Short term usability is not the same as long term usability - <AUTHOR> https://nibblestew.blogspot.com/2020/06/short-term-usability-is-not-same-as.html <comment><USER2> I remember when I was starting out that people talked about this problem a lot. But it's been years since I've heard it said unless I was the one saying it.

I still routinely wonder if the right solution is to build up an 'action bar' the way video games often do. Microsoft got into this neighborhood with the Ribbon but I feel like they missed the target.

You graduate to more sophisticated options and the ones you use all the time are mapped to whatever key _you_ want it to be. Add a hidden flag for setting up a new machine or user where you jump straight to expert mode and you're done. This costs the expert one more setting to memorize, but the payoff for doing so is quite lucrative.

Shortcuts seem to work great on QWERTY but less awesome for everyone else. Just let me set my own so I don't have to use an extra finger on Dvorak or a Japanese keyboard.

<comment><USER3> While that sounds like a great idea...

* How do these shortcuts remain consistent between applications?

* What's a system wide, task-type-wide, and program specific action?

* How do these persist across different versions of OS, application, devices, different ownership (work / home / etc), or otherwise follow the user?

* "X is broken" use the shortcut... wait what did you configure that as?

<comment><USER2> That may be the other thing. Apps have gotten a lot bigger on average. How many shortcuts are really consistent across applications? A dozen? That might have been half of the shortcuts 20 years ago. Now that's a quarter and nobody bothered creating bindings for half of the menu entries.

Hell, Outlook gets it wrong and MS used to harp on this loudly. I can't count how many new folders I've created while trying to start an email.

</comment></comment></comment><comment><USER4> I agree with the notion.

I find that a lot of less experienced devs I work with like to prioritize "ease of use" in API design over other things, such as testability, orthogonality, decoupledness, reversibility, etc. If an API is "easy to use" from a client perspective, they often deem it a good one. API ease of use is definitely important, but weighed against other constraints, which are more fuzzy and more about long-term maintainability. Sometimes making an API slightly harder to use (often requiring additional client knowledge about the domain before using it) is worth the trade-off against ease of use since it means it's easier to extend in the future.

It's definitely a skill to learn what helps long-term usability vs short term usability.

I often go back to Rich Hickey's talk about Simple Made Easy when thinking about this problem. [https://www.infoq.com/presentations/Simple-Made- Easy/](https://www.infoq.com/presentations/Simple-Made-Easy/)

<comment><USER5> IMO "public" facing APIs should _always_ be easy to use and only require the minimum information from the user necessary. An example of an outstanding public API would be nlohmann's json library for C++[0].

Whether that API is merely a wrapper for an internal API that is more testable (i.e. allows injection, etc.) or whatever is another matter.

[0] [https://github.com/nlohmann/json](https://github.com/nlohmann/json)

<comment><USER4> I think there can be debate on what is "minimum information". I'd also say "easy" for one developer may be challenging for another developer if the domain of the model is foreign to them.

A lot of frameworks require up-front knowledge to work with. To some, that's not "easy", but it allows the client to do so much because what the framework is providing is not simple.

In other places, the API can be dead easy because what it's providing is so simple.

</comment></comment></comment><comment><USER6> I agree with the sentiment in the headline, but want to offer a counter example.

Consider Emacs vs. Notepad++, for the purpose of editing code. Emacs in this example represents "maximal flexibility" for having a configuration interface where almost every aspect of its function can be (re)programmed, and Notepad++ represents "maximal cooperation" for having a configuration interface and limited toolset tailored to the task specifically at hand (editing code). I'm not going to contribute code to either project; submitting patches for a "maximally cooperative" system to adapt it to your use case is just an advanced and inconvenient form of "maximal flexibility".

In my experience this has the opposite relationship to that described in the article. Getting started with Emacs is a significant investment (as per the article, "everything is possible but nothing is easy"), while Notepad++ is pretty much pick-up-and-go out of the box, but over time the extensibility of the former pays off in a better functionality/amount of work ratio.

There is an example of "maximal flexibility" in the article, but none for "maximal cooperation", and I'd like to see one.

<comment><USER7> I recently worked with a developer who proudly told me he has over 25 years experience. Unfortunately, he wasn't a very good developer.

In talking to him, he told me he switched jobs on average every 3-5 years. And I realized this was the problem. He didn't have 25 years of experience, he had 5 years of experience, 5 times over because he never went deep enough to master his craft. He stuck with Notepad++, never bothered to understand topics like hard tabs vs. soft tabs, never added automated linting or reformat to his coding workflow, didn't bother writing tests (or testable code).

I'm sure many of us have worked with someone who's terminal is misconfigured, has a messy PATH or their computer is in a general state of disarray. This is an example of short-term usability. Long term assumes general mastery of a tool/system... But this isn't always the case.

</comment></comment><comment><USER8> The general point the author is making sounds true but I am sceptical regarding any criticism against make. Building and/or handling dependencies was basically a solved problem as soon as make was invented and all of the new stuff in this area just seems plainly unneeded to me. Also, when people invent new build systems one can end up with projects where one part is built using one build system and another part is using another. Since things can depend on each other in arbitrarily complex ways because of code generation this will lead to build either too much or too little. In particular having a build system for a particular language is such a strange concept.

<comment><USER9> The problem with make, is that it's yet another DSL to learn.

Every single tool in your toolbox could introduce a new one, and it leads to fatigue.

Task runner? New DSL (make)

Test runner? New DSL (robot)

Deployement? New DSL (Ansible)

Batch spawning? New DSL (tox)

Etc

Of course, dev in half of those DSL is a total pain, because, like with most DSL, the tooling sucks: terrible completion, linting, debugging or composing experience.

So people write/leverage tools they can use with their favorite language. And why not? You have to install it anyway (make isn't default on windows, it's not even installed on vanilla Ubuntu!).

When I need a make-like tool, I use doit ([https://pydoit.org/](https://pydoit.org/)).

Why?

It's in Python, the language of my projects. So I can use the same tooling, the same libs, the same install and testing procedures. And so can people contributing: no need to train them. Most devs don't know how to use make (most of them are on Windows after all).

Using make adds zero benefit for me: doit just does what make does (ok, that sentence is hard to parse :)). But make adds an extra step of asking to install it while I can just slip doit among my other python project dependancies. I have to google the syntax. I can't use tab to complete names, of right click to get documentation. And if (actually when) I need to debug my make file, God have mercy.

It's not against make. It just doesn't provide enough value to justify the cost of it.

<comment> yjftsjthsd-h > You have to install it anyway (make isn't default on windows, it's not even > installed on vanilla Ubuntu!).

What are the odds that you're compiling software on Ubuntu and haven't installed base-devel? I mean, it could happen, but it feels contrived.

<comment><USER9> You assume make is only for compiling, but it's not.

It's just a task runner.

</comment></comment></comment></comment><comment><USER10> >project('tutorial', 'c') >gtkdep = dependency('gtk+-3.0') >executable('demo', 'main.c', dependencies : gtkdep)

This is a snippet from meson tutorial, and that's why I'm still using make (and not cmake) in all my personal C projects. I have no idea what flags will be passed to gcc and how to change them (-mmsbitfields was required on windows for gtk). Second, I may have no pkg-config environment when I link windows executable against msys2-installed libs in plain cmd. These shorthands may be a long-term win for a regular project in strict unixlike or msvc-env.bat, but it is not a build system. It is a fixed recipe book (as seen from the tutorial page, don't take it as a criticism). It substitutes a simple knowledge on -I, -L and -l with a cryptic set of directives. You spoke gcc very good, now you have to speak meson's local dialect and be able to catch and fix subtle errors in translation.

The problem is, one has to investigate into seemingly-easy build system to tune it to their needs. It is much harder than just fixing CFLAGS+= or LDFLAGS+= in a Makefile.

For me, a better build system would look like a set of rules, but not in a Makefile, but in a general-purpose language, like:

      var all_srcs = qw('a.c b.c')
      if_(files_changed(all_srcs)).do_(changed_srcs => {
        changed_srcs.forEach(src => compile(src))
      })
      fn compile(src) {
        exec('gcc', CFLAGS, '-o', to_o(src), src)
      }

      if_...

This simple process would cover 99% of common cases and you're still in control of everything. Just prepend:

      if (os == 'msys2') {
        CFLAGS += ' ...'
      }

And that's it. It is a long-term usability, because you may open this file a year later and still figure out what needs to be done in few seconds.

<comment><USER11> I'd recommend you take a look at how Bazel works (Meson may be similar if you look further, but I haven't used it much myself). The default interface you get is relatively "high-level", but everything behind the scenes is a general- purpose system like what you describe, and you can customize it pretty deeply.

What makes it _really_ great IMO is that the language and tool are designed for best practices. For example, your scripts can't actually execute anything: they can tell the build system what command would be used to build the file and what the dependencies would be. The sandboxing allows the build system to be pretty hermetic without much effort. This means that it can always parallelize your build, and incremental builds are always fast and correct.

</comment></comment><comment><USER12> > Perhaps the best known example of this kind of tool is Make. At its core it > is only a DAG solver and you can have arbitrary functionality just by > writing shell script fragments directly inside your Makefile.

I am still fascinated by redo ([https://redo.readthedocs.io/en/latest/](https://redo.readthedocs.io/en/latest/)), which provides exactly the same purpose as Make, but turns its interface inside out: Make is a DSL for describing an acyclic dependency graph, with attached command lines to compile, link, install or run stuff, with a minimum amount operations. The fact that Make is not language-specific, and one just uses shell commands to build stuff, makes it versatile. But there are edge cases which have the effect that people often to prefer to do "make clean", because dependencies might not be captured completely.

"redo" is internally more complex, but basically it is a set of just ten shell commands which are used declarative to capture dependencies, and are part of build scripts. For example,

        #!/bin/sh
        redo-ifchange /usr/local/include/stdio.h
        redo-ifchange helloworld.c
        gcc -I/usr/local/include helloworld.c -o $3

has the effect to rebuild a program if the file "/usr/local/include/stdio.h", or the source file "helloworld.c" was changed - be it by the programmer or by a system update. That's it. No "clean" command is needed.

