Is reference counting slower than GC? - <AUTHOR> https://mortoray.com/2016/05/24/is-reference-counting-slower-than-gc/ <comment><USER2> It is well-known that the amortized cost of naive reference counting is considerably higher than that of a modern tracing garbage collector (regardless of whether you also support cycle collection). It is also well- known that non-naive RC-based approaches generally make it easier to achieve lower pause times (though cycle collection may throw a spanner in the works).

Attempts to bring amortized RC performance up to par with tracing GCs [1] generally require an underlying machinery that is just as complicated as that of a tracing GC; you will typically rely on stack scanning to implement deferred reference counting or non-trivial compiler optimizations with the goal to eliminate or reduce the overhead of local pointer assignments and you may still be left with a more expensive write barrier, so you may also have to gun for a hybrid approach.

Advantages of naive RC are that it is easier to add to an existing language without extensive compiler/runtime support (assuming you don't need cycle detection) and that it can more easily coexist with other approaches to memory management; amortized cost is not one of them.

[1] Such as [https://www.cs.purdue.edu/homes/hosking/690M/urc- oopsla-2003...](https://www.cs.purdue.edu/homes/hosking/690M/urc- oopsla-2003.pdf)

<comment><USER3> I submit this is only true for equivalent number of things to keep track of. In practice this is not the case. Languages with GC go completely overboard with GC, using it completely everywhere, even when not strictly necessary and certainly java does.

In C++, if you have a map with items, you use move semantics and you have have either 0 or 1 refcounts to keep track of, the one for the map itself. The rest is still "refcounted" but without ever touching any integer, by the normal scoping rules. Same goes for Rust code. That's ignoring the fact that a Java object is, at minimum, 11 bytes larger than a C++ object. Given java's boxing rules and string encoding, the difference in object sizes becomes bigger with bigger objects. Because out-of-stackframe RTTI is a basic necessity of tracing garbage collectors this is unavoidable, and cannot be fixed in another language. Bigger object sizes also mean more memory needed, more memory bandwidth needed, ... And Java's constant safety checks also mean

In Java, the same map will give the GC 3 items to keep track of (minimum) per entry in the map, plus half a dozen for the map itself. One for the object that keeps the key and the value, one of the key and one for the value. That's assuming both key and value are boxed primitives, not actual java objects. In that case, it'll be more.

Now you might argue that it'll therefore depend on a case by case basis. And while that is technically correct, any real program will in fact have a number of maps, and vectors, and ... and C++ smart pointers will wipe the floor with their java tracing equivalent (but will be significantly less correct, or perhaps expressed better it will take a far better programmer to get the C++ code right memory-use wise than for Java).

An additional comment should be made that the Java JVM's garbage collector is the result of 21 years of development by very, very good programmers. It is not able to beat C++'s smart pointers in most cases, mostly due to it's VM overhead. If you are not able to beat a department of senior Sun/Oracle programmers you cannot beat their GC's performance without doctoring benchmarks. Therefore the chances of any new GC'ed language beating the performance of C++ smart pointers any time soon (by which I mean decades) seems negligible. In practice it is considered very good performance for any non-C++ language to be about half as fast as C++ when it comes to memory allocation and deallocation.

<comment><USER4> Sounds like you're conflating GC with Java's limited type/value system.

> That's ignoring the fact that a Java object is, at minimum, 11 bytes larger > than a C++ object.

In C++ minimum object size is 0 bytes. No virtual methods and no member variables.

> In Java, the same map will give the GC 3 items to keep track of (minimum) > per entry in the map, plus half a dozen for the map itself. One for the > object that keeps the key and the value, one of the key and one for the > value.

This is because of lack of value types in Java, nothing to do with GC. Think of how horrible C/C++ would be if you had only primitive types (char, int, double, etc.), and pointers to objects or primitive arrays.

> That's assuming both key and value are boxed primitives, not actual java > objects. In that case, it'll be more.

 _Boxed_ primitives are actual Java objects.

> "and C++ smart pointers will wipe the floor with their java tracing > equivalent"

No, C++ "smart pointers" (are you talking about std::shared_ptr?) will definitely be slower in amortized runtime costs. High cost of std::shared_ptr is one reason why std::unique_ptr exists.

Disclaimer: C++, not a Java programmer.

<comment><USER3> > Sounds like you're conflating GC with Java's limited type/value system.

Well, yes. It's the JVM that seems to prevent value objects, not Java per se. Since async GC will need RTTI this is going to be more general than just Java (it needs to know, given only memory adress, what the type of the object is, which means it needs at least a pointer in there (these days 8 bytes)). I also don't know any VM that really does a better job.

> In C++ minimum object size is 0 bytes.

C++ minimum object size is 1 byte (since 2 objects can't have the same address).

> Boxed primitives are actual Java objects.

I should have been clearer : I meant classes with fields, as apparently a class with a single int is bigger than a boxed Integer in the JVM.

</comment></comment></comment></comment><comment><USER5> Years pass but I still prefer languages with reference counting over languages with proper GC.

Main reasons for me:

\- Reference counting is deterministic (barring refcnt loops, which can usually be avoided by a careful programmer). Each run of the program will allocate/free memory in _exactly_ the same way.

\- No latency spikes. "When GC kicks in, the latency must raise"

\- This means it's way easier to understand the performance characteristics of code.

Having that in mind, there are couple of problems with refcnt:

\- Cache spill. Increasing/decreasing a counter values in random places in memory kills cache. I remember one time I separated the "string object" data structure in python away from the immutable (!) string value (python has usually C struct object followed in memory by value blob). The python program suddenly went _way_ faster - immutable (readonly) string values in memory were close to each other, mutated refcnts were close to another. Everyone was happier

\- When dealing with large data (binary blobs), refcnt programming languages have a tendency to copy over needed data. Copying over is in many cases slower.

In general I'd say it's the last point that is critical. The big question is less of "refcnt" vs "gc", but how to deal with binary blobs. "Copy over" pattern (C style) and newer version: "slices" (golang style) VS "proper GC" style of trying to guess how may pointers point to a blob.

<comment> david-given Regarding latency spikes: that's not _entirely_ true. If you drop the last reference to an object, then freeing that object can cause the last reference to other objects to be dropped, etc.

So it's possible that dropping a reference can cause a large amount of work, which if it happens during a critical path can cause a latency spike. Particularly if finalisers are involved. If your object ownership graph is straightforward this isn't a problem, but if you have large objects with shared ownership it's very easy to be surprised here.

(Used to work on a object-oriented operating system which used reference counting everywhere, and I discovered this the hard way.)

I don't follow your comment about binary blobs?

</comment></comment><comment><USER6> This isn't an informed article.

Reference counting is a type of garbage collection. It's not complete without collecting cycles, but it can form part of a GC mix.

Assigning pointers in a scanning GC can have a cost; for example, generational GCs need to track writes to old generations that point to newer generation objects.

There's no discussion of thread safety and how that affects reference counting. That's probably the biggest problem; you need to use memory barriers to make reference counting safe with multiple threads, and that can kill performance.

<comment><USER4> You don't necessarily need memory barriers (implementation detail).

All you need is an atomic fetch-and-add (like x86 XADD opcode). Many architectures provide that as a primitive. On those that don't, you have to compose it out of other atomic primitives.

<comment><USER7> Atomic part has to notify the rest of caches to invalidate the cache line. Local latency in the best case.

<comment><USER8> FYI, _any_ store has to invalidate remote cachelines, that's taken care by the coherence protocol even before the store is actually performed.

Memory barrier (and atomic operations) don't have anything to do with it.

<comment><USER9> Whether stores invalidate remote cachelines depends entirely on the architecture. But yes, Intel has fairly strong coherency.

<comment><USER8> It seems to me that any cache coherent system needs to do that. If multiple writers can be updating a cacheline a the same time [1] you can't talk of coherency at all. Intel is stronger as it guarantees a total ordering of modifications across all cachelines, but any coherent system will guarantee the ordering of modification of a single cacheline.

[1] visibly at least. HTM complicates things a bit of course.

</comment></comment></comment></comment></comment></comment><comment><USER4> Reference counting is fast with one CPU core. But it gets worse and worse as you add cores. Inter-CPU synchronization is slow and the buses can saturate. With enough cores, at some point that'll be all the system is doing.

As far as I know, reference counting also requires you to have a heap with "alloc" and "free". Memory allocation is a slow operation, because it involves searching for the best matching free span to avoid heap fragmentation.

On the other hand, GC can scale across any number of CPU cores.

<comment><USER8> That's not how cpu synchronization work. Reference count updates by themselves are purely CPU local even when atomic. Cross CPU synchronization happens only if an object is actually shared.

It is true that, if an object is actually shared, reference counting would 'upgrade' a read only sharing to writable which is expensive; there are ways around that though, look for differential reference counting.

Re alloc and free, that's completely orthogonal with refcounting.

<comment><USER4> You're more exact, I tried to simplify.

Whether they're CPU local depends on cache line state. It's fast in MESI protocol exclusive or modified state. Slow in invalid and shared states.

However real systems have contended objects pretty much always.

I'm vaguely aware about differential reference counting, but don't know any systems that use it. A bit like fast multicore counters, that break one counter into multiple uncontended "sub-counters". Read operation adds all sub- counters together to get the "real" value.

> Re alloc and free, that's completely orthogonal with refcounting.

Technically true, but in real systems those go hand in hand almost always. Yeah, I have written firmware for embedded devices that do refcounting and don't allocate memory. But that's not the usual case.

<comment><USER8> I guess that the reason that existing systems do not use advanced refcount modes is that they simply that either they are not meant for high performance (e.g. python, perl) or just don't do much refcount traffic (i.e. only long lived objects are refcounted and new references are not created often).

