Treaty gives Hong Kong option to reject Snowden extradition to the US - <AUTHOR> http://www.scmp.com/news/hong-kong/article/1257639/treaty-gives-hong-kong-option-reject-snowden-extradition-us

<comment><USER2> Sorry, but I don't buy this guy's story. Something is just incredibly fishy.

I don't buy this guy's argument for going to Hong Kong, e.g. that has a history of free speech, and its supposed autonomy from the mainland -- even after all of these years, Chinese pressure prevents Taiwan from international recognition. You think they are just letting Hong Kong do its own thing? He seems intelligent and must be aware of this, especially having worked in the intelligence world. The Chinese firewall is the most renowned internet chokehold in the world. The Chinese are known for hacking Google to spy on their own citizens.

I just have to think of it if I were in his situation. If I were a freedom- loving individual looking to seek asylum, I'd probably first look at countries that granted asylum in similar cases that weren't internationally renowned for suppressing freedom of speech. Assange has asylum with Ecuador, why not go there first? China is just such a weird choice for someone who is purportedly morally driven to his actions by privacy violations.

Not only that, this situation has nothing but upsides for the Chinese. It looks great for them to expose another world power is spying on their own citizens (and weakens any diplomatic arguments the US has when pressuring them to open up free speech and the internet). It's also a nice thorn to retort after all of the recent hubbub about Chinese government hackers. If he wasn't an active spy in the traditional definition feeding the Chinese information, he is certainly an asset by circumstance -- why wouldn't they manipulate him to their benefit?

Now, that's not saying the US did the right thing -- we kind of fucked ourselves here having PRISM in place first of all -- but I am not sure this guy is the lone ranger whistleblower hero is painting himself to be.

<comment><USER3> >Sorry, but I don't buy this guy's story. Something is just incredibly fishy. >I am not sure this guy is the lone ranger whistleblower hero is painting himself to be.

That is exactly right. Its much too convenient. This guy was probably a PRC mole/sleeper. Who defects to a country that still executes dissidents?

<comment><USER4> At [https://twitter.com/SCClemons/status/343392529913356289](https://twitter.com/SCClemons/status/343392529913356289) @scclemons writes:

> In Dulles UAL lounge listening to 4 US intel officials saying loudly leaker > & reporter on #NSA stuff should be disappeared recorded a bit

<comment><USER2> lol, perfect example of why twitter is retarded.

I live in DC and know tons of people who work for the government. Guess what? They are people like you and I, and in a lot of cases less capable or bright (which is why they go for cushy government jobs). They get drunk and they act like assholes in groups, you hear them talking garbage all the time on the metro and in restaurants.

Just because these people (who in all likelihood are bureaucrats with no power at all) say they want this guy dead doesn't mean they have any power or ability to send out the hit squad, or killing reporters is now US Policy. It's just as meaningless as me randomly saying "god, I wish Karl Rove was dead."

<comment><USER5> Killing reporters is _not_ US policy. Yet. Pulling clear diplomatic strings to insinuate a rape accusation and force them into a situation where they require diplomatic sanctuary, on the other hand...

</comment></comment></comment></comment></comment><comment><USER6> He probably did his research, looked at court systems etc. He probably expects to spend some time fighting over extradition. Its not really a bad call (Hong Kong). The question is, where do you want to fight? What battlefield do you want to choose?

I don't know. It is probably better than many other choices. One major problem with choosing Ecuador is that if Ecuador is involved in both Snowden and Assange there are potentially large problems for them. I don't doubt for a moment that Correa would love the fight, but I do doubt that it would last past one administration.

He's the underdog. Wherever he chooses, he bears a huge level of risk. There is a lot to recommend HongKong.

But in addition, the fact that it poses important options for resisting extradition provides another way of fighting. If the Obama Administration wants this to go quietly they do not want a long extradition fight showing up in papers followed by a long court trial.

<comment><USER6> As a note (too late to edit) it is possible he could be gambling for example that if the US asks for extradition the Chinese will come asking for classified information or better yet, that the fear of the Chinese doing so would be enough to keep the US from asking for extradition.

</comment></comment><comment><USER7> I don't see a downside for Hong Kong/China in rejecting an extradition request.

Cynically, it's leverage and they'll have the moral high ground in the eyes of the world.

<comment><USER8> Being in HK for the summer, I honestly don't get the impression that anybody here cares about this particular issue.

<comment><USER9> The extradition decision will be done at a high-level for someone like Snowden. Whether or not the common citizens of HK care about the NSA hoopla doesn't really factor into it.

<comment><USER10> It'll be done at a high level, but PR will be a large part of it.

The US is a valued trading partner of both HK and China. One doesn't generally go about pissing off their major trading partners unless there's something in it for them.

There are really only two things Snowden can give HK or China:

\- Further intelligence. This seems unlikely if his story is what he says it is.

\- A giant PR coup domestically, putting the Chinese government, for once, on the right side of a human rights/democracy/transparency issue.

That second part depends largely on how much the general population can be made to care about the issue. The Chinese won't hang onto a _highly_ wanted American criminal that the US federal government desperately wants tried, not unless they can extract something out of the deal.

<comment><USER11> That second one is a benefit not to PR to the general population, but as an underline to Chinese statements in arenas such as the UN which seek to defend their practises (censorship, monitoring) in the face of very hypocritical statements by the US. The cost of doing this is negligible, yet the value to them as a PR coup on a political level is quite high.

</comment></comment></comment></comment></comment><comment><USER12> The article is confusing. More clearly: both Hong Kong _and_ the PRC (mainland) can deny extraditions from HK to the US.

 _Beijing, which gave its consent for Hong Kong to sign the agreement, also has a right of veto if it believes the surrender of a fugitive would harm the "defence, foreign affairs or essential public interest or policy'' of the People's Republic of China. In short, the treaty makes Snowden's fate a matter of political expediency not just in Hong Kong but in Beijing._

[http://www.guardian.co.uk/world/2013/jun/09/edward- snowden-h...](http://www.guardian.co.uk/world/2013/jun/09/edward-snowden-hong- kong-gamble)

<comment><USER13> Hong Kong is special, while it is part of china it is also acts on it's own with permission from the mainland. That is why Beijing gets it's own vote in what happens with Hong Kong

</comment></comment><comment><USER14> Given Snowden's background in intel and the information exposed, I think he calculated his decision correctly. Even though other countries (like Iceland) are offering asylum, I really do believe Snowden choose a formidable country that opposes western views...anyone recall Hilary Clinton addressing China's firewall, or Google pulling out?

<comment><USER6> Additionally consider this. The ball is now in the court of the US Government. They can ask for extradition or they can wait. If they ask for extradition, what is China's next move? The logical one is to approach Snowden and ask him to make a deal, to exchange classified information in exchange for asylum. That puts the ball back in Snowden's court and he has three options:

1\. Let the US know he has had the offer and ask them to step down before he has to take it.

2\. Take the Chinese up on the offer.

3\. Reject the Chinese offer, turn himself in, and return to the US in shackles specifying he did not sell out his country. If he can manage to do that publicly, that might also be a great great gamble that might turn out in his favor.

The more I think about it, the more I am impressed with his choice.

<comment><USER14> The Guy Fawkes mask that anonymous uses illustrates what? - treason (hope that's not too cryptic)

I strongly agree with you that I too am impressed with each calculated decision he has taken...even down to the press release.

The press release is also key in his decision to reveal him self. By doing so, how suspicious would it be if he "committed suicide." An example of how the press can protect him, you need not look farther than Julian Assange.

And even when it comes to the initial press release, the only reason I believe that it was revealed in the order that it did was for competition. He seeked the Guardian (in England), and compelled the Post (in the US) to publish. In media, it's all about being first, royalties, and copyrights. Check the link below.

I'd have to say, his execution of his plan, was very well calculated.

[https://news.ycombinator.com/item?id=5853496](https://news.ycombinator.com/item?id=5853496)

<comment><USER6> > The Guy Fawkes mask that anonymous uses illustrates what? - treason (hope > that's not too cryptic)

First 100% agreed with your points.

As a tangent.

BTW, if I ever start a hacktivist group I will use a medieval split tally stick for a logo.

Why?

In 1834, the humble tally stick accomplished what Guy Fawkes was unable to. Look up "1834 parliament tally stick" to see what I mean.

<comment><USER14> Reminds me of the plot in V for Vendetta. I'm sure we'll hear from some of Anonymous this week, but in regard to hacktivism...just remember, the nail that sticks out gets hammered.

In memory of LulzSec: [http://www.youtube.com/watch?v=gAYL5H46QnQ](http://www.youtube.com/watch?v=gAYL5H46QnQ)

<comment><USER6> The great irony though was that what caused the Great Fire was burning tally sticks that were the government's half of tax receipts.

There's something deliciously ironic about trying to dispose of tax receipts causing both houses of parliament to be burned to the ground.

Never, never underestimate the humble tally stick ;-)

</comment></comment></comment></comment></comment></comment><comment><USER15> I wonder whether the HK government perceives him as an asset or liability.

<comment><USER16> Either way the USG will be working as hard as hell to make him a liability for _everybody_ except the US.

</comment></comment><comment><USER17> why everybody thinks he's realy in hongkong? at his place I'd say I'm in any place but real location.

</comment><comment><USER18> So that's where the Snowdens of yesteryear are.

