Semantic Snakeoil - <AUTHOR> http://brack3t.com/blog/2011/semantic_snakeoil/

<comment><USER2> "It's currently impossible to be 100% semantic and still be useful."

I disagree.

As I understand it, in this argument, "usefulness" is defined as "is styled correctly with CSS". To this end, the author cites using `"class"="span6"` on elements, which are presentational, but not semantic.

This argument may have held more clout a few years ago, but tools like Sass have pretty much solved this problem of separation of content and presentation. Using a framework like Compass allows `"span6"`, for instance, to be expressed as a function on a semantic element, leaving your markup intact.

CSS frameworks, like Twitter Bootstrap, still stuffer from this conflation, but that's just a limitation of the tools. I make no claims to a prescriptive argument on the matter--go ahead and do whatever works--but I would be interested what the author would think about Sass, or Less.

<comment><AUTHOR> As the author, I think we're pretty much on the same page. My example of ``span6`` is from the Twitter Bootstrap (which is also available as Less).

I don't think tools like Less and Sass can save us from this decision, though. You can write hundreds of rules to handle different configurations of HTML elements and remain completely semantic, but eventually you'll have the same configuration in two places where you want them to appear different. Then you have the decision of giving one of them an ID or giving them classes and those have to be semantic (and custom to your site, requiring learning from future devs) or generic and breaking the "semantic all the things!!!" rule.

People are trying to figure this out. Semantic.gs is a great example of that. I just don't see, in our current browser, markup, and styles situation, a way to avoid generic classes that's still new-developer-friendly.

<comment><USER2> You know, as nerdy as it is, it's this sort of Aristotelian dichotomy between content and presentation that I really nerd out on. I'm reminded of an old SimpleBits staple where Dan Cederholm challenged us to find the most correct way to mark up breadcrumbs. But I digress...

I'm always glad to hear about more creative solutions to solving this dilemma. In my experience, since switching to Sass, I can't really think of a case where I had to sacrifice semantics for style, but perhaps that's an effect of being a designer who's wary of such things (letting the man who shovels sh*t decide how many elephants there should be in a parade, et wot).

Anyway, I don't think I share any normative urgency, (especially with something like W3C specifications). At the end of the day, I'm overjoyed that Sass saves me from 99% of semantics issues. For that other 1%, there's always the style attribute, no? ;)</comment></comment></comment>


How to choose an in-memory NoSQL solution: Performance measuring - <AUTHOR> http://highscalability.com/blog/2015/12/30/how-to-choose-an-in-memory-nosql-solution-performance-measur.html <comment><USER2> > Tarantool is an open-source NoSQL database management system and Lua > application server developed in my.com. The first version of Tarantool was > released in 2008 and the newest version is 1.6.7.

and later

> Through all tests we executed, Tarantool showed the best result for the > count requests per second and for many of tests latency values on any type > of examined workloads. Therefore, we can decide that for most of typical > projects Tarantool suits them more that popular solutions such as Redis, > CouchBase or Memcached. This is the basis of our decision to use Tarantool > for our projects here at my.com.

So yeah. Obviously.

<comment><USER3> tarantool.org is an open-source project which is supported by my.com __and __many other commercial customers. my.com is an independent U.S. company that choose products on competitive basis.

Anyway, the benchmark is fully open. If in doubt, you can always download disk images and re-run benchmark.

// Disclaimer: [http://tarantool.org/](http://tarantool.org/) developer

</comment></comment><comment><USER4> Why is memcached under-performing? Is it maybe their driver? Or their benchmark? Shouldn't it be similar to Redis, if not a bit faster?

It's a bit fishy that the leading one is by the guys who wrote the article, see [https://news.ycombinator.com/item?id=10814318](https://news.ycombinator.com/item?id=10814318)

<comment><USER5> Those tests don't look reliable.

For example I'm quite surprised that no one pointed it out, but if you look, the memcache its performance grows nearly linearly to number of threads. They stopped at 256 when it was about to take over redis.

Now if you look at workload A and B, workload A supposed to have 50/50 read/write while workload B was 95/5 read/write. You see that memcached performed terribly there. You would think that perhaps the access pattern is different but then if you look at rest of databases they perform closely to workload A. And memcached which was doing 15000req/s is doing 10000req/s on a workload which supposed to be less work.

This looks to me that performance issue is most likely not in memcached itself but in their test application, but we can't prove that because they did not release code they used for testing.

</comment></comment><comment><USER6> Postgres is also a good in-memory NoSQL solution. Actually you can use anything really as an in-memory NoSQL solution such as ArangoDB, MySQL, MongoDB, RethinkDB or whatever.

<comment><USER7> Do you mean using postgres tablespaces backed by memory or do you mean using a FDW?

