER12> It's essentially DRM, except that you would be the media provider and the hosting company is the pirate. For your stuff to function you need to provide the cryptext, the decryption device and the key. So of course they have access.

</comment></comment></comment></comment><comment><AUTHOR> Update from Godaddy's CSO (Chief Security officer):

<http://blog.sucuri.net/2010/02/godaddy-security-update.html>

<comment><USER13> Wow, you're letting them off the hook pretty easily don't you think? Seems like this is a major breach of trust, worthy of a little more sustained anger no?

<comment><AUTHOR> Not off the hook, no. The issue still stands that they store the passwords in a retrievable format. About them accessing the servers, he said that they will change their policy to communicate first with the client, which is a big PLUS for me. If anyone wants their malware removal service, it is fine for me.

But just for calling back and talking about improvements, gives them a +1 (they are famous for ignoring their users).

Plus, that happened almost two months ago (see the date in the logs) and this post was on my draft for a while... So the sustained anger had time to pass.

<comment><USER13> Ah, didn't catch the date. I understand your anger may have subsided by now :)

But to me this still seems like letting GoDaddy off the hook. I understand they want to provide some sort of malware protection service for which they need to periodically log in to your vps with your password. The question is, if you are concerned about security at all, and you're not interested in taking advantage of that service, why would you continue to do business with a company that openly stores your password and makes it retrievable?

Seems like you shouldn't care if they have some sort of "procedure" in place for password retrieval. That's almost irrelevant. It's time to move your business elsewhere.

<comment><USER14> "I understand they want to provide some sort of malware protection service for which they need to periodically log in to your vps with your password."

This is so unusual, and so unexpected that it should have been in the TOS, at the top. This should NOT have been a surprise, with proper description of the REAL TOS, rather than just the written TOS. (I am assuming this isn't in the TOS, I'm not a GD customer.)

</comment></comment></comment></comment></comment><comment><USER15> Argh that really sucks. We should make a website that keeps track of these 'clear text' password people.

<comment><USER16> this is why i use <http://prq.se> for hosting

<comment><USER11> Thanks a lot for that suggestion/link. I'm looking for new dedi hosting and I really love those guys.

I'll be seriously thinking about moving to them. The most expensive combo package there is less than I pay right now. Plus, they're committed to privacy. Very very compelling.

How has your uptime been? Had any problems?

<comment><USER17> I've used PRQ for about a year, and had no major problems. There was a DDoS attack at one time that broke things for a while, but other than that I've had no problems.

I had a dedicated server that ran without any problems, and when I had a few questions it was easy to get in touch via phone, mail and IRC.

<comment><USER11> Great, that's good to hear. Thanks.

</comment></comment></comment></comment></comment><comment><USER18> This is a little different than just a registrar having access to your passwords. I don't have a server with them, so I must admit, I'm more concerned with whether or not they have my domain account password in cleartext. If they do, I'll switch registrars immediately, just on the principle of the thing.

That being said, I don't really care about them having your root password for your VPS. I really don't. Why? Because it's their server (physically). So, if they wanted access to it, they could just pull the hard drive and mount it in another computer. Your expectation of privacy just goes out the window if you don't own the hardware.

</comment><comment><USER19> Would anyone be willing to skim their terms of service and see if they mention requiring access to your server?

<comment><USER8> _You acknowledge and agree that Go Daddy has the right to carry out a forensics examination in the event of a compromise to Your server or account._

<comment><AUTHOR> I agree with that (and I also confess that I didn't read it before signing up). However, it doesn't say that they will do that WITHOUT your permission (or even asking first).

<comment><USER20> Aren't you giving them permission when you agree with their terms?

<comment><USER21> I think that sentence should put the onus on them to prove "the event of a compromise to Your server or account".

<comment><USER22> It doesn't say who has to compromise it.

</comment></comment></comment></comment></comment></comment><comment><USER23> I found out the other day that DreamHost also stores control panel passwords in the clear.

<comment><USER24> They also store ftp and database user passwords in clear text. In fact, the used to _show_ the ftp user passwords in their control panel. Now it's hidden, but you can still access ftp user passwords via their api and you can get MySQL user passwords by doing a "one-click install" of something and then opening the config file.

<comment><USER25> Correct. If having user service passwords stored in our database bothers you, log into a shell account and change the password with "passwd". We'll pick up the new password hash on our next user config and store the password internally as "changedbypasswd".

You can also view MySQL user passwords by clicking on the username in the panel (<https://panel.dreamhost.com/index.cgi?tree=goodies.mysql>). This shouldn't be a big deal, though, as you have to store the passwords in the clear in config files anyway.

</comment></comment></comment><comment><USER26> Thats really scary, trust is always a concern when your in a managed hosting solution. How do we know that people from their company aren't taking advantage, even if the Godaddy isn't trying to.

</comment><comment><USER27> A tool that I wish more people would use is PwdHash (<https://www.pwdhash.com/>). It's a system for generating psudo-random passwords for the web.

Basically, it will take some input from you (a password) and then hash that with the domain name of the site you're accessing and supply that when you actually submit the form. This means that my GoDaddy password would be "O0ErvdwEiy" instead of "asdfasdf".

It helps protect you against sites that may store your password in plain text because a compromise of one system does not mean a compromise of all systems.

It's fairly painless to use, but is only supported as a Firefox extension or through their website. There are some issues with sites that use different domains for their login servers or that use flash for their login dialog (yes, they exist).

</comment><comment><USER28> Hostmonster.com also stores your password in plaintext. When I called customer support once they asked me for the last 4 characters of my password. So, I asked the support guy "Can you see just the last 4 or can you see my whole password?" He told me he could see my whole password. W. T. F.

</comment><comment><USER29> We use godaddy in our company for email and webpage hosting. It's not been a great experience.

Storing passwords in the clear sucks. Why would they do that, unless their audience is primarily 'non-technical' people?

<comment><USER13> Because their audience _is_ primarily 'non-technical' people. Have you seen their ads?!

<comment><USER29> Ha ha ha... well then, storing passwords in the clear? who cares :-)

</comment></comment></comment><comment><USER30> I know that when I worked for a major hosting company in 2001, we had our own SSH keys added to every VPS. This gave us access without needing their password.

Right or wrong, it is very common at hosting companies.

</comment><comment><USER31> I think the standard practice with other providers is to have a separate admin account that can login to the VPS and whose actions are easily audited.

Using the VPS owner's account and password is ridiculous and could cause a legal liability for the VPS owner.

</comment><comment><USER12> Not really surprised by this. GoDaddy is horrible on so many levels, selling chained certificates without telling you what that implies until after you purchase; ganking peoples domains at the behest of third parties without going through UDRP.

And if you've ever had to deal with them you may agree with me when I say that their website constitutes criminal negligence on the part of the UI/UX designer. Deceptive and high-pressure sales tactics are a bad sign; especially in a company that wants so much of your trust.

</comment><comment><USER32> The real question here is, who do you recommend as an alternative. Thankfully, the domain name registrar market is not monopolized by GoDaddy, but I have never used anybody else.

<comment><USER33> Godaddy is one of the worst choice for hosting. Also, avoid media temple. So, basically most _well known_ hosts, other than these two, are good choices.

<comment><USER32> Thanks for the advice. Currently I put my faith into the following list of companies:

* GoDaddy - registrar * Tocici/BuildYourVPS.com - VPS server * EveryDNS

GoDaddy is by far the biggest pain in the @$$ to use out of these.

</comment></comment></comment><comment><USER34> Worth repeating for the nth time: just because they have access to your password doesn't mean it's stored in clear. They could simply be using a reversible encryption algorithm.

This does not excuse them from accessing your VPS without your permission, of course, but the only thing you know about their password storage mechanism is it allows them to access your password when they need it. You have no idea what the procedure for this access is, or how exactly it's stored.

<comment><AUTHOR> Reversible encryption algorithm that an admin can use to get my password and access my servers == same as clear-text to me...

The problem is not that they can get hacked and someone steal all their data, the problem is a malicious employee acessing my private server and my passwords. That's the issue.. unless they trust all their employees.

<comment><USER34> As others have pointed out, if you don't trust your host, you're hosed right from the start. If you want a private server, keep it in your closet.

Having the password reversibly encrypted means that if someone gets their hands on a dump of the db, they will at least not be able to automatically gain access to millions of accounts with no effort. Depending on the encryption scheme used, it may even be extremely secure - for example, decryption could require sending the encrypted string to a different, extremely secure server off the WAN that answers with the password.

<comment><USER4> In 15 years as a security professional and over 5 years directly consulting for big companies, little companies, locked down companies and lunatic companies, selling operating systems, browsers, parts of the power grid, cores of financial exchanges, retail banking applications, email management applications and to-do lists, I have never once seen the "extremely secure" system you allude to.

I have seen lots of "reversable encryption", though.

Maybe I've just gotten lucky in my career, and I just get the fun applications where people do this wrong. But there's no way GoDaddy did it right.

<comment><USER11> Nonetheless you must admit it is possible.

If I did this, that's how I'd do it. Have a separate computer, locked down to the max, except for a couple of functions: accepting HTTP requests POSTing an encrypted password, then sending back the decrypted string. That function would be severely rate-limited. Another function, to confirm the hash of passwords, would not be rate-limited, allowing high volumes of website access.