The result is, in terms of user interface and usage, fascinatingly simple (I tried it with a ~ 20,000 lines C++ project which generated a Python extension module using boost.) The lack of special syntax needed is just astonishing.

But I wonder how well it would run with all the additional complexities like autoconf and autotools - knowing that the all complexity of these tools is usually there for a reason.

<comment><USER13> If you trust yourself to capture the dependencies totally then it doesn't really matter whether you use make or redo, you could add the stdio.h dependency to either. But the only way to actually achieve reliable clean-less builds is to run it in an environment where you either take away all access to non-dependencies (like Nix[0]) or automatically record all accessed files (like Tup[1]).

GCC also supports emitting header lists in a format that Make understands, but that won't cover non-GCC targets, or be as comprehensive as doing it in the build system.

[0]: [https://nixos.org/](https://nixos.org/)

[1]: [http://gittup.org/tup/](http://gittup.org/tup/)

<comment><USER14> GCC actually gets it wrong, as does almost every compiler and makefile combination.

Consider this realistic example. Realistic in that I've encountered it in the real world and seen buggy demos shipped because of it, with non-reproducible bugs.

We have a search path for headers, like so:

        -Imyinc -I../dep1/inc -Idep2/inc -I/usr/include

We compile a source file which contains:

        #include "creative.h"

GCC outputs a dependency which is read into the Makefile next time:

        object.o: ../dep2/inc/creative.h

Looks good! Later that day we update from our upstream dependencies:

        git pull

Which adds a file ../dep1/inc/creative.h

Recompiling, the project works:

        make
        ...
        make test
        => 144,123 pass, 0 fail - well done, you earned a coffee!

We captured automatic dependencies, this should be good to ship. But no:

        make clean
        ...
        make
        ...
        make test
        => FAIL!

What happened? Turns out someone upstream moved (by copying) creative.h to ../dep1/inc and forgot to remove the old copy in ../dep2/inc. Then someone edited a data structure in that file. Automatic dependencies gave everyone false confidence in the build results seen by different people.

That kind of automatic dependency is insufficient because it doesn't capture "negative file results" during path searches, where output depends on a file _not existing_ , and changes if a new file is created.

It is possible to use Makefiles with this handled accurately in the automatic dependency tracking, but I haven't seen it done often.

An equivalent problem occurs in caches which automatically track data dependencies used to generate results. For example web pages generated from a combination of files, templates and data, build artifacts such as container/VM images, or at a much lower level, data dependencies inside calculations with conditional branches. To do caching right, they must validate negative tests as well as positive that arise in searches. I've seen a surprising number of cache implementations which don't try particularly hard to get this right.

</comment></comment></comment><comment><USER15> Context matters, and context changes over time, making the whole process more difficult. When Apple was exploring how to build the Lisa (their first GUI system) they did user testing on both a single button mouse and a multi-button mouse. New users were confused by a multi-button mouse, so Apple went with a single button mouse. But as the years go by, and users get more sophisticated, it's clear that multi-button mice are better. There's no clear right choice that spans time. How fast are users going to come up to speed? What level of difficulty are you foisting on new users? Will they persist through that difficulty?

<comment><USER16> Take a queue from games: Gradually unlock more features as people use the existing ones.

</comment></comment><comment><USER17> I don't know. There is some truth to this, but it's the same kind of argument I've heard from Rails people, EmberJS people, maven people, and many others; it's the famous "you're holding it wrong" argument.

Sometimes you really are the best judge of what you need, and when the system works against you because for whatever reason the designer of the original system thought your problem is not an actual problem, you have to resort to weird monkeypatches or weird workarounds.

I would be fine with the "this problem has been solved" argument if we could all agree about objectively right solutions, and in some cases we can (e.g. you don't want to handroll your own crypto), but more often we just don't.

</comment><comment><USER18> I like the two graphs to organize the conversation. IMHO the key to success (max bang for the buck) is better composability and as little boilerplate code as possible. Haskell and Julia (for example) do this fantastically well.

The essential theme of long term usability is very close to what Guy Steele talks about in his fantastic talk/article _Growing a language_ — you want as little as possible embedded into the language, and you want as much as possible farmed off to the libraries so that users can compose the pieces they like without drowning in too much code.

</comment><comment><USER19> You could make the same argument for presales vs postsales.

There are numerous examples of this:

The look of the apple keyboard in a store, vs day-to-day functionality (or admittedly many apple products, such as a glossy display)

Any RGB product for sale now -- RGB keyboards, RGB mouse, RGB computer, RGB system memory. (get it home, turn it off)

meanwhile, a trackball or weird vertical mouse might be completely unapproachable, but for the folks who need them they are usable forever after putting in the time.

</comment><comment><USER20> Maximal cooperation?

Two schools of thought:

1\. Maximal cooperation require maximal composability

2\. Maximal cooperation requires some dictatorship

Interestingly I find that this is quite embodied in two of my favourite languages - Go and Haskell.

Haskell is all about composition. And it does so by dictatorship of its type system.

Go is dictatorial in the sense that there is one way to do things, but encourages compositionality, coming from a unix world where pipes are everything.

</comment><comment><USER21> I consider this a fundamental insight of Rust programming language: that it is a programming language optimized for long term usability.

No wonder it is struggling for adoption.

<comment><USER22> I wouldn't say Rust is 'struggling'. Compared to other languages, like say D and Nim, it's doing well.

No language could possibly topple its incumbent rivals overnight. To do this, it would have to have great advantages over existing languages, _and_ excellent interoperability, _and_ an approachable learning-curve. That's essentially a contradiction. If your language offers a new and better way to do things, it pretty much _must_ be unfamiliar to those who use older languages. If the concepts involved were similar, you'd be releasing a library, or publishing a compiler optimisation, rather than developing a whole new language.

Perhaps that's a bit of a generalisation though. TypeScript isn't doing anything new, it's just adding an old and familiar feature (static type checking) to an old and familiar language that lacks it. In TypeScript's case, the feature isn't ground-breaking, but it's valuable enough that it may be worth the pain of using a different language.

<comment><USER23> It seems like C++ offered all of "it would have to have great advantages over existing languages, and excellent interoperability, and an approachable learning-curve" and worked hard and made whatever compromises were needed to do it. Which is probably why it took off relatively quickly.</comment></comment></comment>


ACLU sues Homeland Security over 'stingray' cell phone surveillance - <AUTHOR> https://techcrunch.com/2019/12/11/aclu-cbp-ice-stingray-surveillance/ <comment><USER4> If we had a crowd-sourced database of cell towers (picture & coordinates) wouldn't it then be straightforward to know (and report) when your phone _wasn 't_ connecting to a legitimate tower?

I for one want to make sure the _criminals_ aren't intercepting my signal with home-made stingrays; the police have other lawful ways to get what they need.

<comment><USER5> No, because the cell carriers have "tower in a box" kits that they make available to various people. These are real towers, but they move often. If you go to a large event (something like burning man, though I don't know if they do for that specific event) there is a good chance the carrier has scattered a few of these around the venue because the fixed location towers (often miles away) would be overwhelmed and nobody would be able to use their phones.

<comment><USER6> Agreed - there are companies that specialize in ad-hoc towers to provide service. Example: Mobilitie in Chicago. Very important piece of mobile data infrastructure, but a rogue tower is still a real security risk.

</comment></comment></comment><comment><USER7> Some informed person can probably tell us: are there any technical developments on the horizon which could plausibly make stingrays unviable? From a lay perspective, it seems like cell tech hasn't been designed to meet some criteria that ought to be achievable.

\- Are there future cell technology standards being planned which would make it harder for a 3rd party device to impersonate a cell tower? (e.g. the police would actively need the cell network to help them sign something)

\- Why can't we encrypt calls and texts in a way which doesn't let all this stuff get read? Like (handwaving) either trust the network and encrypt with a key they provide, or else some form end-to-end encryption (where maybe generating keys is part of what happens when you activate a sim card or something)?

Like, sure the lawsuits are important, but why did we end up with a system where these tools are possible?

<comment><USER8> The key factor is the compatibility with international roaming - customers, manufacturers and operators really want the phone to "just work" when you step out of a plane in a random place where the only cell tower in range is run by an operator that was established after your phone was made. There can't be a global list of 'trusted operators' for political reasons (long story), and in order to make calls, your phone needs to work with that operator directly - <USER2> can't do end-to-end to your home provider, your data streams won't get routed halway across the world and back for no good reason, they'll route only the billing info and metadata as per the roaming agreements.

The other problem IIRC is virtual towers - when operator A gains improved coverage by renting capacity on a tower of operator B, they want the phone to seamlessly connect to that tower as if it's run by operator A (even if it's not) without the phone being able to inform the customer that hey, you're now connected to operator B - because it might rise confusion about roaming charges, and also give bad PR about coverage which might suggest the customer to switch to that competitor.

What could work is the combination of (a) your phone being able to cryptographically verify if it's _really_ connected to your 'main' operator or someone they explicitly authorized (isn't this something that 5g and even 4g protocol supports?) and (b) requiring explicit confirmation if connecting to someone that's not. Of course, (a) would mean that police Stingrays _would_ be recognized as legitimate cell towers, they'd need cooperation from the cell network, but's IMHO not really a problem, just some paperwork whenever they need to activate a new batch of intercepting devices.

<comment><USER9> > The key factor is the compatibility with international roaming

You could have an encryption setting in the phone, and the handshake with the network could have a bit telling you the setting isn't supported.

</comment></comment></comment><comment><USER10> Contribute to the ACLU here:

[https://action.aclu.org/give/now](https://action.aclu.org/give/now)

<comment><USER11> Canadian equivalent: [https://ccla.org/give](https://ccla.org/give)

</comment></comment><comment><USER12> Hopefully, this puts to rest the idea that government can use "private contracts" as a end-run around constitutional and legal restrictions on their activity

They have been hiding behind the NDA as a reason they should not have to follow federal disclosure laws, but never in the history of the law has a private contract superceeded the law itself.

they also hide behind these same NDA's when criminal defendants get to court and want to challenge the use of the tech on 4th amendment grounds

Hopefully the ACLU can put a end to that, the government should not be able to contract with any organization that prevents them from disclosing their activity to the public. Seems law enfrocement has lost sight of who they awnser to, which should be the people of this nation

<comment><USER13> The third party doctrine loophole is huge and not likely to be impacted very much by this, unfortunately.