<comment><USER19> Correct, Yossarian

</comment></comment><comment><USER3> Snowden is probably already a PRC citizen, he doesn't have much to worry about.</comment>


Ask HN: What happens to your code if you get hit by a truck? - <AUTHOR> It's a pretty common scenario: you develop thousands of lines of code, then get hit by a truck. Now what? What do you do to make sure your code continues after you've become a spot on the pavement? <comment><USER2> If your code is well-documented I guess it will be easier to deal with it. If you can't understand code you have written 6 months ago, it won't be easy for other programmers. All black magic code should be clearly indicated.

</comment><comment><USER3> I think that my code must die with me. My precious code.

</comment><comment><USER4> Luckily I have a "hit by a truck" exception I include in every project regardless of language.

</comment><comment><USER5> I haven't even made out a will yet.

</comment><comment><USER6> I'm confused.</comment>


How Meg Whitman Failed Her Way to the Top at eBay - <AUTHOR> http://www.alternet.org/story/148629/

<comment><USER2> Im not a republican or even a Whitman fan. But that article was so much hyperbole I could not read beyond page 2. eBay revenue in 2000 was $431.4 million; revenue in 2007 when Whitman left was $7.672 billion.

Seems to me like she did a great job at ebay.

<comment><USER3> Yeah, there's no question that buying Skype was a terrible move and not just in hindsight (lots of people at the time were saying that it didn't make sense). But if you compare eBay to Amazon (which the author tries to do), the eBay share price dramatically outperformed Amazon during her tenure and just as dramatically underperformed after she left (but to be fair, the recent performance was also due to the fallout from Skype and to her failure to evolve the eBay business model)

</comment></comment><comment><USER4> It's as if there's a concerted effort to post these hit pieces against Whitman on HN. Yesterday it was how she destroyed HP's culture, today it's 'failing her way to the top at eBay'. What's on for tomorrow? Raping puppies? Grinding up newborns to make baby oil? Drinking the blood of young girls so she can maintain her youth?

<comment><USER5> Whitman destroyed HP's culture? I thought Fiorina was the HP CEO: <http://news.ycombinator.com/item?id=1840389></comment></comment>


Vedeu: Ruby-based terminal GUI framework - <AUTHOR>

I've been working on a terminal/console based GUI framework for Ruby for around 4/5 months. Its still very basic, but there's a complimentary mp3 playing app which uses it to showcase capabilities. Not quite cross-platform, and still needs a bit of work. Welcoming pull requests.<p>Vedeu: https://github.com/gavinlaking/vedeu<p>(The mp3 player; Playa: https://github.com/gavinlaking/playa). <comment><USER2> From the headline alone it looks a lot like Urwid in Python-land: [http://urwid.org/](http://urwid.org/)

Some compare&contrast would be a nice introduction for those who know one but not the other (like me).

EDIT: it looks like this one really doesn't use ncurses at all relying instead on terminal escape codes: [https://github.com/gavinlaking/vedeu/blob/master/lib/vedeu/s...](https://github.com/gavinlaking/vedeu/blob/master/lib/vedeu/support/esc.rb)

Urwid can use that too, but has a few other display backends: [http://urwid.org/reference/display_modules.html#module- urwid...](http://urwid.org/reference/display_modules.html#module- urwid.raw_display)

Urwid is also MUCH older (first Changelog item from 2004).

Of course, Urwid is still Python, so it may not be a good fit if you absolutely need a Ruby library.

</comment><comment><USER3> Wildly, I was looking for something like this a few weeks ago when I got the itch to create a text-based game. I came across ncurses, but this looks to fit the bill a lot better than that.

I doubt I'll get around to pursuing the game in any amount of time, but I definitely support the project. It fills a niche I was looking for.

</comment><comment><USER4> I have been looking for something like this a while ago. I was very dissatisfied with the existing solutions. This looks a lot nicer. I hope to find some time to play with this. Thanks for sharing!

</comment><comment><USER5> How does it compare to some of the other Ruby CLI frameworks?

I've been using escort[0] for my CLI utilities, and it seems like a decent compromise between providing a useful number of features and not bloating your app into a huge framework with a complex DSL to figure out. It is a little short on interactivity once the command is running, though.

[0] [https://github.com/skorks/escort](https://github.com/skorks/escort)

<comment><USER6> This is not a CLI Framework; it is a GUI framework. You can think of this as a ncurses interface for Ruby.

[https://en.wikipedia.org/wiki/Ncurses](https://en.wikipedia.org/wiki/Ncurses)

<comment><USER7> It doesn't use ncurses, actually - it just prints characters out to STDOUT.

<comment><USER2> "characters" is a bit misleading name for what it is: [https://github.com/gavinlaking/vedeu/blob/master/lib/vedeu/s...](https://github.com/gavinlaking/vedeu/blob/master/lib/vedeu/support/esc.rb) \- but yes, that's how it works.

<comment><USER7> how are those not characters? :D

</comment></comment></comment></comment></comment><comment><USER8> Hello,

I'm an amateur ruby developer. You should announce your project to the ruby- users mailing list: firstname.lastname@example.com

best regards and thanks for the code :-)

<comment><AUTHOR> Thank you, will announce there a little later today :-)

</comment></comment><comment><USER9> This looks fantastic, look forward to trying it out. I have built various csv conversion scripts for people to use at work, and have been using the awesome highline[0] option parser, but i would make people feel so much more comfortable with a more usable interface.

[0] [https://github.com/JEG2/highline](https://github.com/JEG2/highline)

</comment><comment><USER10> I'm split here, on one hand there's (n)curses already available on ruby, on the other hand, you need an additional library for it. Any other benefit one should be aware of?

<comment><AUTHOR> Hi,

I've tried to escape the tyranny of NCurses to be honest. NCurses is procedural in nature and I wanted to try to provide an OOP interface as my solution. I'm also experimenting with events which I think make implementing GUI apps with this framework much easier and flexible.

</comment></comment><comment><USER11> Looks very cool, and more intuitive than a lot of the popular alternatives (urwid, blessings/blessed). I'll be giving this a shot soon, thanks for sharing it!

</comment><comment><USER12> Wow, I was searching for exactly this kind of framework to build a little Pomodoro clock to run in a Tmux window. Thanks so much for this!

</comment><comment><USER13> This is pretty cool - been kind of looking for something similar in node-land, inquirer seems a bit lacking

</comment><comment><USER14> Thanks! Looking forward to applying this to my personal productivity workflow.

</comment><comment><USER15> I'd love to see modern Turbo Vision clone :)</comment>


Clive Thompson on the Death of the Phone Call - <AUTHOR> http://www.wired.com/magazine/2010/07/st_thompson_deadphone/ <comment><USER2> Clive Thompson is easily the author who most regularly grabs my attention long enough to read an article start to finish and then actually email him to tell him how awesome the article was.</comment>


Writing Your Own Programming Language - <AUTHOR> https://github.com/marciok/Mu#writing-your-own-programming-language <comment><USER2> Peter Norvig's "(How to Write a (Lisp) Interpreter (in Python))" ([http://norvig.com/lispy.html](http://norvig.com/lispy.html)) covers a superset of this material and makes more sense, and actually has a portable implementation you can run yourself. If you're going to do this, use Norvig as a guide.

<comment><USER3> When I think about writing my own language, I think of something with as few parenthesis as possible and all the examples use Lisp.

<comment><USER4> The reason for LISP or SCHEME as the tutorial is that parsing is easy and doesn't call for Flex/Bison. There is a level of semantics also that if you don't strain yourself on edge cases you can do a decent interpreter or compiler pretty quickly.

Without making this post long I could "tempt" or encourage you by suggesting that if you take the outermost paren pair off an s-expression, you sortof have a language of function application:

defun fact n = if (< n 2) 1 (* n (fact (- n 1)))

I think there is an SRFI for Scheme that proposes something like that plus offside rule to get rid of parens.

You could get rid of more parens by adding operator precedence to the syntax (and that offside rule would help too), but now you're making the parsing interesting instead of making the execution interesting.

<comment><USER5> And the reason you don't want to drag in Flex and Yacc/Bison is that then the bulk of the course will revolve around the banal issues surrounding syntax, rather than semantics: high in heat, low in light.

Not even the smarter side of syntax (abstract syntax), but rather character- and-token level syntactic sugaring.

</comment></comment></comment></comment><comment><USER6> Honest question: why do tutorials in this topic seem to always use functional languages/syntax as examples? Our compilers class at MST had us re-implement a lisp compiler, but didn't touch on why we used lisp specifically (other than the professor liking it; we were a largely C++ school). Do they think functional languages are simpler / less complex / easier to understand? Is there something inherently easier to implementing a functional language instead of something more imperative?

<comment><USER7> I've built interpreters for both a subset of Java and a full Lisp. Here's my take.

> Is there something inherently easier to implementing a functional language > instead of something more imperative?

Other answers have focused on the parsing of the language (that is, the production of an AST) which is much easier to cover instructionally for a Lisp because it's basically the AST already.

To my mind the semantics' of imperative languages is the real issue. In particular when defining and/or implementing the semantics for an imperative language, eventually store (memory) management comes up and everything gets much more complicated instantly.

[edit] And to go along with the store there are often more forms for which you need to define the semantics (statements, expressions, classes, etc).

In contrast functional languages can frequently be implemented using term rewriting which can deal directly with the AST itself.

More broadly, this is why I wish students were required to implement an interpreter of an imperative language. The act of debugging programs becomes more difficult for the same reason the semantics is more difficult to define and implement: it's more complex and there are more nuts and bolts to consider.

<comment><USER8> _In particular when defining and /or implementing the semantics for an imperative language, eventually store (memory) management comes up and everything gets much more complicated instantly._

Why? Isn't C-like "call malloc" simpler than the GC which is required for most (all?) functional languages?

