Ask HN: Where to Host Dedicated Servers? - <AUTHOR> Related to the discussion on sticking with on-premise servers (https://news.ycombinator.com/item?id=23089999) - I want to know HNers' opinions on companies that will provide dedicated servers.
Do people have recommendations for services they've used? Principally interested in reliability, quality of support, etc..
I'm looking for use in our business though experiences with personal projects would probably be useful too. <comment><USER2> We used Hetzner in Germany, when I worked for a startup a few years ago, for some stuff which was getting too expensive on AWS, and which had to be located in Europe for certain reasons. A lot cheaper and reliability was good. We had many tens of servers there, at one point, at least.

<comment><USER3> Still using Hetzner for some of the services. They had some reliability issues in early days with servers randomly stopping or rebooting but not anymore. Cheaper than AWS definitely if you compare apples to apples.

<comment><USER4> We had the same issues (must have been around 5 years ago). Hetzner though exchanged the servers directly. At the end it was a bios issue with some rams which were incompatible, which was quiet hard to find out.

</comment></comment></comment><comment><USER5> OVH. They have a limited number of data centers around the world. Bandwidth is extremely cheap compared with AWS however there's a setup fee with their dedicated range. I haven't looked at their cloud offering.

I'd like to consider them for a project soon using k8s, needing auto node scaling and I'm not too sure what's best to use from their offerings. Maybe k8s on bare metal?

The biggest benefit is pricing, location (close to me), and reliability has been excellent. Scaling would be an issue.

<comment><USER6> We used OVH for bare metal purchases in several of their data centres for over three years now. It is cost effective and was pretty good. We did have issues with how quick it was to fix hardware issues when they arose. What doesn't help is that we were using custom instances and not their stock offering. We may switch to their "enterprise support".

We also host some machines we own in a small local datacenter from a local provider because it is connected to a dedicated connection to a private network.

</comment></comment><comment><USER7> If it's for personal or pilot projects: find a third-tier, cheap co-lo within 100 mi / 161 km of your usual location. Buy some used enterprise boxes off eBay / UNIX Surplus / etc. that don't draw too much power. Data is cheap (unless you're being screwed or you don't lease your own glass). It's electricity that costs $$$.

If it's for something that makes some, but not a metric ton of, money: find a second-tier co-lo within about 50 mi / 80 km of your usual location.

If it's for something that makes a metric f-ton of money: stick to a hybrid, well-managed mix of VPS and co-lo, preferably from a good vendor.

Currently, I have a home virtualization/workstation box:

\- 2x EPYC 7402 + Noctua NH-U14S TR4-SP3 (dual fans)

\- Supermicro H11DSi v2 (-NT works too if you want dual 10 GbE or NVMe OCuLink)

\- 512 GiB Samsung RAM

\- 4x HGST 14 TB HDD

\- 2x FireCuda 520 1 TB

\- Thermaltake Core V71 TG case w/ default fans & fan controller removed, modded with extra holes to support the board

\- 4x 200mm Noctua fans modded to fit within the top and front panels

\- 5.25" fan controller + 4 temp probes + 4 temp alarms

\- 2U/tower Smart UPS 1500 with quality new batteries, NMC 2 w/ env monitoring, 2nd temp/humidity sensor and a WiFi bridge (TL-WR802N v4; overkill maximus)

\- Looking at Intel Optanes for ZIL and some Samsungs for L2ARC

\- Also looking at a 4U Supermicro 36x 3.5" bay for FreeNAS usage

When you need an OpenBSD or opn/pfSense jumpbox/VPN(es), find (a) minimal, supported good box(es) and stick an Intel X710 series card in it because virtualized jumpboxes maybe _too converged_ for some use-cases. Also, Intel QAT cards can be helpful for TLS termination, edge firewall, and some VPN/SSH jumpboxes in use-cases where (mostly older) CPUs can't push accelerated crypto bits fast enough.

Off the top of my head, some of the colo's I've used:

\- Bytemark

\- Rackspace

\- Pair

\- Equinix ($$ IIRC)

Also, random ones in SF, SJC, Sacramento, and other cities that escape me right now.

</comment><comment> blaser-waffle Go to Data Center Map www.datacentermap.com and see who is near/at where you want to host your servers.

Web Hosting Talk (www.webhostingtalk.com) is also worth a look.

These ^ sites aggregate various colo and dedicated server businesses; many of them have larger, more fleshed out cloud options as well. They'll rent you space, rent you severs, or rent you a slice of their cloud -- maybe all of the above. Options range from one-man-shops to regional-heavy-weight MSPs, and sometimes larger.

\---

Bigger colo and dedicated providers I've dealt with are:

\- Coresite

\- Dupont Fabros

\- Equinix

\- Atlantic Metro

\- Rackspace

\- Flexential (formerly Peak10)

\- QTS

\- Raging Wire (I believe they're NTT)

\- Digital Reality (Telx)

\- Most large ISPs have their own spaces (Level3, Zayo, Cogent, etc.) and can host your servers or rent you some as well. Usually not competitive in terms of compute, but could offer good deals for bandwidth or other perks

(disclaimer: I used to be a data center manager in Northern VA and worked with/for/against most of the above companies)

</comment><comment><USER8> I highly recommend hivelocity.net [0]. Solid and their support is top notch. In 5+ years of hosting, we probably had an issue may be once with them (DNS was not pinging) .

[https://hivelocity.net](https://hivelocity.net)

</comment><comment><USER9> I worked for a company committed to managing their own DCs for cost. The idea of a big B2B contract with a cloud provider was frequently tossed around, but never manifested.

Our server demands were high. In Ad-Tech, we needed incredibly low latency which required thousands of bare-metal server boxes.

Our servers also processed nearly 300 _billion_ transaction each day, each one in around ~50ms. This generated petabytes of data, used tons of bandwidth, and required many servers.

leasing bare-metals and a warehouse was cheaper.

</comment><comment><USER10> Softlayer, while not as cheap as a straight ahead colo, strikes a nice balance between cloud and bare metal. You can provision metal on demand and manage hardware servers via an API. They also have data centers across the world and services like managed SAN/NAS storage. Worth a look for sure.

</comment><comment><USER11> Wholesaleinternet.com is based in Kansas. They have good pricing and connectivity. Support was functional but barebones, in that you are responsible for the configuration of the servers after they have put your requested òperating system on it.

</comment><comment><USER12> Maybe have a look at Packet

[https://www.packet.com/](https://www.packet.com/)

</comment><comment><USER13> I've had a good experience with Zare.com. Support is very fast and the pricing is fair.

</comment><comment><USER14> I've been using hostwinds for years and has been very satisfied with them.</comment>


How dumb court decisions made it impossible to sample like the Beastie Boys - <AUTHOR> http://www.slate.com/articles/business/moneybox/2012/05/adam_yauch_and_paul_s_boutique_how_dumb_court_decisions_have_made_it_nearly_impossible_for_artists_to_sample_the_way_the_beastie_boys_did.html <comment><USER2> Damn, this author really doesn't listen to a lot of music. Greg Gillis has become the poster child for mashups, but mashups had been a part of the cultural zeitgeist for a long time before Girl Talk was discovered.

Just one famous example: <http://en.wikipedia.org/wiki/The_Grey_Album>

This is to say nothing of all the heavy sampling in EDM in the last decade plus.</comment>


Presenting Financials to Venture Capitalists - <AUTHOR> http://www.instigatorblog.com/presenting-financials-to-venture-capitalists/2007/05/16/ <comment><USER2> This wasn't very helpful. I still haven't found a good source that explains financial projections for web startups. While personally I think its bullshit, you build the product and see what happens. Investors/VCs want to see it sometimes and you don't want to look incompetent.</comment>


Automated Web Testing with Selenium IDE - <AUTHOR> http://blogs.lessthandot.com/index.php/WebDev/UIDevelopment/automated-web-testing-with-selenium Automated Web Testing with Selenium IDE <comment><USER2> To the 3 separate comments on not using IDE below: I am aware of the flaws and I would never use it in a continuous deployment environment, but it's a good gateway tool to get into the mindset of automation testing before moving on to other methods, such as using webdriver from a unit test framework or building a full blown framework (I'd put PageObjects somewhere in the middle).

There was a point for each of us where we had no used an automation library. I think the IDE is a much more accessible way to get in, play around, learn what can be done, and do some very basic tests than it would be to hand them a library and expect them to be able to code up a similar set of tests.

</comment><comment><USER3> Selenium IDE is a bad road to go down if you're in any type of continuous deployment environment. Your test suite is unmaintainable after a dozen or so cases. What has worked for me is to use WebDriver directly, and to separate the testing and implementation logic. The testing side is driven by standard JUnit fixtures, and the implementation side follows the page object design pattern. Now even with huge changes or "pivots" to the UI, you only have to update a few xpaths and setter/getters in your page objects.

There's more info here: <http://code.google.com/p/selenium/wiki/PageObjects>

</comment><comment><USER4> Please don't use IDE for automated testing.

As it says on the Selenium homepage (<http://seleniumhq.org>), use Webdriver for testing, and IDE for bug reproduction or exploratory testing.

</comment><comment><USER5> Selenium IDE is good, but it honestly isn't a huge step up to use Selenium proper (the WebDriver variant)- it's certainly something the HN crowd would be capable of doing. That way you can use more than just Firefox- we have tests running in IE, Chrome and Firefox regularly.

</comment><comment><USER6> Selenium is really great. Easy to use, effective. One pitfall to remember: Any UI change (e.g. renaming a link) requires to update the test. On new sites these changes occur a lot, so try to focus on the main theme that changes less freq.</comment>


How Structs Really Work in C - <AUTHOR> http://tenaciousc.com/?p=3184

<comment><USER2> People like the author of this should be banned from the Internet. Almost everything in that post is wrong or misleading.