Here's a relevant talk from the National Constitution Center, if you want to hear some of the nuance: [https://www.youtube.com/watch?v=hW32k7x7zE0](https://www.youtube.com/watch?v=hW32k7x7zE0)

<comment><USER12> Third party doctrine has little to with this case, I agree it is a problem, but that is not what I was talking about in my post

The Thrid Pary doctrine allows the Government to end run the 4th amendment if you discloused info to a 3rd party.

In this instance, the government is claiming they do not have to talk about the technology at all, even to the point of proving it actually does what they claim.

In criminal Trails they treat it as a black box that is magical.. this should not be allowed evidence collected by it directly or as a result of his use should be barred unless the defence has access to the technology fo independent review

The government claims they do not have to disclose anything because they signed a contract with the manufacturer saying they would not disclose anything about the tech.

<comment><USER13> True, but I was talking about the actual issue primarily being that Stingrays are mostly micro targeted, often with warrants due to costs, etc, while the vast majority of cell providers have warrantless, sometimes even subpoena-less web portals for LEAs to conduct spying operations on the public, or how the vast majority of the cell tower companies (separate from the major providers) themselves have the most useful information and do the same types of things.

While stingrays are an issue, the vast majority of spying on cell phone users (read: vast majority of US pop) comes from those other mechanisms which do employ the third party doctrine loopholes. I should have been more specific, but you are right about Stingray.

<comment><USER12> Well some of that falls on Congress not the 4th amendment

We need to redefine data ownership in this country, not just to curb police abuse, but to curb the abuse of corporations as well

That extends well beyond the 3rd party doctrine

</comment></comment></comment></comment></comment><comment><USER14> Stingray use requires a warrant and every case should be dismissed where one was used without a warrant. I'm sure that's the main reason they want to hide the use of stingrays, they know they're doing something wrong.

Police having the ability to spy on everyone with little to no oversight is nightmarish authoritarianism, it's completely against the spirit of American democracy, not to mention in violation of The Constitution.

<comment><USER15> As part of some volunteer work I'm doing with Lucy Parsons Labs, I submitted a FOIA request to every single state's largest city, asking for search warrant records that would likely exist on complaints for search warrants, the warrants themselves, or from any audit. About 100 requests in total.

After two months, only two cities have sent me their search warrant records. All other states have given me rejections saying:

1\. The records are on paper and never transcribed.

2\. The records are digital, but there's no way to query from a frontend.

3\. The records are digital and queryable, but the agency considers the use of queries "creating reports", where tons of states have case law backing this up.

4\. Nothing, because they haven't responded yet.

So far I've received three enormous fee estimations of ~500k, ~400k and ~150k. Obviously not affordable.

Chicago is one of the few cities that sent records (though, it took a _year_ ). They've sent three separately sized files for the same timeframe - <USER3> rows, 9k rows, and 20k rows. The data is messy, and there is some very important info missing from their records. Can't speak too much about it yet, since I'm still confirming the reasons. It's been blindingly frustrating trying to get a consistent message about whether the data is even accurate.

All this goes to show that police agencies don't make records on search warrants even remotely easily available to the public, and we have no way of gauging whether our constitutional rights are being upheld throughout the US. It's honestly very sad.

If you want to support this work and our other projects, please consider a donation to Lucy Parsons Labs: [https://lucyparsonslabs.com/support/](https://lucyparsonslabs.com/support/)

<comment><USER16> Ahhh, good ol' government inefficiencies and obfuscation. I have no faith in there ever being efficient systems in place because it'll just make it harder to hide shady behavior.

<comment><USER17> That's how it's been developed, continues, and planned. If it wasn't, it wouldn't be like this.

</comment></comment></comment></comment><comment><USER18> Stingrays have been known to be used by law enforcement for a decade now. It's about bloody time more information than just "they are used" is opened to the public.

<comment><USER19> Seems they were in use for about 15 years -before- cellphones became a thing. (See '2009 Utah case' here: [https://www.wired.com/2014/03/stingray/](https://www.wired.com/2014/03/stingray/) )

</comment></comment><comment><USER20> Presumably Homeland Security and its child agencies are targeting everybody within 100 miles of a border (~65% of the population) with any and every form of surveillance they can think of, because why not? It's very legal, and very cool.

<comment><USER21> > It's very legal, and very cool.

With who? I'd really like to know who is copacetic with this kind of surveillance state.

<comment><USER22> Cool as in "tacticool," like driving military surplus IED-hardened vehicles around for small town policing.

<comment><USER23> Or staging a shootout over property theft in an area full of civilians

<comment><USER20> or taking a guy to the hospital in chains so that doctors can spend the night inspecting the inside of his rectum and colon with increasingly invasive procedures because you think he might be hiding drugs in there

</comment></comment></comment></comment></comment><comment><USER24> Generally if the RSRP or RSSI increases significantly that is a dead give away you are on a stingray. You don't really need an app to see that (google how to see it for your phone type). Of course, it is always possible that your carrier just turned up a new site closer to you but that is not something that happens often and you can usually notice it.

Some comments about mm-wave 5G, keep in mind that mm-wave != 5G. But on mm- wave stingray becomes more difficult due to the high directionality of short wavelengths. But at lower bands, there is no advantage of 5G over 4G in terms of resilience over stingray types of attacks (which are basically a L1 middleman attack, similar to age old wifi types of spoofs).

<comment><USER25> Watching signal strengths is all well and good, but you need historical data to compare to. This is a viable option for a few sites (maybe near where you live), but not an option when you're on the go.

</comment></comment><comment><USER26> Knowing Bellard managed to build a 3G cell tower just by using a cheap antenna, I guess it means anybody can build a stingray, although connecting to the cellphone network might not be a trivial thing to do. No idea how companies secure their networks, and I wonder if there are security standard about it.

<comment><USER27> Where might I find more information about this?

<comment><USER26> [https://bellard.org/lte/](https://bellard.org/lte/)

Actually it's a 4G antenna. It's not a stingray, but to me, it's a big step towards it if you're a black hat and can find a way to access the cellphone network.

I have optimism and want to believe most big telco have good security practices and make it extremely difficult or impossible to connect to their network. Although one might be able to do some social engineering and do it, since the cellphone network requires a lot of antenna and manpower to install and maintain them.

For example, imagine you set up a fake company that installs those antennas. How can the telco make sure the antenna is not being moved around (monitoring GPS of the connected smartphones, maybe checking the residency of users to see if something is statistically fishy)? So in short, I tend to think it's not very hard to penetrate cellphone networks, unless the telco spends enough money to secure it and triple check their contractors.

</comment></comment></comment><comment><USER28> after reading through the comments i found this on hackaday, its from 2018; seems germaine to the current topics in thread:

[https://hackaday.com/tag/stingray/](https://hackaday.com/tag/stingray/)

the first paragraph is an intro speech of sorts then the real content begins. There is an interesting article linked in that part so i want to bring it to the fore.

[https://www.eff.org/deeplinks/2018/04/dhs-confirms- presence-...](https://www.eff.org/deeplinks/2018/04/dhs-confirms-presence- cell-site-simulators-us-capitol)

it seems that a number of factions may have been using "stingray" devices and thier contemporary equivalents for some time.

</comment><comment> ga-vu Source: [https://www.aclu.org/news/privacy-technology/ice-and-cbp- are...](https://www.aclu.org/news/privacy-technology/ice-and-cbp-are-secretly- tracking-us-using-stingrays-were-suing/)

For more insight and details.

</comment><comment><USER29> I have a femtocell in my home, because my small neighborhood sits in a dead zone. Not a repeater, a full femtocell.

To the casual security conscious user, that is probably going to look like a 'stingray', since you will be walking down the street with a gradually dropping RSSI, when all at once, boom, you walk into a five bar signal and life is good.

It covers about a 300 ft radius with the most blessedly beautiful signal you can imagine. Maxes out at 100Mb/S, since that is all the backhaul it gets from the ISP where it is connected. (Not that I am complaining about 100/100 in the house.)

But it isn't a Stingray. It is a fully secure registered femtocell base station.

Given that it hasn't moved in five years, it may well be on someone's map of established cell towers.

<comment><USER30> Can you use this device to enumerate imei of passers-by?

<comment><USER29> No. It is a closed secure box with ssl backhaul to the provider.

I was involved in the chip architecture for the silicon that is used in the box as well as the software engineer involved in the secure boot path for the cellular modems. It is one large chip with all the modems and application processors in one chunk of silicon. No unencrypted data, air link or Ethernet back haul, ever leaves the die.

From that, I am familiar with the physical design that the manufacturer implemented. (We did a lot of support work to get the manufacturer up and running)

They even go so far as to have a physical 'self destruct' button within the box. If you try to physically open it, it will never boot again.

The service provider states in the documentation (when you get the box) that if you tamper with the device such that the self-defeat gets activated, you have to pay full retail for the now dead box (they provided the femtocell for free if you live in a dead zone).

I laughed when I opened the retail box and that was the first thing in the document stack. Basically a large font "you have been warned"

</comment></comment></comment><comment><USER31> Watch Mr Robot and see this in action

</comment><comment><USER32> This made me wonder,

Do spoofed callers appear on a capture device as the spoofed number?

If so, you could in theory use law to target anyone by calling their number using a spoofed number that is included on a surveillance order. Just keep calling the numbers you want to monitor and the net keeps getting bigger.

Please tell me this is not the case?

<comment><USER33> Caller ID information is sent to the receiver by the switch.

If your switch is under your control (say, you're using Asterisk), you can send whatever you want, as demonstrated nearly constantly by all those spam calls.

</comment></comment><comment><USER34> Is it just me, or has the ACLU been on a roll lately? I'm really enjoying its current direction. It might have just been that the most controversial headlines were getting the most airtime, but it seemed to be going off the tracks for a while.