<comment><USER9> It's not really being functional that calls for GC -- if you have data structures (whether they're closures, records, or whatever) escaping up from the scope in which they were created, you have a tricky lifetime question to deal with. In both the imperative and functional cases, you _could_ require explicit allocation and deallocation (like malloc/free), and you _could_ make it automatic (garbage collection). Functional programming tends to use GC because passing/returning closures is a common thing to do. These days, I would say imperative programmers also tend to use GC.

</comment></comment></comment></comment><comment><USER10> I have a friend who wrote this book: [http://createyourproglang.com/](http://createyourproglang.com/)

Jeremy Ashkenas created CoffeeScript after reading that book. I can't recommend it enough for someone going down this road.

<comment><USER3> Ah, I searched this link for a while, thanks.

</comment></comment><comment><USER11> There are a TON of resources like this which focus on lexing and parsing which is all fine and dandy but interpreting the resulting Abstract Syntax Tree will be extremely slow.

Are there any resources on the code generation side of things? Even getting from a high level language down to SSA seems like a big leap (nevermind going from SSA to assembly).

<comment><USER12> > Are there any resources on the code generation side of things?

Cooper and Torczon's "Engineering a Compiler" is mostly focused on the back end. I liked it a lot.

</comment></comment><comment><USER13> I took a university course where we built an interpreter for MicroScheme. It was a difficult project but was also really awesome and rewarding. I'd like to go back and do it again without deadlines to really understand it better. I think functional programming languages can be a great choice for implementing an interpreter since metaprogramming is their forte and Racket's match function helped a lot, it's like the most powerful thing I've ever seen[1]

[1] [https://docs.racket-lang.org/reference/match.html](https://docs.racket- lang.org/reference/match.html)

</comment><comment><USER14> No. First, understand what the language is for (if nothing, stop here...). Second, make the main design choices (expressiveness of type system, level of control of mutability or lack thereof, etc.). Third, design the type system, with a view to type inference. Fourth, design and define the semantics. Do those last two in a way that will let you test your implementation against these definitions automatically. Fifth, think about sufficiently efficient implementation strategies. Sixth, pick a syntactic style that will be familiar to most of your users. Seventh, design the actual syntax. Eighth, implement it. Ninth, try it out on users and go back to the start. Tenth, rest.

</comment><comment><USER15> I'm confused, the article says the language uses a postfix operator and then shows examples like `(s 2 3)`. Isn't that a prefix operator?

</comment><comment><USER16> Why do bloggers focus on lexing and parsing? These things should not take up 80% of the article about creating a programming language.

This fascination with "how" to build something, without considering "what" and "why", seems to be an issue that gets repeated time after time again.

<comment><USER17> I found [http://hokstad.com/compiler](http://hokstad.com/compiler) a lot easier to understand than any other compiler tutorial I've seen. Writing a compiler the way you'd write any other program. It does end up with e.g. a distinct parser, but only when the reasons that might be a good idea become apparent.

<comment><USER18> Thanks :)

Though in retrospect I think it should have been two separate series (and I need to write a few more parts; I'm _very_ close to having it compile itself as of last night).

I think it'd have been better to evolve the initial simple language into an equivalently simple language to parse, and kept the long slog towards compiling Ruby as a separate thing.

Especially as that has complicated things enough to be in severe need of various refactoring (which I'm avoiding until it will compile itself, at which point I'll start cleaning it up while insisting on keeping it able to compile itself..).

The parser itself started out conceptually quite clean, for example, but the Ruby grammar is horribly complex, and I keep having to add exeptions that's turned it quite convoluted. I don't doubt it can be simplified with some effort once I have the full picture, but it's not great for teaching.

</comment></comment></comment><comment><USER19> [https://raw.githubusercontent.com/marciok/Mu/master/WriteYou...](https://raw.githubusercontent.com/marciok/Mu/master/WriteYourLanguage.playground/Pages/Interpreter.xcplaygroundpage/Resources/simple- ast.png)

 _(Beavis and Butthead laugh)_</comment>


Unlearn Your MBA (Entire Talk) by DHH - <AUTHOR> http://ecorner.stanford.edu/authorMaterialInfo.html?mid=2351

<comment><AUTHOR> Bullet points from the talk:

1\. Unlearn Your MBA.

2\. Veer Away from Heavy Management Theory.

3\. Planning Is Guessing.

4\. Venture Capital Is a Time Bomb.

5\. Don't Play with Other People's Money.

6\. Playing It Small Doesn't Mean Not Making Money.

7\. Great Ideas Derive from Well-Rested Minds.

8\. Constraints Are Your Friends.

9\. Overnight Success Does Not Exist.

10\. A Small Business Can Be a Highly Profitable Company.

11\. Out-Teach Your Competition.

12\. What I Did Learn at Business School.</comment>


Rebasing Merge Commits in Git (a cautionary tale for software teams) - ryan-allen http://notes.envato.com/developers/rebasing-merge-commits-in-git/

<comment><AUTHOR> When working with teams what is the problem with just doing "git pull" and "git push". It seems this is more truthful, and merge commits are evidence of what is going on with the repo. Rewriting history might simply appear nicer in the log, but what is the point really?

<comment><USER2> The problem with the default git pull is that it treats every "give me what's up on the server" as a first class merge commit.

It adds a lot of noise to the commit history if you're trying to differentiate between "oh, this bug fix or feature was added into master/trunk/whatever" and "oh, that was just bob getting the lastest code from upstream"

</comment></comment><comment><USER3> Interesting. Would like to see how this compares to mercurial pull and mercurial fetch (if it has the same problems, or not)</comment>


Chill The F*% out over the Google/Verizon Proposal - <AUTHOR> http://www.seanoc.com/blog/2010/8/17/chill-the-f-out-over-the-googleverizon-proposal.html <comment><USER2> Google fans:

You know how when Apple does something unsavory to further its own business interests, and Apple fans spin the most elaborate arguments to show how Apple doing what's best for Apple is actually in everyone's interest? This is your chance to be different.

<comment><USER3> What about when people spin a story out-of-control and sensationalizes to the extreme? Or that's not an option...? People aren't even reporting on FACTS, they're making up shit to say Google doesn't support net neutrality and wants the net to be ruled by Google alone. That is total sensationalism and I cannot believe you are resorting to: "Oh, you guys are fans that cannot think because you don't ridicule Google."

<comment><USER2> The only _fact_ here is that Google very quickly switched from a whole-hearted support of net neutrality to, at best, a compromised position endorsed by Verizon, a company with a long history of outright opposition to net neutrality and one that has significant leverage over Google thanks to Droid sales. Their change of heart occurred very shortly after Android began to be perceived as a success and after rumors of a Verizon iPhone.

Fundamentally, this is an issue of trust. The deal Google is proposing creates significant wiggle room for the landline carriers, and asks us to trust that the issue will be revisited for wireless carriers somewhere down the road, even though an entrenched discriminatory regime will be much more difficult to dislodge if it becomes a reality on the ground. There is a fairly strong net neutrality movement today, even without Google, an apparently sympathetic FCC, and a Democratic Congress capable of passing a net neutrality bill. There will not be a better opportunity to legislate net neutrality for _years_ , given the likely results of the upcoming midterms. Google is asking us to trust them and wait, when waiting will almost certainly put the enemies of net neutrality into a stronger position.

Personally, I don't see a lot of reason to trust Google on this issue. They are like a lifelong Republican who suddenly discovered the attraction of left- wing politics after losing his primary and joining the Democrats.

<comment><USER4> What's the sympathetic FCC and the Democratic Congress accomplished towards Net Neutrality lately?

"Congress rebukes FCC on Net neutrality rules" <http://news.cnet.com/8301-13578_3-20005834-38.html>

"In theory, most Democrats favor Net neutrality. But theory doesn't always mesh with political practice. Rank-and-file Dems are clamoring for Net neutrality about as much as Bush-era Republicans were clamoring for limited government: it's a valuable talking point, but of course there's no need to do anything hasty. (Besides, even in this anti-incumbent year, how many single- issue Net neutrality voters are there?) The last time there was a major rewrite of telecommunications laws, it took something like five years for Congress' internal mechanisms to spit out the Telecommunications Act of 1996. A push for national cable franchising legislation went on for years but died without a vote."

</comment></comment></comment></comment><comment><USER5> I hate self-censoring like this.

Either use fuck, or don't. If you don't want to use the word fuck, then use another word. It's easy to be equally harsh. "Chill the hell out about the Google/Verizon proposal." "Freaking out about the Google/Verizon proposal? You're a retard."

The point of censoring is that it's _externally imposed._ Swear filters on poorly designed multiplayer video games. Internet forums. When you self- censor, you announce that you spend so much time in such places that it has irrevocably altered your writing.

</comment><comment><USER3> It is sad that most people jump on the bandwagon without really grasping what Google is trying to accomplish. I think the author frames it pretty nicely towards the end with, basically, if we don't play the game we won't get to make the rules. Google is trying to play the game - it has no incentive to NOT have neutrality on the Internet. Most of Google's best products have been start ups that they bought (and a lack of some neutrality on the Internet would put a damper on that).

Instead, we get cries of Google running afoul and that (somehow) every intellectual person at Google is now "evil" and bent on world domination.

<comment><USER6> This is called "being co-opted by the system". It's not evil in itself, but you no longer get to pretend to be idealistic once you've done it.