If you do mean using a ramdisk tablespace, the postgres docs recommend not doing that. However, if you really want to do that, make sure you attach xlog (the WAL table) to that ramdisk tablespace as well, otherwise every transaction will still hit the disk.

<comment><USER8> Not the poster upthread. But if you have enough memory (shared_buffers) and use unlogged tables, the effect is going to be that both reads and writes pretty much only hit memory, no disk. Without going through the trouble of moving tablespaces or anything.

</comment></comment></comment><comment><USER9> Sqlite is always a good option if you want in-memory and SQL. Kyotocabinet supports a number of in-memory database types, as does its networked counterpart kyototycoon. BerkeleyDB can be effectively run in memory if you size your cache right, and as a bonus you can build bdb with a sqlite frontend.

Anyway, cool post. For more lua, there's openresty (nginx and lua), and kyototycoon supports lua scripts as well.

</comment><comment><USER10> Apache Geode is a distributed, in-memory database ([http://geode.incubator.apache.org/](http://geode.incubator.apache.org/)).

See [https://news.ycombinator.com/item?id=10596859](https://news.ycombinator.com/item?id=10596859)

<comment><USER11> I will try it. Thank you!

</comment></comment><comment><USER12> The hardware setup is not clear. Are you running YCSB client and the database on the same single A3 instance?

<comment><USER11> No, I ran two instances close to each other (in one DC).

For example, Tarantool and CouchBase were installed on nosql-1 instance and YCSB client on nosql-2 (There are links to *.vhd files in the article).

</comment></comment><comment><USER13> Sometimes it is depressing how little effort people put in to run a level playing field when doing numbers like this. The couchbase SDK used is from Mid 2013, with little effort the numbers could've been better..

<comment><USER11> I've used my simple Memcached module, not Couchbase SDK.

</comment></comment><comment><USER14> A couple of notes on usability: Having the labels of the charts (i.e., the color to db matching) be defined only in one place (above the graphs) makes comparing the charts in the article really difficult to read and interpret.

</comment><comment> aps-sids I'm quite surprised to see that there's no Aerospike in this comparison.

<comment><USER15> Similarly, I was hoping to find VoltDB in the mix.

<comment><USER15> Why downvote? How is VoltDB not relevant here?

<comment><USER16> No idea (I haven't voted here at all), but maybe someone didn't want to make this a long thread naming myriad of NoSQL databases out there?

</comment></comment></comment></comment><comment><USER17> Hi folks, was this a test over a single machine? Also anyone know why the test used an unofficial version of couchbase (4047)?

<comment><USER11> Yes, it is. When I was running the test, CouchBase 4.x hasn't been released.</comment></comment>


Device Orientation in HTML5 (tilt your computer if you have a MacBook & Chrome) - <AUTHOR> http://slides.html5rocks.com/#slide-orientation <comment><USER2> The last three versions of Firefox have supported the W3C device orientation spec. Before that, and going all the way back to Firefox 3.5 more than two years ago, Firefox supported a vendor prefixed version.

</comment><comment><USER3> Pity the developer didn't include -moz extensions, given the use of -webkit extensions you'd think he doesnt care about anything but Webkit.

<comment><USER4> Yeah, it's a couple years old now: <http://news.ycombinator.com/item?id=1272481> At this point, much of the CSS3 demonstrated wouldn't require a vendor prefix at all.

</comment></comment><comment><USER5> About 50% of the things on this page aren't HTML5, but chrome-only features.

Bleh for standardization, really.

<comment><USER6> If you are building something for wide market use then definitively don't use these new features until they are supported by multiple vendors. But before standardization can happen things have to be tried out, I don't see what all the negativity is about when it comes to new features in chrome (I don't get the same vibe with Firefox only features).

It's better, in my opinion, to have a working prototype of a feature working and used by some early adopters than to build standards in a vacum.

Those early adopters need to know those features my disappear or the apis change and be ready to fix their code.

<comment><USER7> The API they use _was_ standardized, and supported by multiple browsers since long. The page is written to only work in WebKit browsers.

There is no need or sense in defending this behavior. It's bad, and shortsighted.

</comment></comment></comment><comment><USER8> Or an IBM/Lenovo ThinkPad.

They all (ingeniously) use the sudden-drop detection that prevents hard drive head crashes to double as an accelerometer.

<comment><USER9> Many years ago, 2006, I was using the sudden-drop detection in my iBook G4 to know when people were walking down the hallway to my office.

<comment><USER10> Wouldn't you get false positives every time you typed?

<comment><USER9> Yes, but due to how the structure was (poorly? likely…) constructed, the movement caused by someone walking down the hall was much larger than me typing.