<comment><USER35> When was the ACLU going off the tracks exactly?

<comment><USER36> I love the work that the ACLU does, but they've always been picking and choosing which rights to actively support. See the opinion of the 2nd amendment on their own website: [https://www.aclu.org/other/second- amendment](https://www.aclu.org/other/second-amendment)

I personally don't hold the constitution as a sacred document, though I do find that it aligns with my ideals more than the actual policies of modern America. I could respect an organization being opposed to an amendment and deciding not to defend it for that reason, but it's always been weird to me that they have to hide behind a legal rationale rather than just admitting their political opposition to individual gun rights.

I still love the ACLU, and in the past I've given them time (passing out flyers, IANAL) and money despite these reservations. I'm really not trying to hate on them, but I would consider them "off the tracks" in this regard.

<comment><USER37> Are you concerned that organizations like the NRA are doing an insufficient job defending the 2nd Amendment to the point where the ACLU desperately needs to step in?

<comment><USER36> The NRA is more an arm of the arms industry than it is an organization actually interested in the rights of individual gun owners; for example, they're in favor of making 3D printed guns illegal. This is good for the industry, but would infringe on the currently recognised rights of individuals. I think the Second Amendment Foundation would be a better example of an organization that actually supports the 2nd. I do think our 2nd amendment rights are slipping away (in the beginning we could own and sell unregulated cannons), but I'm not presuming to tell the ACLU how to spend their time and resources. As noted above, I _would_ appreciate a recognition that their decision to not defend the 2nd is actually political rather than legal in nature, which I believe is pretty obvious.

<comment><USER37> > As noted above, I would appreciate a recognition that their decision to not > defend the 2nd is actually political rather than legal in nature, which I > believe is pretty obvious.

You're leaving out the third option, _practical_.

There are already well funded, effective organizations defending your interpretation of the Second Amendment. It makes little sense for the ACLU to divert resources to that endeavour as a result, even if they agreed with your political view on the individual vs. collective right to bear arms.

<comment><USER36> That would be fine, too! Knowing that the ACLU doesn't support the 2nd, I can choose to support organizations that do in proportion to how much I care about that amendment as opposed to the others. I'm totally cool with that. But practicality is not their stated reason for not defending the 2nd, and if it were their actual reason then I'm not sure what reason they would have to use a legal rationale instead. If their actual reason is politics, it's pretty obvious why they wouldn't want to admit that; it would alienate some people, and make them appear more partisan.

</comment></comment></comment></comment></comment></comment></comment><comment><USER38> Why not focus policies around using the surveillance tools?

The tools should be as powerful as possible. To keep people safe, shouldn't infrastructure be powerful enough to tap anything instantly with proper authorization, even backward in time? Why not?

Then we're focused on making rules better. Isn't that the best thing to do in a system of laws and standards?

Imagine if you could change any aspect of the system to make it more proportional, fair, ethical, whatever. Why not think about asking the right questions, weighing the pros and cons, and tailoring a way to improve it with minimum side effects?

Also, sometimes the regulations are so strict, it's dangerous.

For instance, here's an example where the rules around stingrays being so strict led a guy to get away with murder (in eyes of the judge):

> Circuit Judge Yolanda Tanner said in court Monday that while she is > suppressing the evidence "with great reluctance," Copes is "likely guilty." > [https://arstechnica.com/tech-policy/2016/04/citing- > unconstit...](https://arstechnica.com/tech-policy/2016/04/citing- > unconstitutional-search-via-stingray-judge-suppresses-murder-evidence/)

I wonder what it would have been like had that case been in Florida. Which has sweet inevitable evidence law.

<comment><USER39> > The tools should be as powerful as possible.

I think a lot of people would disagree with this premise. The argument against it is basically that abuse of powerful surveillance technologies is inevitable precisely because the technology is so powerful. In reality, law enforcement is only incentivized to catch criminals, not necessarily to protect people's privacy or personal freedoms, so LE will abuse these capabilities 100% of the time they have access to them.

A more subtle argument is that bureaucratic oversight of LE is almost always impotent to reign them in and has every reason not to due so due to a lack of accountability. A "fair, ethical" system is fundamentally incompatible with one in which law enforcement has sweeping surveillance capabilities and the lack of oversight which always results from any sufficiently large/slow/complex legal system.

<comment><USER38> > The argument against it is basically that abuse of powerful surveillance > technologies is inevitable precisely because the technology is so powerful.

What would be some examples of an abuse?

What would be some examples of a powerful surveillance technology?

For instance, what "surveillance technology" isn't already an internal diagnostic tool for day-to-day system administration for a telecom/service provider?

Only difference is who picks the target and them having oversight (likely having to provide a predicate/rationale). Why is this so bad?

If there's a lack of oversight, what rules and systems would you suggest to prevent abuse, as you define it?

<comment><USER40> I think that part of the issue is that blank surveillance is as easier than surveillaning a single person used to be.

Also, it is possible to build systems where the admins can access the data or metadata. End-to-end encryption, for example parent the admin from seeing the contents of messages. Systems like Tor also prevent any one person from knowing who everyone is and what's saying. Mutual authentication can also help establish that mitm attacks aren't happening, but that's a slightly different problem than when there is access to the back end of the system being used.</comment></comment></comment></comment>


ISuppli: $499 iPad components estimated at $260 - <AUTHOR> http://arstechnica.com/apple/news/2010/04/499-ipad-components-estimated-at-260-what-cost-software.ars <comment><USER2> Sigh. The price of a product is wholly unrelated to the cost of its raw materials. The price of a product is determined by the intersection of how much buyers are willing to pay, versus how much sellers are willing to accept in payment. That's it, the whole story.

</comment><comment><USER3> Interesting how the gross margin is falling as the SDD gets larger. One would expect the exact opposite, considering SSDs are getting cheaper by the day.</comment>


Page views required to generate $1M in ad revenue? - <AUTHOR> http://www.microsoftstartupzone.com/Blogs/the_next_big_thing/Lists/Posts/Post.aspx?List=6bab7b08-81ca-4602-bd97-4b7b2c893e88&ID=675

<comment><USER2> 300 million in page views net $15K in revenue. Not a business I want to be in. Google makes a very nice living because people who are googling are looking for information and the ads provide links to information. People who are socializing are not looking for something, they are already there. Most of the time the ads are even below the level of annoyance. (Mouseover videos are definitely over the threshold.) CPC vs CPM doesn't address the issue. Radio and TV ads work because you cant avoid them. Print ads works because people do scan newspapers in search mode.

The real issue is how to engage people when they are socializing. The advertiser needs something more engaging the current social event. Sex sells and flash sells, but the post is talking about something beyond that. I dont think target advertising is much more than the same old same old, but more refined. The break through will be something that enhances the social experience.

Maybe something like a chat about Paris brings up a live feed of a Paris cafe complete with tables for your avatars, with an urchin trying to sell you a travel guide. Whatever it is it needsto be engaging an not annoying.

<comment><USER3> pretty bad example, considering the people might be chatting about Paris Hilton.

<comment><USER4> pretty sure sites like perez hilton are getting great CPMs and advertising offers. It may be annoying/not to your liking as a site owner, but tv shows "reskin" the site on premiere nights. That costs a pretty penny.

<comment><USER5> You're right - Perez Hilton is making an absolute killing:

[http://web.blogads.com/adspotsfolder/ba_adspotsfolder_revisi...](http://web.blogads.com/adspotsfolder/ba_adspotsfolder_revision_create_shortcut?persistent_uid=3e759f53402fc5bafd783046580df71f)

[http://web.blogads.com/adspotsfolder/ba_adspotsfolder_revisi...](http://web.blogads.com/adspotsfolder/ba_adspotsfolder_revision_create_shortcut?persistent_uid=2bf3ca8b27a840dd60c8a1170cc175aa)

And there's multiple occurrences of those ads. 40k-75k PER week isn't that far of a stretch

</comment></comment></comment></comment><comment><USER6> What sites like Facebook and Twitter need to do is infer peoples needs from things that are happening to them in the moment. For example, if a user posts to their feed "My POS car broke down" They should be shown ads for new cars, repair shops, car rental and AAA. If a FB user invites 30 of their friends to a Halloween party they should all be shown ads for costumes and other related things.

FB and Twitter have the ability to preempt Google because they could predict your needs from your updates before you even know them yourself. As it stands though Facebook advertising strikes me as being about as effective as putting up a billboard on the side of a highway.

<comment><USER7> For certain types of advertising, I think Facebook's ability to target by demographic must make it significantly more cost-effective (and hence popular) than keyword searches -- products for a particular age range, or relationship status come to mind -- despite the lack of intentionality (i.e., a keyword search is somebody looking for something, but a Facebook user is not).

</comment></comment><comment><USER8> > _But, based on a survey of social network sites let's assume an average CPM > of $0.40. You would need 2.5 Billion page views per month to earn $1M in ad > revenues. That is 2,500,000,000 page views...and how many sites can sell out > all their page view inventory?_

This makes the mistake of assuming that one page impression = one ad impression. That's not the case on most sites. Most sites can quite easily have 2-4 ad impressions per page impression.

Also, it's not hard to sell out ad inventory at ridiculously low CPMs. There's always _someone_ willing to pay _something_ for a genuine ad impression. Most sites can probably sell a little bit of their inventory for a high CPM and the rest for a very low one.

</comment><comment><USER9> Trying to make that sort of money using something like an Adsense program is going to take a hell of a lot more pageviews over having a sales force capable of selling high-dollar ad packages.

That isn't to say that sites like PlentyofFish haven't been able to do it, but your CPM has to be fairly high if you're not getting billions of pageviews a month.

Sourceforge doesn't get nearly the level of traffic that Facebook does, but they brought in $5.4 million in media revenue from 36 million uniques in their first fiscal quarter of '09[1].

1\. <http://www.globenewswire.com/newsroom/news.html?d=155376>

<comment><USER10> Be careful not to confuse uniques with impressions.

Assuming 10 impressions per unique, that's still a very respectable CPM of $15.