<comment><USER3> I do not think that being realistic necessarily means being bad. It is unrealistic to expect everyone to get along and the world to be great without some abiding laws that those involved agree upon. The fact that things have been luckily good so far is really not the whole story. These carriers are itching to reduce network load, and without any rules they could begin making decisions to lower costs without directly harming customers. This could be very toxic for what the Internet stands for, and while it's unthinkable today it is possible in the future.

</comment></comment></comment><comment><USER7> Bottom line is that Google's advocacy of net neutrality was an attempt to innovate via legislation... by making a major competitive force illegal.

There are strong arguments both for and against net neutrality, and Google did itself a disservice by trying to rally people behind the idea that net neutrality is the "good" option and anything else is "evil". That sort of simple binary good/bad is reminiscent of George W. Bush's approach to selling people on his war strategy.

The fact is, it doesn't matter whether we have laws enforcing net neutrality... for most things a neutral net is what consumers expect and demand. For the marginal things where consumers don't care (possibly including internet search) then consumers still win.

</comment><comment><USER8> This pretty much all started because of a single New York Times article. Everywhere reported that Google was requiring Verizon to abide by net neutrality except the NYT which said it was destroying net-neutrality (pretty hard to do when it never existed).

The fact that everyone on the internet reads the NYT and Gawker (and Gawker just reports on NYT reports) lead to some sort of vicious rabble-rousing feedback cycle. The power of the media.

</comment><comment><USER9> Just spell out fuck, you're making us all think it.

(thank you Louis c.k.)

<comment><USER10> Or, even better, find a less colloquial way of expressing yourself.

Not that I have a problem with the word 'fuck'; just that it's not really appropriate for most serious discussions.

</comment></comment><comment><USER11> <http://en.wikipedia.org/wiki/First_they_came..>.

</comment><comment><USER12> I think that most of the uproar is about people interpreting this agreement as a direct business deal and Google will get it's traffic sped up and that they are somehow legislating and neither is true.

Also many forget that Verizon is the company owning the pipes and spectrum, not Google, and as much as it's unpleasant to think about, NN won't be put into law without teleco input.

<comment><USER13> Do you acknowledge that Google and Verizon now have an interesting business relationship, where the success of one party in the mobile space directly influences the other? Vested interests do drive people and companies to behave differently.

In this case, its reasonable to wonder if Google has changed from champion of NN to a company that sees its next great revenue pool (mobile) forming before its eyes.

<comment><USER14> You appear to be hinting at the "android" argument that I've never seen spelled out properly. Care to explain why this makes such a big difference compared with say HQ Youtube carrying TV shows to homes supplied with internet by Verizon?

Because to my euro eyes it seems like US fanboys cheering on Apple, iPhones and AT&T, which makes Google, Android and Verizon the "baddies" in this tag team match. And yet you get Android phones on all carriers, including AT&T, and the iPhone seems to be coming to Verizon (and I assume all other carriers once exclusivity is broken, like in many other countries) so these "teams" are basically fiction.

So where's the real beef here?</comment></comment></comment>


Recovery.gov Bid -- a Good Failure - <AUTHOR> http://sunlightlabs.com/blog/2009/06/25/recoverygov-bid-we-failed/ <comment><USER2> "As I said before, this RFP was written in a different language. That language isn't something we spoke fluently. We just took our first 101 class and have begun to learn the language and the nuance involved and we can start sharing it with you as we learn more."

This alone will change the world.

</comment><comment><USER3> "Management Approach: 15 pages"

Yikes. My life has been a lot better since I stopped writing these type of proposals (and business is doing just fine). What a waste of time. The whole RFP process is broken.

<comment><USER4> It's not "broken" ... it's that way for a reason. And that reason is so it can be steered to the people who are 'supposed' to get the work.

What the Sunlight Labs people don't really understand is that they never had a chance in a million years of getting the contract. That's why the other contractors have been so friendly to them; they were never seriously in the running. If they had actually been competition, they would have gotten a much more hostile reception.

That's not to say that what they did was a waste of time, but there's no such thing as a fair and open competition when government contracts are concerned. They're all rigged to a certain extent, and there's always more than meets the eye.

If they (or any other company) are serious about winning work as a prime contractor, they need to build up a Rolodex of people who can make phone calls on their behalf. The best way to do this is to start off as a subcon, and work up from there.

<comment><USER5> I would contend that the point of the RFP process is to make it _harder_ to rig. That doesn't mean that the vendors themselves don't try to influence the RFP such that it makes them look better, or that the people issuing the RFP don't do that themselves. But it's overly cynical and a misunderstanding of where the RFP process came from to say it's there to rig the process: it's there because the bidding process has been "rigged" since time immemorial, and it's an attempt to make things more transparent and harder to rig. It's certainly not totally successful at that, but it's unfortunately often better than the other sorts of processes people use for major contracts (like no-bid contracts, handshake deals, etc.).

<comment><USER6> > I would contend that the point of the RFP process is to make it harder to > rig.

Whose point would that be?

The point of an RFP is pretty much determined by its author. It can be to minimize said author's work (by cut/paste from previous RFPs), to ensure that the right people get the work, to give the author cover if the project blows up, etc.</comment></comment></comment></comment>


Minority Areas Pay More for Car Insurance Than White Areas with the Same Risk - <AUTHOR> https://www.propublica.org/article/minority-neighborhoods-higher-car-insurance-premiums-white-areas-same-risk?utm_campaign=sprout&utm_medium=social&utm_source=twitter&utm_content=1491498493 <comment><USER2> If "accident costs" were the only component in the cost of insurance, this would make sense. I guess they also assume that the zip code one lives in is also the zip code that one gets into accidents.

But insurance coverage reflects things such as theft and other damage (so high crime neighborhoods will get charged more), reasonable security precautions taken by the driver (a garage typically gets the buyer a discount compared to a car port or street parking).

End of the day everybody gets charged for the miles spent on the road, and unless major employers set up offices in such areas, the liability component of the insurance would penalize high annual mileage.

<comment><AUTHOR> Well, the article claims that they are comparing premiums to "to the average amounts paid out by insurers for liability claims in each zip code" which seems to include the additional factors that you describe.

<comment><USER2> That's the liability component. The collision / comprehensive / underinsured / medical do not seem to be included, perhaps the article omits them, but actual survey does not?

Here's the more or less full list of auto insurance components [http://www.rmiia.org/auto/steering_through_your_auto_policy/...](http://www.rmiia.org/auto/steering_through_your_auto_policy/Auto_Insurance_Basics.asp)</comment></comment></comment>


Microsoft threatened journalists on the Lundgren e-waste case - <AUTHOR> http://techrights.org/2019/07/26/story-of-eric-lundgren/ <comment><USER2> > Our coverage of the matter won't be slanted or biased. We'll stick to the > underlying facts, .... When dealing with Microsoft, however, sanity isn't a > factor. Insanity prevails and a schoolyard bully's mentality/mindset guides > the legal department.

Riiiiiight.</comment>


Three Rules to Actionable Metrics - <AUTHOR> http://www.ashmaurya.com/2010/07/3-rules-to-actionable-metrics/

<comment><USER2> > "actionable"

Metrics you can get sued over?</comment>


Show HN: A site using zero images – any feedback on the UI? - <AUTHOR> http://www.tyresum.co.uk/

<comment><USER2> I agree with basically everything that has been said so far. Now, I don't drive or buy tires, but I do dabble in design, so here are the first things I see when I start nit-picking:

* The nav text is too small to read comfortably.

* For the nav in the top right: why is it in that spot? It doesn't line up with other content, so it looks out of place.

* TyreSum.beta – my first thought was: 'there is a .beta TLD?' This is confusing.

* The logotype doesn't need an underline when you mouse over it.

* 'We compare so you don't have to' – you have used periods throughout your whole site... but not to end your slogan?

* Why are the buttons shiny? Then, why aren't they shiny when you click on them? Why is the gradient on the properties-of-tyres buttons is different from the submit button's gradient?

* Why do the buttons have squared corners when the container and the submit button have rounded ones? (Or, why do the other things have rounded corners?)

* Why are the buttons all square, when the text takes up less than half of their height? Since they are, why is the text (very tight!) at the top?

* 'Width', 'Profile', and 'Size' look awkwardly narrow centred on the wide rows of buttons. You could make them look chunkier, or move them to the left of the rows, or something. It would also be nice to see more padding between them and the rows above. The padding on the page is not very consistent all-around.

* For example… the padding on the container is awkward. There is a bunch of whitespace on the left and right, and an awkward mismatch of whitespace size on top and bottom.

* The container has a shadow but nothing else does; except for the gradients on the buttons, if you see that as a shadow – in which case this is doubly awkward because the shadows are running in different directions.

* Why is the container 940px wide? Since the contents don't seem to fill it horizontally, it could be narrower. This would be good because it would work better on smaller screens – especially mobile devices.

* On the search page:

* It's a little strange that 'make and cheapest model' contains links, and 'website' doesn't. I couldn't guess where those links were going to take me.

* You have a 'price' column, and then a 'purchase' column, where each button has the price on it. The 'price' column could go. (You have to be able to sort based on the purchase column, then, though.)

* Why are the contents of some columns centred while others are left aligned?

* Why are the website names a different size and font weight, and why are they all in caps?

* As others mentioned, you don't need the back buttons.

* 'Showing…' doesn't line up with anything.

* I don't have a suggestion here per se, but it takes several clicks to get from stating a size to buying a tyre. To me, the information hierarchy was not obvious. After I got past the search page, I was confused each time I saw another link. I couldn't predict where any of those would take me. Eventually I figured it out, but it would be good if I didn't have to.