 _1) In C, a struct maps to memory_

A struct maps to memory, sure, but not in a defined way. For popular machine architectures, there is usually an ABI standard which specifies the mapping. For less popular ones, each compiler does whatever it wants.

It is correct that a struct representation may include padding, but the author makes several mistakes explaining it. Firstly, there may never be padding at the start of a struct, which is the _only_ rule dictated by the C standard. Secondly, he fails to mention _why_ padding is sometimes used (to achieve natural alignment for all members). Finally, he suggests using implementation- specific pragmas or flags to pack the struct without padding.

Apart from padding, there is a further problem with this approach which the author fails to mention: byte order. If the data file was written with a different byte order than the machine executing this, all multi-byte values will come out wrong.

As another commenter points out, the correct solution to all of the above is to perform explicit marshalling between the struct and a serialised format.

 _2) In C, structs are allowed to "run off the end" [...] As long as a symbol is backed by real memory, you can do what you want with it -- including running it past its boundaries_

Nothing could be more wrong. C very explicitly disallows accessing an address outside a declared object, array, or dynamically allocated block (malloc). Even computing such an address is forbidden. The errors resulting from breaking these rules are often very hard to pinpoint.

The zero-length array suggested is also in violation of the standard, which requires that arrays have a positive size. In C99, structs are allowed to end with a "flexible array member", which is an array with no declared size at all. This array can then be accessed as though it has as many elements as will fit before the end of the containing object or dynamically allocated block.

Declaring a 1-element array and accessing beyond the end of it is invalid even if the resulting address is otherwise within the containing object. Violating this will, again, lead to subtle errors which are hard to find.

 _3) In C, you can compute an offset within a struct [...]_

While the null pointer casting suggested here usually works, offsetof() is the preferred method, and the author even mentions this in a footnote. An important distinction not mentioned is that offsetof() must expand to an integer constant expression, which the address-of expression is not. This means that only the former may be used where an integer constant expression is required, such as (static) array sizes and case labels (using a struct member offset for either of those seems rather unlikely, of course).

</comment><comment><USER3> Meta comment:

 _"You don't know it yet, but you're...wrong."_

I really _really_ hate it when a posting starts off like this, then proceeds to tell me something _anyone_ who considered themselves a C programmer would know.

Want to write a post about something kind of neat that people outside the field might not be up on? Cool, have fun. But don't start it out by being a rude ass. And this guy dedicates the first hundred words or so of his article to it.

</comment><comment><USER4> Most seasoned C programmers understand every point in this post. Points 2 and 3 are indeed clever tricks, but they're tricks that you eventually have to employ if you're doing low level work. It's part of the beauty and allure of C.

</comment><comment><USER5> _Many compilers insert padding bytes into the struct to ensure the fields are byte-aligned. What's worse, they often do this by default._

The way this guy explains it, he makes it sound _optional_ , when it isn't. You can't use misaligned addresses on pretty much every piece of hardware. Compilers make a choice between time and effort, it is much easier to just pad a struct then try to juggle elements around until it takes up the least space. The onus is on the programmer to order their struts properly if they really care heavily about memory.

</comment><comment><USER6> "memcpy(&v, video_loc_in_memory, sizeof(struct video_file));

"Well, here's the problem: if padding bytes are involved, you could be entering a world of pain and not even know it. [...] The solution is to use a compiler switch or a #pragma pack to ensure that structs are packed (i.e., no padding applied)."

That's an implementation-defined hack. The correct solution is to explicitly marshal your data between its in-memory format and the required external representation.

</comment><comment><USER7> Any decent C programmer should know this stuff.

Also,

> size_t offset = (size_t) &(((struct s*)0)->thing);

In what universe is that code "ugly"?

</comment><comment><USER8> Padding is not allowed at the start of a struct, and some architectures simply can't access misaligned objects.

</comment><comment><USER9> Wouldn't the zero-length array potentially run into other memory?

<comment><USER10> It is only fit to be used for heap allocation, you allocate the size that you need (i.e. malloc( sizeof(struct video_file2) + ARRAY_SIZE) ). It wouldn't work as a local variable.

edit: I suppose one could use for globals or on the stack by casting a byte array ... I would find that to be unspeakably ugly but I don't write much C.

<comment><USER9> ah, that's clever.

</comment></comment></comment><comment><USER11> Packing a struct can reduce performance due to misaligned reads. If the compiler decides your struct needs padding it probably does.</comment>


Ask HN: Notice of Class Action Settlement Re Google Plus - <AUTHOR> Many people I know are reporting that they received an email from firstname.lastname@example.com with the subject line "Notice of Class Action Settlement re Google Plus – Your Rights May Be Affected".
The email references a Google Plus settlement and directs the user to www.googleplusdatalitigation.com to redeem a settlement claim. The website refuses all connections at the time of writing.
All people I've talked to so far are highly skeptical of this email. The lawsuit does in fact exist. The purported settlement administration website is hosted on Amazon Web Services and shields its whois information using Amazon's product. I can't really tell more beyond that.
Can anyone advise as to whether or not this is a legitimate thing? <comment><USER2> Yeahhhhh somehow how I find this super fishy. The email is incredibly well- written, which makes it sound way more legitimate, not to mention it didn't get caught by the spam bots, but that link just seems fishy. I found other forum threads that said the link works if you add the https to the beginning of the link, but somebody said it just asks for your bank or PayPal info which is a big no-no. I personally do not want to even attempt navigating the link; I don't have good blockers or virus prevention on my phone lol. Honestly I just wanna opt out of the thing, no idea why I would wanna sue Google in the future, but I can tell you I don't need $12 and I don't recall my personal info being stolen or used.

</comment><comment><USER3> Even I am at a loss as to whether it is legit or not. I have multiple Google+ accounts, and my husband having a couple himself. I did receive the email on my main personal email account, but not my others, such as my Thylacine Alive one, which is not relating to my Chibi's World account in any form. My husband, who also has a couple Google+ accounts, did not receive this email, either. I'm awaiting response from my followers on Facebook and Twitter regarding this, as well. Hopefully we get an answer, soon.

</comment><comment><USER4> Can confirm that adding [https://](https://) the url works for getting on the website.

According to the privacy policy, the website is run by a company called Angeion, which according to a quick google search is a settlement administration company. Those handle complying with settlement agreements for other companies. Kinda like the one listed at the bottom of this webpage:

[https://www.courtlistener.com/docket/7999009/in-re-google- pl...](https://www.courtlistener.com/docket/7999009/in-re-google-plus-profile- litigation/)

The addon "uMatrix" that I have on firefox confirms that the only parts of the website are from Angeion, the website listed, and the usual google analytics crap.

The adresses from the website and email are for what appear to be a real court office in the northern distric of California and the Angeion office in Philidelphia. I couldn't find anything on the listed phone number.

To me the parts that looked the skethiest to me were:

1) Asking to not call the california office

2) Saying that anyone who does not reply and opt-out will no longer be allowed to sue after the set date

 _Disclaimer_ I am not in any way a lawyer. The things that look sketchy to me could easily just be normal legal stuff that I disagree with (I'm staring really hard at the "you can't sue us if you don't notice this email in time). Asking to not call the California office could just be to prevent the legal office from being spammed by calls when there's a different place specifically set up for that.

Also, the information asked for on the website don't seem unusual given it's self proposed purpose. The information asked is very dependent on what you're trying to do, e.g. opting out requires an address and submiting a claim requires a claim ID.

</comment><comment><USER5> I think it's legit:

[https://9to5google.com/2020/08/04/many-receiving- settlement-...](https://9to5google.com/2020/08/04/many-receiving-settlement- notices-for-google-class-action-lawsuit/)

But the max award is no more than $12, so I'm not going give them enough personal information to find out for sure.

</comment><comment><USER6> I actually just got the email as well and the first thing I did was to see if this was legit or not. Would love information if you guys could find any

</comment><comment><USER7> I definitely would like to know if this is legit or not. I just got the email too!

</comment><comment><USER8> I got it as well and am waiting for official word before taking next steps.

</comment><comment><USER9> i think it may be legit but something about the toll free phone menu it almost sounds too easy and good to be true. i feel like if google was to send out a mass email like that, the links would work.

</comment><comment><USER10> It's not real.</comment>


Trump seeks an additional $100B in tariffs against China - <AUTHOR> https://www.washingtonpost.com/business/economy/trump-seeks-an-additional-100-billion-in-tariffs-against-china-in-escalation-of-trade-confrontation/2018/04/05/8a015664-3928-11e8-8fd2-49fe3c675a89_story.html <comment><USER2> WaPo's title is misleading because $100b is not the amount of tariffs but the _amount of goods being tariffed_ : "tariffs on an additional $100 billion of Chinese products."

[added] Not that I condone tariffs in any way or form, just as I dislike subsidies.</comment>


Gluon: A static, type inferred and embeddable language written in Rust - <AUTHOR> https://github.com/Marwes/gluon <comment><USER2> This is an impressive effort!

It seems that Gluon has taken inspiration from Haskell right down to the monadic solution to mutable state: [https://github.com/Marwes/gluon/blob/master/std/state.glu](https://github.com/Marwes/gluon/blob/master/std/state.glu)

I wasn't able to find any 'cell' type or mutable records like in OCaml, so this does seem to be a pure language -- is that right? I wonder how that works in practice for small embedded scripts/logic -- my intuition is that the discipline enforced by monadic types and purity is really great at large scale but can be frustrating when you just want to hack something together.

Anyway, it would be interesting to see typical use-cases for Gluon!

<comment><USER3> Author here, thanks for the kind words :D. The language used to be completely pure and the state type is a remnant from that time (as well as to show and test that higher kinded types such as monads works). I started to allow impure functions a while back though for a few reasons.