<comment><USER9> That's the point, though, $15 CPM is enormous compared to the article's claim that the social network average is 40 cents.

<comment><USER11> I can confirm that claim.

This is over a sample of about 3 million uniques / month.

</comment></comment></comment></comment><comment><USER12> Hmm, not even counting the cost of content creation, how much is it going to cost to produce 1M in ad revenue?

They mention 2.5 billion views for $1M. Being very, very conservative in data transfer, that's several terabytes a month. 4k/page is 10 TB (3.858 MB/sec sustained for a month), 32k is 80 TB (30.864 MB/sec for a month), etc. A single banner image off of gamasutra.com (not even flash) was 149k.

The netlink, server hardware, and infrastructure (bought or rented ala rackspace) isn't exactly cheap.

<comment><USER13> This is highly dependent on what your site does. If you could somehow get that much traffic on a blog, the cost of bandwidth and servers would be very low (tens of thousands at the most, say 5% of your revenues).

On the other hand, if every page view is extremely heavy with a long tail of uncacheable content (e.g. Youtube) or computationally expensive (web search engine), then bandwidth and servers become a significant percentage of the revenues.

</comment></comment><comment><USER14> I think it's pretty clear that the best way to make money from a site is to sell things. For money.Crazy, I know.

<comment><USER15> A good way of making money is to sell things. But that is a way for a business to make money, not a site.

It has never completely gone away, but there was a time when instead of having ads, people thought sites should have shops. Newspapers would have shops. Sell mugs and pens. A lot of sites like news sites actually added them.

This idea never went very far.

Facebook and the like are here to stay n the internet. Even if Facebook itself goes out of business, it will be replaced. They are not a store. They do not magically turn their visitors into Amazon visitors by selling stuff.

<comment><USER16> _"This idea never went very far."_

Well, not to burst your bubble but there are many sites that use this exact business model.

One of the sites that comes to mind is homestarrunner.com - who have been doing this since they started.

Granted, it doesn't work for every business, but the fact is that if you create a service that your users _genuinely_ care about, they will purchase your merchandise, because for those users, this enhances their overall experience.

It's a classic model that's taken straight from hollywood. Merchandising revenue is a HUGE factor in lots of productions.

<comment><USER15> I never said sites don't have shops.

I'm saying Facebook are not going to monetise by adding one.

</comment></comment></comment></comment><comment><USER17> Google CPC works because it ties in buyer behaviour with advertisers. The solution to driving revenue from pageviews must either connect up existing behaviour with advertisers (where can I buy an X), or create a compelling new behaviour. For example, in the early days of newspapers, it wouldn't have been obvious to look in the back for classified ads, but buyers learnt this and now know to look in the back for the ads.

The power in social networks is the group of trusted friends. I'm sure some sort of group question along the lines of 'do you guys think I should buy an LCD or Plasma TV' with voting, or something similar, would develop new behaviours, particularly amongst consumers of products they aren't completely familiar with (anything from cars to financial products). Once you develop this behaviour in a social network, selling ads into it is a cinch.

</comment><comment><USER18> Uh.. audience matters. Like, a lot. If you think all impressions are equal, then you will only be able to attract lowest common denominator advertisers who will only pay you commodity prices. Why do you think washingtonpost.com has ads for asbestos lawyers?

If your site is for luxury yachts owners, or people looking to buy Enterprise CRM systems, or is specially tailored to Fortune 1000 CEOs, you can charge CPMs that most sites only dream of. With a dedicated ad sales staff You could probably clear a million with a few hundred thousand page views a month.

</comment><comment><USER19> The thing that is difficult about ads, not many people like to be told what to buy. And I think it might be the ads themselves that are lacking, not necessarily how they are delivered.

For example, look at this award winning Pringles online ad: <http://awardshome.com/cannes2009/pringles/can-hands.html>

The reason why this one is great, is because it isn't pushy, it has humor, and it uses normal, honest language that we can all relate to. Maybe it's these type of ads that need to be displayed in the social networks.

<comment><USER20> Your comment is so very incorrect.

It's not that _ads_ as a whole don't work, it's that untargeted, random banner ads are very ineffective at driving conversions.

Ads on search, which frequently tell you what to buy, and don't have room to be artsy of humorous generate billions of dollars for Google and probably much more than that for its advertisers. I wouldn't be surprised if Google gets $20-$100 CPM on its pageviews.

Award-winning ads are frequently not the most effective. The most effective ads are often bland, boring ads that tell you what to buy but take into account segmentation, positioning, targeting, behavioral trends, and so on.

<comment><USER19> I don't think a downvote was warranted here, but do what you may.

Could you provide a source to your last sentence? I'd like to read more about this. Thanks.

<comment><USER21> Take a look at any trade magazine or other specialty publication. In general the ads you'll find there have very low production values.

Award-winning ads and creative branding are necessary when trying to sell highly undifferentiated, commoditized products (e.g., potato chips). But if you have a product that is obviously differentiated from the competition (a laptop with 100 hour battery life, an electric sports car, etc.), informing consumers of your existence is often enough.

<comment><USER22> I got the impression that ads in specialty publications and trade magazines only have low production values because the companies advertising have small budgets.

</comment></comment></comment></comment></comment><comment><USER23> Last time I analysed revenue from ads per visitor the figure was between 0.0025 and 0.004, so 1000 views means 2.5 dollars at the low end or 4 dollars at the high end, so maybe the problem is limited to social networking sites alone. How can they make money? Perhaps freemium is the best way? I mean these people, well some of them, well most of them are addicted to Facebook and all the rubbish in it such as quizzes and friend poking, so if it costs say £2 to I don't know, send your friend the perfect girl questionnaire, sure some people will pay and if it goes hot and viral then all of them will pay, they have to.

<comment><USER24> Where are those numbers from?

<comment><USER23> just my own website

<comment><USER25> which ad provider do you use?</comment></comment></comment></comment>


Blind faith (computer programming) - <AUTHOR> http://en.wikipedia.org/wiki/Blind_faith_(computer_programming) <comment><USER2> This might be a good time to remind folks of Markham's Rule of Technical Debt: _The economic cost of making your code better can never exceed the economic value of the code to begin with._

Write a function that saves to disk but never checks if it fails? Who cares? If you never use it again, or it never does anything of value to anybody, it's not worth anything.

Craftsmanship is a great thing, but it always exists inside a larger economic context. The guy laying tile in your kitchen doesn't give the same attention to detail as the artisans completing the Sistine Chapel. And this is a good thing! He might not have much education, he buys pre-assembled pieces, and he's liable to just slop it in there. This is appropriate because your bathroom's economic value is miniscule compared to a great cathedral. Likewise, if you're in a startup writing code, you've only got a 1-in-10 chance or so of your code ever having any value at all beyond just playing around. Completely different picture if you're being funded by BigCorp to write version 8 of the Bells-And-Whistles App. Yet some of us insist on treating all this coding the same.

So I am a bit annoyed at the use of the word "faith" in this context. If "faith" is calling functions and expecting them to either execute or terminate the program, CS is replete with faith-based-coding. This entry describes the situation too much in loaded terms.

</comment><comment><USER3> I don't quite understand this (or rather why this is a wikipedia page). This is literally "blind faith" as defined by the normal wikipedia page; there is not "Blind Faith (electrical engineering) or "Blind faith (civil engineering)".

Also the recommended alternative does not _have_ to be TDD, that is just one engineering practice. One can develop with tests without it being TDD.

</comment><comment><USER4> I think most of us have probably deployed fixes without knowing 100% whether it helps, but based on a good hunch from looking at data and code. The reason I keep doing so is because so long as the hunch is good and based on facts, it keeps working.

Tests are good, but there are always those issues those 0.001% issues that will never occur when you are trying to make them happen, but will happen to _somebody_ once code is deployed. I am reminded of an incident a few years back where I could reproduce it with tests occasionally, but it would literally take me weeks of re-running the test 24/7 before I would hit it again. As you can imagine, I applied some "blind faith" (as in article) fixes while waiting for that stuff to run.

PS: By the rules of wikipedia, this article probably shouldn't exist. Nonstandard terms, not notable, original research, blah blah blah.

</comment><comment><USER5> _A programmer calls a subroutine to save user-data on the hard disk without checking whether the operation was successful or not._

This might not be blind-faith. "Fail-fast" is a legitimate pattern where you don't check for errors, you just let the program fail/terminate immediately.

<comment><USER6> But in this case, if you don't check the return value of for example the write() system call, it's more a case of "fail silently" than "fail-fast", which is perhaps the most dangerous form of bug that a program can have.

</comment></comment><comment><USER7> Not everything needs a snappy moniker and a Wikipedia page. May I suggest the noun "carelessness".

</comment><comment><USER8> Also read Voodoo programming[1]/cargo cult programming[2].

[1]: [http://catb.org/jargon/html/V/voodoo- programming.html](http://catb.org/jargon/html/V/voodoo-programming.html)

[2]: [http://catb.org/jargon/html/C/cargo-cult- programming.html](http://catb.org/jargon/html/C/cargo-cult-programming.html)

</comment><comment><USER9> Reminds me of Knuth famously publishing some code he had never run, with the disclaimer, "Beware of bugs in the above code; I have only proved it correct, not tried it."

</comment><comment><USER10> Definitely a victim of this. Many times, when optimizing for time.

</comment><comment><USER11> But wait! Shouldn't file system subroutine check if it actually written what was asked thus marking operation as completed successfully.

Why do we have bloody exceptions if we need to double check every action taken?

<comment><USER4> I actually find it much easier to code reliable stuff in C where you have to check error conditions manually. If for no other reason that it serves as a constant reminder that the failures happen, and if you're writing reliable software this forces you into consistent habits to handle them.

I feel like in a language with exceptions, since throwing and catching happens inconsistently and haphazardly all around a code base, people are conned into thinking the exceptions will never happen. Usually one of two things happen:

1\. The language is like java and it forces you to declare what exceptions you throw, so lazy people just put in lots of do-nothing catch blocks to silence the compiler.

2\. The language doesn't have the "checked exceptions" concept, so people literally think no exceptions can happen. They just wait for the exception to make everything blow up.