* Write good, semantic HTML, and validate it. You are using a bunch of deprecated elements (like <center>) where you should be using CSS instead, for example. [http://validator.w3.org/check?uri=http%3A%2F%2Fwww.tyresum.c...](http://validator.w3.org/check?uri=http%3A%2F%2Fwww.tyresum.co.uk%2F&charset=%28detect+automatically%29&doctype=Inline&group=0)

Hope that helps. Basically, I think their are two main points. The first is about implementation: you should try to follow coding best practices, like using semantic HTML and sanitizing your SQL. The second, which relates to design, is that every aspect of your design should have a 'why.' If someone asks (or, hopefully, you ask yourself) 'why is this here? why is this this colour? why is this this size?' etc. you should have a rock-solid answer. If the user finds themselves wondering those things, it probably means it needs work; likewise if you don't have an answer.

</comment><comment><USER3> It would be pretty neat if you could figure out ahead of time which combinations were possible, disabling buttons for impossible combinations and reserving the "Size not found, please try again" message for weird exceptions where your index is out of date.

<comment><AUTHOR> yep, i need to sort that, thanks

<comment><USER4> For car owners this is a non-issue but we geeks are not that car-savvy. I tried several combinations before finding a good one.

Maybe a "most searched" sizes could beat this.

<comment><AUTHOR> thanks for the feedback, we only have the top 50 tyre sizes in the DB, we are adding more sunday

</comment></comment></comment></comment><comment><USER5> 1.) UI is confusing. Not immediately clear what's a button.

2.) Not UI feedback, but the data seems pretty sparse. Getting not found on relatively common sizes.

3.) I'd wager the average person has no idea about width, profile and size. You really need a way to search by make/model/year for something like this or at least a quick guide on how to read the sidewall to get the information.

4.) I'd be more interested in the type of tire (all-season, snow, sport) than the make or source website at the second step.

5.) Tires are probably not the best thing to sell via a minimally visual site. There's a reason sites like tirerack have gone to the trouble to provide tools to simulate what tire/wheel combos will look like on a specific make/model/year/color of car.

People care about what their vehicles look like, right down to the tires.

<comment><USER6> re: 1.) Among other things, a good practice for indicating something is clickable is to set the cursor: pointer css property.

Also, it'd be nice if the text were centered vertically. Since your "li"s are all a fixed height you can do this easily without relying on table hacks or css3 by simply setting the padding-top to 20px and adjusting height accordingly. (Box-align will eventually support this, but you still can't count on people having compatible browsers so for a simple layout like this one padding should do just fine).

<comment><USER7> Don't rely on cursor alone unless you want confused mobile users...

</comment></comment></comment><comment><USER8> Instead of letting me search for things that don't exist, use JavaScript to update the UI when I select from the top rows.

<comment><AUTHOR> thanks, i will work on that next

</comment></comment><comment><USER9> Nice clean UI, but:

You don't offer filtering by (or at least display in the table of) the speed and load rating - these are critical to legal tyres, and could invalidate insurance if found to be incorrect.

You don't filter / display EU tyre labelling - not sure what your legal obligation is, but it would be useful to be able to set a minimum economy / grip or maximum noise rating, or sort results by those.

You only display brand, not model - most premium brands have several models in each size, for example Continental EcoContact, PremiumContact, SportContact - I may only be interested in one of those.

Otherwise, good job!

</comment><comment><USER10> I got excited--it _looks_ great in ELinks! But doesn't actually work (none of the buttons are clickable). [http://i.imgur.com/zH5E2Ib.png](http://i.imgur.com/zH5E2Ib.png)

<comment><USER11> None of the buttons are clickable for me in Chrome, either.

<comment><AUTHOR> that's weird , works fine on my chrome on my mac, i will take a look

</comment></comment></comment><comment><USER12> 1\. As mentioned, you need a pointer hover for the buttons. Otherwise I had to guess they were buttons.

.

2\. 'Size not found, please try again'

This not found message is small and displays in the wrong place. When you click the calculate/search button, your gaze is down at the bottom, and the error appears at the top of the page, out of sight.

Perhaps animate the color of the button, during search going purple say, then when the result is in ( none: red, some: green )

.

3\. Please number the search parameters. You need all 3 to have values. Make them bigger too, they get lost.

.

4\. 'We compare so you don't have to'... I'd put that as 'Save time comparing tyre prices with our simple wizard'

.

5\. Include a working example with some actual results as a link. Chose a common car. Ford Fiesta 2009 165 x 30 x 13 ==> 40 comparisons

</comment><comment><USER13> I know nothing about tires (and had forgotten that we spell it tyre here in the UK), but I do know that a lot of people mix imperial and decimal measurements. Do you account for that, is it not an issue with tires, or should you add in a either a unit of measurement or the ability to enter measurements in multiple units?

</comment><comment><USER14> "We compare so you don't have too" should be "We compare so you don't have to"

<comment><USER15> I'm not a spelling/grammar nazi or anything, but seeing mistakes like this _really_ puts me off things. Like, to the point where I have to close the tab because it annoys me so much.

I probably have a disorder. I should get help.

<comment><USER16> I don't think you do. Spelling mistakes on front pages tell me that someone didn't pay the kind of attention to their work that I would like them to. If their site is trying to sell me something, I conclude that their product is probably made with similar lack of attention, and that is what puts me off.

It's a bit like going into a restaurant and seeing the waiter not wash their hands after using the bathroom.

</comment></comment></comment><comment><USER17> Would be nice if you could select your vehicle and it'd auto select a likely size

<comment><AUTHOR> thanks for the feedback, i have been looking into how to get a database of car/tyre sizes.

<comment><USER18> For the US market, there's at least one company that provides this data. Unfortunately, I can't remember the name, sorry. :(

I do know it exists, though. I used to work for a major American tire manufacturer and maintained a couple of versions of their tire selector application. They would send over a huge file (I think a spreadsheet) with a combination of every year/make/model/trim and its associated OEM tire sizes. I think we also sent over a list of our tires (models and sizes) and they would include that in the db for us. I believe it was left to us to import and normalize it, which was kind of a pain in its own right.

</comment></comment></comment><comment><USER19> 2 things:

1\. Care to post a default so it's possible to explore? Couldn't figure out a working combination. 2\. When you hit an error, would be helpful if you kept the previous selection prefilled (either via AJAX request or passing along the previous selection in the URL).

<comment><AUTHOR> sorry about that, I have put a default on the page

</comment></comment><comment><USER16> Find out whatever the most common tire size is and preselect it. This serves both to explain how it works (i.e. you have to make 3 selections) and lets people see what the site does with just one click (instead of 4).

<comment><USER16> Also, while "no images" may be special on HN, users don't give a shit. Images used right are enormously useful. In this case, I'd add exactly three, symbolizing width, profile and size. Also, separate the three selections a bit more from each other, and perhaps even add a stylized tire to the top/logo to make it immediately clear what the site is about.

<comment><USER20> +1 for your comment. I don't see why "no images" is special anywhere. I think images would help out a lot here, as you mentioned, especially since I've never bought a tire before and have no idea what I'd be looking for.

Images, just like any other UI paradigm, have their appropriate and inappropriate uses. Producing a UI with no images, and shining the spotlight on that fact, is just the same as saying "Look at this UI with no buttons!", which is silly if buttons might be appropriate, just as images could be appropriate in this case.

</comment></comment></comment><comment><USER21> If I select Width then Profile at that point you can calculate (ajax callback for example) which sizes are available for that combination and grey out the ones I _cant_ pick.

At that point you could get rid of Find Best Price for Tyres completely (as the system would know there are results at that point and display them for me) (or keep it just in case).

EDIT: You could also grey out the Find Best Price for Tyres until at least one selection is made since people may want to look for 205mm in 1 or more sizes.

<comment><USER22> What I found refreshing about the site was that it did not make me wait while it determined what to do next.

As a user, once I have gone to the trouble of looking up my tyre size and entering two of the three parameters, having the site go non-interactive while options are filtered is not helpful, it is annoyingly bad design.

It is bad because instead of being done with my task in another second or two, I am given the new task of interpreting the changed state.

In particular with this site, the presentation and options are such that the filtering is useless. It there were 100 wheel diameters, then filtering might have some justification. But as a user, I want the path that gets me to the results as quickly as possible in real time.

<comment><USER23> With the amount of possibilities this has, all the options could be included in the page load, making the filtering (almost) instantaneous.

<comment><USER22> I fucking hate slow loading pages. It's why I browse from my desktop with NoScript.

</comment></comment></comment></comment><comment><USER24> #) It seems like you're not sanitizing the input parameters before using them to construct a SQL query. You should propably fix this.

#) You shouldn't output the SQL error messages to the user.

#) The purchase column shouldn't have a sort icon if it isn't sortable.

#) IMHO the back button doesn't add any value since it just duplicates browser functionality.

Another little nitpick: The sort icon on the page is a image ;-)

<comment><AUTHOR> thanks jabiko, thats now top priority to fix

<comment><USER25> You should also clean the search parameters:

Example: [http://alturl.com/6a7vw](http://alturl.com/6a7vw)

<comment><AUTHOR> thanks qw, i'm on it, only had 10 hours to do the whole site so missed some stuff, thanks for the feedback.

</comment></comment></comment></comment><comment><USER26> Two things that I saw:

* If there are instructions, that's usually a red flag to me that I've done something poorly in the UI design. I agree with one of the previous commenters that you should do a make/model search instead.

* I'm not quite sure what to do with the filter field on the results page. It's just a blank text field. Does it filter by keyword?