* It is intended to easily work with a host language which are likely to be impure. Any functions and types which that host language extend gluon with would also have to be pure which is likely to present awkward or impossible APIs. I also cannot check that the functions are pure so it would be really easy for the host language to make a mistake and accidentally pass in an impure function.

* Pure languages require, at least as I understand, more optimization to perform well and I don't expect to spend much time on an optimizer for the foreseeable future.

* An extension language is more likely to be used by less experienced developers and regardless of my personal preferences, impure languages are what most people are used it.

That being said, I do encourage pure programming as the main paradigm inside the language. The only mutable types which currently exists are the `Ref` type (atomic cell taken from Clojure) and a channel type (`Sender`/`Receiver`) which are used to send values between threads. I might add mutable records at some point if I feel they make sense but currently I am leaning towards keeping them out.

(From my own forays into embedding Lua in a C++ game I found it troublesome to mix state in Lua and C++. This makes me believe (though I don't have any good example of this as of yet) that it is a better pattern to keep all state in the host language and keep the embedded language as pure as possible, keeping mutation to only be "update host state".)

This turned out to be rather lengthy which I didn't expect. To finish it of I would love to find some way to keep the language completely pure if the problems mentioned above could be fixed or worked around. In embedded languages there is already a notion of limiting what the embedded language can do which could map really well to monads (ie in a game you might have Draw monad, Update monad, Sound monad, etc).

<comment><USER2> Ah hah -- I had missed your `Ref` and channel types. Thanks for the detailed explanation!

</comment></comment></comment><comment><USER4> This is VERY well thought out, [https://github.com/Marwes/gluon/blob/master/TUTORIAL.md#embe...](https://github.com/Marwes/gluon/blob/master/TUTORIAL.md#embedding- api)

<comment><USER5> Agreed, it's a very good overview of the language. In case the author is here, I think there is some confusion in the section about indenting:

> When a token starts on the same line as a token on an earlier line, gluon > implicitly adds inserts a block expression

I think this means that lines where tokens start on the same _column_ are part of an implicitly inserted block. The comment on the code snippet is similarly confusing (and seems to have missed a refactor from `id` to `add1`).

Hope that is helpful! Looks like a really nice language.

<comment><USER3> You are quite right! I uploaded a new version of the tutorial which should clarify the indentation behaviour (and fix a few typos).

</comment></comment></comment><comment><USER6> Another project from the author which is now abandoned, but might have provided the spark for gluon: [https://github.com/Marwes/haskell- compiler](https://github.com/Marwes/haskell-compiler)

It's a partial Haskell compiler written in Rust.

</comment><comment><USER7> I really like how the parser is implemented [1]. Very straightforward and readable even to a Rust amateur like I am.

Are there any more open source languages of similar nature, using Rust?

1\. [https://github.com/Marwes/gluon/tree/master/parser/src](https://github.com/Marwes/gluon/tree/master/parser/src)

<comment><USER8> I know of Dyon [1] as an embbedable scripting language written in Rust.

1) [https://github.com/PistonDevelopers/dyon](https://github.com/PistonDevelopers/dyon)

<comment><USER9> Dyon is built to work really well as a scripting language for the Piston game framework written in Rust. I was just looking at it.

I'll need to compare and see if Gluon can be leveraged in any way.

</comment></comment></comment><comment><USER10> Is it just me, or do all the new languages this year look the same (like a hodgepodge of Haskell and Rust)?

<comment><USER11> I'm ok with that.

</comment></comment><comment><USER12> How does this interoperate with the Rust program it's embedded in? Is making functions or values available to it as tedious and verbose as in Lua? Or is there some way of calling Rust functions or accessing Rust values automatically from inside embed_lang neé Gluon? I'm assuming it's just as tedious as in Lua, since otherwise it would need powerful runtime reflection, which seems like a feature that Rust wouldn't really have or want.

<comment><USER4> Lua has one of the cleanest no_magic c-apis of any scripting language. LuaJIT has the cleanest with_magic c-apis of any scripting language. So clean that it has been copied by PyPy [0], Guile [1] and others.

[0] [http://www.freelists.org/post/luajit/LuaJIT-FFI-Python- CFFI](http://www.freelists.org/post/luajit/LuaJIT-FFI-Python-CFFI)

[1] [https://www.gnu.org/software/guile/manual/html_node/Dynamic-...](https://www.gnu.org/software/guile/manual/html_node/Dynamic- FFI.html)

And yes, Gluon appears have to an extremely low friction interface to Rust. See my comment above.

<comment><USER13> What do you mean by magic here?

<comment><USER4> Magic in the LuaJIT sense is automatically parsing C declarations and constructing shims from LuaJIT into native code without having to interact with a C compiler.

</comment></comment></comment></comment><comment><USER6> I like the separate heaps ala Erlang and GHC. Hope they're small enough by default and initial size can be tuned for actively avoiding GC.

</comment><comment><USER14> Very unfortunate name since "Gluon" is already a commercial entity, sort of a Java counterpart to Xamarin, and almost certainly has trademarks that would overlap. Even if they didn't, it's still a pretty uncool move.

[http://gluonhq.com/](http://gluonhq.com/)

Did nobody run a simple Google search before picking the name?

<comment><USER15> Very unfortunate that a corporate entity chose the name Gluon, as it's already the name that was assigned fifty years ago to a fundamental particle. At least, that's what I get when I do a simple google search.

Also, this project

[https://github.com/freifunk-gluon/gluon](https://github.com/freifunk- gluon/gluon)

predates GluonHQ by several years.

<comment><USER16> But I dont think anyone copyrighted a fundamental particle's name.

<comment><USER15> I think it's pretty uncool to copyright a word which is a fundamental particle and prevent people from using it.

<comment><USER17> Trademarks are fairly narrow in what they restrict other people from using. While not a "fundamental particle", is it uncool for Intel to have processors called "Atom", so now no one else can release an "Atom" processor?

<comment><USER15> Thank you, I shouldn't have reused the incorrect terminology here (it matters). Thanks for bringing this point up, I completely agree with you, because there is no chance of consumer confusion between these products, which is a reasonable standard to adhere to.

Now, if Intel were to go after the Atom Text editor, we would agree that'd be pretty silly, no? Obviously they wouldn't, because there is no confusion. Now, if AMD were to start selling ATOMe processors, I'd also agree that Intel would have a reasonable complaint.

There is no reasonable confusion (for the target markets) between this gluon project, gluonhq, and the router gluon project (linked to above).

</comment></comment></comment></comment></comment></comment><comment><USER6> In the sources there's a component called VM, despite Gluon being statically compiled. Is that more akin to a runtime system or is it a separate VM for the REPL?

<comment><USER18> Static checking does not directly imply static compilation.

<comment><USER6> You're right, there's no mention of static _compilation_ , just that it's statically typed.

</comment></comment></comment><comment><USER19> if the language is statically typed and types are inferred, are there blockers against including a JIT like LLVM or something simpler to the vm?

<comment><USER20> The latest LLVM releases have major regressions regarsing JIT performance. Compilation via LLVM has essentially become to time consuming for use in a JIT. Bit of a bummer really.

</comment></comment><comment><USER21> Ooh, this is nice! Always a fan of more ML-alikes out there.</comment>


The International Fight Over Marcel Duchamp's Chess Set - <AUTHOR> http://www.theatlantic.com/technology/archive/2015/09/the-international-fight-over-marcel-duchamps-chess-set/404248/?single_page=true <comment><USER2> Copyrights should expire much, much faster. Five to ten years would probably reasonable. In its current form, copyright is an obstruction to the creativity it was designed to incentivize.

<comment><USER3> Various studies put the sweet spot at about 14-15 years.

</comment></comment><comment><USER4> The irony is great. Readymade art, remade in the 3d printed world. ReadyRemadeAndReprinted art as it should now be called. All the 3d printers need to do is sign every piece and hang them in a museum .</comment>


Trump's pick for NOAA chief causes a storm - <AUTHOR> http://www.politico.com/story/2017/10/12/trump-noaa-chief-accuweather-barry-myers-243735 <comment><USER2> I'm somewhat sympathetic to this argument. On the one hand, weather and forecast data that are collected and produced by the National Weather Service (a taxpayer funded entity) should be available to the people.

However the development of consumer/end-user services, such as weather apps for smartphones, seems to me more properly done by the private sector (by which I do NOT exclude open-source projects).

<comment><USER3> If you read TFA though, the ambiguity you're citing doesn't seem to be the line they're waffling over.

The santorum bill the new NOAA chief supported in the past was pretty explicit about allowing _no_ competitive service, which would allow them to preclude even the most basic data sharing.

We've shown during the last N crises that american weather forecasting is already notably behind european models, and our lack of proper prediction and information dissemination has been very visible over the last decade of storm recoveries of varying success. I simply don't see the private sector incentives that would lead to fixing this, and see the competition argument as just another avenue to allow existing corporations to extract profit from even the most basic aspects of human safety.

</comment></comment><comment><USER4> You see what they did there?

<comment><USER5> Nope, it's too foggy.</comment></comment>


How to Survive the Crypto Trading Platform Shitshow - <AUTHOR> https://www.dappchap.com/crypto-trading-platform/ <comment><USER2> I'm interested what people think about binance. I enjoy it enough except I expect more from the charts and tools. Also the dashboard could use more details.</comment>


Future Windows Phone specifications announced - <AUTHOR> http://www.neowin.net/news/future-windows-phone-specifications-announced

<comment><USER2> The only Windows Phone feature that really matters: All Nokia phones will ships with WP7 on them starting in the fall.

[http://conversations.nokia.com/2011/02/11/open-letter- from-c...](http://conversations.nokia.com/2011/02/11/open-letter-from-ceo- stephen-elop-nokia-and-ceo-steve-ballmer-microsoft/)

Seriously, though, it's pretty exciting.