I could make that machine friggin' _impregnable_ (and so could you). But yeah. No-one ever does it.

<comment><USER4> I wouldn't do it at all. If I wanted escrowed access to a VM, I'd stick a "break glass" SSH key on the box.

I'm not sure how "extremely secure" this "password-decrypting server" design really is, by the way. SQLI is often equivalent to remote code execution. Even when it isn't, XSS is equivalent to operator access, and operators can use the feature that decrypts the password.

Passwords are hazmat. You shouldn't be storing them, at all.

<comment><USER11> Yeah. I used to disagree with you, but now I agree.

You should write up a definitive guide for password security. For instance, I want to know if we should still use salts in the age of bcrypt, etc. Tell us what to do, man.

<comment><USER4> I kind of don't want to be "the password guy".

<comment><USER11> Haha. I understand.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER35> I've filled a complaint to GoDaddy support and I'm now looking for an alternative. What are your suggestions?

<comment><USER36> If you want a VPS you should check out SliceHost.

<comment><USER37> RackSpace has turned SliceHost into a dead man walking. Linode has better pricing and a real future.

<comment><USER38> Do you have any specifics, or is this just mud slinging?

Longtime slicehost customer here, haven't seen any negative impact from the acquisition.

<comment><USER39> See these for reference:

<http://news.ycombinator.com/item?id=1132138>

<http://journal.uggedal.com/vps-performance-comparison>

<http://news.ycombinator.com/item?id=966555>

<http://journal.dedasys.com/2008/11/24/slicehost-vs-linode>

Still, Slicehost is certainly one of the best VPS providers.

<comment><USER22> Thanks for that list. The second link was particularly useful.

</comment></comment></comment></comment></comment></comment><comment><USER40> There's a difference between storing passwords in clear text and not storing passwords as a one-way hash.

<comment><USER41> If hundreds of people within the company can reverse the encryption on a password it might as well be in plain text.

</comment></comment><comment><USER42> GoDaddy's business practices are awful. Their view of the rights of domain owners alone was reason enough for us to move all of our domains to Gandi. More expensive, fewer features, but at least they respect their customers.

</comment><comment><USER43> It makes sense if they need to do maintenance but there has to be some code of conduct / guidelines for a VPS provider.

Either way, I stopped using Godaddy a while back - slicehost is amazing for developers and hackers.

</comment><comment><USER44> I just checked directnic.com, and they seem to store passwords in clear text as well (if you retreive your password, they email it to you(!))

</comment><comment><USER45> And here I thought that GoDaddy was the bastion of perfection in our technology landscape </sarcasm>

</comment><comment><USER46> Thats REALLY scary, I wonder how many passwords they store? just the previous? your whole password history?

</comment><comment><USER47> Automatic malware removal on Linux systems? Get real.

</comment><comment><USER48> ffdsfds

</comment><comment><USER49> people always say they're such a great domain registrar...

its the least navigable site i've ever used in my life. i will always use enom via google.

</comment><comment><USER50> Gone Daddy!

Who in their right mind would work with this funky company in the first place? They seem to be hiring morons. Or maybe they have the Superbowl models doing their Security.

</comment><comment><USER51> Way to go, godaddy!

<comment><USER52> I bet if you had said "Way to godaddy!" you would be sitting at -2 instead of -3 right now

</comment></comment><comment><USER53> How could someone expect a minimum serious service of a provider named "Go Daddy". Really, this is not ironic.

<comment><USER54> What a bizarre statement.

I really don't see the correlation between a memorable (and thus brandable) business name and business performance.

Some of the web's biggest and most respected properties have almost whimsical names, but that doesn't reduce their "street cred" so to speak.</comment></comment>


"Unknown or expired link." - Why? - <AUTHOR> http://www.google.com/search?q=hacker+news+Unknown+or+expired+link.&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a Why would such a valuable site continue to allow itself to be plagued with this type of repulsive usability issue? <comment><USER2> It's an artefact of the way in which news.arc (actually srv.arc) uses functions for links. Here's the key code:

      (= dead-msg* "\nUnknown or expired link.")

      (defop-raw x (str req)
        (w/stdout str
          (aif (fns* (sym (arg req "fnid")))
               (it req)
               (pr dead-msg*))))

If the fnid (function ID) isn't in the fns* list then you get the dead message.

      (def flink (f)
        (string fnurl* "?fnid=" (fnid (fn (req) (prn) (f req)))))

In many places in the code closures are used to handle requests (see the flink code there). If the fns* list is cleared (say news.arc is restarted or harvest-fnids kills them) then you'll get the message.

The use of closures in this manner means that the code needed to handle say a form submission is really compact and set up when the form itself is generated.

<comment><USER3> I would be interested to know how much state is in those closures. If it is less than 200 or so bytes, it would not be impractical to encode it (b64) in the url for the next page (rather than a reference to the state).

<comment><USER4> You don't want to execute code from URLs. (Yes, you can use cryptography to "sign" URLs you create. Don't try that at home unless you know the difference between MACs and hashes, and how to avoid timing attacks.)

<comment><USER5> Whoa, whoa. Putting the _state_ from the closure in the url is not the same as putting the _closure_ in the url.

<comment><USER6> But you are still likely to want to sign the state so you can tell if it has been corrupted (or deliberately doctored) and reject it if so.

<comment><USER5> Sign or sanity check, whichever you prefer. Personally in a simple interface like this site I'd rather sanity check the few simple parameters.

<comment><USER7> It's not a druthers kind of thing. If you need to trust that it hasn't been tampered with you _must_ sign it.

And if you don't care you might as well not add authentication because without signing it's just a fancy CRC - ie, totally replicable by an attacker. As cookies and links are sent over TCP there should be vanishingly few errors in transmission - you're far more likely to introduce false positives with buggy code, and ...

You need to sanity check your inputs anyways. Just do it. This is also how you avoid bugs normally.

<comment><USER5> I'm not sure what your argument is.

Yes if you want to trust it you have to sign it and make sure you implement all the crypto correctly. But I don't see a need for that here.

Also TCP's checksum sucks.

<comment><USER7> You said "sign or sanity check it", as if you can do whichever you want. But in the area suggested they have vast differences and security implications.

How many corrupted web pages do you see because of CRC failure in TCP?

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> You get that when your session expires, which takes just slightly less time than writing a well thought out comment.

<comment><USER9> It doesn't just happen when writing comments; it can happen almost anywhere on the site if you linger too long. It's the most glaring fault with the software behind this site and would be completely impracticable if this site weren't populated by technology-minded people who aren't bothered by error messages.

<comment><USER10> Agreed. I've pretty much gotten used to refreshing before I click to the next page every time...

<comment><USER11> I just open up each page I'm interested in reading in its own tab, I've never really had a problem with the error message unless I take too long on a comment.

</comment></comment></comment></comment><comment><USER12> PG is using a really cool programming technique that I'm afraid is ahead of its time relative to current hardware. An upgrade to the HN server should allay the problem.

To see the potential, look at this code snippet from an academic paper on the topic. The web server presents a form asking for a number, then presents a form asking for another number, then displays their product. This technique makes event-driven web applications feel (to the programmer) like sequential imperative programs.

      ;; main body
      '(html (head (title "Product"))
             (body
               (p "The product is: "
                  ,(number→string (∗ (get-number "first") (get-number "second"))))))

The paper: [http://cs.brown.edu/~sk/Publications/Papers/Published/khmgpf...](http://cs.brown.edu/~sk/Publications/Papers/Published/khmgpf- impl-use-plt-web-server-journal/)

<comment><USER13> It's not so much that it's ahead of its time relative to hardware as it is something you do in the early versions of a program.

Using closures to store state on the server is a rapid prototyping technique, like using lists as data structures. It's elegant but inefficient. In the initial version of HN I used closures for practically all links. As traffic has increased over the years, I've gradually replaced them with hard-coded urls.

Lately traffic has grown rapidly (it usually does in the fall) and I've been working on other things (mostly banning crawlers that don't respect robots.txt), so the rate of expired links has become more conspicuous. I'll add a few more hard-coded urls and that will get it down again.

<comment><USER14> Over the last week the home page appears to be cached longer than the arc timeout, no doubt due to the spike in traffic. As I throw away cookies when closing the browser, I need to login daily. It's been impossible to login from the HN home page because of this. Refreshing the page doesn't help; I've had to click through to a story to be able to login.

You should hard-code that one too.

<comment><USER13> The problem there is that we switched to a new deliberately slow hashing function for passwords.

Edit: I investigated further, and actually you're right, the problem was due to caching. It should be better now because we're not caching for as long. But I will work on making login links not use closures.

<comment><USER15> What'd you go with, and how much of a pain was it to get working in Arc?

I ask because I'd love to be able to make a claim like "even Hacker News, which is written in a Lisp, managed to implement a modern password hash".

<comment><USER13> We use bcrypt. Rtm did it. I never looked at the code till now; it's about a page of Scheme.

<comment><USER15> Thanks!

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> The HN server uses a table of closures to implement those links (the id code for the closure is the bit after fnid= in the url).

When the HN server starts running out of memory, it drops entries from this table. When your browser asks for an entry that is no longer in this table, you get the "Unknown or expired link" error.

This is a crazy design, but unless someone would like to patch the source code and get PG to accept it, we're stuck with it.