</comment><comment><USER27> If you click a button and drag the mouse it starts a rectangular selection that can select multiple buttons on the same row. (Chrome, Win 7)

<comment><USER28> Same thing in safari

</comment></comment><comment> mark-ruwt I'd guess that very few people know the size of their tires offhand, so their first experience will be experimentation.

Add a list of the "Most Popular" 5 tires sizes so that these first-time users can still use the site and understand what it does. Then when they actually need to shop, hopefully they'll give you another go.

</comment><comment><USER29> In terms of UI things are looking good, I'd love to see some more custom style's as opposed to just bootstrap styles. I think the biggest complaint is the lack of padding. If you would add a bit more it might make things feel a bit better. ie. "width" "profile" and "size" headers on front page.

</comment><comment><USER30> I'd recommend against using the Default Bootstrap CSS (tm) if you're trying for a unique UI approach.

</comment><comment><USER31> Not really UI feedback but "clicking on the box's below" box's should be boxes

<comment><USER32> Should he call them squares instead?

<comment><USER33> I think he was referring to the pluralization of box.

<comment><AUTHOR> thanks now fixed

</comment></comment></comment></comment><comment><USER34> How about putting the number of available listings in parenthesis below each button number (width, profile and size). Instead of just enabling/disabling the buttons when a selection is made, update the count of available items.

<comment><AUTHOR> good idea, i think we will add that, cheers

</comment></comment><comment><USER33> It looks like you can multi-select (through ctrl-clicking or click-dragging), but it doesn't appear that that has any influence over the results. It seems to only choose one item from each row to search over.

</comment><comment><USER35> Add cursor: pointer or similar to the boxes where you select size, etc.

</comment><comment><USER22> Browsed with Windows Phone 7.8

I found it intuitive and easy to use. The interface reflects the the data domain it represents rather than glomming the data onto a generic shopping solution.

<comment><AUTHOR> thanks for that :-)

</comment></comment><comment><USER4> Maybe I'm a freak but putting a js in a css folder feels weird.

<script src="/css/tyrejs.js" type="text/javascript"></script>

<comment><USER36> i use /libs and put js, css and less files there. After years of /css and /js folders, i find /libs to be much easier to work with.

</comment></comment><comment><USER37> What this then? [http://www.tyresum.co.uk/images/graph.png](http://www.tyresum.co.uk/images/graph.png) :)

<comment><USER38> and [http://www.tyresum.co.uk/images/sort_asc.png](http://www.tyresum.co.uk/images/sort_asc.png)

<comment><USER39> [http://www.tyresum.co.uk/images/sort_both.png](http://www.tyresum.co.uk/images/sort_both.png)

</comment></comment></comment><comment><USER40> Found an image: [http://www.tyresum.co.uk/corporate.php](http://www.tyresum.co.uk/corporate.php)

<comment><AUTHOR> :-) forgot about that one

</comment></comment><comment><USER41> It would be nice if the buttons actually looked like tyres, you could also make them wider/thinner to reflect the different sizes.

</comment><comment><USER42> Aesthetics are a big part of UI, and the default Booststrap aesthetic works only with some supplemented creativity.

</comment><comment><USER43> As an autocrosser it would be great to have some bigger tire sizes (275, 285, 295, 305, 315, 335) to choose from.

</comment><comment><AUTHOR> ps. data is almost clean just a few bits to sort out. so please ignore any duped data etc.

</comment><comment><USER32> Good job. Haven't we been doing this for a few years with CSS3? I have anyway.

</comment><comment><AUTHOR> p.s. 205/45 17 is a good test tyre size

<comment><USER44> Being one of those that have no clue about tyres' sizes, I found the 205/45 17 combination after a few tries. It would be nice if the "tyres size choosing page" would retain your choices, after you get a "Size not found, please try again" or a "Please select Width, Profile and Size".

In the results page you may want to hide the table header's sorting buttons from the "Purchase column" and call the "back" button something like "New search" (this last point is quite debatable of course).

About the UI, it looks good overall (caveat: I have a bias toward non- distracting UIs). I don't really see the need for images.

<comment><USER45> It would probably be helpful to have a little section telling you how to figure out what size tyres you have. You'd probably need an image, though. See, e.g., [http://www.blackcircles.com/tyres](http://www.blackcircles.com/tyres).

</comment></comment></comment><comment><USER46> tyre Whats that?

<comment><AUTHOR> lol, try tiresum.com

</comment></comment><comment><USER47> Off Topic: The word is "grateful" (although greatful is a common misspelling). I was just thinking about this because I've been listening to a lot of Grateful Dead and I was wondering which was the correct spelling. Turns out they spelled it right.

</comment><comment><USER48> Wait. You own tiersum.com and still decided to call tires 'tyres'? Why don't you, ya know, spell the word correctly?

When I visited your page, between the horrid spelling and lack of images, I had no clue what the hell your site was supposed to do.

<comment><USER49> "Tyre" is British English for the black rubber cylinders that wrap around a car's wheels.

Also, physician, heal thyself: you've spelled 'tire' as 'tier' in your first sentence.</comment></comment>


Security 101 for SaaS startups - <AUTHOR> https://github.com/forter/security-101-for-saas-startups <comment><USER2> A pretty useful, logical and sensible list. I'd be actually surprised if most SaaS startups were NOT doing this. As a one man show (recently doubled in size to TWO!), I've ticked off nearly everything on here.

One question though - is on the multiple domains bit. Not sure how several separate domains is better than one domain utilising subdomains for API etc.? Intrigued about the 'secret' internal domain thing, and I guess it would apply to larger organisations.

I'd be interested to hear how many startup founders here have a separate internal domain name for back office stuff related to their web offerings.

</comment><comment><USER3> Might not contribute much to the discussion, but I found this pretty sad:

\- Mac users can encrypt their drive with 1 click.

\- Windows users would need the Pro version and prefer laptop hardware that supports TPM.

\- Linux users would require disk reformatting

<comment><USER4> I believe that's slightly misleading. Enabling LUKS on Linux would require a re-format, but there are ways to encrypt only your home folder without a re- format, which is all macOS does.

<comment><USER5> I think FileVault 2 [1] has been doing full-disk encryption, not just the home folder, since OS X Lion.

[1]: [https://support.apple.com/en-us/HT204837](https://support.apple.com/en- us/HT204837)

</comment></comment></comment><comment><USER6> Good advice but this is a little dubious "For other internal communication use Slack". Use slack because it is beautiful and free, not because of security

<comment><USER7> Older employees, and some managers, I found prefer email in many cases. I still request them to use slack

<comment><USER8> Call me an old fart but I much prefer email.

Email gives me a reminder to keep me organized.

And the two teams I worked on that use slack killed productivity by chatting all day and sending animated gifs.

Plus, people expect email to be asynchronous. With slack, I get a mixture of immediate and asynchronous requests. So every message breaks my flow while I determine the priority level.

<comment><USER7> I know. We use emails for some meeting summary. But you can't ignore the fact that many attacks start with phishing, and slack is free from that problem

<comment><USER9> Slack is not free of the problem whatsoever:

[https://arstechnica.com/security/2016/04/hacking-slack- accou...](https://arstechnica.com/security/2016/04/hacking-slack-accounts-as- easy-as-searching-github/)

[http://www.businessinsider.com/slacks-security-breach-may- be...](http://www.businessinsider.com/slacks-security-breach-may-be-worse- than-its-letting-on-2015-3)

[http://www.networkworld.com/article/3123727/collaboration/th...](http://www.networkworld.com/article/3123727/collaboration/the- next-target-for-phishing-and-fraud-chatops.html)

<comment><USER10> Those three links don't really relate to third parties getting unauthorised access through phishing by leveraging Slack. Slack has plenty of security issues, but you're not proving phishing by any of those sources. It can potentially make you more vulnerable to phishing, but that's not the same thing.

The links in question relate to:

* Searching on GitHub for Slack API tokens

* The Slack database hack

* How the rise of ChatOps can open you up to many more issues if someone gains access to employee's Slack accounts and the risk of third-party applications which might open up things you do to more entities than you realise

</comment></comment></comment></comment></comment></comment><comment><USER11> A few remarks/questions

> Stop using disk-on-keys

never heard that phrase

> Buy at least 2 or 3 domain names

I don't really understand the whole paragraph - or fundamentally disagree with your reasoning. Of course there are some upsides (regarding security) of splitting stuff over a few domains but there's a lot of reason why you wouldn't do that. I think this is written too harshly as "Do as I say" without _proper_ explanations and nuances of the details.

> Monitor your endpoint's public certificate expiration date, to detect > prevent certificate expiration.

typo? missing "and"? remove "detect"?

> By default AWS users choose Oregon (us-west-2).

Highly misleading. Or is your advice only relevant for US companies? I'd also say this is false for many people who have an international market leaning towards Europe, not Asia - then us-east is often better.

> Using git would allow you to add outsource/freelance developers for a > limited time, by giving and then revoking commit permissions.

Non-sequitur unless you insert "easily". Maybe. I don't disagree that git is the way to go, but your reasoning is nonsensical here. We did exactly that with CVS and SVN 15 years ago.

> Every service you use requires a 2nd authentication factor (2FA).

This is under "your first customer". Was this meant to be "should require"? Are you talking about the XaaS you (the company) are using? Are you advocating that your users use 2FA with your product?

> Antivirus

No, don't.

All in all some good points, but could use some clean up. You're lumping things together from varying degrees of technical expertise - also some paragraphs are highly detailed (and thus, sometimes miss to convey the bigger point) and others are pretty sparse.