<comment><USER3> Not for us ex-nokia fans.</comment></comment>


Conway's Gradient: Reversing Life with differentiable programming - <AUTHOR> http://hardmath123.github.io/conways-gradient.html <comment><USER2> I recently made a similar implementation for SHA256. Unfortunately it suffers from gradient vanishing. Source code: [https://github.com/calebh/differentiablesha256](https://github.com/calebh/differentiablesha256)

<comment><AUTHOR> Cool project! Yes, it would be really surprising if this "worked," because SHA256 is meant to be very difficult to reverse. But it's interesting that the failure mode is gradient vanishing as opposed to, say, getting trapped in a local optimum.</comment></comment>


Amazon donates 0.5% of the price of your purchases to the charity of your choice - <AUTHOR> https://smile.amazon.com/ <comment><USER2> This is fantastic!

To save the most lives, select Against Malaria Foundation as your charity. It's the current top recommendation from Givewell ([http://www.givewell.org](http://www.givewell.org)), an excellent charity evaluation organization. They focus on proven cost-effectiveness and transparency.

AMF can save lives at a rate of $2500 or so per life saved, which vastly outperforms most other giving opportunities, at least if you require a high standard of evidence. Givewell's evaluation of AMF is here: [http://www.givewell.org/international/top- charities/AMF](http://www.givewell.org/international/top-charities/AMF)

</comment><comment><USER3> The first thing I thought when I saw this was awesome!

The second thing I thought was that I'd never remember to use it.

Just whipped up a tiny little chrome extension that will always redirect you to smile.amazon.com when you go to Amazon. It's not well tested, so could screw you up a bunch, but figured I'd share.

[https://github.com/jessepollak/smile](https://github.com/jessepollak/smile)

</comment><comment><USER4> Errr, out of 1 million eligible 501c's how many are "controversial"? as in political shills or fronts for religious nut jobs?

I wonder how Amazon plans to deal with the inevitable "why did you donate to a charity supporting / opposing $ISSUE?

Edit: well kids that's what happens if you comment before coffee - a negative take on something that has a decent potential to up the level of giving USA wide by a huge margin. Visit givewell.org and choose your favourite.

may as well make that prime account count - let me know when the UK can join in too.

</comment><comment><USER5> FWIW, I work helping the non-profit site www.thegivingmachine.co.uk. We give 2.25% of purchases tracked through our site from Amazon (plus some other retailers).

We also have a lot of other merchants signed up.

</comment><comment><USER6> Previous Discussion (4 days ago):

[https://news.ycombinator.com/item?id=6643676](https://news.ycombinator.com/item?id=6643676)

</comment><comment><USER7> Amazon may be making _more_ profit on these purchases, rather than less-- utilizing the potent marketing skills of non-profit organizations to direct more dollars to Amazon without Amazon having to pay higher affiliate fees. I'm not an expert, but I think Amazon's affiliate fees can be as high as 10% of the purchase price. 0.5% is a 20x cheaper customer acquisition cost.

<comment> stp-ip One reason why they axed down socialvest.com and aflattr.com support and started doing smile. Nothing new, but cheaper.

</comment></comment><comment><USER8> There's a catch... It only works if you go to [http://smile.amazon.com](http://smile.amazon.com), using the regular amazon won't do anything.

</comment><comment><USER9> I wouldn't expect it to be too difficult to incorporate one's own charity these days.

A 0.5% effective rebate on everything you purchase on Amazon is better than many bank accounts offer...

</comment><comment><USER10> Is this forever? Why are we just hearing about this now - and from a mallard?

<comment><USER11> From a mallard? A duck?

<comment><USER6> It showed up, on Reddit, 6 hours ago as a meme, using the Actual Advice Mallard image.

[http://www.reddit.com/r/AdviceAnimals/comments/1pu5wh/a_simp...](http://www.reddit.com/r/AdviceAnimals/comments/1pu5wh/a_simple_way_to_help_the_world/)

[http://i.imgur.com/SRIGLBb.jpg](http://i.imgur.com/SRIGLBb.jpg)

</comment></comment></comment><comment><USER12> yup that's also the amount of taxes amazon's paying in europe

</comment><comment><USER13> This is great news! Keep it up!</comment>


WebKit.js: Yes it has finally happened Browser Inception is now possible. - <AUTHOR> http://badassjs.com/post/20294238453/webkit-js-yes-it-has-finally-happened-browser

<comment><USER2> In a way html2canvas[0] does actually do this, implementing a (minimal) rendering engine in JavaScript. I wonder how far this will go.

[0] <http://html2canvas.hertzen.com/>

</comment><comment><USER3> Wouldn't something like this be doable with PhantomJS?

<http://www.phantomjs.org/>

</comment><comment><USER4> Is there any reason you couldn't actually do this with emscripten?</comment>


Cash is pretty much dead: China is living the future of mobile pay - <AUTHOR> https://www.cnbc.com/amp/2017/10/08/china-is-living-the-future-of-mobile-pay-right-now.html <comment><USER2> Oh? How are people paying rent?</comment>


Permafrost collapse is accelerating carbon release - <AUTHOR> https://www.nature.com/articles/d41586-019-01313-4 <comment><USER3> For those who haven't been watching this topic for the past few years: permafrost melt is the most probable factor for the possibility of a near-term extinction event.

<comment><USER4> I'm pretty sure it's well known that we're currently in one of the largest extinction events.

<comment><USER5> From another perspective, we _are_ "one of the largest extinction events".

</comment></comment></comment><comment><USER6> To the meat:

> We estimate that abrupt permafrost thawing in lowland lakes and wetlands, > together with that in upland hills, could release between 60 billion and 100 > billion tonnes of carbon by 2300.

<comment><USER7> Is this unique to human caused climate change or does it happen each time earth heats up?

<comment><USER8> That doesn't feel particularly relevant to the possibility of destruction of our species. Regardless of whether or not this has happened before, it is unprecedented in human history.

<comment><USER7> It is super relevant if it happened before because, even if no human witnessed it, there could be proxy data that shows how this unfolds. It could explain past sudden changes in climate change (and accompanying mass extinctions) that are not yet well understood for example.

<comment><USER9> Most sudden changes were long enough ago that continents were in a different configuration at different latitudes, so it's not very prescriptive. It's almost definitely played some role but past climate change has almost always been the result of a number of factors coalescing, we have to estimate it's effects on our specific conditions.

<comment><USER10> This is pure speculation. Configuration of continents has no affect on a warming ocean releasing large amounts of methane trapped as methane ice (methane clathrates).

You then set some arbitrary condition on us understanding the current configuration of continents and how that would interact with the release of methane clathrates based on warming. Sorry this is denialism mascarading as evidence-based requirements. The analysis must be risk based - <USER2> requiring absolute certainty. Currently, scientific consensus is there is a risk of large releases of methane from melting Arctic sea ice.

<comment><USER9> > This is pure speculation. Configuration of continents has no affect on a > warming ocean releasing large amounts of methane trapped as methane ice > (methane clathrates).

TFA is about permafrost and not all clathrates, the word isn't even mentioned in the article and if you bothered to look at a map ([https://geology.com/articles/methane- hydrates/](https://geology.com/articles/methane-hydrates/)) you'd see they're virtually all on continental shelves or the continents themselves.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> The recommendation for arboreal permafrost is to remove all the trees because grassland tundra hard freezes easier than forests, and this is necessary to maintain soil stability in the summer months. And to do so, reintroducing large megafauna herds that destroy trees are necessary, potentially with a mammoth/elephant hybrid; or with logging.

Interestingly, large managed herds of grazing animals is a solution to grassland health for avoiding and reversing desertification.

<comment><USER12> Allan Savory talks about the use of intensive grazing as a method for combatting desertification in Africa [0]. Herd fertilize while eating grasses that would otherwise fall into senescence and create pockets of erosion.

[0][https://www.youtube.com/watch?v=vpTHi7O66pI](https://www.youtube.com/watch?v=vpTHi7O66pI)

<comment><USER13> Alas their experiment concluded without significant difference between the treatment and non-treatment zones. Basically the guy (and holistic grazing) is a quack(ery). :/

[https://www.truthordrought.com/holistic-grazing- myths](https://www.truthordrought.com/holistic-grazing-myths)

[https://en.wikipedia.org/wiki/Holistic_management_(agricultu...](https://en.wikipedia.org/wiki/Holistic_management_\(agriculture\)#Criticism)

<comment><USER9> Thanks for that, I believed this. I've got to stop trusting TED talks.

<comment><USER13> I loved TED Talks, but .. it turns out 20 minutes is rarely enough to get new and complex issues topped out with very unheard of solutions across. [0] And it became a ripe ground for crackpots and PR stuntfolk.

There are great and amazing TED talks, and Chris Anderson and the whole team seems to be able to pick great stories. But they probably lacked a scientific review panel back then. (They have a guideline nowadays: [https://www.ted.com/about/our-organization/our-policies- term...](https://www.ted.com/about/our-organization/our-policies-terms/ted- science-standards) and it talks about advisors and a science curator, etc.)

They would probably go a long way to supporting real proper 100% real world science by having a redactions list. (So a list of talks that turned out to be completely wrong or partially flawed.)

[0] topics like cosmology, quantum-computing-anything, artificial intelligence, energy (carbon capture, nuclear [especially thorium]), bio/sustainable/green/animal-friendly anything (recycling, food, plastics, construction, energy again), medical/health, and of course psychology (also behavioral economics) are all very much still work in progress, so accurately reporting on them would require at least 1-2 hours. unless we're talking about something very concrete like a picture of a black hole 53 million light years away reconstructed from petabytes of radio interferometry.

</comment></comment></comment></comment></comment><comment><USER14> A practical plan for limiting carbon emissions:

1\. Carbon tax 2\. Import tariff at the border equivalent to the carbon tax on carbon used in production, plus an admin fee. But only on products from countries without their own carbon tax or equivalent.