Often when exceptions _are_ handled, this lack of explicitness makes sure it's done at totally the wrong stack frame to make the judgement call about what to do about it. Then some people do dumb shit like try to catch things like stack overflow exceptions which should rightfully take down the process, and keep running. Not to mention that an exception is just a wacky concept, it's essentially a goto that crosses stack frames... Everyone criticizes goto, but few people will question exceptions...

</comment></comment><comment><USER12> My entire Computer Science education summarized. Blind faith. Every test, every question, every function, every call. Blind faith.

</comment><comment><AUTHOR> TDD FTW!</comment>


"It's like Twitter. Except we charge people to use it." - <AUTHOR> http://www.27bslash6.com/p2p.html

<comment><USER2> It's hilarious, but of dubious origin. Simon Edhouse says it's fake[1]. I have no reason to trust him, but I also don't have any reason to trust David Thorne (and DT is known for pranks).

[1] <http://www.naymz.com/simon_edhouse_864677>

<comment><USER3> While it proves nothing, I have had the misfortune to have met a couple of people who act almost identically to the everyday Edhouse, and, on an off-day, exactly like the rather more extreme Edhouse as presented by Thorne. The two personalities are perfectly consistent with each other, in my humble experience. It's not a million miles from Calacanis.

I'm leaning towards 'exaggerated for comic effect', as opposed to 'exactly as it happened' or 'made up'.

</comment></comment><comment><USER4> and he will sell it for 40 million bucks, and then will send him a postcard from his "yaght". LOL.

</comment><comment><USER5> Funny, but a dup of [dead]ed prior submissions:

<http://news.ycombinator.com/item?id=962280>

<http://news.ycombinator.com/item?id=989448></comment>


'Game Boy' gadgets used to steal cars by imitating key fob signals - <AUTHOR> https://www.techspot.com/news/85988-25000-game-boy-gadgets-used-steal-cars-imitating.html <comment><AUTHOR> > "What is most worrying is that something sold decades ago has been > repurposed to help thieves. With plenty of old gadgets collecting dust, some > will tinker with them in the hope they can unlock a car"

As always they quote people with absolutely no knowledge. Pictures are obviously a look-alike shell (probably sourced from china with a pi or similar already inside), and adding radio functionality alone is a bit more than just 'tinkering'.</comment>


Ask HN: Is This a Case for Kubernetes? - <AUTHOR> Summary: Should I use K8s for this case: https://imgur.com/a/L0TfAtA?
I'm planning a new app and was wondering if I should use K8s. I'm familiar with AWS and have been using Fargate with autoscaling for most of my projects. This app is going to be my most complicated program, so I'd like some input before I start coding.
The app is a REST api that connects with each customer's datasource to perform an operation.
This is my current plan:
1. Public Subnet

  - Elastic Load Balancer
 2. Private Subnet 1

  - Fargate Service - Auth Server

  - Private Elastic Load Balancer (routes request to correct Fargate service)

  - <USER2>

    - 1x Fargate Service for each customer (with autoscaling)

    - 1x KMS key for each customer

    - each Fargate Service can only access their KMS Key
 3. Private Subnet 2

  - MySQL database

 I made a quick diagram here: https://imgur.com/a/L0TfAtA. Is this something I should consider K8s for?
I've created very basic K8s applications, but nothing in production.
Happy to provide more information. <comment><USER3> Why are you considering k8s? What are you expecting k8s to make easier or better for you? Is your aim to learn k8s?

K8s comes with a lot more complexity for the benefits you get. There are setups, interactions, tradeoffs outside of k8s that might be considered. Depends on your goals.

Another question might be, how much DevOps do you want to do? Are you trying to launch a product or is this a learning project?</comment>


Show HN: SSL Timer – Certificate expiry countdown timer - <AUTHOR> https://ssltimer.com <comment><AUTHOR> I created this little website because I tend to leave things to the last minute, such as renewing an old website's certificate. There's nothing like a countdown timer to create a sense of urgency. I hope you find it useful.

</comment><comment><USER2> It would be good if you could list several domains and show the countdown for whichever one is the next due to expire. Once that one gets renewed, shuffle the next one due into the countdown.

Or use lets-encrypt and automate renewals.

<comment><AUTHOR> Thanks for the suggestion regarding multiple domains.

People should definitely use Let's Encrypt. I certainly do where I can (e.g. ssltimer.com).</comment></comment>


15 Startups With $100 Million+ Valuations That Hardly Existed Last Year - <AUTHOR> http://www.businessinsider.com/15-valuable-startups-no-one-knew-about-last-year-2011-9

<comment><USER2> A nice follow up thread or article would be how many of these websites or services would retain this value, based on what some call currently a book market.

</comment><comment><USER3> Most of these "startups" existed for years.

<comment><USER4> Indeed was just coming to post that.

From the article:

15 - Betterworks 2011

14 - Instagram 2010

13 - Warby Parker 2010

12 - Beachmint 2010

11 - Flipboard 2010

10 - Shoedazzle 2009

9 - Vostu 2007

8 - One Kings Lane 2009

7 - ZocDoc 2007

6 - Storm8 2009

5 - Spotify 2006

4 - Rovio 2003

3 - AirBnB 2008

2 - Square 2009

1 - Drop box 2007</comment></comment>


HN Is this forum Software available? - <AUTHOR>

Hi, I'm actually looking for the software that is used for this forum/bulletin board. I believe I saw a link once but I can't find anymore. I believe that this forum was coded especially for HN but also available for download. Please correct me if I'm wrong. Thanks Colin. <comment><USER2> It's written in pg's lisp dialect Arc. IIRC, a version of the news app is provided with the official Arc distribution, available here: <http://www.arclanguage.org/install>

See also the Arc Forum <http://www.arclanguage.org/forum> and the unofficial Anarki version of Arc (which, again, includes news.arc): <http://github.com/nex3/arc/tree/master>

<comment><AUTHOR> Also thanks for the reply.

</comment></comment><comment><USER3> It looks like it's released with Arc:

<http://news.ycombinator.com/item?id=494421>

</comment><comment><AUTHOR> That's excellent, thanks!</comment>


SunSed – Blogging platform where what you see is what you get - <AUTHOR> https://www.sunsed.com/

<comment><USER2> Interesting ideas on the front page but I wouldn't mind seeing some more before I have to sign up!

<comment><USER3> I have updated the home page! Sorry!

<comment><USER2> No sweat, just tested it out a little bit! Really love the interface. Very professional, easy to use and lots of options.

Couple of other thoughts that would make it a little bit better (from my point of view).

\- When browsing my own blog, if logged in, it would be awesome to see some admin link (maybe the normal hamburger menu?)

\- More information what certain options do. For a software engineer things might seem super obvious, but if I look at for example my girlfriend who currently uses Squarespace for her blog, a lot of things aren't that clear. A simple (i) icon which, when hovered, gives a little explanation would help a lot. For example the FP option when a cover is uploaded, the page settings (register as web page?, difference between the redirects).

\- The need for hashtags while tagging seems a little bit redundant, since I'm already using a specific field for tags, why not use it like Delicious where I just write the content with comma's.

\- The Google Analytics setting doesn't have a logo when using an add blocker ;)

\- Not for right now, but I can imagine when the settings become more populated having separate settings for the Social Media, GA, Disqus and stuff might be summarized or sub-menu'd so it won't become a massive mess of possible things.

\- When looking for pricing I couldn't find anything. Maybe I just looked in the wrong direction, but there is a possibility to enter my credit card but no way of knowing how much I'd have to pay you. Besides that, it might also be valuable to let the user know who handles the payment transactions. If it is for example Stripe or another well-known provider people will probably quicker give those details than just to a 'random' blog provider if you catch my drift?

Really really love the UI, and the possibilities for customization. Not sure when you released this but it feels like a solid, full product that I'm seriously considering using (though always the feeling of building something yourself creeps up). Big ups for the amount of effort and the execution quality!

EDIT: Just saw that if I log out I can actually see the pricing.

EDIT2: Maybe some way of contacting you (support) might be handy?

<comment><USER3> Your comment made my day!

I have printed your comment and highlighted all the points I have to work on and put it on my board.

You are right with the hashtag system. I just switched to hashtag yesterday from a tag system just like delicious, the only reason being it would be easier to search specifically for tags. I might have to reconsider!

Thanks a million,

You ROCK!

UPDATE1: I have implemented non-hashtag tag system.</comment></comment></comment></comment>


A New Tech Generation Defies the Odds in Japan - <AUTHOR> http://www.nytimes.com/2012/10/04/technology/a-new-tech-generation-defies-the-odds-in-japan.html?_r=1&pagewanted=all

<comment><USER3> I am not sure if it is appreciated but I'll try to be bold and add some personal experience. I have been based in Tokyo for three years now and I'll try to fill in a bit on the cultural components affecting the start-up scene here along with how foreigners fit into the whole picture. The Times hint towards this but it isn't the main focus of the article. At the core of it all is the phrase "There is one, and only one, correct way of doing everything".

As mentioned in the article, Japanese society favours stability and predictability, life-time employment is something that has been the standard for a long time and your elders and society at large simply won't accept you if you don't have permanent full-time employment. This means a harder time to get everything from an apartment to a credit card. You have deviated from the true path, which is to secure employment in the "job hunting" period, which lasts for about two years leading up to your graduation as a bachelor or a master student (Ph.D. is generally a different story, so let's save that for a different time).

This job hunting involves an initial one year of "getting to know" (the companies do take attendance) each company at seminars and events. You register at their websites and attend in your own spare time. Schools try their best to respect this and are not as hard on the students during these years. Hordes of students dressed in suits (mind you, there is one kind of correct suit for this, well, one, depending on your gender) try their best to learn about the company and their goals, because this step is the preparation for the second stage. The second stage is filing applications, we are now somewhere between 1 1/2 and 1 year prior to graduation. A student can apply for as many as 75 companies, the reason for this will soon become clear, the failure rate is high and so are the stakes. At this stage the student has some idea of what he or she wants to do, but they will apply for anything they can consider okay. Each company has a different time when they accept applications and then go through three, four, maybe even nine steps of tests, interviews, group interviews and procedures (public sector jobs usually has an exam with questions from history and English to IQ-testing, you need to pass to get to the next stage). Once a student gets past these steps, they get an offer and are faced with the choice of accepting it or maybe to wait since their dream job may not even have started accepting applications yet. Once you enter the company you may very well receive training that is very different from your educational background, you are now "one of the family", for life, but that is a different story, let's get back to the start-ups.