Sorry if this sounded like complaining, there were (very) few points where I strongly disagree, but overall a good overview. I probably would've split it in at least 2 parts - e.g. for a CEO (overviews, less details, but more fields) and CTO level (technical stuff, with details).

<comment><USER7> USB flash drives is the term used in the US, right?

us-west - perhaps I should change it to don't use us-east-1, since it fails much more often and is more crowded.

I'll rephrase the git and 2fa.

Endpoint Security - you gotta have it. I understand the natural objections, but there is no certification that doesn't ask about it. There are the more expensive ones like cyberreason or carbonblack.

I need to research more the domains issue. I suppose it's more prevalent in Israel since some devops in Israel worked for gaming (gambling) companies where they definitely use multiple domains for multiple purposes. But I think the main reason is allowing devs more management access to internal subdomains and disallowing management access to the API endpoint domains that customers use, to reduce attack surface.

Thanks for your comments. Keep them coming

<comment><USER7> hi. Here is my attempt to clarify the domains section. Could you please comment on PR [https://github.com/forter/security-101-for-saas- startups/pul...](https://github.com/forter/security-101-for-saas- startups/pull/35) ?

</comment></comment></comment><comment><USER12> SPF and DKIM can be applied just fine to subdomains, I don't understand the suggestions made for email, yet there are good reasons to have a few extra domains, none which are actually mentioned: accidental cookie leakage and redundancy being obvious ones. The implication made for the API domain was that it should not be protected by SPF and DKIM

I stopped reading there

<comment><USER7> My understanding was that SPF and DKIM are only for sending emails.

I need to rearrange that paragraph and add the 2 other reasons you mentioned, and you are right that outgoing emails are better sent from subdomains.

I do wonder though if a spam filter blocks x.d.com would it also block emails from d.com?

</comment></comment><comment><USER13> I would advise against Google Drive for document sharing. Recently I tried to share a trial build of an application (an exe I built) with a client. I zipped everything up and created a share link. Google auto-flagged it as a terms of service violation and blocked the file. No way of getting round it, and no way Google will bother to remedy the situation in time.

There's also OneDrive for business which seems to work well for sharing, though syncing options are totally broken. There's no way to selectively sync a share folder, so either you have your entire filesystem downloaded or you go online to get files. That sucks when your backup is terabytes of data.

I ended up sending a Dropbox link instead. So far it seems to be more or less foolproof.

<comment><USER7> I am not sure that binaries are the use case for g-docs.

I would have used s3 for that.

<comment><USER13> For mass distribution, sure a solution like S3 is the way to go. However, this was more of a "The file is too large to email, I'll zip the build and send a shared link" occasion. Using S3 for that is a sledgehammer approach especially when you're working with people who aren't tech savvy.

The concern is that G-Drive (not Docs) seems to arbitrarily decide what you can and can't share using it. In this case, it was a binary and associated files. I was able to share an earlier build without problems. Was it a DLL I'd bundled? VCpp redistributable? Was there some pattern of bits in the code that bothered the file checker? I don't know what triggered the violation and probably never will.

</comment></comment></comment><comment><USER14> > automation (for example a Jenkins task)

I think there's value in this, but I want to point out that often time Jenkins becomes a collector of tech/security debt itself. It has very high privileges, and often time accesses/changes are not properly auth & audited.

<comment><USER7> Are there any best practices you would recommend?

</comment></comment><comment><USER15> If any developer says code review is too "corporate", I would suggest that they need to try a different profession.

Code review is an industry practice these days, and that is a good thing. I would say even for POC / MVP development, CR is a must.

<comment><USER7> I might need to find a better example.... Do you have an example of a process that is not needed in the beginning, and needed one year down the road that is less obvious?

<comment><USER16> I think (good, thorough) documentation is probably a good example. Unnecessary early, when everything is in flux, but critical later, when there's too much for one person to know.

<comment><USER15> Yeah, docs is a good one.

Starting out a lot of people dump info in a wiki, but as they get bigger, proper docs (with actual doc writers) is a must.

</comment></comment></comment></comment><comment><USER7> Original Author here. If you have questions or comments I would love hearing them.

<comment><USER17> Some of it seems like overkill. Now that Google Cloud Shell is a thing, the correct answer for small teams of people who are not security engineers is usually just "chromebook".

<comment><USER18> As a founder of a company I would gladly buy chromebooks for all employees if it would solve my security problems. Sadly, I don't think today there's one solution that addresses everyone's needs, balancing dev requirements with security (and I don't think here will be one so soon):

1\. We are a company that develops for iOS, so we have Apple computers and laptops... Nothing to be done about that. 2\. We are on AWS, switching to Google Cloud is definitely not for everyone, definitely not just for this feature. 3\. Even if we had not been developing for iOS, some developers really value working on a MacBook, and in a highly competitive recruiting market, that's a factor, and not an insignificant one.

<comment><USER17> I run 100% in AWS too and still use the (free) Google Cloud Shell for doing dev and orchestration and running terraform and docker-machine and whatnot.

<comment><USER7> Do you mean that you use it as bastion host?

</comment></comment></comment></comment></comment><comment><USER19> Disabling email attachments from your email server is also a good idea.

<comment><USER7> Can it be done with hosted mail solutions like most startups use? (Gmail/office365)

<comment><USER19> I know you can do it with Google Apps. Have not tried with Office365.

<comment><USER7> After sleeping on it... I am not sure it would work with managers. They work with outside council on a day2day basis and they use attachments for that. I wonder why gmail hasn't made phishing attachments obsolete.

<comment><USER19> If you just blocked zip files, it would be a good start.

<comment><USER4> Gmail does block quite a few attachment types. Zips are tricky because they're a very common way to send a collection of photos or docs or similar.

</comment></comment></comment></comment></comment></comment><comment><USER20> > Open an email group and name it firstname.lastname@example.com and add a page on your > website to report security incidents to this email

You know a company takes security seriously when they have a typo in the word "security".

<comment><USER21> Typos happen all the time - I was going to suggest that it was a bit of an unfair comment. Then I opened up their website [0] and their strapline is "In fraud prevention Accuracy Matters"...

None the less it is a useful document for those not versed in the basics of opsec and there's likely more value in insightful comments on the content...

[0]:[https://www.forter.com](https://www.forter.com)

<comment><USER7> Mmm. I'm sure our marketing would like to know why it feels strange. Would you care to state it even if it feels obvious to you?

<comment><USER21> accurate ˈakjʊrət/ adjective

1\. (especially of information, measurements, or predictions) correct in all details; exact. "accurate information about the illness is essential" synonyms: correct, precise, exact, right, errorless, error-free,

A typo is the antithesis of this.

However, as I mentioned in my previous comment the content is of value and to find fault in the guise of typos is absurd.

<comment><USER7> Ahhh - now I get it. Well our marketing staff are mostly native English speakers. I'm not :)

</comment></comment></comment></comment></comment><comment><USER22> > Remember that SSL encrypts network traffic, but does not supply > authentication. SSL is also not a replacement for 2FA.

False and false.

<comment><USER23> Are you referring to something like SRP+DSS|RSA? Not widely supported but I've used it via gnutls as a custom auth proxy layer for various things. 1password uses something like this iirc.

A really simple TFA pattern with SSL enabling is requiring a signed client cert with additional directory services auth (or even basic auth).</comment></comment>


Show HN: Online journal that encrypts entries with a cipher - <AUTHOR> https://www.bitjournal.io <comment><AUTHOR> Author here. This was a weekend project I've been working on. It's very much in beta.

I'm using SJCL ([https://crypto.stanford.edu/sjcl/](https://crypto.stanford.edu/sjcl/)) and CryptoJS ([https://code.google.com/p/crypto- js/](https://code.google.com/p/crypto-js/)) for client-side encryption, and Python's Cryptography library ([https://cryptography.io/en/latest/](https://cryptography.io/en/latest/)) for back-end encryption.

Would love some feedback. Since it's in beta, signups are limited but you can use "hackernews500" as an early access code to sign up now if you want to check it out.

Thanks!

EDIT (PS - It's not mobile friendly yet, so you'll probably run into some UI issues on mobile devices)

<comment><USER2> Feedback:

Browser crypto is unreliable. This has been debated to death, but here's a plain and simple fact: Your project delivers crypto software via your website to the user's browser, so this connection is absolutely critical for your site to be worth anything at all. And yours is not secure.

First off, your root domain has no SSL server ([https://bitjournal.io/](https://bitjournal.io/)), so it's vulnerable to HSTS hijacking. Basically, if you use HSTS, someone can MITM the initial connection to [http://bitjournal.io/](http://bitjournal.io/) every time because you don't have an SSL server on that hostname to negotiate HSTS. Fix: set up HSTS and an HTTP redirect on [http://bitjournal.io/](http://bitjournal.io/) to [https://bitjournal.io/](https://bitjournal.io/), set up HSTS and an HTTP redirect on [http://www.bitjournal.io/](http://www.bitjournal.io/) to [https://www.bitjournal.io/](https://www.bitjournal.io/), and then HTTP redirect from [https://bitjournal.io/](https://bitjournal.io/) to [https://www.bitjournal.io/](https://www.bitjournal.io/).

Slightly more pressing problem: you aren't using HSTS at all. Anyone can mitm your site and screw with your users.

Additional problem: your SSL site supports weak encryption, and is potentially vulnerable to secure renegotiation DoS.

My suggestion is to do a lot more research into security in general before you get into making crypto software. You can fix the problems I mention above in a weekend, but that doesn't mean you won't make other mistakes which could expose your users' private data.