<comment><USER17> It's not crazy at all, it greatly simplifies development to use callbacks for actions rather than manually encoding the necessary state into the URL. Techniques such as this are what enable a single developer to be so productive by automating boring and time consuming stuff.

<comment><USER18> Except it doesn't appear to work robustly, which makes it poor design. "Automating boring and time consuming stuff," is all well and good if it actually produces a functional system, but that concern is secondary to robustness.

<comment><USER19> It'd work robustly enough if the links didn't expire, and if we believe other posts on this page, the links are expiring due to memory limits on the system. (The other possibility is a timeout, I guess, which is easily fixed.) If it's running out of memory to store the closures it would run out of memory to store the interaction state.

In other words, there's a problem here, but it's not the programming model that pg chose.

<comment><USER18> Except the links do expire, so its not robust. I expect that when I visit a web page, I can let it sit for an extended period of time before moving on to the next page and have it work. HN doesn't work.

Furthermore, the technique of holding important state authoritatively in memory like this is not a good web-development practice for various reasons. Doubly so if its state data which can be round-tripped. Links should not break when the web server or cache (I'm not sure which one it is) runs low on memory. So yes, there is a problem with the programming model that pg chose.

<comment><USER17> If he hadn't used that technique, there would be no hacker news for you to use at all. You're entirely missing the point that this is a technique to make hobby programming more fun, it's not about being robust or best practice, it's about making programming simpler so pg finds it worth his time to build this site in the first place.

<comment><USER18> blahedo's point was that the technique was not fundamentally a problem from a robustness point of view, and I disagree with that point. It is a problem, and I was pointing that out.

Your point seems to be that since Hacker News is a "hobby project," that we may forgive sacrificing a bit of robustness to make the programming exercise more pleasant. That point was not clear to me from your original posting. Rather, the point seemed to be that the technique was good because it was clever and fun, and I disagreed with that sentiment.

PG seems to be saying elsewhere that it was used as a rapid prototyping technique. That seems to be a fair justification of the technique, in my estimation.

</comment></comment></comment></comment></comment></comment></comment><comment><USER20> If you clicked on the links, you'd know why.

The software stores the current state in a closure. The closure gets cached. When the cache is full, the older closures get flushed, hence the error message.

</comment><comment><USER21> I find it interesting that most discussions I've seen about this exact topic are about Arc and closures... instead of about the fact that this may well be an interesting programming thing to do but it's a moronic user experience thing to do.

<comment><USER13> Your comment is in a sense its own refutation, because the ultimate test of user experience is whether users continue to use the software.

Getting user experience right depends on the users. I wouldn't use this technique in an online store. Random online shoppers would be confused by expired links, and you'd lose sales. But HN users aren't confused by them. What HN users care about is the quality of the stuff on the site.

Since I can't work full time on HN, I focus on the things that matter most. What I spend my time thinking about is e.g. detecting voting rings. Those affect what you see on the frontpage, which is what users of this site care most about.

<comment><USER22> I think you underestimate how annoying the issue is. It's one of those things you put up with because of the content, but which are annoying enough that they detract from the site experience.

So far I'd rate the user experience of the site around 3/5 and the content 5/5. You don't need to work any more on the content unless it starts dropping!

<comment><USER15> I've been here a long time and seen this expired linky thing happen roughly every other week; on a very few occasions it's been an annoyance, but mostly it makes me smile; after reading news.arc, it's a reminder of what a hack HN is.

I could care less if this issue got fixed. I have never once felt, "man, I'd definitely jump to another site if it didn't have this expired linky thing happen".

(Now, politics stories on the front page, on the other hand... I've _often_ wished for a site with as good a crowd as HN but without the politics...)

</comment></comment></comment></comment><comment><USER23> I, too, wanted to ask this question, but feared that someone would respond with something akin to "submit a patch" or "grep the source code"

Obviously, it makes sense for someone who is versed in the news.arc internals to fix the problem; nonetheless this issue certainly bugs me.

</comment><comment><USER24> Good question, but in my opinion it's somewhat rhetorical. Given bugs like these, the ongoing optimization battle, and fairly reasonable feature requests (see the huge HN topic on that), isn't it about time Paul Graham hired someone full or part time to work all these issues out? Given how important HN is to YC, I would think it's worth it. Are any of these tasks _really_ things pg has to do or are the best use of his time?

<comment><USER12> It's good to do things you enjoy. _Best_ use of his time? I don't think anyone can definitively answer that.

</comment></comment><comment><USER25> Steps to reproduce:

1\. Open Hacker News

2\. Go to lunch

3\. Come back from lunch and click next

Every. Time.

<comment><USER26> Restrain from eating then.

<comment><USER26> Hm... Didn't know that obviously jest comments are ill-favoured in HN. Hackering is a serious business apparently.

</comment></comment></comment><comment><USER27> The first complaints are from 1575 days (over 4 years) ago, including about the more button breaking, so I am guessing pg has no interest in fixing it.

<comment><USER28> Hacker News is open source, so it seems as if nobody is interested in fixing it. Or are there fixes and pg has rejected them?

<comment><USER9> Or it's so ingrained in the architecture of the software that a fix isn't possible without completely rewriting it and changing the entire design philosophy.

<comment><USER13> Sort of yes, sort of no. It's a rapid prototyping technique. Essentially you fix it case by case, by taking individual bits of code that use this technique and replacing them with the uglier and less flexible but more efficient alternative of a hard-coded url.

<comment><USER29> Paul, I really do not mean any disrespect here because you are truly a class act and first rate player in the start up world. You are also a great hacker that loves to push the limits. You've created an amazing community here that I have been able to learn a ton from.

I have to ask, and I'll probably get down voted to hell because I'm naive or something, but what is so elegant about a coding technique that breaks under normal usage conditions? If I put out a customer facing piece of code, especially after 4 years, wouldn't it make sense to use an "uglier and less flexible but _more efficient_ alternative" that doesn't break?

I understand your previous explanations of why this happens and of rapid prototyping etc. But at what point does the architecture actually get changed to eliminate this _bug_?

<comment><USER13> It doesn't make sense to call any specific amount of traffic "normal conditions."

What's good about this technique, and about rapid prototyping in general, is that you can write an initial version quickly in very little code, then gradually make it more efficient as the demands on the app increase.

The rate of expired links says more about how busy I personally have been lately than about the desirability of storing state in closures.

<comment><USER29> I'm not referring to any specific amount of traffic. I'm referring to how users expect a website to work. If the user sees a link, especially a More or Login link then the user expects it to do just what it says. When those don't work I would call that a bug. I'm in agreement that this technique can be useful for rapid prototyping, but I also think this site is probably the most active and mass used prototype I've ever seen. ;)

My goal for a web site or web app is to have 0 expired links. Sometimes stuff you link to outside your site will go dead, and it must be fixed or removed or whatnot. But for your own internal stuff... I don't know... something doesn't feel right about an architecture that allows that systematically. How much time could you save if you didn't even have to worry about fixing any expired links? Any idea on what the ROI on your time would be?

Anyway, just thinking out loud. Thanks again for the site though. I do indeed enjoy it very much regardless.

</comment></comment></comment></comment></comment></comment></comment><comment><USER30> This is apparently an old problem that hasn't been fixed yet. As you can imagine, pg has a lot to do these days ;)

See here <http://news.ycombinator.com/item?id=28944>

</comment><comment><USER31> This happens to me a lot while reading HN. I hit "More" and by the time I am done reading a few comments on a handful of entries, the next "More" has expired, and so has the current.

This only happens on HN (at least to me).

<comment><USER32> Actually _right_now_ I cannot click "more"(on the first page) without hitting the "Unknown or expired link" page ... so I cannot go past the first page :/ -- Someone should submit a patch :)

</comment></comment><comment><USER33> I thought this was to combat cross-site request forgery attacks?

Else couldn't one set up malicious scripts to up-or downvote many stories, or post comments under someone else's name?

<comment><USER34> Those are orthogonal issues.

</comment></comment><comment><USER35> Everyone who has literally answered the question "Why?" has completely missed the point. What would PG say about a primary site feature that is so completely broken that it drives users to complain actively, and maybe stop using the site? That it is their problem because they don't understand the technical details? Well, obviously, no one is losing any money here, so maybe that's the answer after all.

</comment><comment><USER36> I'm getting this error when using the login link right now!

EDIT: The only way I was able to login was to use the 'add comment' button on this post.

<comment><USER37> I also just tried to log in about 6-7 times in a row (clicking the "login" link on the front page, reloading the front page in between attempts), and I repeatedly received the "expired link" page.

It also reliably happens clicking the "next page" link on the bottom of the front page; by the time I'm done reading the front page the next page link usually expires.

Please fix?

</comment></comment><comment><USER38> The problem could made less painful by including a link back to <http://news.ycombinator.com> on the "Unknown or expired link" page. That would save me fishing around with the mouse and the back button to get a new start.

<comment><USER39> I would go one step further and just send me back to the homepage.

</comment></comment><comment><USER40> I've been wondering about this for a long time, but just as a data point if anyone cares, it has reached the point recently that HN is basically unusable for me a lot of the time, and I really am starting to give up on trying and spend more time elsewhere instead.

Perhaps one visitor is no great loss -- I'm hardly the personality around here that someone like patio11 is -- but I hope my contribution is constructive, and my comment scores have always suggested so.