1\. This can be adopted unilaterally, but would probably work best if adopted by a group of nations at the beginning.

2\. Does not require the near impossible task of requiring world wide agreement at the beginning. The hope is that it will encourage everybody to join the club eventually

3\. Structuring as a tax rather than quotas mostly eliminates the fairness problem between developed / developing

<comment><USER13> The important thing is, that to make the tax a pure carbon-negative incentive, that the revenue from the tax should be simply paid back to the taxpayers (of course divided into equal parts).

</comment></comment><comment><USER15> Melting permafrost is the thing that terrifies me. For a long time now scientists have been warning of the potential bomb lurking there. But, my understanding is it hasn't factored heavily in the IPCC reports because feedback loops have historically been difficult to quantify. Anecdotally, the trend seems to be that when it comes to Climate Change, things rarely break in our favor and those "worst case scenarios" seem to be coming up frequently.

I'm a pragmatist, I remain optimistic (foolishly, perhaps), but I think it's fair to say that society isn't sufficiently grappling with the potential catastrophe on the horizon. In particular I don't think enough attention is given to the possibility of climate dynamics at some point rapidly flipping to some new normal.

</comment><comment><USER16> This is an emergency; it's well past time we started acting like it: [https://rebellion.earth/](https://rebellion.earth/)

<comment><USER17> It may well be an emergency, but inconveniencing [1][2] the very people you are attempting to persuade (the voting public) is not a strategy that is likely to work. In my opinion it will make them deaf to the underlying message (Although, I can provide no suggestions for strategies that might work!).

[1] e.g. preventing them getting to work or flying to a holiday [2] Extinction Rebellion Protests: What happened? - [https://www.bbc.com/news/uk- england-48051776](https://www.bbc.com/news/uk-england-48051776)

<comment><USER18> > inconveniencing [1][2] the very people you are attempting to persuade (the > voting public) is not a strategy that is likely to work

Funny. Seems like it's working, _remarkably quickly,_ to me:

Michael Gove, the current Environment Minister, met with the protesters and accepted the need for urgent action, and other points. Far more than might be expected from the rather extremist position of today's Tory party.

The opposition have acknowledged all their points, and pledged to make climate emergency policy. They are currently trying to force a vote on calling a climate emergency in the Commons.

The organisers have turned up for interview on most of the UK's serious news outlets, including, I think, twice on the Today programme. Even those who've studiously avoided the topic are now talking about it.

Oh, and public opinion of ER appears to have _risen_ since the Easter protests. On that basis, I sincerely hope ER continue, and can step up their actions to more locations and companies too.

<comment><USER19> > need for urgent action

funny because most contaminants in water and air come from China and India

what is the UK environmental minister going to do about that?

unless the rest of the world agrees on the need on both regulate local industry and heavily tax import from unregulated countries nothing is going to change for the planet situation

the rest are mostly feel-good measures that carry increased cost on the population without shifting the global scenario very much.

<comment><USER18> > come from China and India

Utterly irrelevant. Everywhere needs to take action to solve the issue, USA, China and India especially. Both China and India are investing heavily in renewables, though clearly they have some way to go. The odd one out, presently, is the USA. I expect that to change soon enough.

Doesn't matter who goes first, who does more, or when, just that everyone takes enough action.

You'll be able to level the same criticism against any of the first countries that start inching toward acknowledging and starting to change the system. Still doesn't matter. Even if it's not yet enough. Only the end result does. Maybe it will eventually come to sanctions and closing trade to nations that aren't doing enough.

Simply put, someone has to go first, the first step is never enough.

<comment><USER19> > someone has to go first

but that's the point, European countries have done _a lot_ and the only result was most pollution intensive production was pushed abroad while destroying local productions chains, the lower classes and raising the cost of living to the point the middle class is unable to build the saving to promote healthy growth, meanwhile the planet is still as fucked as it were

</comment></comment></comment></comment></comment></comment><comment><USER20> Again a speculative article. "Might" is the important word in that article and Might" is not the word you use in scientifically demonstrated claims.

This debate have become so ideological that all reason has left the room a long time ago.

Show me scientifically demonstrated consequences not just speculated consequences we cant deal with, then ill rally behind you until then i am quite confident in my non-alarmist position.

<comment><USER21> You are asking for absolutes in science, which is something that does not exist because science is not dogma, thus open to corrections, which is inherently opposed to making absolute statements.

That's why scientific statements use probabilities and words like "might", it has nothing to do with "not demonstrated" but everything with admitting that humans are fallible beings and there's always a margin of error.</comment></comment>


Ask HN:  How should I publicly disclose a vulnerability without hurting users? - <AUTHOR>

I don't want to mention names right now or go into too much detail, but I have found a vulnerability in an open-source application that could be exploited to financially damage those who run it.  I have tested this myself under various setups and confirmed that it works.
I contacted the developers about the issue, including versions affected, the exploit, and the fix.  Within 5 minutes, I had a response saying, in effect that they "cannot be responsible for the user not knowing".
I'd submit a fix myself, but there's no place to do so.  It's an open-source app but you cannot commit publicly.  I want them to fix this because it's an extremely simple patch, and the potential damage resulting from an exploit would be crippling.
If I blog about it, or otherwise publicly post details, people could get hurt.  If I don't, the developers have no reason (or rather, motivation) to fix it.
Advice? <comment><USER2> The EFF has a nice FAQ on this that you might find useful:

[https://www.eff.org/issues/coders/vulnerability-reporting- fa...](https://www.eff.org/issues/coders/vulnerability-reporting-faq)

</comment><comment><USER3> By hurt I assume you mean financially and not that anyone will be physically harmed. If you've done due diligence by contacting the developers I think you have a responsibility to make it known what you have found so that others can put pressure on to fix it. Just my .02

<comment><AUTHOR> <sarcasm> Actually yes, physically. The bug is in a beta version of Skynet. </sarcasm>

I tend to agree with you, and that's what my heart is telling me, but aren't there legal issues involved? I seem to recall the standard being something like "Wait 30 days after informing", but if they outright refuse to fix it before then and they say so, am I able to be sued for damages if I disclose?

</comment></comment><comment><USER4> Maybe a logical "2nd step" for you would be to disclose that you've found a substantial bug that could "financially harm users" if exploited...but don't actually share the exploit. Post that you've contacted the developers as of <date> and will give them X-days to resolve the issue.

Now, as for that final step...that's up to you. Not sure the legal ramifications for sharing the exploit, or frankly, what the benefit to the community would be. I think your goal should be to put pressure on the developers, but not to actually expose the threat. If they never get around to fixing it, you've just potentially screwed the community (not to mention those that might never see the update).</comment>


Tips for founders doing their first tech startup (from a YC founder) - <AUTHOR> http://www.immadsnewworld.com/2007/10/tips-for-founders-doing-their-first.html

<comment><USER2> Wasn't Apple the one where some third person had 2% in case the two Steves had some conflict? But that third person was just for conflict resolution.

In general I find 3 or 4 is a good number for a start. It's not too many to manage, but not too few. 3 is company.

<comment><USER3> Any investor can also play the conflict resolution role.

</comment></comment><comment><USER4> Interesting on the third co-founder advice... does anyone else have a perspective on this?</comment>


John McAfee: My new company will make the cloud 'completely obsolete' - <AUTHOR> http://www.businessinsider.com/john-mcafee-mgt-capital-going-to-make-the-cloud-completely-obsolete-2016-9 <comment><USER2> Their website: [https://www.demonsaw.com/](https://www.demonsaw.com/)

I see a lot of bold claims but no information on what it is exactly. It looks like filesharing, but the also mention things like chat.

Where does it fit in? Does it replace bittorrent? Does it replace TOR?

<comment><USER3> It would be really nice to have more information about the 'mesh-based' networking that just looks like web tradffic etc...

I'll try it later but am unable to investigate at present.

<comment><USER2> Ok I checked it out. It's basically like a bittorrent client with chat/messaging. Or like those decentralized file sharing apps that were all the rage after napsters demise. I think theres more stuff to setup your own groups etc but thats basiclly it.

</comment></comment></comment><comment><USER4> [https://www.demonsaw.com/](https://www.demonsaw.com/) That's the company/product. On a quick look this looks like Tor - or not?

<comment><USER2> Glad I'm not the only one confused.

</comment></comment><comment><USER5> Expects to make "substantial revenues"...how?</comment>


Japan's levitating maglev train reaches 500km/h - <AUTHOR> http://bbc.com/news/world-asia-30067889

<comment><USER2> On their 27 mile test track. Which is too bad since at 300mph that would be a 4 minute ride :-) I expect it spends all of its time accelerating and decelerating. I suspect such trains will only be practical in the 'real' world by having them in some sort of fully enclosed track. It doesn't have to be a solid tunnel but something that keeps out birds and other debris from the area. Nothing like hitting a pigeon or catching a flying bit of branch at 300MPH, hurricanes put 2 x 4s through houses 2/3rds that speed so that would be a challenge.

That said the only other remarkable thing was how shaky the video was at 500km/h if the train was really moving around that much it wouldn't be too sustainable. One of the amazing things for me on the TGV was how smoothly it rode even going 200km/h.

<comment><USER3> _Nothing like hitting a pigeon or catching a flying bit of branch at 300MPH, hurricanes put 2 x 4s through houses 2 /3rds that speed so that would be a challenge._

At 250 mph, the TransRapid TR-08 simply vaporized any biological object it hame across little-to-no-damage to the vehicle (but there was a mess to clean up). A large object can be an issue, but small objects will likely be pushed aside by the pressure wave ahead of the vehicle.

 _That said the only other remarkable thing was how shaky the video was at 500km /h_

The vehicle is still undergoing testing, the facility may not have figured out or implemented the ride-quality algorithms yet.