<comment><USER3> gee, I'd hate to see what you have to say to the guy in this thread who made secretdiary.org which "was basically the same idea but implemented server- side", using php.

in other words, relax, this is obviously a joke and not actually meant to be secure in any way, shape, or form.

<comment><USER4> "Keep your thoughts, ideas, and other confidential information protected from prying eyes with your own BitJournal. Each entry is encrypted with a symmetric key cipher, and only you have the key."

Hopefully the author can comment, but this doesn't look like a joke.

</comment></comment></comment></comment><comment><USER5> I'm not being negative or sarcastic, but what is the purpose of this?

If I was concerned about secrecy or privacy, why is this better than just using some regular encryption tools and some "cloud drive" or whateveryoumightcallit?

I appreciate that this is a weekend project (and by the way it looks nice) so I'm not trying to beat it up, but its a big leap from a project for scratching your own itch to inviting others to give you their sensitive data (encrypted or not) with a promise of security.

At the very least you might want to publish a terms of service and privacy policy. A warrant canary might be nice as well.

PS - I have a spectacular ability to make an ass of myself, so if my criticisms come off as rude or are unwarranted, I truly apologize.

</comment><comment><USER6> I'll let someone else rant about browser Javascript encryption (it serves essentially no security purpose), but instead just comment to say that "AES-256 in CBC mode" is not a confidence-inspiring description of a cryptosystem.

Have you published the Javascript code you used for this anywhere? Can we see it? I was going to peek at it, but would apparently need to register for the site to do that.

You might consider hoisting your SJCL crypto code out of the DOM and sticking it in a Chrome extension.

<comment><USER7> > "AES-256 in CBC mode" is not a confidence-inspiring description of a > cryptosystem

I'll second this, although knowing the author, my concurrence doesn't add much weight.

To wit:

        * Encryption is not authentication. CBC mode in particular is vulnerable to
          bit-flipping attacks.
        * The password KDF is an important implementation detail that needs to be
          considered.
        * Browser extensions and node-webkit > browser JS

OP: Let me know if you'd like to know more about these details and/or advice on moving forward.

<comment><AUTHOR> Hey thanks for the feedback! I go into more detail on the "info" page. Wasn't sure if I should include the entire description on the home page or not.

I'd love all the feedback I can get. That's exactly why I wanted to post it to HN today. I'll follow you on Twitter and DM you my email.

</comment></comment></comment><comment><USER8> Hello, I created some time ago [http://secretdiary.org/](http://secretdiary.org/) [now deleted]. It was basically the same idea but implemented server-side since that was what I wanted to learn at the moment, using the encryption MCRYPT_RIJNDAEL_256 from PHP [1]

I think that the double encryption is not needed, but since I am not an expert (just an enthusiast) I dig in the past about it and the experts and enthusiasts say the same [2][3]

I just re-bought the name so that no one could buy it when I made it public. If you want it, I have no problem in giving it for free since it reminds me a lot to my project and I think the name could be more suitable and you _are_ indeed much more advanced that my project ever was and actively developing it (:

[1] [https://github.com/FranciscoP/secretdiary](https://github.com/FranciscoP/secretdiary)

[2] [http://security.stackexchange.com/a/32260/9161](http://security.stackexchange.com/a/32260/9161)

[3] [http://www.reddit.com/r/crypto/comments/1nhi4m/why_encryptin...](http://www.reddit.com/r/crypto/comments/1nhi4m/why_encrypting_twice_is_not_much_better/)

<comment><USER7> > MCRYPT_RIJNDAEL_256

I hope you realize this isn't AES-256.

I strongly encourage you and anyone else who wants to play with encryption in PHP to just use [https://github.com/defuse/php- encryption](https://github.com/defuse/php-encryption)

Also, encryption isn't authentication. You'll probably quickly hear about Moxie Marlinspike's Cryptographic Doom Principle from others. Basically it means that you should be authenticating your ciphertexts.

Welcome to crypto, a lot can go wrong and some people have very strong opinions about it.

I highly recommend taking the time to go through the challenges on cryptopals.com (by the fine folks at Matasano) and learn more about it. :)

EDIT:

[https://github.com/FranciscoP/secretdiary/blob/d5a04a7053597...](https://github.com/FranciscoP/secretdiary/blob/d5a04a7053597a3d2df0d116efbddd3577aa07af/class.cipher.php#L11)

In your library, you're using ECB mode, with an IV, and not MACing anything...

<comment><USER8> It was one of my first projects and the first time I did anything with cryptography. I expected it to have some security holes but discontinued it for lack of time, I was just offering the domain here (;

<comment><USER7> Understood. If you're interested in learning more about crypto I encourage you to check cryptopals out :)

</comment></comment></comment></comment><comment><USER9> Obligatory disclaimer: "Javascript Cryptography Considered Harmful"

[http://matasano.com/articles/javascript- cryptography/](http://matasano.com/articles/javascript-cryptography/)

<comment><USER10> This article gets posted a lot. The author seems to provide two scenarios: either you use SSL/TLS and don't need Javascript encryption or you use Javascript encryption and are open to side-channel attacks. He briefly covers the idea of using both, then hand-wavily disregards it.

He has many valid points, but serving Javascript encryption code over SSL/TLS and using it to keep your privacy in the server's DB is _still a good idea_. Do you have to trust the server a reasonable amount because of the fact that they could change their JS at any time? Yes. Does that make encryption useless and not worth doing? No.

I'd also like to point out that there are alternatives to this where you don't have to trust the server after verifying the code the first time, see Substack's demo here: [http://hyperboot.org/](http://hyperboot.org/)

JS encryption does have weak spots that could be improved, but that's not going to happen by completely refusing any sort of JS encryption as useless.

<comment><USER9> > Do you have to trust the server a reasonable amount because of the fact that > they could change their JS at any time?

What if it's not the server's JS? -

[http://imgur.com/DKmfic0](http://imgur.com/DKmfic0)

<comment><USER11> Agreed.. but XSS (or MITM injection) isn't a scalable activity. You'd have to write it custom for each app. Even if you just attacked the underlying library, it's still something that's detectable on the browser side, so you'd have to carefully target your opponent (unless you just didn't care if they knew at all -- but that'd minimize your effectiveness as well.)

IMO, it's definitely worthwhile at least the initial crypto stage in-browser. Heartbleed et al proved that. Just don't rely on it. Ensure strong TLS, HSTS, etc as well.

Definitely agreed - XSS is really severely problematic since it's potentially easier and doesn't require MITM. In this rare use case (and without actually trying the app), I'm guessing you'd basically have to be XSS'ing yourself since you're probably not XSS'ing a public field?

</comment></comment></comment></comment><comment><USER12> This is cool, but all that it takes to break down the fancy encryption is for the government/law enforcement to take it over and add some tiny js in the page.

If you really need to be secure, never trust a third party.

</comment><comment><USER13> I can't see myself using this for journal, simply having a usb or some other way is preferable if I need privacy. However, this has potential as a very nice solution for encrypting entries of any kind. Some kind of secure evernote. Anyhow, if you decide to further develop, I think this can grow into very interesting solution.

</comment><comment><USER14> Just curious, why the double encryption? if I trust the client-side encryption (thats a whole other discussion) then the server-side is redundant. If I don't trust the client-side encryption, I'm entrusting all my security to your second round of encryption (and, you).

</comment><comment><USER15> Very cool project! Would be interesting if you did something along the lines of facebook - asking a user to recognize a photo of friends after they connect their facebook account as an alternate encryption method. My bank also allows the upload of an image, which you need to choose and it's paired with the password.

<comment><USER10> Are you sure you're not thinking of a "security image"? That's a common tactic by banks to help users feel more secure, but in practice it actually provides _very_ little benefit.

</comment></comment><comment><USER16> I'd rather keep any personal journal/diary offline.

Even if Web technology was trustworthy in itself, I'd have to learn about exactly what is safe to do in a browser, if I trust the website itself and if I trust the person/entity/company behind the website. That is a _lot_ of things to learn and be wary of for just being able to write a diary online.

A personal diary is the most private and uncensored thing that I could write. I would never consider adding any more complexity to the question of "is this really for my eyes only?".

It might be fine for something like a technical journal though.</comment>


The Adults in the Room - <AUTHOR> http://dandreamsofcoding.com/2013/07/21/the-adults-in-the-room/

<comment><USER2> Good stuff.

"Adults know when they've made mistakes, and instead of shying away from the memories, they use them to get better."</comment>


Avant-Garde is a game where you play as an artist in 19th century Paris - <AUTHOR> http://playavantgarde.com/

<comment><AUTHOR> And is very realistic. I'm in the middle of the game and I already have no money.</comment>


Show HN: Window Recorder for macOS - <AUTHOR> https://window-recorder.rhardih.io <comment><USER2> I've tried this software and it is super practical, it outputs a nice h264 encoded mp4 file. Configuring video FPS (currently defaults to 15) and having an option 'correspond to device pixel ratio' would be nice though.

<comment><AUTHOR> Premium version coming soon which will have further features. Scaling for one, but also setting FPS.

When you say 'correspond to device pixel ratio', do you mean 50% scale when on retina e.g.?

</comment></comment><comment><AUTHOR> I really like the way the built-in screenshot tool works on macOS, and it's ability to "snap" to windows.

For screen recordings, Quicktime works great, but only provides a fullscreen or area based capturing option.

With Window Recorder, I've tried to mimic the behaviour of the screenshot tool, but for screen recordings.

It's currently free, but my intention is to take the freemium route, with an upcoming version including a premium upgrade, with a few more knobs and dials to tweak the recording, as well as recording directly to .gif.</comment>