However, subjectively, it seems like the quality of posting and voting has taken a sharp nosedive since the "Unknown or expired link" problems have become a several-times-per-session occurrence over the past few weeks. I can't help wondering whether long-standing regular contributors are being put off as a result. If positive contributors can't even log in to refute an objectively incorrect post with a verifiable link or downvote Redditesque diversions, a downward slide seems inevitable, and then the loss of high quality posting and voting becomes a self-sustaining decline.

<comment><USER28> When writing comments, always make a copy of your text before hitting submit (CTRL+A, CTRL+C). A good strategy for any text form on the web.

<comment><USER41> "go back one page" (alt-left arrow) recovers your text on HN

<comment><USER42> This is browser dependent (although many modern browsers do keep form content in the history).

</comment></comment></comment></comment><comment><USER43> It seems kind of ironic to have such an egregious bug on a site dealing with coding and technology...

</comment><comment><USER44> Silly question, but, if HN is purportedly open-source where can I download the source code?

<comment><USER45>
      1. http://arclanguage.org/install
      2. Extract arc3.tar
      3. See news.arc

However, AFAIK pg forked from the latest public news.arc, so the current Hacker News platform is _not_ open source.

</comment></comment><comment><USER46> Yes please, fix it already. I this problem where in another site we would be posting complains from random blog posts over and over again.

</comment><comment><USER47> I think some pages are generated statically and expire. Why the login/logout pages "expire", I can't really guess at.

Wow, not sure why this is so deserving of downvotes. Trying to find a source, but I thought there was a previous discussion of many HN pages being statically generated and served quickly with links that expire after a certain time (or become invalid because of what may happen on the server side of things). But oh well.

</comment><comment><USER48> One reason might be that posts/users are getting axed. Would be nice if everything except spam was unmoderated, imo. Also, the current rate limiters to keep spam out are blocking those that would otherwise be more active.</comment>


Who the Hell Is This Joyce (1928) - <AUTHOR> http://www.theparisreview.org/blog/2016/09/21/who-the-hell-is-this-joyce/ <comment><USER2> "My warmest wishes to you Joyce. I can't follow your banner any more than you can follow mine. But the world is wide and there is room for both of us to be wrong."

An admirable sentiment. I don't think the human mind (including mine) is capable of following it 100%, but I wish more people at least aspired to it, and fewer people saw it as a sign of weakness (which it is not, quite the opposite).

<comment><USER3> Aspired to it.

I read The Dead and Portrait. But when it came to Ulysses it felt like I was aspiring to read it. Too much work and too little pleasure

No one ever quotes Joyce. They allude to him. Maybe they're just further along that aspirational trail.

<comment><USER4> I would encourage you to give Ulysses another go. I think there are a few chapters that are hard going at the start that put people off, but after about the third or fourth chapter it is a bit more digestible. Especially the one where he's getting the carriage to the graveyard. Another thing I found helpful was to read an edition with lots of footnotes explaining various obscure passages. You can even look up bits you find confusing online. It's more work than reading your average novel I'll grant you, but after finishing it every other novel I've read really made me appreciate the richness of the language in Ulysses.

<comment><USER5> I was once advised:

1\. Don't be afraid to skip parts or start from the middle and jump around

2\. Don't worry too much about it all fitting together - each small part is enjoyable even if you're not following that larger structure.

Basically open a page at random and revel in it. It's potentially a lot of fun to read.

I'll hasten to add that I personally haven't followed this advice. I gave my copy away before hearing it.

</comment></comment></comment></comment><comment><USER6> I would never ever read finnegan's wake. Honestly, I can't imagine why anyone in their right mind would except perhaps literary scientists. But to put finnegan's wake on the stereo or headphones while working out or doing a fanstatic hike or sailing or whatever is an incredible experience that I have always been grateful for. I encourage everyone to do it. HG wells, however, on the other hand is something you'd want to sit down and read because he kills his darlings with the idea that his readers will sit down and read it. Not just let it waft over them and permeate their subconscious. Finnegan's wake is wonderful mental music.

BTW, Joyce wrote portrait of an artist as a young man, which is a really great read and a must for anyone with a literary / artistic bent.

<comment><USER7> Listening to FW is a superb idea, especially because the text takes onomatopoeia to its limits and contains a plethora of multilingual puns. It's meant to be read aloud. I'm guessing that the stream-of-consciousness style lends itself especially well to audio that you can lose yourself in, which is great for running etc.

<comment><USER8> Can anyone recommend a good unabridged reading of the Wake?

By the way, the Irish RTE radio (unabridged!) production of _Ulysses_ is wonderful.

[https://archive.org/details/Ulysses- Audiobook](https://archive.org/details/Ulysses-Audiobook)

<comment><USER9> When I saw this question, I went to find a link so that I could recommend Patrick Healy's reading. I was pleasantly surprised to see that it now available for free on the internet.

It's quite rushed and somewhat flat at parts. Some of the abridged recordings I've listened to do more justice to the excerpts they've chosen. But it's a heroic effort none the less. For me, it made the full Wake accessible and alive in a way that made me really enjoy spending time with it.

<comment><USER10> This? [http://ubu.com/sound/joyce_fw.html](http://ubu.com/sound/joyce_fw.html)

<comment><USER9> Yes exactly. Sorry for failing to include the link in my earlier comment.

</comment></comment></comment></comment></comment></comment><comment><USER11> > Who the hell is this Joyce who demands so many waking hours of the few > thousand I have still to live for a proper appreciation of his quirks and > fancies and flashes of rendering?

This is a perfect phrasing of my feelings about all postmodern literature. I tried so hard to get into Pynchon but I couldn't shake the feeling that I was the butt of an elaborate practical joke.

<comment><USER12> That feeling may come from looking for meaning or trying to make sense of it. That's the conclusion I reached, anyway, after reading V and Gravity's Rainbow, anyway. And one other -- Vineland, that was it.

I love Dubliners by Joyce, but the later stuff? I'd sooner read The Sound and the Fury again, but only if published with the different color inks Faulkner wanted.

<comment><USER13> > I'd sooner read The Sound and the Fury again

I have to assume this means that Joyce is somehow worse than sticking forks covered in bees into your eyes. The Sound and the Fury is on the shortlist for the worst book I ever heard was a great piece of literature, and soldiered through despite its awfulness.

<comment><USER3> I attempted S+F but there was a girl imvolved. Neither worked out.

</comment></comment></comment></comment><comment><USER14> Great post. In fact, this is the perfect article to counter the fist-shaking cries of "Why is this article posted on Hacker News?"

The take-aways from this article are so broad that they are applicable to many disciplines, especially coding, technology, and entrepreneurship. Here we have two writers with very different ends. Joyce, the great poker of form, who must have mildly infuriated the utilitarian and reductive sensibilities of Wells.

The letter makes me reflect on the tensions of my own life between engaging in more experimental flights of fancy (where I'm making something I really love) and, conversely, asking myself if other people may actually find value in what I'm doing. Either way, I find articles like this much more insightful than another Iphone headphone jack op-ed or whispers from the Elon Musk rumour mill.

<comment><USER5> > who must have mildly infuriated the utilitarian and reductive sensibilities > of Wells.

I get the feeling you came away siding with Joyce. I came away with hugely increased respect for Wells (who I didn't know a huge amount about going into this). Maybe I'm reading too much into your comment but 'utilitarian and reductive' seemed faintly damning whereas I was surprised how deeply he was considering the role of his work in relation to society and how nuanced his challenge to Joyce was. Especially for a 'mere' science fiction writer...

<comment><USER15> interesting.. what gathered respect for wells were you able to gain from reading this?

the letter is a series of self edifying straw men

to me it reads like someone trying to speak confidently to hide a deeply rooted, or joyce induced, insecurity and ends up coming across as arrogant

<comment><USER16> I can only speak for myself, but I had to the same positive pro-Wells feeling from the letter. I've read Joyce, but I've barely read Wells. This letter makes me want to.

I read the letter as an honest but negative reaction to the Wake, while genuinely praising the prodigious talent of the writer. I don't know their relative ages[1], but I read it in the tone of a businessman father astonished by the virtuosity of his musician son --- astonished that the son followed through on his dreams, but still wondering why someone would dedicate their life to making pretty sounds.

I think Well's both captures what Joyce is up to, and clearly expresses why it's not for him. I feel much the same toward Joyce. I've fought my way through the most of the Wake, and feel happy knowing that it exists without having much desire to read much more. Joyce's talent for language is obvious; his choice of where to dedicate that talent is not. In retrospect, it was probably a good choice, although one wonders how much impact a different path might have had too.

[1] Looked it up: Wells was born in 1866, thus was just over 60 at the time of the letter. Joyce was born in 1882, thus was about 45. I was picturing Joyce as being a little younger from the tone of the letter, but the difference is about right.

<comment><USER15> i am unsure exactly what wells means by any of his words, but he's dead so i am unable to ask him

if i were to follow well's example laid out in the letter i could just assert my own assumptions as fact and criticise those, but instead i will just try to explain how his words affect me

also, it is important to note that it is difficult to truly know anything about this letter because we are unaware of any prior or subsequent correspondence

> The outcome is that I don't think I can do anything for the propaganda of > your work.

did wells mean for the word propaganda to be a subtle dig? does he mean 'promotion'?