</comment></comment></comment></comment><comment><USER11> it would be cool if GMail and other data sensitive web applications used these APIs so that it would log you out of the web service if your computer had a lot of motion (e.g. someone running away with it).

<comment><USER12> Interesting idea but it would make gmail impossible to use on a train or bus.

<comment><USER5> true :D

<comment><USER11> correct, back to the drawing board! :)

</comment></comment></comment></comment><comment><USER13> wrote a labyrinth demo back in the day to demo the Firefox-prefixed version of the API. I've updated it here: <http://potch.me/labyrinth/>

</comment><comment><USER14> doesn't seem to work on my 2011 air

<comment><USER15> Nor mine, I suspect its because the accelerometer is designed to halt the disk if it detects sudden movement. There is no hard disk in the airs thus it has no need for an accelerometer.

</comment></comment><comment><USER16> I'm still waiting for someone to build a popular whack based interface based on this data. I'd love a photo album where I would tap the side of my screen to advance to the next/previous photo.

<comment><USER17> The hdaps Linux kernel driver for Thinkpads' sensors (don't know about the other flavors) can export the data as a joydev, which can be mapped arbitrarily - I've tried things like desktop switching by hard taps to either side of the keyboard, but it's more of a neat gimmick than a useful interaction mode. Some (severely out of date) scripts here: <http://www.thinkwiki.org/wiki/HDAPS> (no HTML in comments?)

</comment></comment><comment><USER18> It seems to only react to two axes (beta and gamma -- in other words, if I rotate my MBP on a flat surface, nothing happens) -- is anyone on a device that provides alpha as well? I know the iPhone does, but this demo doesn't seem to work in Mobile Safari.

<comment><USER19> Doesn't that require a gyroscope? Most devices that would work with this only have accelerometers.

</comment></comment><comment><USER20> No JS required w/CSS media query, e.g. @media only screen and (orientation: landscape) {...}</comment>


In France, a Baby Switch and a Lesson in Maternal Love - <AUTHOR> http://www.nytimes.com/2015/02/25/world/europe/in-france-a-baby-switch-and-a-test-of-a-mothers-love.html <comment><USER2> "After four days, how can you not recognize your baby?" Sophie Chas, the lawyer for the clinic, told the newspaper Le Figaro. "We can believe in it when it's a second, a day, two days. But 10 years? The mothers may have been involved in creating the damage."

How sad that the lawyer chose to argue that "the mothers may have been involved in creating the damage"... because they trusted the doctors? ...because they didn't possess some "maternal instinct" to recognize a baby they had spent almost no time with? Even after say 2 years or 10 years it's your fault because you didn't call the police to report that your child's skin tone doesn't match your own? How is it even acceptable to make this argument in a court?

<comment><USER3> in France, when the judge is a professional (by opposition to a jury), you can use whatever arguments you want in court. But outrageous arguments are extremely risky, the lawyer might have been in a desperate position to use that.

</comment></comment><comment><USER4> To summarize, two babies were switched at birth with plausible explanation as to why neither mother acted on her suspicions. Each mother bonded with her non-biological child, and raised her as her own (just like millions of adoptions the world over). 10 years later, when a paternity test finally happened (the delay was better explained in these HN comments) and the families were reunited, differences in parenting and family dynamics (one said to have strict discipline) meant neither family got along with their biological child nor wanted to keep in close touch. They still made about $1 million each from the birth clinic in a civil suit.

I'm not really sure what the big deal is here, and whatever cultural significance was missed by the NYT author (surprising given the French- sounding name). Fact is, this was the plot of a hugely successful French movie in back in 1988, thus still entrenched in the memories of many adults. Of course, the movie was more of a white-collar vs blue-collar social satire and very funny. But the real story for the French audience was that of life imitating art.

[http://en.wikipedia.org/wiki/Life_Is_a_Long_Quiet_River](http://en.wikipedia.org/wiki/Life_Is_a_Long_Quiet_River)

[http://fr.wikipedia.org/wiki/La_vie_est_un_long_fleuve_tranq...](http://fr.wikipedia.org/wiki/La_vie_est_un_long_fleuve_tranquille)

</comment><comment><USER5> It should be said that parental tests are illegal in France (and some other countries), and parents in this case could face huge fine and jail.

[https://en.wikipedia.org/wiki/Parental_testing#France](https://en.wikipedia.org/wiki/Parental_testing#France)

<comment><USER6> Why would they be illegal? Shouldn't men be able to know whether they are the biological fathers of their children?

<comment><USER7> It's illegal in order to prevent precisely this.

<comment><USER8> What is the reasoning behind that? It seems quite absurd to prevent men from knowing if they're the father of a child or not.