<comment><USER4> > The vehicle is still undergoing testing, the facility may not have figured > out or implemented the ride-quality algorithms yet.

The Maglev train between Shanghai airport and the city is perfectly stable at 500 km/h if I remember correctly. Japan is very, very late for Maglev technology.

<comment><USER5> If I recall correctly, the Shanghai one topped out at around 478km/h... They actually run at that speed only a couple times per day.

<comment><USER6> 431 km/h. I've ridden it, and it vibrates, for lack of a better word, disturbingly; you can really feel that it's pushing the envelope of what's possible. Not a big deal for a 7-minute ride, but would be a bit annoying to put up with for an hour.

</comment></comment></comment></comment></comment><comment><USER7> Tgv beat that speed many years ago, on rails : [http://youtu.be/8skXT5NQzCg](http://youtu.be/8skXT5NQzCg)

<comment><USER8> Maglev also beat that speed many years ago: [https://en.wikipedia.org/wiki/Land_speed_record_for_rail_veh...](https://en.wikipedia.org/wiki/Land_speed_record_for_rail_vehicles#Maglev_trains)

In 2003 the Japanese maglev test train running on the same test track reached 581 km/h. It was not until 2007 that the TGV reached 574 km/h.

</comment></comment><comment><USER9> How do the engineers account for earthquakes on these trains? I could see it being quite disastrous if one were to occur while this train travelling at 500km/h. Also I wonder what the efficiency is given that the train needs to push through the thick atmosphere at 0 altitude compared to airplanes which fly at their top speed in a very sparse atmosphere.

<comment><USER6> Thanks to the Shinkansen, Japan's had _plenty_ of practice with this. Their "UrEDAS" (theoretically "Urgent Earthquake Detection and Alarm System", although this is just a backronym for _yuredasu_ "starts to shake") monitors both P and S waves and brings trains to a halt automatically, and is considered the gold standard for this kind of thing. In the 50 years they've been running trains, there's been one (1) derailment due to an earthquake, with zero fatalities.

[https://en.wikipedia.org/wiki/Shinkansen#Earthquake](https://en.wikipedia.org/wiki/Shinkansen#Earthquake)

[http://sdr.co.jp/papers/13wcee_uredas.pdf](http://sdr.co.jp/papers/13wcee_uredas.pdf)

</comment></comment><comment><USER10> I am sitting on the Sakura Shinkansen headed towards Shin Osaka as I read this.</comment>


Stop the Spies – Campaign against mass surveillance down under (Australia) - <AUTHOR> https://stopthespies.org

<comment><AUTHOR> Hi everybody,

Australia has recently proposed new surveillance laws not unlike and if not worse than the NSA in the US. We are attempting to run a grass roots campaign to place pressure on legislators to change their minds on the matter before it's too late.

It would be great if we could follow some of the European nations in ruling it unconstitutional -> [https://twitter.com/Steve_Dalby/status/498660816548143104/ph...](https://twitter.com/Steve_Dalby/status/498660816548143104/photo/1)

As an Aussie I've worked on many of the campaigns against mass surveillance in the US under the banner of [http://taskforce.is](http://taskforce.is).

I was hoping some of you might return the favor and help us raise awareness by supporting and if possible displaying the banner in September.</comment>


Is Nokia About to Eat Its Inventory? - <AUTHOR> http://www.dailyfinance.com/2012/07/10/is-nokia-about-to-eat-its-inventory/

<comment><AUTHOR> The takeaway ...

"Since these [current Lumia] devices won't be upgradable to Microsoft (NAS: MSFT) Windows Phone 8, but will instead receive a topical upgrade to Windows Phone 7.8, [Mark] Sue expects customers to hold off until they can get their hands on the newer devices once they're released. That's leading him to slash his estimates across the board."</comment>


Cryptocat Considered Harmful: The Root Cause - <AUTHOR> https://datavibe.net/~sneak/20130717/cryptocat-considered-harmful <comment><USER2> So make something better that people will actually use--then the question of what to use will become a no-brainer. "Just use Foo." The "best" alternative to something like Cryptocat is Pidgin/Adium+OTR plugins, and you can't seriously claim they're as usable (nor are their implementations actually perfect.) If not that, then help to fix whatever issues the popular tools have. (They're open source, after all.)

Make formal security proofs, implement them, open source your prototypes, and have them vetted by as many cryptographers as possible (so one or two if you're lucky.) Then figure out how to market your product.

By far the hardest aspect of cryptography engineering is getting people to use your software in the first place. It doesn't matter how good you are at crypto if your software is never used.

It's very easy to criticize. Much harder to actually make more secure, more usable alternatives. (And, ironically, the people who ought to be doing this the most are much more hesitant to do so since they know of many more subtle ways to make mistakes.)

<comment><USER3> [https://heml.is/](https://heml.is/) should be on the way. I've been keeping on eye on it. It'll be interesting what the security community thinks of it after release.

There is also TextSecure ([https://whispersystems.org/](https://whispersystems.org/)), but it requires text messaging.

<comment><USER2> Definitely holding off until the open source release (and hopefully it won't just be dumps of old versions like Silent Circle's.)

Agree that TextSecure and Redphone are great tools, albeit in different categories, and as far as I can tell their implementations are sound.

</comment></comment></comment><comment><USER4> Nadim's ego has lead him down a path where he believes that what he is doing is infallible and his critics do not deserve any level of praise--and it is reenforced by those who do not know any better than he does. You can see this in any project or startup, but in the case of Cryptocat, we have a situation where lives are potentially at risk and there is a likelihood that someone has already been compromised due to his actions.

The "cutesy" icons and flashy colours that Cryptocat displays are really nothing more than lipstick on a pig.

</comment><comment><USER5> As a passive observer of all cryptography discussions on HN, I can't help but think if security researchers spent as much time on creating usable, secure software as they did in proving that other's implementations were flawed we'd be in a much better place.

As a user, I just want to be able to message another person, over the internet without having to worry about setting up plugins or setting up any kind of keys. I want to add them to my friend list, click their name, send them a message and be comfortable in the fact that my communication cannot be intercepted.

<comment><USER6> Would you rather use a piece of communications software which purported to be cryptographically secure, but wasn't, and not know it because no security researchers spent any effort attempting to prove that its crypto implementation was flawed?

<comment><USER2> > Would you rather use a piece of communications software which purported to > be cryptographically secure

..than communicate in plain text? Yes.

Where's the alternative? We can have Cryptocat shut down, which is what the author is suggesting, but then what are we (and by that I really mean people who currently use Cryptocat) going to do?

<comment><USER7> So, let me put that a bit more clearly:

You would prefer to communicate in plaintext-equivalent where you think nobody can read it even though in fact everybody can over communicating in plaintext where you know everybody can read it?

<comment><USER2> I wouldn't prefer that, but I'm also not as convinced that Cryptocat is as "clearly broken" (i.e. plaintext is trivially recoverable) in its current state as a lot of people on here are. Most of the attacks that I've seen so far were against the group chat implementation, which, granted, is significant, but not against the primary component, the OTR chat.

I think it is somewhat naive to believe that _any mechanism_ other than a one- time pad will absolutely keep your communications safe, and that it's a little dangerous to insinuate that Cryptocat leaks information about the plaintext but X or Y doesn't.

</comment></comment></comment></comment></comment><comment><USER8> Guy creates a blog and his first single post is to discourage someone truly trying to innovate in the cryptography space (though admittedly more in usability aspects).

After listening to Glen Greenwald at the CCC it was quite clear that cryptography that is easier to use than PGP is really needed in this world (he almost lost the Snowden story due to it). I think that Nadim needs to be encouraged. Sure, point out any flaws but aim for constructive feedback.

The points here centre around it "not good enough". This is a bit of a chicken and egg problem and isn't really helpful.

<comment><USER9> Don't implement your own crypto. Better people than you have tried and failed. Everyone should know this by now. If you can innovate on the usability, that's great, and we really do need that - but build it on top of a well known, peer- reviewed protocol like OpenPGP. It's not like it's even any harder than rolling your own.

<comment><USER8> Definitely. I'm really interested in the progress of OpenPGP.js. It could possibly replace a lot of the sketchier parts of Cryptocat.

<comment><USER10> Even if it does, it still won't help. Crypto in the browser is like playing soccer in a minefield: either you don't move or you lose a leg. Either way, your game is hosed.

The issues are, to put it mildly, insurmountable. The environment is simply too toxic to trust. Between standard Web security flaws, timing attacks (what happens when one context can detect the timing of another? Remember, the code is slow, so your resolution doesn't have to be good), inadequate random number generators, an inability to securely manage memory (don't want key materials floating around), etc.

I'd rather trust Bob's Discount Car And Certificate Authority than JS crypto.

<comment><USER2> Unfortunately, after the recent revelations this is how I feel about computers in general :)

</comment></comment></comment></comment></comment><comment><USER11> I understand the problem here: don't experiment with crypto with your users' safety in the balance, claiming all the while that they're safe. The sad reality is that none if his users will ever know that there's a problem until it's too late.

Slightly off-topic, but this is one of those areas that bugs the hell out of me, and I don't know the solution. On one hand, security and cryptography people tell lawmakers and those in authority that crypto is math, anyone can do it, it's silly to try to regulate it, etc. On the other hand, these same experts tell the "anyones" of the world _not_ to implement their own crypto, mistakes are easy to make, correct implementations are hard ...

Here's the kicker for me: If you absolutely should never release another piece of software that might have bugs that could endanger someone's life, then you'll never release another piece of software. You can become the greatest cryptographic implementor on the planet, implement to the current state of the art, and, in a couple years, still have your work completely obliterated by a new attack against a cryptosystem that you are using _correctly_.

<comment><USER2> I don't think your two examples are contradictory. It _is_ silly to try to regulate export of strong crypto, and it _is_ difficult to get crypto right.