'i don't think i can do anything for'.. who asked him to? did joyce? is wells just asserting that his approval should be important to joyce?

if this letter was unsolicited i'd argue it's more about wells than joyce, and as it stands alone i find it abhorrent

> Your training has been Catholic, Irish, insurrectionary; mine, such as it > was, was scientific, constructive and, I suppose, English.

on first glance this sentence had me suddenly wanting to read wells, until i read it again and realised he's 'just making pretty sounds' without any evidence or explicit reasoning which i would think any scientific and constructive mind would consider wholly necessary

this hearkens back to my first notion about a correspondence but why does wells tell joyce what joyce's 'training' is? and then set his own assumed 'training' up as a counterpoint.. and a very appealing one at that

wells continues on in this effort to assign opinion and motivation to joyce and then set himself as the better

> And while you were brought up under the delusion of political suppression I > was brought up under the delusion of political responsibility. It seems a > fine thing for you to defy and break up. To me not in the least.

this is another confusing message for me

for me 'delusion of political suppression' is a horrible thing to accuse someone of and self assessing a 'delusion of political responsibility' is something endeared to me

but it would seem to me someone who calls their own education one of a 'delusion of political responsibility' then i would assume that person thinks political responsibility is unnecessary but then he goes on to say that to 'defy and break up' is not for him..

so does he adhere to political responsibility even though he recognises it as a delusion? if so it would also seem rather unscientific

and of the notion of being 'constructive' it seems you in your comment also have some loose verbage in the same vein:

> although one wonders how much impact a different path might have had too.

impact? how do you measure that? i mean look at your first sentence wherein you say you've read joyce and hardly wells..

so prior to this letter who has impacted you more? you could argue, 'sure, i've read joyce but it went through me' but you still read joyce those words and ideas have a direct influence on you whether you agree or disagree with their content or construction where as an ignorance of wells means his work only indirectly impacts you

i think it is a silly effort to try to measure impact but since you deride joyce's assumed impact i will defend it

joyce was a major influence on the beat generation who were a group of poets in san francisco in the 1950s whose work went on to shape contemporary civilisation by altering legal definitions of words which catalysed a number of the social movements that followed in the coming years

this criticism and response of one of the beat poet's work plays perfectly with this letter:

> His central criticism is that the Beat embrace of spontaneity is bound up in > an anti-intellectual worship of the "primitive" that can easily turn toward > mindlessness and violence. Podhoretz asserted that there was a link between > the Beats and criminal delinquents. Ginsberg responded in a 1958 interview > .. "The bit about anti-intellectualism is a piece of vanity, we had the same > education, went to the same school, you know there are 'Intellectuals' and > there are intellectuals. Podhoretz is just out of touch with twentieth- > century literature, he's writing for the eighteenth-century mind. We have a > personal literature now—Proust, Wolfe, Faulkner, Joyce." (o)

is wells 'out of touch'? who cares? but speaking negatively about someone else's work to prop up your own, for me, makes me question the quality of your work more than the one you are deriding

(o) [https://en.wikipedia.org/wiki/Beat_Generation#Criticism](https://en.wikipedia.org/wiki/Beat_Generation#Criticism)

<comment><USER16> > although one wonders how much impact a different path might have had too.

 _impact? how do you measure that?_

I ask the question in the sense of wondering what impact Brian May might have had as a scientist rather than as a musician ([https://en.wikipedia.org/wiki/Brian_May#Astrophysics](https://en.wikipedia.org/wiki/Brian_May#Astrophysics)), or vice versa, whether Richard Feynman would have had greater impact as a drummer than a physicist ([http://io9.gizmodo.com/5909408/and-now-richard- feynman-playi...](http://io9.gizmodo.com/5909408/and-now-richard-feynman- playing-the-bongos)). Wondering counterfactually what other work Joyce might have created had he dedicated himself to it does not take away from the work that he actually chose to create.

 _since you deride joyce 's assumed impact i will defend it_

I _think_ you are misreading Wells. I'm _sure_ you are misreading me. Personally, I am very far from deriding Joyce's impact. Joyce has had great impact on me. I originally learned Perl and CGI to do a hypertext Ulysses. I don't normally celebrate Bloomsday, but I'm usually aware of it. I've even attended Joyce conferences. While it may be my fault for not writing clearly, if you read me as deriding Joyce, it should give you pause to consider that you might be misreading Wells too.

<comment><USER15> i'm sorry, but it seems clear to me that wells is ridiculing joyce's 'last two works'

> Now with regard to this literary experiment of yours.. I don't think it gets > anywhere.

> .. Your last two works have been more amusing and exciting to write than > they will ever be to read.

even ignoring how joyce suffered while writing these works, i can say anecdotally that wells is so completely wrong in this assertion because i found reading these works to be both extremely amusing and exciting to read

> .. Do I get much pleasure from this work? No.

> .. Do I feel I am getting something new and illuminating ..? No.

that is some clearly contemptuous ire.. and you said you agreed:

> I think Well's both captures what Joyce is up to, and clearly expresses why > it's not for him. I feel much the same toward Joyce.

so i apologise for reading your post as agreeing with wells' contempt but it seemed to me a pretty sure reading that that was your intent

that said, now that you have described what you meant by 'wondering about ones impact' it seems like an innocuous game and i suppose my reaction to it was more about its proximity to wells' opinions that i still read as clearly saying joyce's choices were simply wrong

asking 'what would have been if he wrote in esperanto instead?' takes on different connotation when presented as nonsequitor, but when paired with 'he wasted his potential. what would have been if he wrote in esperanto instead?' it just reads rude

i am also confused why my opinion that wells is belligerently overreaching is controversial when the paris review even notes it in their lede describing the letter as "reacting, irascibly if not uncharitably"

i like wake and ulysses

> I've fought my way through the most of the Wake

this assumes a prerequisite that books, or novels, should be read cover to cover.. personally i am without this prerequisite i can pick up wake and read a single sentence and put it down and be wholly satiated

> Joyce's talent for language is obvious; his choice of where to dedicate that > talent is not.

i love to have my expectations subverted, i find the obvious can often turn droll and disappointing

this is clear from the fact that dubliners bores me but i think wake is the only true novel, ulysses is the first iteration of that endeavour and is much more approachable but i think he achieved the closest thing to the platonic ideal of what i, for myself, consider a novel: a true account of affects and effects; with finnegan's wake

i think of wake as a literary fractal

what is often accused of being crowded, elabourate, riddled digressions i see as the truest account possible

like you said of me misreading you, i believe it, because regardless of the amount of words you use there will always be more that was left out that could have further elucidated those ideas

joyce seems to follow a single strand to a point of abstraction that the reader feels unable to comprehend the moment and in so doing achieves the truest expression of that moment

any finite description is incomplete

and someone could respond, 'but joyce's abstractions are well documented and you can read the text annotated to understand every foible' but that only defends that position that the work is incredibly calculated and anything but gibberish

to truly define stephen dedalus and his mind joyce would have to write within abstractions that joyce would be unable to have because joyce is wholly disparate from stephen

to attempt any such an effort would be indistinguishable from gibberish even for the author because in its essence the author would have to be unaware of what he is writing and why

so, as i see it, his only possible choice is to take it to the point that he is aware of what is being said but the reader is just too far from familiar

from this letter wells seems to revel in telling some other person why he does what he does, which from my reading is hillariously the exact opposite of what joyce wanted his readers to get from his work: life is enigmatic to life

i could be wrong about joyce, but that is why i love it

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> > Your last two works have been more amusing and exciting to write than they > will ever be to read.

Oh how true for so much code, unfortunately.

<comment><USER18> Haha, I came to say exactly the same thing. I'll have to save that line for some code reviews.

</comment></comment><comment><USER19> I agree with a lot of what he's saying, but at the same time, why does it matter? Does every book need to be easily enjoyable as light reading by anyone who is literate? Joyce was highly educated and exceedingly well-read, and he wrote (in his later works especially) for an audience similar to himself on those points. The only downside is it limits his potential audience, similar to how a writer of obscure fanfiction or someone who blogs about niche subjects limits their own potential audience. His particular niche was writing for literature nerds.

<comment><USER20> But Finnegans Wake isnt difficult like Pynchon or Gaddis, who have tons of characters and complex plot devices and rich narrative. It is syntactically erratic and full of "puns" and "wordplay" whose existence the reader is forever aware of but cannot understand without countless hours more poured into the supporting literature. It is not an awful experience but you do not get out what you put in, unlike other difficult authors.

</comment></comment><comment><USER21> This is a nice reminder that we don't have to make enemies out of those that disagree with us.

</comment><comment><USER22> A great example of the complaint writing process of beginning and ending with a compliment and sandwiching the criticism in the middle. Allowing him to get away with

"Your mental existence is obsessed by a monstrous system of contradictions."

and still not being too personally offensive.

</comment><comment><USER23> "Your last two works have been more amusing and exciting to write than they will ever be to read."

Ouch.

<comment><USER24> That's the one that caught my attention too.

There have been times where I try to get into a book, and if I even get the hint the writer is filling up pages with overly complex flowery prose; I immediately put the book down.

I always assumed it was just because I wasen't a natural reader. I've actually stayed away from a lot of classical literature, because I just couldn't get into the books.

I have been completely wrong though. I remember reading Nabrakov's Lolita years after I suffered through those English/Lit. courses. I do wish my instructors felt it was safe reading back then, or they weren't afraid of getting fired for assigning this book.