Re alloc and free, I meant that you do not need to use the system malloc and free, you can be allocating and deallocating from a simple thread local bump allocator plus free list.

At the limit you can have a fully generational GC behind and use the rerfcount only to decide when to run destructors or as an optimization.

</comment></comment></comment></comment><comment><USER10> The author unfortunately doesn't understand how GC works:

> GC's overhead relates to the total memory allocated, not just > the memory > actively used in the code. Each new allocation > results in an increased > time per scanning cycle. Certainly > there are many optimizations involved > in a good GC to limit > this, but the fundamental relationship is still > linear. As a > program uses more memory the overhead of it's GC increases.

A GC's overhead (at least a mark and sweep collector) is proportional to the number of live objects. This is because all of the dead objects are unreachable and thus aren't scanned.

<comment><USER11> I'm not sure how this disputes what I say about a scanning garbage collector. The number of live objects is proportional to the amount of total memory allocated.

I don't consider dead objects, where the memory is not longer used and free to be allocated, to be part of the allocated memory.

<comment><USER12> That's a confusing choice of terminology. "allocated" reads like the past- tense of "allocate"; it's natural to think "allocated" means "was allocated at some point in the past". Maybe it is correct in some technical sense, but for the casual reader "live" would be a lot clearer.

</comment></comment></comment><comment><USER13> All talk & no benchmarks. If reference counting with cycle detection was faster, the jvm & clr would use it.

<comment><USER11> In my conclusion I mention why there are no benchmarks, it's nearly impossible to construct a realistic comparison between the two techniques.

When I cosnider tracing GC my primary arguments against it have nothing to do with performance at all, yet it often comes up as an argument against my position. This article is attempting to address that critique, by saying I doubt you could compare the two directly.

<comment><USER14> > In my conclusion I mention why there are no benchmarks, it's nearly > impossible to construct a realistic comparison between the two techniques.

You "mention" this as if it were fact, yes. Apparently you are not aware of realistic comparisons that do exist, such as [http://www.cs.utexas.edu/users/mckinley/papers/mmtk- sigmetri...](http://www.cs.utexas.edu/users/mckinley/papers/mmtk- sigmetrics-2004.pdf) (Alternatively, the article needs a discussion of why you think this is not a "realistic comparison".)

</comment></comment></comment><comment><USER15> There are other differences to consider: such as deterministic destruction with reference counting.

</comment><comment><USER4> I wish people would realize they're just some of the different tools in the memory/resource management toolbox.

Neither is the best option in every case.

We should just use whatever fits better for the purpose.

</comment><comment><USER16> What?

Of course reference counting is slower. Especially if you take loop handling into account. Imagine a degenerate scenario: using up all of your memory to allocate a single linked list, and then dropping it all at once.

Another, much more common scenario: allocating huge numbers of very short living objects. A generational GC handles this with nearly zero overhead, while reference counting plus a heap allocation sucks on an epic scale.

Also, do not forget about the compactification and cache locality implications.

<comment><USER17> > Another, much more common scenario: allocating huge numbers of very short > living objects

This is true in Java. Other languages (C++, Rust, D, etc) give the programmer the means to not allocate so much garbage instead.

<comment><USER18> Yes, but Eiffel, D (on your list), Modula-3, Oberon(-2), Component Pascal, C#, Go are all examples of GC languages with finer control over static vs dynamic allocation.

Something that most GC vs RC discussions seem to keep forgetting about.

In Modula-3 I can even make use of manual memory management in unsafe modules, if really required. And control storage layouts even in safe code.</comment></comment></comment>


Asynchronous Loggers for Low-Latency Logging - <AUTHOR> http://logging.apache.org/log4j/2.x/manual/async.html#Performance

<comment><USER2> Main LMAX Disruptor site: <http://lmax-exchange.github.io/disruptor/>

Related Google Group: <http://groups.google.com/group/lmax-disruptor>

API is not as easy as a queue, but the results speak for themselves...

<comment><USER3> Also, using disruptor (efficiently) forces a certain threading model onto your app (at least downstream of the ring).

<comment><USER2> The threading model is part of the "Mechanical Sympathy". Multiple threads can write into a ring buffer, _without locks_. On the other end, coming out of the ring buffer you can have one thread (which means that the biz logic never needs to lock anything and can be blazingly fast), or multiple threads doing something with the event independently (at LMAX they journal to disk and replicate to backup machine). These threads can process the event in parallel. And you can "pipeline" or stage threads, so after both journaling and replication are complete (and not earlier than that) the event is passed to the business logic.

Then if the business logic needs to do something slow, like network I/O, disk I/O, database access etc, you would set up one or more other Disruptors for that. Instead of doing the slow task in the biz logic thread, you'd post a task for that on the helper Disruptor. That way the business logic can stay single-threaded, uncontended and blazingly fast.

When the slow task (disk I/O or whatever) is done, it will post a new event onto the first Disruptor, so the business logic can pick up the result and process that.

So it's all asynchronous, all event-driven, but pretty flexible.

In Log4j 2.0 there is just one Disruptor that takes the log message, puts it in the ring buffer, and passes control back to the application. Coming out of the ring buffer the event is passed to the normal log4j loggers, parent loggers and appenders.

It is not completely zero-garbage, but all ring buffer slots are created up front and re-used during the life of the process. Coming into the ring buffer, log event parameters are copied into the ring buffer slot without creating new LogEvent objects. Slots in the ring buffer implement the LogEvent interface, so coming out of the ring buffer, the slot itself is passed downstream, again avoiding object creation. Other parts of log4j are not that garbage-conscious so there is still room for improvement in this area.

<comment><USER4> That's a great description of how it works - looking forward to reading more of your comments on HN in the future.

</comment></comment></comment></comment><comment><USER5> I wish "Mechanical Sympathy" was defined/explored more in computer science. Googling mechanical sympathy just leads me to a blog...although it's an extremely interesting blog and tied to the idea of mechanical sympathy.

Also, LMax Disruptor looks really cool on the surface (can't wait to dive in). However, I haven't found too much literature that talks about its possible tradeoffs. Glad this story was posted.

<comment><USER6> Check Martins talks on the topic too - <http://www.infoq.com/author/Martin- Thompson>. Very interesting indeed.</comment></comment>


Video meetings in the browser made simple using WebRTC and AngularJS - <AUTHOR> http://comoyo.github.io/blog/2013/08/05/video-meetings-in-the-browser-using-webrtc-and-angularjs/ <comment><USER2> It's insane how much leverage you get with a modern web stack. I was approximately 1000% more productive using knockout, bootstrap, zeromq and websockets as I am using the in-house non-web platform I'm programming on data to day at the moment.

</comment><comment><USER3> Link to just the service: [https://appear.in/](https://appear.in/)</comment>


Samsung drops lawsuit against Apple - <AUTHOR> http://www.reuters.com/article/2011/07/02/samsung-apple-idUSN1E76101620110702

<comment><USER2> Technically yes, but not really.

The judge suggested that it would be more efficient judicially if Samsung were to drop the separate suit it filed against Apple shortly after Apple sued Samsung, and instead bring its claims as counterclaims in Apple's suit.

That is what they are doing.

</comment><comment><USER3> maybe Samsung can't afford to lose Apple as a customer, given the $7.8 billion in sales it provided last year?</comment>


Realtime Analytics with MongoDB - <AUTHOR> http://www.slideshare.net/jrosoff/scaling-rails-yottaa

<comment><USER2> I liked this one as well:

[http://www.slideshare.net/jrosoff/scalable-event- analytics-w...](http://www.slideshare.net/jrosoff/scalable-event-analytics- with-mongodb-ruby-on-rails)

</comment><comment><USER3> I'm working on a system which is similar but higher volume.

Have you done any benchmarks to test thousands of updates per second?

Same, but on the front-end. What is the impact of generating 10 reports per second for 2 hours? Do the writers get behind?

You won't have scaling issues in until the front-end hits some threshold of x queries per y updates, with x servers.

Good presentation on another application of mongo.

<comment><AUTHOR> We have hit 1000's of updates per second on our current system during some high load periods and did not see any problems. Our steady state is 100's per second, but it bursts to 1000's for extended durations about once per week if not more often.

10 reports per second is actually not that much load and has almost no impact on writers. We have an alerting system that runs while data is input to the system. It effectively loads a report for each metric reported in the input and decides whether or not to send an alert. That system generates queries about 50 reports per second on an ongoing basis and does not impact the writers. Our read volume in steady state is about 2x our write volume.

We have not seen any queueing problems on writes and the lock ratio in mongodb is typically in the 0.01 - 0.005 range.

We have found that we can break this by running lots of map-reduce jobs simultaneously while processing high write volume but that's a whole other ball of wax.

Our data access patterns very easily accomodate sharding. Both reads and writes are pretty even distributed across the set of URL's we track. By activating sharding using URL as shard key, we feel we can handle scaling several orders of magnitude beyond where we are now without anything more than additional hardware (or virtual machines).

I'd love to hear how your system scaling goes. Feel free to hit me up via email if you want to discuss (jrosoff AT yottaa.com)

</comment></comment><comment><USER4> If you like this, you may want to check out HummingBird...(Node + Mongo)

<http://webpulp.tv/post/757442457/hummingbird-michael-nutt>

<comment><AUTHOR> Hummingbird is awesome and both as a tool and a case study. We learned a lot from Hummingbird that we incorporated into the design of our system.

</comment></comment><comment><USER5> Slide 11 and 12 were interesting because they are close to the same solution, but 11 looks more complicated with Voldemort, et. al. in the mix. HBase with Hadoop seems like another good alternative not mentioned.