</comment></comment><comment><USER12> Note that this article simply shits all over Cryptocat without giving any concrete examples: "has had myriad errors in implementation" and "After being berated by dozens, repeatedly, because of the myriad flaws". I kept waiting for Paul to substantiate his criticism or at the very least link to some of the implementation flaws he keeps trumpeting, but he doesn't. Pointing out that Cryptocat has tried multiple encryption schemes isn't really evidence in itself, either.

For all I know this guy could be totally right about Cryptocat, but this is absolutely not the way to make this kind of statement. It isn't well-reasoned and it sure as shit isn't informative.

</comment><comment><USER13> A nice quote from Phil Zimmerman from a comment in a post by Schneier which was posted in a comment to this post:

"I remember a conversation with Brian Snow, a highly placed senior cryptographer with the NSA. He said he would never trust an encryption algorithm designed by someone who had not earned their bones by first spending a lot of time cracking codes. That did make a lot of sense. I observed that practically no one in the commercial world of cryptography qualified under this criterion. "Yes", he said with a self assured smile, "And that makes our job at NSA so much easier." A chilling thought. I didn't qualify either. "

[https://www.schneier.com/blog/archives/2011/04/schneiers_law...](https://www.schneier.com/blog/archives/2011/04/schneiers_law.html#c530393)

edit:

By the way I think that Jeffrey Paul has a relevant point, I think it deserves to be taken into account. I understand his words can hurt Nadim Kobeissi nevertheless from my point of view they carry no such will.

</comment><comment><USER14> Considered Harmful considered harmful, please use the active voice.

<comment><USER15> "Considered Harmful" is supposed to be humorous, please do not attempt humour on HN.

<comment><USER15> See?</comment></comment></comment>


Librem 15: A Free and Open Source Laptop That Respects Your Essential Freedoms - <AUTHOR> https://www.crowdsupply.com/purism/librem-laptop

<comment><AUTHOR> I posted this because it was interesting but don't know anything about Purism or Todd Weaver it's founder. So beware...

Someone at PCWorld is excited about this --> [http://www.pcworld.com/article/2849795/purism- librem-15-linu...](http://www.pcworld.com/article/2849795/purism- librem-15-linux-laptop-blends-high-end-hardware-with-totally-free- software.html)

</comment><comment><USER2> Comes with NVIDIA GT840M Graphics. How could the driver be free without Nvidia providing it!</comment>


Vote for Amsterdam as the last city to host Euruko before the end of the world - <AUTHOR> http://lasteuruko.org/ <comment><USER2> I think Amsterdam would be a great place for the next Euruko! But hopefully, there will be more tickets available than this year... -.-</comment>


Should "Yes, delete it" be red, or green? - <AUTHOR> http://ux.stackexchange.com/questions/49991/should-yes-delete-it-be-red-or-green/ <comment><USER3> Neither. Wherever possible, design your code to use undo rather than confirmation, Gmail-style. Saves the user time and avoids training them to click through confirmations (and perhaps eventually be sorry).

<comment><USER4> Making an action undoable often more than doubles the development cost of that feature. Google can do it, for a small startup it only makes sense in a few situations.

<comment><USER5> It is particularly difficult in a collaborative application with 'hard' links between records. For example, consider this scenario:

(1) Sally deletes an employee record

(2) Bob deletes that employee's department

(3) Sally tries to undo the deletion of the employee - will the employee be restored without a department?

<comment><USER6> >(1) Sally deletes an employee record >(2) Bob deletes that employee's department

I would argue that a good design would actually prevent you from deleting important records like these. i.e. when Bob clicks delete, it just marks the object as deleted and it stops showing up in reports/interfaces. Then maybe you have something clean it up 90 days later or something.

<comment><USER7> Yes. This is pattern I've seen in both companies I worked for, and it makes so much sense.

Similairly you don't make table ARTICLES with column AMOUNT and KIND. You make table CHANGES with DIFFERENCE and KIND, and only ever add rows to that table (possibly with negative DIFFERENCE).

<comment><USER8> Sorry I don't really understand what you're trying to say here. Could you expand on the differences in data between the two tables, please?

<comment><USER9> In the first case, you only know the AMOUNT. You can't undo transactions because you only have 1 object stored, the total amount. If you store DIFFERENCE, then you'll have a table of every transaction and can undo them individually. The cost is having to sum the table whenever you want to know the amount (which is usually worth the flexibility).

<comment><USER7> Regarding the performance - you can add triggers writing to additional table with a sum, or maintain that table in the code that adds rows, or calculate it each time you want to know the sum.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Red should be associated with risk (where care and consideration is warranted), not 'bad' (you should not do this).

Thus the act of deleting should be red, but the act of not deleting should NOT be green, rather a neutral tone.

<comment><USER11> As stated in the accepted answer :)

But yes, that was my immediate reaction, too. Not the most mindblowing Stack Exchange Q&A I've encountered on the HN front page.

</comment></comment><comment><USER12> I'd also drop the "Yes" given we're auto-programmed to agree and make popups disappear. "Delete it" is more powerful.

<comment><USER13> As suggested, I'd change "Delete it" to just "Delete", might seem minor, but it's less to read and the word "it" doesn't add any information the user didn't already have...

<comment><USER12> Agree!

</comment></comment></comment><comment><USER14> (1) Ask a simple question "Delete?"

(2) Don't use many words when 1 will do. "Cancel" "Delete"

(3) Don't use words when an icon will do.

(4) Don't use cognitively conflicting symbols and colors. Red be cautious, green it's safe, but deleting something can be dangerous in either direction, safe in either direction. A better mental model is action vs inaction, then it's more clear to highlight the response that causes an action.

(5) Avoid blocking interfaces altogether. Avoid interrupting the users flow. Perform all actions immediately, but only ever offer recoverable actions. Undo is not the only choice, and probably not the best for things like entire documents. Like loading a file, delete is often not meaningful in the undo stack (though it can be). Another paradigm is moving an item to a differentiated group, such as trash, an undisplayed group or a low rating. This approach is idempotent and allow things to be recovered out of order (it's also easer to implement than undo especially asynchronously). It can also be it's own valuable feature like edit tracking for word processors.

</comment><comment><USER15> "Would you like to Cancel?"

"OK" / "Cancel"

<comment><USER16> That's confusing; they both appear to cancel whatever action was just performed.

<comment><USER15> Yes.. this is the point

</comment></comment></comment><comment><USER17> Colours are fine.. Either way works although for my sensibilities the red works for the Delete button. I am red/green colourblind and the two have distinct enough values that I can easily tell them apart.

But I think YES and NO shouldn't be there. It's an extra piece of information that demands the original context of "Do you want to delete this album". It might seem like a small mental investment to ask of your users but people have varying degrees of comprehension at different times, whether due to temporary distraction or because of more permanent conditions such as dyslexia and such.

Instead I would just say "You are about to delete this album" And have the buttons read "Cancel" and "Delete"... Or something similar.

Undo would also be preferred as comex mentioned.. Or even better a git-like revision history so you can undo any action in the past. This comes with other technical challenges I'm sure but it's the most powerful solution.

</comment><comment><USER18> It is sad nobody mentions book The Humane Interface by Jeff Raskin.

Raskin would say, that this is not a question of red or green. It is a question of habit. If user deletes enough items, you will train him to press "Yes" button and not to think about the question. It will be his habit. Uninterruptible sequence.

Anybody deleted his important files just because he is "trained" to press sequence F8 - Enter in his favourite file manager?

Raskin recommends to provide undo. User content is sacred and should not be lost. You can also try to randomize the dialog. User will stop the sequence and think what he is doing. But if user performs the delete operation often, he will be greatly annoyed.

Read it. It is a great book with many valuable gems. [http://amzn.com/0201379376](http://amzn.com/0201379376)

<comment><USER19> Please do not randomly change buttons. Thats the worst idea ever. Where does this guy do his research?

</comment></comment><comment><AUTHOR> Another discussion which got started in the comments[1] is whether to place the 'Delete' button to the left or right.[2]

[1] [http://ux.stackexchange.com/questions/49991/should-yes- delet...](http://ux.stackexchange.com/questions/49991/should-yes-delete-it-be- red-or-green/#comment74992_49994)

[2] [http://www.nngroup.com/articles/ok-cancel-or-cancel- ok/](http://www.nngroup.com/articles/ok-cancel-or-cancel-ok/)

<comment><USER20> Brings back the old Gnome vs KDE, Linux vs Windows thing with OK and Cancel buttons ;)

See this discussion from 2002:

[http://markmail.org/message/hpkehtmximjn3cl5](http://markmail.org/message/hpkehtmximjn3cl5)

<comment><USER21> That's really the MacOS vs MSWindows disagreement, and then the "whom should we emulate?" disagreement among Linux desktop people. Oh, and the OpenWindows and CDE people before them.

I'm biased, but I think of this as another one of those "well, Microsoft got it wrong, but people are so used to it now that we have to perpetuate it or we look like we're just willfully antagonistic" situations.

User studies can be produced to prove either side, of course.

</comment></comment></comment><comment><USER22> IMO, cancel should be neutral colored, and Delete should be "warning" colored (be it red or orange).

Edit: I predicted the top response. Yay!

</comment><comment><USER23> Does it matter which shade of brown you choose?

/colorblind

</comment><comment><USER24> I would prefer solid blue for a confirming step, and a blue border with no fill for a cancel button. The contrast of fill vs no fill for the button highlights better than two colours.

</comment><comment><USER25> Just a note that X percent of the population is colorblind. I'm not, but I have a couple of colleagues who are, and I've made graphics that are unreadable for them.

<comment><USER26> Its a good idea to use "Delete" in addition to color, multiple signals can avoid problems like color blindness.