That book really changed my view on lituraure. I remember reading the book, and every sentance, paragraph just flowed.

I remember being shocked at the subject matter, and wondering if that was clouding my judgement, and honestly I'm still not sure.

After that book, I bought all his books, and haven't completely finished one.

I think it's more due to my unnatural reading ability though.

I college, I saved up most of my required English/lit. classes for my last semester year in college--out of fear. I do know I felt traumatized by my English 101 instructor. He would rip apart my writing with that red pen. He would have me read my horrid papers in front of the class, and public speaking was my worst fear. He once, in a round about way, accused me of plagiarism-- because he had to ask his wife what an amygdala was, and "How did You come up with that idea for a paper?" In the end, he did give me a B, but I was really affected by that class. I used to enjoy writing before his class. It's funny how one teacher can stifle a young student's enthusiasm.

I had a girlfriend in a different English class, directly across from my classroom, at the same time of day. The doors were always open. I could hear her instructor because he had a loud voice. I would write down what that teacher had to say--stuff like funneling paragraphs, and not being to wordy, etc. I learned more about writing from her teacher than mine.

And as usual, I rambled on to long, but if you don't quite get what's so great about seemingly dry old books, give Lotita a shot.

<comment><USER3> Nabakov is a pleasure to read. You can argue about what he means (and that's a good thing) but he is a sheer joy to read.

</comment></comment></comment><comment><USER25> Sorry, the title missed the bigger draw for me: This was written by H.G. Wells! The title should make that clear. This was not just anyone asking "Who the hell is this Joyce...?"

<comment><USER26> HN tries to de-emphasize authors in titles. The year should be in there, though, to cue the reader that it's probably a historically interesting author. We'll add that.

<comment><USER27> I really wish you wouldn't, though I can see some of the merits of this. Fact is, reputation _does_ matter.

I disagree strongly with publications that do this, most especially for _current_ works. _The Economist_ doesn't have bylines at all (and have an explainer for this, which utterly fails to persuade -- the less charitable explanation is that many of the stories are written by young recent grads with little actual depth and who wouldn't be considered other than the publication's umbrella branding), _The Register_ omits bylines from its overview page, though they're featured on articles themselves. Arguably the justification is the inverse of _The Economist_ 's.

<comment><USER26> That analogy doesn't hold up because HN isn't a publication, it's a list of links.

It's nearly always trivial to figure out who the author of a post is. The question is whether that should be emphasized in the title, and HN's traditional default is no. Focusing on content rather than personalities seems to produce better discussion.

<comment><USER27> As I said, I understand your reasoning (your description is as I'd thought it would be). I disagree with it.

Arguing over whether or not HN is a publication is awfully semantic. At the very least, it's a publication of links and the commentary of them. So we disagree there as well, though that's not particularly material.

There's a deeper issue of reputation, credibility, _consequences_ , and more, that matter. This ties strongly into my "Big Questions" re-asking (submitted an hour or so back), and a suggestion from Ted Lemon in 2015: that a very large part of the addressible problem we're facing is the noosphere -- a superset of media, all of human thought. There's something very broken (and some terrifying consequences) to how ideas are created, propagated, (or propagandised), distorted, mistated, etc.

I'm not sure how to fix this. I'm not sure that it's fixable.

When I first started studying science -- in primary school -- I found the mentions of scientists names and such to be distractions. Shouldn't the _ideas_ matter more than the person who had them? I've completely reversed my thinking, because it seems to me impossible to consider an idea without understanding the context within it, _and context matters_. The person themselves matters.

I've been thinking a lot about reputation, identity, and community, particularly regards my recent experiences with Imzy, and constrasting that to other spaces. In particular, _identity IS reputation_ in a whole lot of ways -- starting with the etymologies of "fame", "reputation", "fame", "honor". Fully anonymity is also full impunity, and at least my experiences elsewhere suggest that works poorly. I've contrasted that strongly to HN's practices and results. Even where I don't always agree, or find elements frustrating, one thing HN does is, generally, allow tensions to dissipate fairly quickly, through UI/UX (including some of the annoying or missing elements of it), moderation, examples set, and more.

I realise that offering authors names risks a cult of personality. At the same time, some good (and bad) reputations are well deserved. Electronic communications generally strip away many of the normal social queues. Stripping away the few that are left, most especially authorship, strikes me as heading the wrong way. I'm a fan of Jakob Nielsen's microcontent guidance.

I'm also increasingly convinced that not offering users tools to quantify and qualify the content they access online is a tremendous failing of present tools. I've a limited capacity to really process information and messages, various sources (Stephen Wolfram, Walt Mossberg, NY Times moderation desk) suggest ~150 - 300 emails, ~800 comment moderations, are about the upper limit of what someone can _sustainably_ absorb or process per day, over the long term. And _that_ is if this is their full-time job. If you're looking at assimilating quality and complex information, the count's likely far lower.

As such: cues to quality, including reputation and identity, matter.

<comment><USER16> Beautiful response. I was going to take a different direction, but yours makes better reading.

Dan writes: _HN tries to de-emphasize authors in titles._

But HN should also remember that the goal is to improve the discussion, not to just to follow the preexisting rules. In this particular case, I think adding "H.G. Wells" would have helped rather than hurt the discussion. If you think the same, you probably should have added it. If you think the final discussion is better without (perhaps you are right, the quality was good, and had the name been added maybe this would be the first in an onslaught of rerepublished letters by science fiction authors who've been dead for 100 years) then you should keep it off. But as the one making the rules, it's kind of cheating for you to point at them as explanation for your actions.

</comment></comment></comment></comment></comment></comment><comment><USER28> Any Joyce or Wells lovers here may like Jupiter, an app my team built. We are clearly biased, but we think that Jupiter is the best way to read the classics.

It allows you to highlight your favorite parts, and share magic links like this one to a great line from Dubliners: [https://jupiter.ai/books/Q9bx/?hl=Oze](https://jupiter.ai/books/Q9bx/?hl=Oze)

As expected, the reading experience is great in the iPhone app and necessarily not great in the browser.

Here's the app store link: [https://itunes.apple.com/us/app/jupiter-read- highlight-class...](https://itunes.apple.com/us/app/jupiter-read-highlight- classic/id1121414981?mt=8)

</comment><comment><USER29> It's revealing that Wells made this letter to Joyce and not the other way around. To the artist, the audience only becomes important when they're either a patron or a subject. And, even then, they often don't matter much. But, to Wells, the audience is the purpose - and his work, a product.

To consume art is to allow oneself to momentarily seep into the mind of another. And, if done with 'soul' unshielded and open, it's one of the most intimate actions possible for a sentient being like a Human who is eternally imprisoned within a vessel of imperfect sensors.

Joyce is an artist. And, to read him - well, the experience may not be enjoyable - it may actually be uncomfortable, painful or even bizarre or alien. But, it's what he is.

</comment><comment><USER30> Virginia Woolf called Joyce's Ulysses the work of _" a queasy undergraduate scratching his pimples."_

</comment><comment><USER31> "Your last two works have been more amusing and exciting to write than they will ever be to read." is a good zinger, and likely true in mnay cases

</comment><comment><USER32> What makes this so great is that it's private correspondence, unburdened by any audience except the recipient. It's hard to imagine such frankness in a contemporary NY Times column, with the usual liberal/progressive/SJW sycophancy at work. You wouldn't get lines like

 _You began Catholic, that is to say you began with a system of values in stark opposition to reality._

</comment><comment><USER33> The font in this article is nigh-on unreadable on Firefox on Windows. It renders perfectly legibly in Chrome and IE11, but on Firefox it is so faint and the forms so small that they get lost in the anti-aliasing. The kerning seems quite bad too.

Here's what I mean: [http://imgur.com/a/ymnvH](http://imgur.com/a/ymnvH)

Seems like a regression, as usually Chrome's font rendering is much uglier on Windows.

(Sorry for off-topic post.)

<comment><USER34> Those two screenshots are actually using different fonts (you can tell by the shape of the bottom part of the 'g', for example: in one screenshot it's the same width as the top part, but in the other it's wider).

Chances are, this is a difference in what the different browsers do with the "garamond-premier-pro" font family name and which font they actually end up using when that's specified. Any chance you could confirm that?</comment></comment>


2012 Startup School, Oct 20 at Stanford - <AUTHOR> http://startupschool.org/?2012

<comment><AUTHOR> I'm happy to say that this year we're moving to a bigger venue. Instead of Dinkelspiel we're going to be in Memorial Auditorium, which is more than 2x bigger. Many thanks to the Stanford administration for that.

<comment><USER2> @pg will the event be recorded/archived and viewable later?

<comment><AUTHOR> Yes. BTW, you don't need @s here.

<comment><USER3> That's good to know! I won't be making it there, but I would very much like to spend some time watching the talks.

Are the talks from previous years available? I could not find any links on the website.

<comment><USER4> First link after a Google search:

<http://www.justin.tv/startupschool/videos>

</comment></comment></comment></comment></comment><comment><USER5> I had the good fortune of attending last year and it was _phenomenal_. The presentations were entertaining but the conversations with other attendees were priceless.

</comment><comment><USER6> I'm currently a sophomore in high school. Am I old enough to apply, and is it worth it for me (I live near NYC)?