<comment><AUTHOR> Yeah slide 11 depicted what we thought would be a great solution before we started investigating MongoDB. MongoDB effectively replaced all those other systems for us and was _significantly_ easier to set up and develop against.

A few people have mentioned HBase as an alternative. We did not consider HBase at the time we were making our architecture choices, however if we were starting today, we'd probably have looked at it too. My first impressions of HBase are that it lacks the level of documentation & community support behind MongoDB. I am definitely going to dig in some more to see how it would compare. That being said, we're totally happy with our choice of MongoDB and would recommend it to anybody considering HBase.</comment></comment>


Inside Look at Valve's New Lighthouse Tracking System - <AUTHOR> http://www.hizook.com/blog/2015/05/17/valves-lighthouse-tracking-system-may-be-big-news-robotics?ref=HN <comment><USER2> There's some discussion of this article on r/oculus: [https://www.reddit.com/r/oculus/comments/36cli8/valves_light...](https://www.reddit.com/r/oculus/comments/36cli8/valves_lighthouse_tracking_system_may_be_big_news/)

</comment><comment><USER3> This is not entirely removed from how light guns work:

[http://en.wikipedia.org/wiki/Light_gun#Cathode_ray_timing](http://en.wikipedia.org/wiki/Light_gun#Cathode_ray_timing)

The basic mechanism in both cases is measuring the time taken for a patch of light that is steadily moving from a start point to become visible to a detector, and then using knowledge of the scan rate and the geometry of the detector to calculate orientation.

Valve's system is considerably more advanced than Nintendo's, of course. But then they have had twenty years to work on it (i think that's about two and a half years in Valve Time).

</comment><comment><USER4> The physics and engineering of light are not something I'm very knowledgeable about, so forgive me if this is naive. Couldn't you reduce the latency further by running the x and y scans in parallel, and using something (e.g. different modulations) to tell them apart? It seems kind of a waste to run the x and then the y in sequence.

<comment><USER5> If I'm not mistaken, most standard IR sensors have built-in demodulators. They most likely want to keep the parts needed for a receiver as off the shelf as possible.

</comment></comment><comment><USER6> I wonder how it'll compare to the system Technical Illusions uses for castAR's tracking. Especially given the divergence of the two teams.

(Technical Illusions being the company of Jeri and Rick, who left Valve taking the Augmented Reality tech with them.

Jeri Ellsworth basically built the Valve hardware division. Valve worked on AR and VR simultaneously and then canned the AR stuff. Gabe let Jeri take the AR stuff when that happened.

An interesting story that I've oversimplified. I think it was on an AmpHour podcast but don't quote me.)

<comment><USER7> My understanding is that technical Illusions tracking system is tied to the retro-reflective mat. The glasses see some LEDs on the mat and use that to determine their position and orientation. So the tracking is limited to the glasses being in view of the mat. If you turn around, you're no longer being tracked.

The Lighthouse system, on the other hand, is a full volume tracking system that can be expanded to cover any volume of space. So I could walk around a room and no matter where I am or where I'm looking, I can determine my location and orientation.

<comment><USER6> >My understanding is that technical Illusions tracking system is tied to the retro-reflective mat. The glasses see some LEDs on the mat and use that to determine their position and orientation. So the tracking is limited to the glasses being in view of the mat. If you turn around, you're no longer being tracked.

Yeah, although to clarify, it's not the mat per se, it's the tracking marker. (Seen here, bottom picture, as it's the same one for the wand: [https://www.kickstarter.com/projects/technicalillusions/cast...](https://www.kickstarter.com/projects/technicalillusions/castar- the-most-versatile-ar-and-vr-system/posts/1184549)

There's a wand PCB and a wand on there too, they aren't part of the marker.)

The tracking marker is also covered in retro-reflective material, but it's not part of the mat itself. Relevant because there are clip-on adapters to turn the castAR goggles from AR to VR, and you don't need the mat for VR.

It may not be the final version, as the tracking system has gone through a few upgrades and tweaks already according to the updates.

</comment></comment></comment><comment><USER8> This sounds very cool but from what I understand from the article I guess it would require direct emitter-receiver visibility, i.e. turning around and facing away from the emitter wouldn't work.

Similarly, if you used several emitters to circumvent above problem you'd run into aliasing issues and you'd have to engineer the system such that different emitters can be clearly distinguished from each other.

The low latency is a big deal though. See-through AR is a particularly hard nut in terms of latency because just the slightest bit of it can completely destroy the experience (overlay images lagging behind real world), unlike VR where all the photons come from one source and some latency is tolerable.

<comment><USER9> The lighthouses seem to have a 90° sweep. The sensors on the Vive headset (but for some reason not the valve controllers) seem to be in 90° occlusion pits. This means that if the two lighthouses are at opposite corners of a (square) room, for the most part no single sensor will ever pick up both lighthouses at once, no matter where the headset is in the room or how it is oriented.

I think that was the initial strategy, but now they are going with a timing based or modulation based solution, and that's why the controllers, which were developed later, don't have occlusion pits. In this interview with Alan Yates of Valve, he mentions timing, modulation, the role of the LED array, and getting rid of the wire between lighthouses: [https://soundcloud.com/hackertrips/alan-yates-of-valve- talks...](https://soundcloud.com/hackertrips/alan-yates-of-valve-talks-non-vr- applications-of-lighthouse-and-more)

<comment><USER9> (actually from a talk today, it's a 120 degree sweep)

</comment></comment></comment><comment><USER10> That's actually brilliant. I assume you then need two lighthouses so you can do triangulation and get the position of your sensor rather just the angle to the lighthouse.

<comment><USER11> You would be able to get some distance information via the modulation on the signal. If your photodiode response was able to pick up phase changes, you can estimate distance. The light arriving at closer diodes will have a different phase than the further diodes. The article mentiones "MHz" intensity modulation on the does which gives you several meter wavelength.

<comment><AUTHOR> I think your conceptualization is a bit off.

Time of flight as you describe could work at the transmitter, but could not work at the Lighthouse receiving photodiode. To measure time of flight, you need to know (very precisely) when the light was initially transmitted. The synchronization flash is insufficient for this, as an error of just 1ns results in a 1ft error -- modulation or not. Even with modulation, the receiving photodiode doesn't have another signal with which to compare for ToF measurements.

Normal laser rangefinders are transmitting the light (modulated), and looking for the reflected return (modulated) at the same location as the transmitter. They use a PLL to determine the phase difference between the TX and RX (modulated) signals -- since the transmitter has both versions readily at hand. The phase difference corresponds to a time difference => distance. Note that the "reflector" (where the photodiode sits in Lighthouse) is not part of the equation.

In other words, laser rangefinder ToF measurements require coherent demodulation at the location of transmission.

<comment><USER12> This doesn't use time of flight, it's simple "lighthouse was at this angle when diode triggered".

<comment><AUTHOR> I know how Lighthouse works -- I wrote the article. :) I was responding to the GP: "You would be able to get some distance information via the modulation on the signal."

I was telling GP, (1) how Lighthouse cannot use time of flight, and (2) how time of flight works for laser rangefinders.</comment></comment></comment></comment></comment>


Many iPhone 5 components change but most suppliers remain the same - <AUTHOR> http://www.isuppli.com/Teardowns/News/Pages/Many-iPhone-5-Components-Change-But-Most-Suppliers-Remain-the-Same-Teardown-Reveals.aspx

<comment><AUTHOR> Can you guess the name of this supplier?

On the 9/13 newsletter John Mauldin wrote: "... consider this technology kingpin that is positioned to make a mountain of money as one of the key suppliers for the new Apple iPad. It is currently a cheap $8 stock with a 4% dividend and a 24-month price target of $25 that could triple your investment."

If it helps this is the result of filtering (via Google Stock Screener) companies whose stock prices are in the $ 7 - $ 9:

Aberdeen Asia-Pacific Income Fund, Inc. FAX

Air T, Inc. AIRT

AllianceBernstein Income Fund Inc. ACG

American Income Fund, Inc. MRF

American Software, Inc. AMSWA

Arkansas Best Corporation ABFS

ARMOUR Residential REIT, Inc. ARR

Astro-Med, Inc. ALOT

Banco Bilbao Vizcaya Argentaria SA (ADR) BBVA

Banco Santander, S.A. (ADR) SAN

Belo Corp. BLC

BlackRock Income Trust BKT

BNC Bancorp BNCN

Brookline Bancorp, Inc. BRKL

Brooks Automation, Inc.(USA) BRKS

Capital Product Partners L.P. CPLP

CapitalSource, Inc. CSE

Cellcom Israel Ltd. CEL

Centerstate Banks of Florida, Inc. CSFL

ClickSoftware Technologies Ltd. CKSW

Coffee Holding Co., Inc. JVA

Consolidated Water Co. Ltd. CWCO

Cresud S.A.C.I.F. y A. (ADR) CRESY

EarthLink, Inc. ELNK

First Commonwealth Financial FCF

First Community Corporation FCCO

First M & F Corporation FMFC

First Niagara Financial Group Inc. FNFG

Franklin Universal Trust FT

Full Circle Capital Corp FULL

Gladstone Investment Corporation GAIN

Great Lakes Dredge & Dock Corporation GLDD

Grupo Casa Saba, S.A. (ADR) SAB

Grupo Radio Centro SAB de CV (ADR) RC

Hawthorn Bancshares, Inc. HWBK

Heska Corporation HSKA

HopFed Bancorp, Inc HFBC

Hot Topic, Inc. HOTT

Inland Real Estate Corporation IRC

Investors Real Estate Trust IRET

Kentucky First Federal Bancorp KFFB

KeyCorp KEY

Meadowbrook Insurance Group, Inc. MIG

Mechel OAO (ADR) MTL

Met-Pro Corporation MPR

MFA Financial, Inc. MFA

MFC Industrial Ltd MIL

MicroFinancial Incorporated MFI

New York Mortgage Trust, Inc. NYMT

Newcastle Investment Corp. NCT

NGP Capital Resources Company NGPC

Noranda Aluminum Holding Corporation NOR

OfficeMax Incorporated OMX

Pacific Continental Corporation PCBK

PDL BioPharma Inc. PDLI

Pengrowth Energy Corp (USA) PGH

PMC Commercial Trust PCC

Power REIT PW

Pulaski Financial Corp PULB

Regions Financial Corporation RF

Servotronics, Inc. SVT

Somerset Hills Bancorp SOMH

Southern National Banc. of Virginia, Inc SONA

Southwest Airlines Co. LUV

Southwest Georgia Financial Corp. SGB

Sterlite Industries India Limited (ADR) SLT

Stewart Enterprises, Inc. STEI

Sypris Solutions, Inc. SYPR

United Bancorp, Inc. UBCP

United Community Bancorp. UCBA

Value Line, Inc. VALU

Wayne Savings Bancshares, Inc WAYN

Westfield Financial, Inc. WFD

Whiting USA Trust I WHX

Wipro Limited (ADR) WIT

World Wrestling Entertainment, Inc. WWE

WVS Financial Corp. WVFC

Xerox Corporation XRX</comment>


Xanadu: we have a working deliverable - <AUTHOR> http://xanadu.com/ <comment><USER2> For those uninitiated, this is the Duke Nukem Forever of hypertext:

[http://archive.wired.com/wired/archive/3.06/xanadu_pr.html](http://archive.wired.com/wired/archive/3.06/xanadu_pr.html)

      Xanadu was meant to be a universal library, a worldwide
      hypertext publishing tool, a system to resolve copyright disputes,
      and a meritocratic forum for discussion and debate. By putting all
      information within reach of all people, Xanadu was meant to
      eliminate scientific ignorance and cure political misunderstandings.
      And, on the very hackerish assumption that global catastrophes
      are caused by ignorance, stupidity, and communication failures,
      Xanadu was supposed to save the world.

<comment><USER3> The website makes it look like the Time Cube of hypertext. [http://www.timecube.com/](http://www.timecube.com/)

<comment><USER4> What's that? I don't get it.

<comment><USER5> Time Cube is a site by Gene Ray, the self-proclaimed "wisest human". For some reason he thinks the way we should be thinking about the day-cycle is to imagine a cube around the earth, with one edge above daybreak, noon, nightfall, and midnight, for "four simultaneous twenty-four hour days". (He uses the term 'corner' instead of edge.)

If you don't get why this is a fundamental breakthrough and the only way to look at the world, he will call you "educated stupid" and a dupe in an ongoing conspiracy theory featuring the usual villains of the Western world, especially academia and religion (and Wikipedia, which will have very little of him). For instance, something about the opposites-in-balance philosophy attached to the "time cube" representation is asserted to be fundamentally incompatible with monotheism. Anyway, ranting about this comprises the bulk of his site(s). That and racial-conflict armageddon if you make your way onto later pages.

So - a pretty normal crank after a certain point, but in some ways his website it's sort of THE canonical crank website because of its spectacularly rant-y incoherence and _awesome_ web design.

<comment><USER6> Wow. Just wow.

I don't think I've ever seen someone try (or succeed) at explaining What The Actual ... is Time Cube. You seem to have done it in a paragraph and a half.

</comment></comment></comment></comment></comment><comment><USER7> He should have followed the "release early and often" mantra and released a version every decade, and then iterated based on user feedback.

Instead, by waiting an entire 40 years, the beta seems to have some obvious usability issues that a more frequent once-per-decade release schedule would have caught early on.

<comment><USER8> There was a release in 1993, a complete open source release of all code developed during the 80s at autodesk in 1999, a release around 2003, a windows demo in 2007, and this latest release. There were some intellectual-property- related delays, mostly related to either unfiled patents (wherein the ideas were under trade secret protection until the patent applications were filed) or due to the difficulty of convincing all developers involved to agree to a release.

Having too many developers and not getting them to agree to a license or design beforehand bit him in the ass several times.

</comment></comment><comment><USER9> This is actually a rather neat visualization. If you open the demo and wait (and wait) you'll eventually get a document that's assembled from different texts. Hold down the space bar and press up/down to scroll through it. Each time you scroll, you land on another segment. If it's a segment from the left, press space+left to shift over to it. Likewise, space+right to go to the right. Mouse scroll also works for smaller increments, and you can also click on the parallel documents.

Other than the visualization, I'm unsure how much it really accomplishes. The recent submission, the Leo editor [1], follows a similar premise but for a much more interesting result: to generate python code. Leo is also an IDE; this is appears to just be a renderer.

1 [http://leoeditor.com/](http://leoeditor.com/)

<comment><USER10> Thanks for the help-text -- and the heads up about leo being (recently) posted here. I remember having a look some 10? years ago, nice to see it's still alive!

leo submission:

[https://news.ycombinator.com/item?id=7843907](https://news.ycombinator.com/item?id=7843907)

</comment></comment><comment><USER11> Would it be possible to re-cast all of the wikipedia content into a xanadoc? It's the closest we have to a huge body of text with full history attached on a wide variety of subjects and two-way links internally. That way you can side-step the problem of doing this for the whole web in one go.

It's a pity they haven't open-sourced it, in my opinion the only thing that will ever rescue project Xanadu is if it gets a lot more people working on it.

In some parallel universe there is another version of me writing this on a Hurd powered computer using Xanaweb about Tim Berners-Lee's pet project and musing about what it would be like if Linux had succeeded.

Edit: I see [https://news.ycombinator.com/item?id=7849533](https://news.ycombinator.com/item?id=7849533) had that one first by a considerable margin.

<comment><USER12> > Would it be possible to re-cast all of the wikipedia content into a xanadoc?

Currently, no, because Wikipedia is multimedia and Xanadu, while it has aspirations in that direction, can only handle text (and, it seems, only linear, unstructured text, and that limitation against structure seems fundamental and deliberate, unlike the absence of multimedia support.)

<comment><USER13> The least they could do is grab a handful of entries and xanadoc it up. Right now it's completely unrelatable to me. Further it's all religious ramblings that I care nothing about.

</comment></comment></comment><comment><USER14> To the confused HNers:

Xanadu is a project by Ted Nelson.

Ted Nelson is a fundamental figure of early computing (despite not being a computer scientist himself). His work (recommended: Dream Machines/Computer Lib, 1974; Literary Machines, 1981; Geeks Bearing Gifts, 2008) is about how computers touch us as humans, and how they affect our future, especially when it comes to communicating and using them to spread+build knowledge and ideas. When Nelson wrote his first essays, very few people had the insight or knowledge to really understand what he was going on about. Nelson came from a movie acting/storywriting/literary background, and this allowed him to establish parallels and formulate ideas that no one at the time could have done. I would argue that even today, some of his finer points still hold deep relevance and are yet unknown from the general computing crowd.

Ted Nelson remains a fairly unknown figure in computing, partly because he never wrote much code/developed products/worked in traditional research groups himself (a major misstep in a field where you tend to be mostly recognized for the projects you ship or papers you publish), and because a lot of his ideas were replaced by ideas that are much more simple to implement and make viable. A lot of hackers do like to ridicule him for those reasons, which I think is a mistake - despite those shortcomings, his body of work is still full of ideas and theories that you won't find anywhere else. You can almost see a second, parallel path that computing could have taken in the 70s. (Nelson was respected by many more famous computer scientists, including for example Alan Kay)

That's where Xanadu comes in: Xanadu is an implementation for Nelson's vision for hypertext (which predates the hypertext we know by more than a decade or so). His hypertext is much deeper than Berners-Lee's: notably, it is based on 2-way links (so not only can a page link to other pages, but you can also see which pages link to that page), a deep version system (so that you can access past versions of webpages), stronger "linking" (no such thing as "broken links" in Xanadu), etc. Of course one can see why this is much harder to implement at scale than the web we have now. Nonetheless, Nelson has been working on it through the years, as evidenced by this release.

PS: if you do start searching the web for material about Ted Nelson, do not start with the Wired article about him from a decade or so ago. It is terrible. I quite like his YouTube videos, but they require to be familiar with his work (or at least his rhetoric style) already. I think "Geeks Bearing Gifts" is the best foray into Nelson's style - and it is short enough that one can read it quickly. Then, if you want to really get into the meat of his stuff, dive into his other books.

<comment><USER15> The real problem with Xanadu is that it's based on a fundamentally flawed concept -- knowable provenance. The problem is one of having an overly literal and simplistic view of what a document is (indeed, this problem is embedded in the announcement page itself). Such and such is linked to THE ORIGINAL sourcedoc. The problem is that with almost any significant document provenance is ambiguous and unknowable, which turns anything of significance into an amiguous mare's nest of noise links.

Take for a simple example "Macbeth". We don't have the "original", we don't know for certain which version derives from which version, and we don't know for certain who is the source of any given change. Yet Nelson uses a shakespeare play as one of his examples blithely ignoring the problem of provenance throughout. Now imagine a really thorny issue like the Bible or a particle physics paper.

Imagine if every document in the world were created and maintained using the same bug free version of word with change tracking on. Any quotations or abstractions were carefully done using OLE embedding. No-one ever misquoted someone else from memory, or accidentally deleted a file and then typed it back in from an old print out. And all the edits acted as links. Ok it still wouldn't work. Welcome to xanadu.

Comparing the web unfavorably to xanadu is like DOS fans decrying the mac because they could do so much more from the command line, except that DOS actually worked at the time the Mac came out.