Now, how does all this play into the start-up scene? Well, the one correct way to go through job hunting is when you are about to graduate. Some students fail to get a job, if you are a bachelor (this I am told holds especially true in science and engineering), you beg to your parents to fund you through your master and you then try again once you are done with your master (if they are rich enough, it isn't cheap and same thing goes for Ph.D.;s). Being outside the system for a year without a very good reason, such as interning abroad, will label you as an outcast, making it difficult to reenter the system. The same, of course, holds for those that try and fail to take part in a start-up. This creates an enormous disincentive to take risks and I think plays a major role in why the only successful Japanese start-up that I can think of that has gone big in the last 20 years or so is Rakuten. I can't blame students for simply asking, "Why should I take the risk? Why should I build the companies of the future?".

This is turning into a speech (maybe I am entitled?), but the way foreigners fit into this whole mess is that we, to a large extent, are exempted from this honour system. We are not expected to "understand" the correct way and can more easily jump between companies and most of the smaller start-up;ish companies I know in Tokyo are at least 50% foreigners (I think I may be a bit biased here). What I suspect is the attraction for foreigners is the culture and the challenge, maybe also the good (and diligent) labour. I think it was Bertrand Russel that said that Japan doesn't move ahead at a continuous pace but rather by skipping ahead after a major collapse of the foundations of its society. The Meiji Restoration and the end of WWII springs to mind. Only then has it been demonstrated that the old ways have failed and there is a climate where innovation can take place on a grand scale and companies and society can be resown. On a personal note, I hope that it won't have to be quite so dramatic, but the whole situation surely is problematic although getting better and better over the short amount of time I have been here.

If you got all the way to the end, thanks for staying with me. Having been in Japan for a few years now I tend to reflect upon these things. The above opinions are of course biased by my own limited understanding of things, I am an amateur at best, but maybe they can prove useful.

<comment><USER4> How hard is it for foreigners (American, in my case) who aren't already in Japan to get into the Tokyo startup scene? I'm guessing you'd need a work visa, something startups would have a tough time providing.

I've studied Japanese and studied abroad in Japan, so I'd definitely like to return, but it seems to me that the easiest way to do that would be by getting a job at a big company like Rakuten.

<comment><USER5> I was going to ask the same question (even though I won't have visa problem because I am married to a Japanese). Also, is it necessary to speak Japanese to work in a start-up owned by foreigners? And how about the paperwork to create a company there?

<comment><USER6> It depends on the startup, but there are opportunities at Japanese and non- Japanese owned startups alike, for people without Japanese skills.

If you have someone who can help you through the paperwork, creating a company isn't so hard. It took us about 60,000 yen and one month to create at Godo- Gaisha (similar to a LLC).

<comment><USER7> Do you have any more info on the paperwork part? I've been putting it off for a few months now and considering just registering in the US first to make things easier with US-based clients.

<comment><USER6> We haven't had issues when dealing with US-based clients (granted previous to this we didn't have any clients, so I don't have much to compare it to).

I didn't actually do the paperwork, so I don't actually know how complicated it was. We're actually incorporated in Chiba, and at that time (Nov 2008), the government office responsible for the paperwork wasn't very busy, so they were happy to help out.

Unless you are fluent in Japanese, you probably will need help from someone else. If you don't have a Japanese cofounder / spouse, probably the best thing is to pay someone to help with it.

</comment></comment></comment></comment></comment></comment><comment><USER8> I don't interpret this information as "defying the odds". I read this as "Japanese entrepreneurs continue to struggle under their oppressive conditions, see little hope for improving investment climate or exit options."

Unless these companies can successfully exit (after all, that's what startups are built for, right?), I would consider them to have *succumbed to the odds".

edit: If the author were actually plugged into the Japanese startup scene, they should have mentioned the recent acquisition of Crosos (a social media marketing startup) by Yahoo! Japan[1].

edit2: I just scanned through recent articles by the author, and it looks like she's not a tech beat writer but just a generalist[2]

[1] <http://pr.yahoo.co.jp/release/2012/0810a.html>

[2] [http://topics.nytimes.com/top/reference/timestopics/people/t...](http://topics.nytimes.com/top/reference/timestopics/people/t/hiroko_tabuchi/index.html?offset=15&s=newest)

<comment><USER9> For me, the most interesting bit concerns how these newer Japanese start-ups are filled with ex-employees of major corporations. Leaving a major corporation was completely unheard of when I left Japan in early 2006. Yet today, it seems to be happening.

Do you have any insight into what's driving this new class of Japanese entrepreneur to leave the comfort and safety of Big Corp.? If so, could you guess how widespread such attitudes might be among young workers in corporate Japan?

<comment><USER8> For one, the younger employees of such megacorps are no longer guaranteed to receive the kind of promotions, raises, benefits, and retirement packages of their predecessors. The more attuned you are to the global tech development at large and the macroeconomic environment, the more you realize that these "stable" companies aren't what they used to be 30 years ago. These companies aren't supposed to have layoffs, yet you see companies from NEC to Sharp cutting workers in the thousands now. The lifetime earnings of a bigcorp guy was said to be $3MM before; now, it's estimated as $2MM for the younger guys.

Second, I think that "high tech startups" have gained significant popular acceptance in Japanese society, which has allowed them to exit bigcorps without being socially stigmatized. (Before, I think it would have hard to even find someone to marry as a startup dude. My friend makes as much money from his website via affiliate ads as he does from his bigcorp job, yet he can't leave the bigcorp since he needs it as a shield against society judging him negatively).

That being said, leaving a big corp is still an outlier. Since a startup exit is so difficult in Japan right now, the "wise" move still may be to stick with the bigcorp job, especially if you're at one of the globally competitive places like the big auto companies or materials suppliers like Shinetsu[1]. It's just that the factors against leaving a bigcorp have become slightly attenuated.

[1] Shinetsu chemical has huge market share for Silicon wafers globally: <http://en.wikipedia.org/wiki/Shin-Etsu_Chemical>

<comment><USER10> If I can oversimplify a bit, as Murakami-san say: You used to put up with the b.s. that went with working a lifetime in a large, bureaucratic organization. Now that the security & benefits are no longer assured, you see more mid- to upper-mid level workers willing to take more chances and start their own companies.

By no means should you confuse this as being any sort of sea change - <USER2> first post is still completely accurate for the majority of young workers, especially - but I think more people are starting to recognize "freelancer" & "self-employed" as something different from "freeter" - a Japanese term that ostensibly means "free + worker" but is really seen as just some young bum who bounces from one part-time job to another.

<comment><USER8> Haha, no need to address me like that; there's a reason why I'm working in SV again now. :P

</comment></comment></comment></comment></comment><comment><USER11> > the value of investments by its 50 or so venture capital fund members > increased to 24.6 billion yen ($316 million) in 2011, 35 percent higher than > the previous year. But that was a small fraction of the $12.6 billion in > venture funding raised by Silicon Valley companies that year, according to > Ernst & Young.

We often see articles critical of VC on HN, and to some extent that criticism is a healthy thing. But in my experience the relative lack of VC investment is one of the bottlenecks of the Japanese startup scene.

Startups obviously cannot offer the same degree of stability as a large company, but if they keep offering the same (or lower) salaries and _no stock options_ , I don't know how they can expect to hire good people.

</comment><comment><USER12> NYTimes, could you please make your included stylesheets load over HTTPS too? I don't want to have to disable your site in HTTPS Everywhere. Thanks!

<comment><USER13> This is what Readability and/or Pocket are for. I rarely, if ever, read articles with their sites' native formatting.</comment></comment>


Any NYC Hacking Programs - <AUTHOR>

Hi there! Anyone know where I can apply to free and affordable, on-site (NOT online; my attention span online is verryyyyy low) web development courses or programs in the NYC area? I hope to apply to Hacker School this month. Any similar programs like that? Thanks. <comment><USER2> You already know the basics of programming and want to apply it in an internship, hackathon or specific challenge? Or you want to take a basic 101 class?

There's a Hacker Hours meetup Thurs night with a lot of developers in a wide range of skill levels that you can probably ask around for guidance or help. <http://www.meetup.com/nyc-on-rails/events/75153382/></comment>


Could it work for rents in SF or Vancouver? - <AUTHOR> http://www.dw.com/en/berlin-housing-law-replenishes-housing-stock-for-renters/a-42360345 <comment><USER2> Interesting Statistics from the Article: While this law has removed 95% of all "Vacation Rentals" in Berlin this article says nothing about how the renting market was effected.

There are >3.4 million people living in Berlin and this increased the number of rental properties by 8000. This means that this law created 1 new long term lease for every 425 residents.

Related Information: Vancouver is the most popular non-us destination on Airbnb and San Fransisco is the most popular US destination.

Personal Summary: While this article is shown as an example of a positive outcome for residents when cities "fight back", I believe further study should be done on how big of an impact this change has on Berlin's housing market before any conclusions are formed. Berlin's politicians are divided on this law, and it is being challenged, but it looks like it will be on the books for some time. There should be impacts on tourism and the hospitality which are also not covered in the article. Outside of mentioning politician opposition no opposing view was represented in the article.</comment>


The Last Question by Isaac Asimov -- 1956 - b-man http://www.multivax.com/last_question.html

<comment><USER2> I can't believe this is posted again on Hacker "News".

There needs to be a separate site that creates and maintains a hacker-oriented library of "Great Articles."

So I'm building one. Let me know if you're building one too, and we can collaborate, or I'll save my efforts and let you have the glory.

</comment><comment><USER3> <http://searchyc.com/submissions/last+question>

<comment><USER4> And despite having been written in 1956 there are still people to whom it is new. This is one of those things that should be re-posted every year or so, just so more people see it.