<comment><AUTHOR> Yes to the first; you have to decide the second.

</comment></comment><comment><USER7> Since it sort of worked well last time (<http://areyougoing2009.heroku.com/>), I updated the are you going app for this year!

<http://areyougoing.herokuapp.com/>

</comment><comment><USER8> To everyone who's on the fence you should definitely go. I flew to two of them from New York and it was well worth it. The talks are available online but by being there you get to feel the startup energy and meet a ton of motivated, driven people.

</comment><comment><USER9> Do subsequent applications overwrite the old one? I want to apply now so I don't forget but I feel I could write a better application given more time.

<comment><AUTHOR> Yes.

</comment></comment><comment><USER10> If you've already been (in say 2010), is there a possibility of going twice?

<comment><AUTHOR> Sure; the software is not sophisticated enough to consider multi-year windows.

</comment></comment><comment><USER11> I went in 2010, but did not apply in 2011. I don't feel I will be going this year either. I just have been too busy and dedicated with my day job to work on side projects/startup projects to feel like I would be worthy of going this year.

I'm jealous still of anyone who gets in and goes :) At least I can watch the videos online after they are posted.

<comment><USER12> is there a link to previous years' video?

<comment><USER4> <http://www.justin.tv/startupschool/videos>

</comment></comment></comment><comment><USER13> Always look forward to watching these talks. Thanks for doing them every year. Really glad that Andrew Mason is doing another one.

</comment><comment><USER14> >> When: 20 October 2011, 9:00 am. >> Application Deadline: 20 September 2011.

2011?

<comment><AUTHOR> Fixed, thanks.

<comment><USER15> The speakers page still says 2011.

<comment><AUTHOR> Oops; fixed that too.

</comment></comment></comment></comment><comment><USER12> Is there anybody know where to find events like this startup school(except by reading post of HN)?

</comment><comment><USER16> pg: "Thanks for applying. We'll respond by email about a week after the application deadline. Please make a note of your username and password. You'll need them later to confirm you're coming."

Er... what username and password?

<comment><USER17> I would assume it's your HN information.

<comment><USER16> I would think so too, except I didn't enter it anywhere, so I'm not sure how the association is made. Oh well, no sense worrying about such mundane details.

<comment><USER18> To apply, you need to sign in using your HN username and password. If you were already signed in, you probably just didn't notice that the form already knew who you were.

</comment></comment></comment></comment><comment><USER19> Excited to hopefully make it! I've only been able to watch the streams previously.

</comment><comment><USER20> pg: when will the applicants know if he/she got accepted?

<comment><USER21> "The application deadline is noon PT on September 20, and we'll issue acceptances on September 30. "</comment></comment>


Researchers find crippling flaws in GPS using only $2500 equipment - <AUTHOR> http://users.ece.cmu.edu/~dbrumley/courses/18487-f12/readings/Nov28_GPS.pdf/

<comment><USER2> Remove the '/' from the end of the link.</comment>


Ask HN: Has a co. ever cancelled your onsite interview after buying the ticket? - <AUTHOR> This just happened to me. This company approached me about a month ago. They tested my programming skills, had me talk to managers and decided they wanted to fly me out. We set an itinerary and I bought the ticket. Then -- they cancelled the interview after a few days. They will reimburse the ticket.
Is this common in the software-engineering realm? The reason for cancelling was that there was a change in their hiring strategy. A manager told me I would be on their list as more roles will open up later in the year, and they might contact me for a different role. Should I hold my breath?
This was surprising as the company treated me as a desirable candidate; they saw my skills and potential as an asset to their team. It would have been nice to prove myself even more during the interview.
I am a valuable candidate and I am confident I can be hired elsewhere. It's a mild shame since I was genuinely interested in this company.
What are your thoughts on this? <comment><USER2> Don't take it personally. Something changed outside of your control. Be glad they told you so you could save yourself the time and travel.

</comment><comment><USER3> If you think the interaction was/is positive. Why not visit the city anyway since it's already paid for? Free vacation! If it was very positive, maybe meet them for coffee?

</comment><comment><USER4> It sounds like they found another decent candidate for that position so your interview is no longer necessary.</comment>


Netflix's plan to get everyone watching foreign-language content - <AUTHOR> https://www.cnet.com/news/netflixs-plan-to-get-everyone-watching-foreign-language-content/ <comment><USER2> The EU's demand that "30 percent of content on streaming services must be created in European countries" seems rather unreasonable to me. I'm all for more diversity in content, and it's great that Netflix wants to make more shows in other languages, but if every country expects 30% of the available content to be in their own language, Netflix would only be able to conform by excluding some of their content from their offering in that country. That wouldn't be good.

Showing local productions more prominently than American ones sounds like a better idea to me.</comment>


Why America Can't Quit the Drug War - <AUTHOR> http://www.rollingstone.com/politics/news/why-america-cant-quit-the-drug-war-20160505 <comment><USER2> So why can't it? The article does not answer that question...</comment>


Scandinavian Unexceptionalism [pdf] - <AUTHOR> http://www.iea.org.uk/sites/default/files/publications/files/Sanandajinima-interactive.pdf

<comment><USER2> It's sometimes argued that, similarly, social homogeneity/cohesiveness has been a factor in the economic success of Japan.

Couldn't it just as well be argued that heterogeneity/diversity can stimulate economic growth, as in, for example, the United States, or India?

Measuring diversity and controlling for the many other variables of history, geography, and the like may be near impossible. So this may be neither here nor there.</comment>


CodeSandbox Live – Real-time code collaboration in the browser - <AUTHOR> https://medium.com/@compuives/introducing-codesandbox-live-real-time-code-collaboration-in-the-browser-6d508cfc70c9 <comment><USER2> How long did this take to build?

I'm impressed that you can build and ship this with a small team and short time, whereas the VS Code and Atom teams are still in beta with their live coding features. I understand scope and scale are very different, but this is a great accomplishment!

<comment><USER3> Thank you very much! It was definitely one of the most fun features to build.

I started working on this on March 15th, and the past few days was about testing everything, preparing the release and squashing bugs. The advantage of this type of functionality is that there are tons of high quality papers and articles already written on the subject, especially this one helped me a lot: [http://www.codecommit.com/blog/java/understanding-and- applyi...](http://www.codecommit.com/blog/java/understanding-and-applying- operational-transformation). There were a lot of sleepless nights involved too.

I'm not sure about the VS Code and Atom teams, but I imagine that there are more constraints and there is more functionality to implement since they work with hundreds of potentially big files. I think those factors make it harder to implement this functionality than in the case of CodeSandbox.

<comment><USER2> Holy shit, you built this in 10 days?!?!

<comment><USER4> Evidently not [https://codesandbox.stream/changelog/](https://codesandbox.stream/changelog/)

Maybe March last year.

<comment><USER3> Ah, I always forget to keep that page up to date. I'm sorry for that. Since CodeSandbox 2.5 we got some new things, like Parcel support, Typescript configuration support and some other things. I'll make sure to keep that page more up to date.

And if you really want to make sure, we're open source: [https://github.com/CompuIves/codesandbox- client](https://github.com/CompuIves/codesandbox-client).

</comment></comment></comment></comment></comment><comment><USER3> Hey everyone! I'm the author of this post, I'll be here to answer any questions.

<comment><USER4> Ok a couple of things.

1) This is awesome.

2) /s/vanilla doesn't work on .stream but does on .io

3) in the live text "To share your sandbox for real time collaboration you need to be a CodeSandbox Patron." you don't specify if all collaborators need to be patrons or not. I assume not, but best to make that clear.

4) I retrofitted the default React template into my standard first project when I teach JavaScript. [https://codesandbox.stream/s/xvw9p3z0k4](https://codesandbox.stream/s/xvw9p3z0k4) It works on every second reload. Also, can I turn off the react voodoo live update thing? [edit: found the last bit in sandbox.config.json]

<comment><USER3> 1) Thank you!

2) Ah that's really stupid of me, `.stream` was our staging server. I should mention this somewhere, codesandbox.io should have the latest version with live.

3) Good one! I'll update it.

4) That's a super nice sandbox, I love tutorials that use gameplay, makes it much more fun to learn. I'd move it to the io domain, because our stream database is horribly outdated. I'll add a redirect from stream soon to avoid confusion.

<comment><USER3> I moved the sandbox to here: [https://codesandbox.io/s/3rrq6yx9v1](https://codesandbox.io/s/3rrq6yx9v1). I'm also curious, how did you find out about the sandbox.config.json? I feel like it's pretty undocumented by now, we could definitely improve on that.

<comment><USER4> That bit is actually quite clear and right where I should have looked for it.

[https://codesandbox.stream/docs/configuration#configuration-...](https://codesandbox.stream/docs/configuration#configuration- files)

</comment></comment></comment></comment></comment><comment><USER5> Always impressed by your incredible pace of development! Congrats!

<comment><USER3> Thank you very much! I appreciate it.</comment></comment>


Email encryption for everyone via fsf - <AUTHOR> https://u.fsf.org/zb <comment><USER2> This is a really nice write up. The automated recipient for testing is particularly cool.

The problem with it though is that the average person isn't going to read 10 pages of configuration and warnings to set up an email client. Hell I doubt the average person who works in tech will even bother with that, let alone John Q. Public.