<comment><USER16> It doesn't have to be the original. In most of his writing, the refs have been content-addressed (hash). It's fascinating to see him backpedal to location- based addressing (URL) here, given the extent to which he's railed against that concept in the past. I would have imagined at least a hashsum retained as a field in the xanadoc file.

<comment><USER17> I've read a fair amount of his stuff but hadn't seen him talk about hash-based addressing, do you know where you've seen it? In Literary Machines he wrote about a hierarchical addressing scheme called Tumblers:

[http://en.wikipedia.org/wiki/Tumbler_(Project_Xanadu)](http://en.wikipedia.org/wiki/Tumbler_\(Project_Xanadu\))

</comment></comment></comment></comment><comment><USER18> This is interesting because its your classic ivory tower (Xanadu) vs the trenches (web) approach. After all these years and all this spilled ink, we finally have an implementation. Ignoring the tinhat style presentation, its um... interesting I guess, but from what I can tell tries to solve a problem that either doesn't need solving or has been solved in a different way by the web and sites like rap genius. Sometimes a "worse" system that's modular can be built upon is better than a "perfect" system that takes decades to launch and is monolithic and inflexible.

Also, this system being blind to things like complex formatting, colors, pictures, videos, etc kinda kills it for the modern user. It really does have this sad sheen to it, like some intelligent people worked real hard on something yet they didn't have the social vision to really ask if this works for the everyman or what problem they were solving for others. Its an Asperger's masterpiece of sorts.

</comment><comment><USER19> "Today's popular software simulates paper. The World Wide Web (another imitation of paper) trivialises our original hypertext model with one-way ever-breaking links and no management of version or contents."

[http://en.wikipedia.org/wiki/Project_Xanadu](http://en.wikipedia.org/wiki/Project_Xanadu)

</comment><comment><USER20> Upvoted for pure hilarious insanity.

<comment><USER21> [http://en.wikipedia.org/wiki/Project_Xanadu](http://en.wikipedia.org/wiki/Project_Xanadu)

Though I'm not sure you're wrong.

</comment></comment><comment><USER22> I was all prepared to see something exciting when I clicked on the link, since unlike many of the commenters here I know what Project Xanadu is. So I open the page on my smartphone, scroll down a bit, and: "INSTRUCTIONS: DON'T TOUCH THE MOUSE!"

Ummm... touchscreen device here? As visionary as Ted is, has he failed to forsee touchscreens and design touch-based interactions? Don't get me wrong, I love my keyboard, but I don't always have one anymore.

<comment><USER23> Just keep reading: mouse interactions are considered "advanced" (which may be a good thing - it means you can do keyboard-only basic navigation):

ADVANCED DIRECTIONS (mouse OK now)

\- scrollwheel: go up and down in xanadoc or sourcedoc

\- clicking on any page takes you to it

\- spacebar + shift: step through three views

<comment><USER22> On a touchscreen-only device, there is no scrollwheel, spacebar, or shift key. That leaves "clicking on any page takes you to it", which I have with the web already. Except with the web I can also pan and zoom to navigate around the page when I get there.

</comment></comment></comment><comment><USER24> Well, decades later they build this, but the question is, why use it when we have iframes and links among the html elements?

And this:

 _STRANGE RESTRICTION-- because of Web security rules (a complex maze), a web page cannot request pages from elsewhere. So we have to package all the contents into this first program._

It's called the CORS security model. Maybe someone doesn't want pages to embed their stuff?

<comment><USER25> It is actually a pretty strange restriction, if you look at it from some distance. I remember back then, when "mashups" were all the craze, I spent a weekend writing a website that parsed another site - forgot what it was actually about - and displayed it in a nice way. It worked perfectly offline, but failed online. That was the first time I heard about the same-origin policy.

The whole web security model grew organically and unplanned. Pages have access to your state and credentials, but are blocked from accessing other domains - but only under certain circumstances (e.g. loading scripts, or sending information is OK, just not "applying" your credentials). Retrospectively, it would have been much more sensible to allow scripts to access arbitrary HTTP (or even socket) addresses, but _without_ sending cookies and credentials along when doing so.

There is just so much awesome stuff you can't build now because of that. Server-less RSS readers, a Wikipedia "shell", legally or politically sensitive mashups/JS apps hosted on some anonymous freehoster, and so on.

<comment><USER24> Well cookies have a same-origin security policy for good reason, right? You don't want a [http://en.wikipedia.org/wiki/Confused_deputy_problem](http://en.wikipedia.org/wiki/Confused_deputy_problem) ... otherwise the web would be horribly insecure.

And imagine that any site could request any document from another site that you're logged into ... I could just steal your bank account info or anything else, by writing a LOLcats site that gives you 15GB of free storage, while silently sending targeted requests to all the banks. Your cookies would be submitted along with those requests and MY SITE would get the info.

Proxies can't send your cookies like the browser can.

No, there are good reasons for these restrictions. Servers should whitelist certain resources and sites. Now there is only this: [http://xkcd.com/792/](http://xkcd.com/792/)

<comment><USER25> Well, a script should be able to set of a naked HTTP request to `othersite.com` _without_ sending along the cookies for `othersite.com`. I don't see how that would allow new vulnerabilities.

Basically, make XMLHttpRequest not use any cookies etc. when making requests to other domains.

<comment><USER24> Yes without cookies it should be able to, since it can via a proxy. this should be a capability of browsers

</comment></comment></comment></comment></comment><comment> vezzy-fnord Oh wow, and just as I was rereading the (in)famous "Curse of Xanadu" article: [http://archive.wired.com/wired/archive/3.06/xanadu.html](http://archive.wired.com/wired/archive/3.06/xanadu.html)

EDIT: Wait, is there anything new here? Hasn't OpenXanadu been around for a while?

</comment><comment><USER26> Xanadu in concept is crazy, a system of documents that aren't just linked via hyperlinks, but where the actual content was linked between different documents. Unfortunately, after many, many times to develop it, it fell on the way-side. It makes this news quite interesting.

I strongly recommend people to read this wired article about it [http://archive.wired.com/wired/archive/3.06/xanadu_pr.html](http://archive.wired.com/wired/archive/3.06/xanadu_pr.html). Also some responses to the article. one from someone from Project Xanadu [http://archive.wired.com/wired/archive/3.09/rants.html](http://archive.wired.com/wired/archive/3.09/rants.html).

<comment><USER27> ...except that this release doesn't actually support links, which makes it a bit pointless. Maybe in another 40 years...

\- links, connections and relations (XANALINKS-- NOT YET) \- shared content between xanadocs (MUTUAL TRANSCLUSION, NOT YET)

</comment></comment><comment><USER28> Why can I not do this with my git commits? If you're trying to track down a blame on a security bug, this would be an amazing way to expose that.

</comment><comment><USER29> This is actually a pretty cool way to do annotated sources. While the explanatory page is a bit eccentric, it looks like some fun tech.

</comment><comment><USER30> "World wide hypertext - The Web got that niche"

Thats's a pretty big niche ... But it pales in comparison to the number of Xanadocs I've been reading lately. On another note, Ted Nelson is one of the characters in The Autodesk Files.

</comment><comment><USER31> It's impressive that it can run in a browser now.

When I try in chrome on OSX, the main document fails to load text. Still, with a little more polish, I could see actually using this (a fully annotated, interactive wikipedia would be a neat demo).

</comment><comment><USER32> <meta name="GENERATOR" content="Mozilla/4.7 [en-gb] (WinNT; U) [Netscape]">

</comment><comment><USER33> Some discussion and several lectures expounding on Nelson's ideas, from earlier this year [https://news.ycombinator.com/item?id=7639599](https://news.ycombinator.com/item?id=7639599) or "Ted Nelson's computing paradigms expressed as one-liners" [https://news.ycombinator.com/item?id=5771992](https://news.ycombinator.com/item?id=5771992)

</comment><comment><USER34> This reminds me of Kenneth Goldsmith's notion of "Uncreative Writing" (In a nutshell: There is enough text out there, don't write anything yourself) From the looks of it, this would be a nice visualisation and way to trace that kind of writing.

</comment><comment><USER35> So I gather the "visible connections" refers to the lines from the document to the original source. What if I had a document with over 100 sources? Would lines just litter the whole screen? By then, you couldn't tell which line went where. It'd be like untangling messy wires.

I appreciate some of the features included with Xanadu, including 2-way links, transclusions, and versioning. But Ted's always tied it to this interface, which seems poor for reading. Couldn't links to the original source be hidden on command, so I can concentrate on what I'm reading, and not the distracting colors and lines?

I'm glad we didn't end up with xanadu.

</comment><comment><USER36> How peculiar. I just mentioned this project 2 days ago regarding URL shorteners..

[https://news.ycombinator.com/item?id=7836851](https://news.ycombinator.com/item?id=7836851)

Its nice to see a release of something here.

<comment><USER37> Funny enough, I've spent the last two weeks researching Nelson and getting my hands on his books to scan high resolution copies of.

</comment></comment><comment><USER38> So is this basically a sort of more-visual copyscape/turn-it-in system where you can see which parts and how much of a document come from other sources? It's interesting from that perspective, but there's far too much visual noise for it to be the primary document structure of the internet. To simultaneously see every related document to what you're currently reading? Seems like there would be a high cognitive load there.

</comment><comment><USER39> I have absolutely no idea what this is, and the wikipedia link below doesn't help. What is this supposed to be/do? I just see an image loading.

</comment><comment><USER40> I don't understand how to read the website...

</comment><comment><USER41> This says not to use the mouse but it seems to works the same with it. Am I missing something?

I actually like it though, it's kinda fun.