</comment></comment><comment><USER27> For most operations, "delete" should be reversible, so there are no consequences for clicking delete. If you really get the UI right, you shouldn't need confirmation. (Gmail's message like "this post has been archived <unarchive>" after you archive a message seems about right to me. It implies something like "you did something destructive, and we can cancel it right now. or you can undo it manually later." Much better than confirm/cancel dialogs.)

For things like "yes, I'm afraid of the NSA, wipe those tapes forever", that's another issue. In that case, you want a "flow" rather than a button, I think.

</comment><comment><USER28> It should blink and beep, and have a 60s Batman yellow callout around it.

</comment><comment><USER29> I think "Yes" should be "green". The question is clear... green reminds me of the traffic ligths, green means "go on" or "go ahead". Maybe "yes" and "delete" shouldn't be in the same button because it seems that "yes" has a positive meaning (green) and "delete" a negative/alert meaning (red), that is why (maybe)you got this paradox... Hope that was helpful.

</comment><comment><USER30> Green denotes a good, positive action. Red denotes a warning, negative message.

That being said, I would have a tendency to put [yes delete] as green. If this was a "delete forever and destroy the world" button, then [yes delete] should be red.

It is up to you based on how permanent this delete is. As has been noted, Gmail style with undo is best.

</comment><comment><USER31> One place that I worked the majority of users were from Asian descent. For them the red was GOOD, Important, Money good sign.

For me red was always ''warning'', stop, danger...

So I don't think red is a good color or even if it has to have color..

<comment><USER32> I'm of Asian descent and cannot confirm. They still use red stop signs and traffic lights. Red is also the color of blood - similarly, there's a fair amount of literature supporting the evolutionary emergence of red as a signal of danger.

<comment><USER33> Really? I thought it was one of those low-evidence beliefs. Consider [http://www.ncbi.nlm.nih.gov/pmc/articles/PMC3933460/](http://www.ncbi.nlm.nih.gov/pmc/articles/PMC3933460/) :

> Recent research has shown that the color red influences psychological > functioning. Red is hypothesized to be linked to aggression and danger in > evolution, and these links are enhanced by culture-specific uses of red. > Thus, color meanings are thought to be grounded in biologically based > proclivities and learned associations. However, to date, there has been no > direct evidence for the influence of experience on the red effect. This > study focused on whether experience could change the psychological effects > of the color red. In the context of the Chinese stock market, contrary to > the meaning generally associated with red as negative and green as positive, > red represents a rise in stock price and green stands for a decrease. An > experiment using a 2×2 between subjects factorial design demonstrated that > red (compared with green) impaired Chinese college students' performance on > an IQ test (in accordance with the red effect), but the opposite effect was > found among stockbrokers. These results provide direct evidence of learned > color meanings, in support of the general model of color effect. ...

which suggests that red has a non-trivial learned color meaning on people, and leaving open the possibility that it's mostly, if not all, culturally based.

Or consider [http://www.ncbi.nlm.nih.gov/pubmed/20677892](http://www.ncbi.nlm.nih.gov/pubmed/20677892) :

> in a series of 7 experiments we demonstrate that women perceive men to be > more attractive and sexually desirable when seen on a red background and in > red clothing, and we additionally show that status perceptions are > responsible for this red effect.

They hypothesize that red is not a general signal of danger, but has many meanings. NOTE! [http://www.ncbi.nlm.nih.gov/pubmed/23398185](http://www.ncbi.nlm.nih.gov/pubmed/23398185) points out that there's likely publication bias in this experiment, so there might be no signal. I bring up the study anyway to point out that many people have different interpretations for the "evolutionary emergence", and the evidence is low.

Or consider [http://www.ncbi.nlm.nih.gov/pubmed/23148465](http://www.ncbi.nlm.nih.gov/pubmed/23148465) :

> Claims of universality pervade color preference research. It has been argued > that there are universal preferences for some colors over others (e.g., > Eysenck, 1941), universal sex differences (e.g., Hurlbert & Ling, 2007), and > universal mechanisms or dimensions that govern these preferences (e.g., > Palmer & Schloss, 2010). However, there have been surprisingly few cross- > cultural investigations of color preference and none from nonindustrialized > societies that are relatively free from the common influence of global > consumer culture. Here, we compare the color preferences of British adults > to those of Himba adults who belong to a nonindustrialized culture in rural > Namibia. British and Himba color preferences are found to share few > characteristics, and Himba color preferences display none of the so-called > "universal" patterns or sex differences.

Since you say that there is a "fair amount of literature" on this topic, can you point it out? I've not been able to find anything rigorous which supports your statement. Certainly nothing which is stronger than that last citation.

<comment><USER34> Whilst it is true that colors are seen differently in various cultures, the universality of red as the color of stop signs makes it a sensible choice for a color that is intended to make someone consider the consequences of an action.

Not the OP, but there is a fair bit of literature which could be construed to support their point. Indeed, 2 out of the 3 references you cite could support their point.

1) Note that the general Chinese student performed worse when red was used - despite the generally positive Chinese cultural values put on red. The fact that training could overcome this does not invalidate that point. Indeed, the learnt value of red indicates that it may be sensible to use it in UI, simply because it is fairly standard.

2) Studies have shown that many women find dangerous men more attractive[1]. Perhaps this supports the idea that red represents danger?

3) Without access to the full study there is no way of determining exactly what this says.

Also, I like this study showing that people wearing red in Olympic combat sports have an advantage: [http://community.dur.ac.uk/r.a.hill/red_advantage.htm](http://community.dur.ac.uk/r.a.hill/red_advantage.htm)

[1] eg [http://www.psychologytoday.com/blog/head-games/201310/why- do...](http://www.psychologytoday.com/blog/head-games/201310/why-do-women- fall-bad-boys)

<comment><USER35> > the universality of red as the color of stop sign

[http://i.imgur.com/6UTTUjW.jpg](http://i.imgur.com/6UTTUjW.jpg)

[http://en.m.wikipedia.org/wiki/Stop_sign](http://en.m.wikipedia.org/wiki/Stop_sign)

<comment><USER36> The wikipedia link is strong support for the idea that stop signs are universally red. Every pictured sign, from Argentina to Zimbabwe, is at the very least framed in red, and most are considerably redder than that. The text notes "The white legend/red field appearance is usually the same [from country to country]".

The imgur link shows an unexplained green sign. Any thoughts as to why it's green?

<comment><USER35> Not clear why that instance is green. I think I've seen arrive photos of green stop signs too. The point of my post wasn't too be flippant though: the GP was talking about stop signs being universally red, and that being basis for red labels/buttons. It only takes one example to disprove universality, I showed multiple.

To point of labeling and actions though:

1) I'm proponent of button labels being verbs ("Delete" vs "Yes") 2) Undo-able where possible

<comment><USER36> Actually, the post you responded to specifically argued that the universality (= every country, not necessarily every sign) of red stop signs makes red a good color for warning dialogs. _That_ argument doesn't require that all stop signs be red everywhere, it requires that red stop signs be typical everywhere, which they are. The only non-red stop signs described by wikipedia are several decades old.

As to the topic, I agree that the "yes" doesn't belong on the buttons, and have no particular opinion on undo vs no-undo.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER37> Since Red means both 'Cancel' and 'Delete', use something else: Black. Black, like: 'an empty black hole is where your data will go.'

</comment><comment><USER38> Why not have a Yes and No, instead of Yes, delete it and No, keep it? Seems like it solves the problem.

<comment><USER39> Ideally the button should describe what is going to happen so people who skim read the dialogue still know what it means - <USER2> [https://news.ycombinator.com/item?id=5018918](https://news.ycombinator.com/item?id=5018918)

<comment><USER40> I don't understand why Yes/No buttons are still being used everywhere. It's stone age.

</comment></comment></comment><comment><USER41> The accepted answer is pretty close to what iOS uses on its UIActionSheet control.

They use the concept of "destructive actions", and delete would fit the bill.

Destructive actions will show in red, and the rest shows in the default button color.

</comment><comment><USER42> Why is the question so long? That's causing part of the confusion. A simple "Delete album? Yes/No" is more than enough.

</comment><comment><USER43> red

</comment><comment><USER44> Although I prefer the method in the best chosen answer, if I had to choose between red and green, I would choose green. You are confirming an action when choosing yes. The button to cancel the operation should be red.

<comment><USER45> You are also being warned about something, and warnings are red. The "warning" aspect should trump the "confirmation" aspect, and imo it's not even a close decision.

</comment></comment><comment><USER46> Another SO set up question :)

But what I did find interesting was this comment getting so many votes -

117 "Neither, if you're red-green color blind like 10% of men. – Roddy of the Frozen Peas Jan 12 at 5:31"

With a obvious reply, but less votes -

53 "@RoddyoftheFrozenPeas (1) while some degrees of color blindness are quite common, thinking that 10% of men are red/green color blind is totally insane, (2) solely using a color to point out something is bad for color blinds, but if the color is something "extra" on top of the main information, then it's perfectly fine. I'm quite surprised and worried that your horribly wrong comment managed to raise 4 votes... – Lohoris Jan 12"

It's amazing people really can't think for themselves and just meaninglessly up-vote because it seems the right thing to do, as compared to what the logical thing to do is.

<comment><USER11> Nearly 10% of men are colorblind, though not all red/green. It is by far the most common type though, and I'm red/green colorblind. A common misconception is that reds and greens are indistinguishable to people like me. That's not really the case.

Most reds look red and most greens look green. It's just that some particular shades of each are ambiguous. For me, the reds and greens produced by displays tend to be tougher to distinguish than natural hues, but the shades in the Stack Exchange question are as different as can be. It's tough to explain. It's also so subtle that many people with my particular type of colorblindness live and die without ever knowing the difference.

I only learned I was colorblind after being explicitly tested for it in 6th grade. I was pretty surprised! Though it did explain how I always seemed to mess up school assignments that involved coloring maps.</comment></comment>