Also minor nitpick:

> Before configuring GnuPG though, you'll need the IceDove desktop email > program installed on your computer. Most GNU/Linux distributions have > IceDove installed already, though it may be under the alternate name > "Thunderbird."

That's backwards. Thunderbird is the root name of the software and IceDove is Debian's debranded / rebranded version of it. Also, I don't think it's actually installed by default on most desktop Linux systems.

<comment><USER3> Thank you for saying this.

I love the FSF and what it stands for however, I really think they have a huge communications issue with the average person, heck, most people.

Just looking over the page gave me a headache.

No one is going to go through all those steps to secure email when, to be perfectly honest, most don't care if their email is secure.

If they want most people to adopt secure email, they should look at how easy let's encrypt made getting and administrating SSL certs.

</comment></comment><comment><USER4> Firstly, its great that more people are encouraging email encryption but why write yet another guide to it with essentially the same content as so many other similar guides? Considering its FSF, why not spend the time enhancing and updating existing open source/ creative commons guides?

For example Security in a Box, EFF Surveillance Self Defence and our own Umbrella App (we would love more community contributions). These are just some of the 15+ guides to essentially the same thing - using free open source encryption tools. Can't we all work together? I know some of us are using the Content as Code standard (on Github) to try and make this easier. There is so much more we need to address without writing the same stuff.

</comment><comment><USER5> Wasn't there an EFF or Mozilla project to make e2e encryption as easy as using signal? Some code was written, I think even a plugin for thunderbird for testing.

Anyone remember the name?

I think basically it would lookup the recipients email address to see if they were a user. If not, they would send a invite type message. If they were a user then it would lookup their public key and encrypt it.

I think it was PGP compatible, basically just some glue to replace the PGP usablility issues related to key generation, web of trust, etc.

<comment><USER5> Finally found it: [https://pep-project.org/index.html](https://pep- project.org/index.html)</comment></comment>


Implementing tile encoding in rav1e - <AUTHOR> https://blog.rom1v.com/2019/04/implementing-tile-encoding-in-rav1e/ <comment><USER2> This is a great example of use of `unsafe` in Rust.

The memory access pattern they wanted is technically safe, but can't be expressed directly in the safe Rust. But that wasn't a blocker, and the Rust language didn't need to be made more complex to handle such case. Instead, the "missing feature" could be added to Rust with a bit of `unsafe`.

The big thing here is that instead of implementing actual encoding using unsafe code, and spreading the risk of unsafety all over the complex parts of the codebase, all of the dangerous parts were contained in a minimal, easy-to- verify abstraction layer. And all other code on top of that remained being safe Rust with the same safety guarantees.

<comment><USER3> That's the positive spin.

The negative spin would be: how to spend a lot of effort to solve a problem you would never have if you didn't use rust. Yes it makes great blogs but it doesn't necessarily make his programs better.

I'm two minds here. On the one hand the safety is nice and it might or might not find a few bugs in advance.

But in a real project do you really have time to go through all this effort every time just to solve something do something legitimate that the rust designer's didn't quite consider?

If he had written it in C he might have had enough time to work on the performance to actually get a performance gain.

I still haven't made up my mind if the trade off is worth it.

<comment><USER2> > how to spend a lot of effort to solve a problem you would never have if you > didn't use rust

No, you don't have that problem even in Rust. Rust has C-like pointers, so if you're OK with them, you can just use them as if you were writing a C program.

The effort here was not forced by Rust, but was author's choice to get a guarantee the code is safe. And I'd say it's relatively low effort given it's reusable, and it'll stay safe even after code changes. In C you'd instead do meticulous analysis, debugging and add a comment "// careful, don't break this!"

<comment><USER4> > Rust has C-like pointers, so if you're OK with them, you can just use them > as if you were writing a C program.

This would not be practicable. Raw pointers in Rust are (probably on purpose) far less convenient to use (no operator + or -, not possible to index an "array" with operator []…).

Moreover, you would lose all benefits provided by slices (iterators, etc.). And locally converting raw pointers to references just to call these methods could lead to undefined behavior (aliasing of mutable references is forbidden even in unsafe code, see [https://stackoverflow.com/questions/54633474/is- aliasing-of-...](https://stackoverflow.com/questions/54633474/is-aliasing-of- mutable-references-correct-in-unsafe-code)).

IMO, using C-like pointers for a whole Rust application would make no sense (it would be worse than just writing a C application).

</comment></comment></comment></comment><comment><USER5> Multi processor encoding goes way back to the early days of video compression. The first real-time MPEG-2 encoder chips from C-Cube Microsystems were specifically designed to be used in parallel. Back then (1993), encoding an SD (720x480) image required twelve processors.

Here's a picture of a development board. This is half of a two board sandwich that supported ten video processors. The CL4000 was the first member of the family and was used for the DirecTV rollout. It was not capable of MPEG-2, and for a few months, DirecTV was actually MPEG-1.

[http://www.w6rz.net/scorpio.jpg](http://www.w6rz.net/scorpio.jpg)

</comment><comment><USER6> Presumably, the mentioned lack of a huge speedup is due to both hyperthreading and CPU clocks depending on how many cores are active (so as to stay within a power and thermal envelope).

Otherwise, profiling would obviously need to be done on the sequential parts to figure out if any of them are amenable to parallelisation, while also being worth the effort based on them taking up a significant amount of time.

<comment><USER7> And also to be careful when doing benchmark on a laptop since the OS / governor is throttling CPU...

</comment></comment><comment><USER8> A few years ago I implemented a vaguely similar image compression algorithm just for kicks. I basically did a separate binary space partition for each color channel of the image, with the splitting points determined by minimizing an error function. It was extremely simple to implement and worked pretty well, except it represented big curves with little compression.

The fun part was when I dropped the error minimization in the partition choice function and set it to choose them randomly:

[https://pbs.twimg.com/media/DMr5LaMUQAA2h2E?format=jpg&name=...](https://pbs.twimg.com/media/DMr5LaMUQAA2h2E?format=jpg&name=900x900)

[https://pbs.twimg.com/media/DMr4Vc4U8AAOlyn?format=jpg&name=...](https://pbs.twimg.com/media/DMr4Vc4U8AAOlyn?format=jpg&name=small)

</comment><comment><USER9> I wonder when the encoder will be good and fast enough so that I can start reencoding my old h264 library, any estimate? I wanted to start next year but I am not sure considering the speeds, it still needs a lot of optimizations.

<comment><USER10> Probably never, unless you're also downsampling because you only plan to watch videos on your phone / downgraded your TV forever / are losing your eyesight. Lossy transcoding barely makes sense when the source is a hilariously bad codec like MPEG2 (by modern standards), and even then you lose a lot of texture (the main benefit is inverse telecine and dealing with any other weirdness of the source disc ahead of time). You pay in quality for every time it's been lossily encoded, but only reap the space savings of the last (to a first approximation). You might save a little HDD space, but you'd have very poor quality for the bitrate.

<comment><USER9> I am aware that some detail will be lost. However with h265 encoding I've tested about a year ago I could shrink it by 40% without any noticible loss. If AV1 can get me above 50%, the >2TB saving is worth it I think. It'll be a lot easier to handle backups.

</comment></comment></comment><comment><USER7> Why do they need unsafe for a video encoder / decoder? There is no other way around in their example?

<comment><USER11> This is perhaps the main point of this article. They needed `unsafe` to implement a safe way of concurrently modifying a single contiguous buffer, which is not allowed in safe Rust.

<comment><USER12> Could such a workaround come to the Rust language in the future. Maybe other programs will need a "safe" way to implement something similar that is currently impossible with the safe methods offered by Rust.

<comment><USER13> But why? That's is exactly the reason why unsafe exists: to open an escape hatch to do something that is impossible to do in safe Rust (and then wrap that under a safe interface). Your safe Rust, standard library, is constructed exactly the same way: based on unsafe. Unsafe doesn't magically make your code unsafe, it's just that you tell the compiler to trust you to handle the problem correctly (usually by meddling directly with pointers).

<comment><USER7> For me the question was more, isn't Rust supposed to have fearless concurrency meaning no "unsafe" part to modify data between threads.

<comment><USER14> What would most likely here would be abstracting this problem into a library that could isolate "unsafe" in a place where it could be specified, tested and examined in isolation.</comment></comment></comment></comment></comment></comment>


Ask HN: Did you receive the Oculus DK2? - <AUTHOR>

I ordered Mar 19, 2014 09:21 AM PDT.
Shipping company contacted me today and they will deliver it tomorrow.
My location: Shanghai, China <comment><AUTHOR> With some delays, I finally got it today.

</comment><comment><AUTHOR> Very excited, of course :)</comment>


Where have all the grownups gone? - <AUTHOR> http://www.jjdisconnects.com/blog/2015/6/10/where-have-all-the-grownups-gone

<comment><USER2> Nice article, but hey, whatever startup is only a startup, you should try Deloitte or jpMorgan to see grownups.

<comment><AUTHOR> I don't understand...are you saying that just because you are at a fledgling business, you can act however you want?

<comment><USER2> on average I'd say so, yes:) at least, on my sampled average so far.

</comment></comment></comment><comment><USER3> Why I prefer the Silicon Valley scene to the SF scene.

This is not to say that there are't a few tech businesses in SF, and that some poseurs haven't tricked down here. But we do still have actual, you know, businesses built around tech!</comment>