<comment><USER42> It only says not to use the mouse at the top. Further down the page you can find the "advanced directions", for people "advanced" enough to use a mouse. (I'm a basic keyboarder myself.)

</comment></comment><comment><USER43> A very long time ago, I got the Xanadu design document from Ted Nelson. Interesting stuff. I regret discarding it when we moved to a small house in the mountains 15 years ago. I wish I still had it.

I like how they admit to having screwed up by not delivering on linked documents before the web.

</comment><comment><USER44> I tried using it for about 2 minutes and then closed the tab because it was sluggish. It feels sad because I read about Xanadu and Ted's crazy ideas years ago. Unfortunately that's how things work, my first impression of it now is that it's crap.

</comment><comment><USER45> I'm saddened to know that this genius will go to his grave thinking that he failed somehow.

<comment><USER46> Everyone dies having failed at many things in many ways. I don't see what's sad about that.

<comment><USER47> Heck, if you don't have a stack of failures when you exit this place, then you really didn't try a whole lot.

</comment></comment></comment><comment><USER48> I have heard of Ted Nelson and Xanadu over the years. But I really don't understand what I'm looking at. Could someone compare and contrast with a more contemporary effort such as Federated Wiki?

<comment><USER49> you're looking at quotations and inclusion being transactional links instead of copy/paste. These links possibly involve micropayments. iirc, for Ted Nelson, this had the side effect of solving the copyright problem (for text, I guess) when viewing a document = following all the links to include quotations and other inclusions = micropayments.

Or at least that's what I remember from Literary Machines.

</comment></comment><comment><USER50> Anyone else get a JavaScript error when they attempt to load the demo?

<comment><USER50> Only runs on Firefox, it seems.

<comment><USER51> It runs in chrome for me.

</comment></comment></comment><comment><USER52> That's it?!? All these years and now there is incontrovertible evidence there was no substance behind the idea.

</comment><comment><USER53> Hmmm, 1997 called and wanted their stylesheet back and they actually gave it back?

</comment><comment><USER54> Next RapGenius

<comment><USER25> Actually, RapGenius is the realized, "worse is better" version of Xanadu. It takes the simple idea of annotated hypertext and runs with it, and doesn't bother with all this unusual things like panning, backlinks, excerpts, and so on. That's why RapGenius is successful, and Xanadu is still vaporware.

OTOH, I don't think this is even _supposed_ to come out. It's rather a demonstration of some pretty interesting, advanced (and thus also failable) ideas. It reminds me a lot of Jef Raskin's "Humane Interface" ideas.

</comment></comment><comment><USER55> w.t.f.?

</comment><comment><USER56> behold, the leaky-ist of abstractions

</comment><comment><USER57> What is this?

<comment><AUTHOR> [http://en.wikipedia.org/wiki/Project_Xanadu](http://en.wikipedia.org/wiki/Project_Xanadu)

</comment></comment><comment><USER58> It's clearly another site by the time cube guy.</comment>


Lavabit needs your help to fight for the right to keep emails private - <AUTHOR> https://rally.org/lavabit <comment><USER2> I'm willing to contribute but I'm interested in details before doing so. I'm aware that lavabit obviously can't go into details of what they're fighting against, but some breakdown on what the money will be used for would be nice - is it all for lawyer fees or does it cover other costs? How far is the sum expected to reach, will the 40k be enough to fight until the last round or will we get another fundraiser in a year? What happens to any money that's not being used up for the defense?

<comment><USER3> The lawyers setup a non profit and applied for status as a 501c3. All the donations are going towards legal expenses and any related travel...the team is spread out between San Francisco, NYC, DC and of course myself in Dallas.

<comment><USER2> So who are we actually (legally) donating to: You personally, lavabit as a company or the nonprofit? What does legal expenses include: are the lawyers paid full wages or are they working pro bono or at a discounted rate? Please note that I'm totally fine with all people involved being paid, they do have to earn a living. It might influence the amount of money I'm willing to give though.

<comment><USER4> Agreed, I donated without a second-thought. But for $30k, we should have a clear explanation (more than a one-liner on HN) on where the money is going exactly.

Online donations are notoriously lacking transparency. Nearly as bad as the FBI/NSA (:P).

<comment><USER5> As long as it's being done through attorneys, that's enough for me. What I cared about was knowing this was legitimate at all, vs. someone just impersonating him, but that seems pretty clear. No member admitted to the bar is going to fuck up something as simple as a legal defense fund, and certainly not over 40k. I'd feel comfortable up to 250k or so without more documentation.

</comment></comment></comment></comment></comment><comment><USER6> 134 upvotes but only 34 contributors. If you truly support privacy rights, please support those fighting for them. Donate.

<comment><USER7> It asks me to log in with Facebook (oh, the irony). I don't have an FB account, and I suppose I'm not alone among the potential supporters.

<comment><USER8> Super. I'll just neatly put my name next to a list of people (which the NSA has connected to) who oppose the surveillance state ... and hope I don't get black bagged to your fancy Cuban torture prisons if I ever cross into the USA.

<comment><USER9> >"and hope I don't get black bagged to your fancy Cuban torture prisons if I ever cross into the USA."

Oh give me a break with the hyperbole. The NSA likely doesn't give a fuck about your activity of pissing and moaning on hacker news.

<comment><USER8> People have been detained for pissing and moaning on twitter about the president.

But thanks for being so pleasant about sharing your assumptions.

<comment><USER10> You mean this? [http://www.charlotteobserver.com/2012/09/12/3521473/man- who-...](http://www.charlotteobserver.com/2012/09/12/3521473/man-who-tweeted- threats-to-president.html#.UkncfyR56QM)

...

<comment><USER8> That's one of many. The first one that comes to my mind is [http://www.dailymail.co.uk/news/article-2093796/Emily- Buntin...](http://www.dailymail.co.uk/news/article-2093796/Emily-Bunting- Leigh-Van-Bryan-UK-tourists-arrested-destroy-America-Twitter-jokes.html)

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> Is it only "the American people" who this person wants emails to be private? That's what they're title says, and they talk about the US Constitution whose privacy restrictions only apply to US citizens (AFAIR). Go beyond the fourth amendment.

<comment><USER3> Personally I think bulk collection is wrong regardless of where a person is, or what passport they carry. But the constitution only protects our right to privacy on American soil...

Since Lavabit operates in the US and we can't tell which of our users is an American, and which are foreign, I'm of the opinion they all have the same rights.

<comment><USER11> _Personally I think bulk collection is wrong regardless of where a person is, or what passport they carry._

I agree.

 _But the [US] constitution only protects our right to privacy on American soil..._

I know. ☹

</comment></comment></comment><comment><USER12> I had just paid for a years subscription when they shut down - I had signed up because they cared about privacy, and boy was I not disappointed.

Join me in donating (even/especially you other non-US citizen HN'ers), to prove PRISM et al unconstitutional, and preserve all our rights!

</comment><comment><USER13> Just gave $25, I hope to see Mr. Levinson succeed! It would definitely be a very meaningful symbolic victory against the surveillance state.

</comment><comment><USER14> The contents of e-mail hosted by third parties will _always_ be subject to legal demand.

Even if Mr Levinson wins his action against NSLs, that will remain true. Non- NSL warrants conform to the Constitutional protections and will continue to be served and fulfilled.

<comment><USER15> Oh, come now. It's not as simple as that and you know it (or you should know it). The Lavabit design - its entire premise -was that the service stored all the emails in an encrypted form that even Lavabit couldn't access. It was especially constructed that way to be different from other services, at the cost of considerable time and expense. The Lavabit threat is universally considered to be a government order to (in essence) stop running the service that way. This is different from previous government demands in which Lavabit did turn over information which they had.

So the question is: should encrypted-hosting service designs be illegal unless they have a backdoor for the government and the service provider to get in?

<comment><USER16> It _is_ as simple as that. If you are not encrypting your email locally you are relying on the service provider to be honest. Claiming that Lavabit could not access your email is silly; Lavabit could easily access it, at the very least when you next log in (presumably this is why the service was shut down). There is no meaningful difference between Lavabit's design and Hushmail's design, and both services had responded to previous government requests.

If you want private email, you need to encrypt locally before the message is sent and decrypt locally after the message is received -- end of story.

<comment><USER15> You state a natural consequence of information theory. The original poster states that "non-NSL warrants conform to the Constitutional protections and will continue to be served and fulfilled." Both these statements are true.

But does that mean that because you can compromise a system then the government is allowed to force you to compromise your systems to utterly betray the purposes for which they are designed and then lie about it?

<comment><USER3> This is vague and I apologize... but it has to be that way... for now.

I couldn't compromise the system... but as it turns out the feds have a few secret capabilities the public doesn't about... they still need certain things in order to break the security though and that's what I'm fighting. Both for the ability to tell people what those secret methods are and the right to not be forced into helping the feds compromise my system/service...

</comment></comment></comment></comment></comment><comment><USER17> What strikes me odd is the notion, that I as a foreigner do not have any rights and nearly nobody in your country seems to care (at least so it seems to me).

Even the Lavabit-Founder just wants to fight for the "rights of the American people".

Don't the American people get it, that what this form of Chauvinism really brings is bringing the world up against your country? Until America recognizes, that it is not the pride of creation, this sentiment will only grow and Americans worldwide will be regarded critically.

With every politician, that promotes this chauvinism, being elected, everyone in the US is seen once more as a supporter of these views. Not the best idea in the long term I fear.

</comment><comment><USER18> From whois lavabit.com, ie, already public info:

Domain Name:LAVABIT.ORG Created On:21-Jul-2005 21:45:20 UTC Registrant Name:Ladar Levison Registrant Organization:Lavabit LLC Registrant Street1:3930 McKinney Ave #576 Registrant City:Dallas Registrant State/Province:Texas Registrant Postal Code:75204 Registrant Country:US

Mail him a check if you want to help and don't want to use electronic means. Sure, it could in theory be a scam or waste of money. But we KNOW the NSA is a scam, a waste of money, and a danger to our values.