<comment><USER3> Probably, there should be a category in HN to most liked posted stuff - <AUTHOR> goldmine.

</comment></comment></comment><comment><USER5> "All other questions had been answered, and until this last question was answered also, AC might not release his consciousness."

Sounds like a memory leak</comment>


Mordred brings Gatsby's "source data from anywhere" idea to the rest of us - <AUTHOR> https://github.com/egoist/mordred <comment><USER2> How does this compare to Sourcebit?

[https://github.com/stackbithq/sourcebit](https://github.com/stackbithq/sourcebit)</comment>


Tim Berners-Lee: https everywhere considered harmful - <AUTHOR> http://www.w3.org/DesignIssues/Security-NotTheS.html <comment><USER2> First TBL accepts DRM, now he eschews HTTPS because it changes the URI protocol and breaks the old http link?

Who are you and what did you do with the inventor of the WWW? Redirects are an easy solution to deprecated http links. And I still wish you understood DRM. [http://www.theguardian.com/technology/blog/2013/mar/12/tim-b...](http://www.theguardian.com/technology/blog/2013/mar/12/tim- berners-lee-drm-cory-doctorow)

</comment><comment><USER3> This sounds like a tempest-teapot scenario because he doesnt seem to know about http/2 which includes the feature TBL is ranting about. Instead, he comes off as fingerwagging at folks for doing something to stop-gap fix the web because the http RFC didnt include security from the beginning. Adding tls to http/1.x is impractical, utopian mythology because there's too much deployed to ever change until http/2 becomes widely deployed.

Instead of ranting, downplaying the EFF and others for improving the situation or wishing for the impossible, TBL missed the opportunity to support adoption of http/2, which might not be perfect (PHK mentioned rushed process and protocol complexity) but it has been touted to supersede http/1, https and spdy.

btw: there's also unauthenticated opportunistic encryption like tcpcrypt which works via server and client plugins.

[https://en.wikipedia.org/wiki/HTTP/2#Encryption](https://en.wikipedia.org/wiki/HTTP/2#Encryption)

[https://tools.ietf.org/html/rfc7540](https://tools.ietf.org/html/rfc7540)

</comment><comment><USER4> So if I understand this right, Tim's main issue is that "s" is just going to lead users to think "oh, it's secure, I'm good right?" when really web security is a continuum, even on the level of certs - the browser doesn't meaningfully differentiate between domain validation, identity validation, and extended validation (EV), and less so on the technical characteristics of the cert (signing algo, ciphers chosen, etc.)

It's not that encryption is bad, it's that the https method encourages lazy thinking.

Call me pessimist, but I think that any method which relies on "user education" is doomed from the start. Any UX designer can tell you that users _do not read error messages_ and just click by them ASAP to get back to what they were doing before the computer so rudely interrupted them.

<comment><USER5> No, he only gets to the point in one of the final paragraphs:

      The problem is of course that moving things from http: space into
      https space, whether or not you keep the rest of the URI the same,
      breaks any links to. Put simply, the HTTPS Everywhere campaign
      taken at face value completely breaks the web.

Of course, in reality, anyone who moves to HSTS also adds a rewrite rule that redirects incoming http vistors to the https URI. In fact, Let's Encrypt even does it automatically: [https://github.com/letsencrypt/letsencrypt/blob/master/letse...](https://github.com/letsencrypt/letsencrypt/blob/master/letsencrypt- nginx/letsencrypt_nginx/configurator.py#L384)

His complaint is completely spurious.</comment></comment>


Farmers using hydroponics and LEDs to grow underground to harvest first crop - <AUTHOR> http://www.theguardian.com/business/2015/sep/13/the-innovators-london-air-raid-shelters-sprout-a-growing-concern <comment><USER2> How exactly is this innovative? The article doesn't make it clear what aspect is an "innovation" over others in the same field. These people don't seem to be first to use LEDs, or grow microgreens...

EDIT: the title of the submission has changed since I wrote this.

<comment><USER3> I don't think these guys are the first, but UV LEDs might be fairly new. They allow very much less electricity yet give plants an optimal frequency of light.

</comment></comment><comment><USER4> What are the possibilities for this in areas that are far too hot/dry for crops? Underground growing retains water and can be more easily temperature controlled.

Given that photosynthesis does not use the full spectrum, how efficient do LEDs and solar panels have to be before you have a net gain on solar energy converted into photosynthesis?

</comment><comment><USER5> I thought this was about harvesting in space.

Replacing the sun here seems inefficient.

<comment><USER6> Light from the sun is broad spectrum. Photosynthesis uses only part of the spectrum. In a charmed world, you could power LEDs using energy from the unused spectrum, and be more efficient than sunlight.

Edit:

Turns out, there is a Y-Combinator company making agricultural LEDs:

[https://blog.ycombinator.com/transcend-yc-s15-makes-extra- ef...](https://blog.ycombinator.com/transcend-yc-s15-makes-extra-efficient- led-lights-for-the-indoor-farms-of-the-future)

<comment><USER7> Yes, but the sun is free. It's not like plants grow poorly in sunlight.

<comment><USER8> They do grow poorly in sunlight in plenty of places. For example, places where water need to be conserved.

</comment></comment></comment></comment><comment><USER9> Good preparation for space exploration, moon/mars colonies, where energy might be abundant, but surface access and water will be resources in short supply.

</comment><comment><USER10> There is absolutely no way this will be commercially viable or environmentally sustainable. I think the real business opportunity is finding out why high end chefs are using 48-hour produce- that sounds like a supply problem and there should be no real supply problem for such greens (these are luxury items with a known level of demand), since they grow natively in the area.

</comment><comment><USER11> Very interesting. I can't wait to see what this brings. Especially with the hydroponics idea of not needing to use soil.

<comment><USER12> Hydroponics is already very common in above-ground vegetable greenhouses.

</comment></comment><comment><USER13> TL;DR; The novelty of plants grown underground, plus the appearance of extra freshness = $ from an entertainment point of view.

Which is cool, people love the idea of doing things underground. It unfortunately almost never makes practical sense but neither does most entertaining things.</comment>


Using Canvas Pixel Caching to Reduce jMockups' Rendering Time By 80%+ - <AUTHOR> http://blog.jmockups.com/2011/01/how-i-used-canvas-pixel-caching-to-reduce-jmockups-rendering-time-by-80/

<comment><USER2> Nice, I have noticed the same thing when working with canvas - any time you can get the pixel level manipulation to happen in native objects there are big performance gains to be had.

I am interested on the general idea behind your new import an existing site feature. I have played around with this a little bit before, and realize that there is no way to directly render HTML onto a canvas (unless of course you have add on permissions in firefox, like this: [https://developer.mozilla.org/en/drawing_graphics_with_canva...](https://developer.mozilla.org/en/drawing_graphics_with_canvas#Rendering_Web_Content_Into_A_Canvas)). Then of course there is something like this: [http://www.cuppadev.co.uk/projects/a-browser-within-a- browse...](http://www.cuppadev.co.uk/projects/a-browser-within-a-browser- htmlcanvas/) which seems a little incomplete.

I assume you build up the elements array from the elements in the DOM, and manually generate a canvas for each one? That seems like it would be quite tedious, and handling inherited styles, etc could be a pain. Also, once you start moving elements around, they may not really have a place in the HTML anymore, so if I want to share the mockup, is it just an image, or does it become absolutely positioned HTML elements?

Great job on this by the way, I'm impressed with how well it is working.

<comment><AUTHOR> Hey, thanks for the note.

The import tool will be a bookmarklet that, when clicked, will analyze the DOM using jQuery then post that data back to jMockups, which will create a mockup based on the data that it received from the bookmarklet. It winds up being just one canvas, the same as jMockups uses now. When you share it, it will be an image, not HTML (though long term an export to HTML/CSS feature would be nice).

The tricky part, as you point out, is all the styles. You've got all the background images, repeats, position, sprites, border width, color, style, etc etc etc. Fortunately, most sites only use a fraction of them, which means that at least for the initial version, it doesn't have to handle everything. It won't be perfect, but I've found it works well on 90% of 90% of the websites.

If you have any ideas on how to improve the tool itself, let me know. Thank you again for the feedback.</comment></comment>


Ask HN: Do you face problems with using Google Chrome? - <AUTHOR>

It seems Chrome has become quite unstable and hangs frequently requiring restart of the linux/mac laptops. Does it happen to you often? <comment><USER2> On my Mac I have the Beta of Chrome and I almost never have problems. On my Windows partition I use the stable releases and I never have problems. I have more problems using Safari than I do in Chrome, not sure about Firefox 4, never tried it out yet.

</comment><comment><USER3> Google Chrome Dev v12. something

Had several problems, can't remember them all. One that I do remember is it being extremely problematic or slow loading Google Maps mashup base stuff where Safari perfectly just worked.

</comment><comment><USER4> I use a pc and have multiple chrome windows open, each with 20-30 tabs, which I leave open. After hibernating 5-6x it starts to get unstable. It used to be fine, but the flash upgrades have made things horrible.

<comment><AUTHOR> You are right. It happens more frequently whenever I open a website with flash content.

</comment></comment><comment><USER5> Sometimes when entering a search term in the address bar the "instant search" goes a little crazy and loses half of the text I typed in. Not a big deal, but happens once in a while.

<comment><AUTHOR> I face that exact same problem on my Nexus One browser.

</comment></comment><comment> T-R I run Chrome Beta in Linux on a 64bit Sony laptop, which is pretty much asking for trouble. Aside from Flash videos occasionally not playing, I haven't had any problems.

<comment><AUTHOR> I also have 64-bit linux running with Chrome beta. If I have 20+ tabs open and open any website with flash content, it inevitably hangs the machine.

</comment></comment><comment><USER6> No. I very, very rarely have any problems. I run the beta version.

Are you sure you are running the stable production release?

<comment><AUTHOR> Currently using 8.0.55 Beta.

</comment></comment><comment><USER7> have you tried removing all your extensions ?

<comment><AUTHOR> No extensions on Chrome :)</comment></comment>