Personally, I trust him. I received a hand-written note thanking me for a donation. Good luck Ladar!

</comment><comment><USER19> "Let's rally for Lavabit to fight for the privacy rights of the American people."

What about the privacy rights of the 95% of the world's population that are not American people?

</comment><comment><USER20> Why spend all that effort in restarting Lavabit as an American firm? There is plenty of room outside of the US for running a secure email firm.

</comment><comment><USER21> I would contribute if I didn't need to give out my credit card details. I wish that they supported paypal or payment via amazon.

<comment><USER22> lavabit.com has a paypal donate link

</comment></comment><comment><USER23> "Let's rally for Lavabit to fight for the privacy rights of the American people."

What about the rest of us?

</comment><comment><USER24> How do I contribute using Paypal or a CC#, without having to give rally.org all my personal info?

<comment><USER3> Their is a Paypal donation link on lavabit.com...

</comment></comment><comment><USER22> He should contact the ACLU + EFF instead of asking for donations.

But hey maybe the donations will help too

</comment><comment><USER25> Lavabit didn't even bother refunding clients, why should we help them now ?

<comment><USER26> Because constitutional protection and human rights are greater causes than the few bucks you lost. Lavabit didn't have to shut down, they could have handed over your private emails, but they didn't. I'd say they've more than earned what you paid.

<comment><USER27> There's no part of "constitutional protection and human rights" that forbade them from refunding customers' money for a service the customers paid for that they then stopped offering.

(NB: I have no idea if they did/did not refund any money; I'm taking it as a given for this comment but I'm completely relying on the comment chain for the unverified story.)

<comment><USER28> In lieu of what's going on, I think anyone expecting their money back should re-examine priorities. Clearly Lavabit needs the money for a cause that, frankly, trumps anyone's concerns about getting their money back. I completely support them taking any cash that's available, risking the anger of the people who would dare to be upset about it. In short, I think making the OP upset is a negligible problem compared to the USgov to getting their way.

</comment></comment></comment></comment><comment><USER29> I'm trying to get in contact with Ladar or somebody from Lavabit about fundraising. Does anyone know the best way to conact him?

</comment><comment><USER30> > What if you filed for bankruptcy, and your emails to your lawyer became > public, humiliating your family?

bankruptcies are public anyway.

</comment><comment><USER31> I sent a few bucks his way a month or so ago, but it was returned to me.

</comment><comment><USER32> What does lavabit actually do?

<comment><USER33> [https://en.wikipedia.org/wiki/Lavabit](https://en.wikipedia.org/wiki/Lavabit)</comment></comment>


TIBCO: The Facebook/Groupon of 1997. Q&A with founder Vivek Ranadive - <AUTHOR> http://www.xconomy.com/san-francisco/2010/10/28/the-two-second-advantage-talking-with-tibcos-vivek-ranadive/

<comment><USER2> I didn't read past the first page, but Tibco could be back on the scene if they ever decide to enforce their patent portfolio around publishing and subscribing to content/topics.</comment>


What to do when employees quit - <AUTHOR> https://www.groovehq.com/blog/what-to-do-when-employees-quit <comment><USER2> _Imagine getting punched in the stomach._

 _And then, instead of recovering in a few minutes, imagine the shock and pain slowly turning into disappointment, anger and dread._

 _Don't you realize how important you are to the team?_

 _How could you do this to me?_

 _It was what I felt right then and there. Betrayal. Sadness. Despair about the future._

Umm, companies pull the plug on employees all the time. In most cases with _vastly_ less forethought and regret than employees engage in when leaving their jobs (even jobs they hate).

I guess it can sort of "hurt" on the management side, when employees leave. But given the pain that employees go through (hint: the immediate threat to their own physical safety, as well as that of their families) when they're let go, I'm not sure how one could begin to consider the two situations as remotely comparable. Let alone get so emotional, and feel such a sense of "despair" when an employee (even a particularly valued one) leaves.

<comment><USER3> That quote is really out of context. His _point_ is that this is the wrong reaction, but a very natural one. Here's what _directly follows this quote_ :

> _It doesn't matter that these questions weren't the right ones to be asking.

It doesn't matter that they weren't even remotely accurate, and frankly, incredibly selfish.

It doesn't matter that they run counter to everything I've learned about managing employee exits since then.

It was what I felt right then and there. Betrayal. Sadness. Despair about the future._

It's pretty easy to get overly emotional on anything that you've put significant amounts of time and effort into. The point of the article is that you shouldn't actually follow these feelings and that there are much better ways of handling it.

<comment><USER2> Your right it is -- I didn't quite catch that when I was pasting, but it does sound a bit unfair, out of context.

So: apologies to the original author.

</comment></comment></comment><comment><USER4> If an employee is so valuable that it hurts when they leave, maybe they should have been given more incentives to stay.

You can't say that an employee is selfish when they're the ones doing all the hard, laborious technical work and getting almost nothing out of it aside from a below-average startup salary.

This might come as a shock to some, but engineers have feelings and ambitions too. In this highly competitive market, it makes sense to give your employees more equity if you want to hold on to them. When you consider supply and demand, the ratio of founders to engineers is now much higher than it ever was. Great engineers are rare.

I've left quite a few companies, even a promising startup - Would I have left if I held even 5% equity in that company? Probably not.

If you don't give your 'valued' employee decent equity then you are the selfish one and I hope that they do leave (if only out of respect for the profession).

I've seen too many self-important founders who think that they deserve twenty times more equity than their best employee (just because they're friends with a rich investor). Taking risks is easy (and kind of fun), doing mind-numbing programming every day for 10 years is not (and working for a single company, in a single problem domain for that long IS mind numbing).

Also, let's not pretend that engineers aren't taking risks. 5 years of a young engineer's life is a huge risk especially when you consider that a lot of engineers start to slow down as they get older.

</comment><comment><USER5> This part is key:

> Take the time, on a regular basis, to talk to your employees about their > lives, goals and challenges. Ask them what they hope to accomplish, not just > in the next week, but in the next year, five years and ten years in their > careers. Listen intently to what they say, and think about how you can help > them achieve that. And then act.

Anyone who asks me those questions will get double the loyalty out of me - they'll know before I even think of going elsewhere. I've been at way too many places that just don't give a damn, or assume that people will look out for themselves. They will, but probably to another place. But if you want them to be dedicated and loyal to working for you you need to get out in front. Solve the little problems before they become big ones, or lose your best employees (who can easily get a job elsewhere) and let your companies morale and productivity die.

<comment><USER6> > Take the time, on a regular basis, to talk to your employees about their > lives, goals and challenges. Ask them what they hope to accomplish, not just > in the next week, but in the next year, five years and ten years in their > careers. Listen intently to what they say, and think about how you can help > them achieve that. And then act.

Ah, the dreaded one-on-ones. This would actually make me want to leave the company if I have to be open all the time. Why should I have to divulge my personal aspirations to my employers? That's private information.

<comment><USER7> You should divulge your personal aspirations because your company might actually help you achieve them.

It pays to start thinking about how your interests which you are a little bit afraid to share might help your career... because this is how you get your employer to pay for them.

It depends on the employer. I wouldn't say "I want to quit this dump and become a water colour artist and photographer". But I /would/ say "I think that studying some art subjects would really benefit my front end design work here".

I wouldn't say "I want to get away from you and write poetry" but I /would/ say "I would like to improve my written communication skills, which will really help the clarity in my correspondence with clients and in my detailed documentation and commit messages. Would work fund this course I have found"

If there is any cross-over at all between where you want to go and what benefits your employer, it's in both of your interests to put that spin on it and get them to pay for it.

The one-on-ones are only something to dread if you don't know how to ask for things in a way that is mutually beneficial. As you get older and more experienced in negotiation it becomes easier.

Remember, its "career aspirations", not "personal aspirations".

</comment></comment></comment><comment><USER8> About to do an exit interview tomorrow, and this article resonates with me, in the general case.

There are also the cases of pathologically bad employees, or just underperforming.

However, in some cases, it _is_ personal. It's not some growth stage for the employee--they could well be leaving an early employee role because _you_ , the founder(s), _have fucked up_. You've found yourself with an employee putting out tremendous amounts of work, transferring their knowledge, coordinating their team even as they're leaving, and who generally would be great except for the fact that, for some reason, _they 're leaving_.

Things you should be asking yourself and your employee:

Did you ignore, multiple times, their domain expertise because you {thought you knew better, couldn't afford to follow it, felt like it, didn't like them}?

Did you support them in front of their team? If not, did you support them _at all_? Did you respect the chain of command, or did you reallocate their resources under them?

Did you lie to them? Was it for a good reason, because of {team morale, need- to-know, legal liability}? Whether or not you ever lied to them, _did they feel like they could trust what you said_?

Did you give them information when they requested it? Did you give them resources when they requested it? If you _didn 't_ give them resources, why not, and was it worth it in the long run?

Did you spend enough time with them, communicating not just about work but bullshitting and building a friendship? If you didn't, was it because you {were busy, had other leads, didn't like them, are an "introvert"}? How did that lack of communication factor into their departure?

Did you display _any competence at all_ by some objective metric in your facility as leader? Whether or not you did, _did the employee feel like you were competent_?

And yeah, I think you should feel bad. You've wasted their time and the company's resources because of your mismanagement. If you're really luckily, maybe you can learn from it and keep from losing anyone else--because if you don't, you don't deserve to be followed.

<comment><USER5> Note that the amount of these questions these leaders will ask themselves is inversely proportionate to their own ego. I watched half an engineering team leave a company over 2-3 months and each and every time the 3 managers up the chain found ways to explain it that didn't involve their competence or methods. Last I saw they were circling the drain.

</comment></comment><comment><USER9> Seems like "pay them more" should be at least mentioned as a possibility here.

<comment><USER10> Tech people (in general) do not make job decisions based solely on money. They want recognition, good work, good teams, good leadership, a meaningful product, etc. If your solution to morale problems is to increase salaries, you have already missed the mark in some of these other areas.

<comment><USER11> > Tech people (in general) do not make job decisions based solely on money.

Actually, money is a huge factor for most tech people. I don't know many developers who wouldn't move jobs for a 30-40% increase in pay.

Not to mention salary is fairly closely tied to value within a company... unless you are getting ripped off. And once somebody realises they are getting ripped off they are likely to leave.

</comment></comment></comment><comment><USER12> I know for some people that article may feel like this article talks about them one way or another. It may also seem a little self involved to think that it does if you are an employee.

But a word of advice for such talented employee as some of the recommendations go both ways. I'm 5 weeks away from being done with a 6 months-ahead notice to my employer that I would be leaving because I knew nobody could enter "the kingdom" that I ended up holding the key to. I felt too bad leaving them in that situation especially since I was given opportunities may developers would never expect their current employer to go for. I also know that despite that long transfer of knowledge they'll have a heck of a hard time dealing with.

You don't want to be irreplaceable just as much as they don't want you to be, especially in an era where software developers are in such ridiculous demand. And in no way does this mean you can't be as good as you work to be.

<comment><USER11> It sounds like you were given opportunities you wouldn't get elsewhere and in exchange you showed them loyalty and didn't leave them in the lurch by giving them 6 months notice. To me that's a great success story for both sides.

Do you feel like the advantages given to you weren't worth the 6 months extra you felt like you had to stay? Why?

The first company I worked for full time made me the solution architect for a 20 person project even though I only had 2 years of work experience at the time. Successfully completing that project put me an easy 5 years ahead of my peers in terms of career growth and very few of them have caught up in the 10 years since.

</comment></comment><comment><USER13> If a leaving employee is so important, you should ask yourself "Am I really 100x-1000x (whatever ratio your equity is to their equity) more important than this employee?"

<comment><USER12> You seem to make the assumption that just throwing more money at the individual is fair compensation. Perhaps I misunderstood your statement.

<comment><USER2> Founder equity is typically on a completely different scale than that of employees (even first hires). So we shouldn't be surprised that their loyalty is on a completely different scale, as well.

<comment><USER13> Exactly. My main problem is that the CEO's stance is entirely hypocritical, because he would demand real equity or quit (probably even faster) if he was in the employee's position.

Once you have access to millions in funding its tough to see people who have to work for a living as human just like you. You expect them to lovingly accept terms that you would be insulted at.

Now if your talent is so great that you dwarf all your employees it might be justified. But when you are pained at losing productive workers chances are your favorable terms exist mostly because of your connections.

<comment><USER14> This is exactly as I see it. A company and it's investment in me is how I determine my investment in it. Pay market average expect an average 8 hour work day.

</comment></comment></comment></comment></comment><comment><USER15> The way you treat exiting employees is just as important as how you treat them when they are still there from a recruiting perspective. If you treat someone well when they decide to leave, they are more likely to recommend your company to others looking for a job.

There have been places I left for various reasons that were great employers that I still recommend to this day for others looking for a job.....and might even thing about joining if the right opportunity came along.

<comment><USER16> I made this point at a previous firm I worked at. That the number of potential employees in any town is a finite number, and so you want to treat people leaving as brand ambassadors of your firm so you won't have trouble hiring in the future.

</comment></comment><comment><USER17> As good as slack is for communicating I don't think it should be used as a "knowledge" store. At a previous employer I found that commit messages were a great way to store information. Maybe commit messages aren't as great for question and answers, but searching slack doesn't seem very intuitive.

Idea: A slack bot that searches for questions and answers and creates a wiki out of the scraped information.

<comment><USER18> What's really great is when you go back in the Slack history from the day you interviewed and see what people said about you... I imagine that can sometimes be awkward.

<comment><USER19> sounds like they are using it wrong. user error.

<comment><USER20> Or privacy fail in the applicatio design/UI

</comment></comment></comment></comment><comment><USER21> As someone who left, and is now hearing of the rest of the team leaving....

1st, if someone is so darn important, it is your job to have a backup plan for when they quit, or for that matter get hit by the proverbial bus. Anything less is managerial incompetence, spend a day or two reading about business continuity.

2nd, there are these things called golden handcuffs, if you don't understand the concept I refer you to the above.

3rd, if you don't have the money for 2, then you better not be seen driving around in your brand new lamborghini, or spending all your time at over the top expensive restaurants while your employees have a tiny fraction of the company, and slave away for 70+ hours a week eating crap ass food from the fast food joint they are paying for themselves. (This really happened!)

</comment><comment><USER11> You can document institutional knowledge and try and make sure nobody is indispensable but ultimately you will still take a huge blow.

You should focus most of your attention on improving retention.

I left a full 200 page notebook full of product ideas/customer notes/requirements/designs when I left my last job. Hopefully it helps the team but it is only in note form and completely unordered. More likely they won't look at it and the knowledge will just be lost.</comment>


Ask HN: Do you use Web Application Firewall (WAF)? - <AUTHOR> I am wondering if it is worth the extra protection of using a WAF or is it ok to rely on our application code to protect against XSS, SQL injection etc. type of attacks? This is for a new cloud application that we are launching. I am leaning towards using a WAF since this is a enterprise/business application. Also, are there any specific products you would recommend? I have been reviewing how to configure the rules in HAProxy/mod_security but am wondering if it is just safer to rely on commercial product. Any suggestions or experiences? <comment><USER2> I've always viewed security as a layered approach. The more layers you add, the better protected you are. I subscribe to the thought that nothing is 100% secure, so I would recommend to put as many layers as possible. In my opinion, the issue you should be concerned about is the effectiveness of whatever solutions (layers) you implement. I think it is being accepted by the industry that detection and prevention methodologies based on predefined data (signatures, rules, etc) are only as strong as said predefined data. In layman's terms, it will probably protect you from most unsophisticated attackers, but that's it. Today's most sophisticated attacks are one-off (0day) and/or custom, so they probably won't be defined. In this regard, some of the newer generation security solutions are developing / using smarter detection and protection methodologies (real time adaptive models vice defined positive and / or negative models). I don't mean to paint a negative picture, but I am trying to illustrate the importance of multiple layers. ModSecurity seems to be the preferred open source solution with a more active community than the rest. But Intel and Oracle also have some interesting solutions in this space.

<comment><USER3> As a security expert I wouldn't recommend this approach. The "as many layers as possible" is a waste of time and money (an overkill).

A proper threat and risk analysis should be done so you can have a cost- effective solution. Security is expensive and maybe the cost of a breach is way cheaper than the security appliance or experts you hire.

Sometimes the best security solution is not to have anything, because it doesn't really matter.

<comment><USER2> To each their own I guess. I would call this the "what you don't know can't hurt you" approach. What would this threat and risk analysis be based on? Known threats? Unknown threats? How can you quantify "proper"?

In my opinion, if the threat could actually be defined, then there would be no security industry. Everyone would know the answer, and everyone would be secure. The reason this industry exists is because you cannot define the threat, it is constantly evolving. Doing nothing because it does not matter (really?), or justifying a lack of security by lowering the value of the customer's data sounds like an unprofessional approach.

</comment></comment></comment><comment><USER4> I've used Mod_Security previously and I must tell you it is quite efficient against basic types of attacks. Being a penetration tester, I would suggest that you implement mod_security preliminary and test your product for vulnerabilities.

</comment><comment><USER5> I don't think WAFs are worth the maintenance headache. I help manage a pentesting firm. Once in a blue moon, we'll get a target with a WAF installed that can't be disabled for the test, and it's never more than a speed-bump. Generally: I wouldn't bother.

If you're going to do something WAF-y, my recommendation would be modsecurity.

<comment><AUTHOR> Since ours is a business SaaS application that will be utilized by other companies, I believe there may also be commercial benefits of having a WAF. Eventually, we may need to do a formal security audit and penetration testing but it seems to me it would help to tell customers that we are using a WAF as part of our infrastructure. Is that possible?

</comment></comment><comment><USER6> A WAF is like insurance, most of the time you wont need it, but its good to have when the s*it hits the fan.

While you can rely on your app to have its own security, it never hurts to have extra (unless latency is a concern).

I'd start with an open source version and move up to a commercial product if its necessary.

</comment><comment><USER7> I use mod_security for personal sites and Cisco NetScaler as a WAF, load- balancer and SSL offloader at work. If I was given the choice, I would use HAProxy and mod_security as I'm not too impressed with NetScaler.</comment>


Issue to Replace "master" and "slave" terms in Redis - <AUTHOR> https://github.com/antirez/redis/issues/3185 <comment><USER2> I am genuinely tired of this kind of proposals, the problem is the context, banning the word will achieve nothing, slavery will still happen even if we don't talk about it.

</comment><comment><USER3> Seriously? How PC do we have to get?

</comment><comment><USER4> Some people are just intent on being professional victims.

</comment><comment><USER5> this happened in the Mesos project as well. Maybe we should ban the word slave from dictionaries as well.</comment>


Ask vs Bing - <AUTHOR> http://www.ask-vs-bing.com

<comment><USER2> do people actually use these websites ?

I've seen atleast 2 or 3 different search engine comparison websites, please stop doing them !

<comment><USER3> meta-comparison website ftw!</comment></comment>