<comment><USER3> The reasoning is that a "your" kid doesn't only depend on genetics, it's also through adoption, or other family system (like in Africa, some kids are raised by their aunt and uncle). Because deciding overnight that the kid should stop calling that guy daddy is not really something we want to be simple like fetching a baguette. Since it's a medical procedure, they used the medical law to limit that. A family matters judge has to be involved, and the outcome has to have a purpose. In this example the "father" was very distant and not really involved in raising the little girl and the couple was splitting, so the question of paying child support was raised. I guess the lack of a fatherly bond and the lack of genetic link made the judge decide against the child support and allowed the father to be removed from the child birth certificate (but it's a soft limit, the judge has to make a difficult call for the definition of father).

</comment></comment></comment></comment></comment><comment><USER9> How touching. This story gives me hope that I can both deeply love an adopted child and that the child will love me back.

<comment><USER10> I had similar questions when we were presented the opportunity to adopt a newborn. She is now 10 days old, and she has felt like mine ever since I first saw her minutes after her birth. Perhaps my experience is unique, but I didn't expect the connection to happen as quickly (instantly) as it did.

<comment><USER11> Mazel Tov!

</comment></comment></comment><comment><USER12> > "The nurse said that the lights from the phototherapy treatment made the > baby's hair grow,"

> The other mother, also 18 at the time, asked another nurse why her baby > lacked hair. She was told that phototherapy could also shorten hair.

Unfortunately, this kind of attitude from incompetent employees is damaging to the society, and it is quite commonplace in France.

</comment><comment><USER13> You might be interested in this story too: [http://www.thisamericanlife.org/radio- archives/episode/360/s...](http://www.thisamericanlife.org/radio- archives/episode/360/switched-at-birth)</comment>


The Whole World Should Be Up in Arms About the EU's Looming Internet Catastrophe - <AUTHOR> https://www.eff.org/deeplinks/2018/09/why-whole-world-should-be-arms-about-eus-looming-internet-catastrophe <comment><USER2> A few months ago everybody was saying how awesome it was that the EU was regulating the Internet. You don't get to criticize them now. Or, well, I guess you can try, but that's not how things work in reality. Once the principle is established that the state (or suprastate) gets to impose regulations in an area of life, it may turn out that people you don't like work for the state also and they will do it too.

To mix some farm metaphors, the chickens are coming home now and it's too late to shut the barn door.

<comment><USER3> I think that's somewhat missing the key nuance of the point. There are actually two debates:

1\. Whether to regulate the internet.

2\. Whether a specific regulation is a good one.

#2 is the debate that happens for every law in a democratic system. If you agree with the democratic system on principle, then you already acknowledge that the democracy may not choose the laws you want.

#1 is what you're talking about. But it's not an all or nothing deal. You can believe that the internet should be regulated and simultaneously believe that any specific regulation is a bad one.

<comment><USER4> _I think that 's somewhat missing the key nuance of the point. There are actually two debates:_

 _1\. Whether to regulate the internet._

 _2\. Whether a specific regulation is a good one._

How often have lawmakers and regulators proposed things that would significantly break the Internet and online communities/activities? It seems to happen continuously, a few times a year.

I think you're somewhat missing the key nuance of a point. There are actually two debates. 1. Whether to text while driving. 2. Whether a specific texting is too distracting.

Here's the thing, though. Is legislation a remedy for bad internet legislation?

<comment><USER3> _How often have lawmakers and regulators proposed things that would significantly break the Internet and online communities /activities? It seems to happen continuously, a few times a year._

Fair point. You can argue that not regulating the internet at all is overall better than dealing with all of the bad proposals. However, bringing it back to the post I was responding to, everyone wasn't celebrating the EU regulating the internet, everyone was celebrating privacy regulation in an instance where the system had gotten to a bad place on its own.

 _I think you 're somewhat missing the key nuance of a point. There are actually two debates. 1. Whether to text while driving. 2. Whether a specific texting is too distracting._

You and I agree that the potential benefits are tiny compared to the harms of allowing texting while driving. On the other hand, you and I disagree that the balance is in favor of deregulating the internet.

That's a crucial difference. We never get to question 2 with texting while driving. We get to question 2 with internet legislation _all the time_.

 _Here 's the thing, though. Is legislation a remedy for bad internet legislation?_

Legislation doesn't exist in a vacuum, and bad legislation is remedied in multiple ways, one of which is more legislation.

That said, your question sounded to me like a rhetorical way to say that the risk of bad legislation isn't worth the occasional good one. Fair point. I disagree, but fair point. I don't think it's a useful debate to have because it's too fuzzy to be non-ideological, and, practically speaking, the world has already moved on from the question of _whether_ to regulate the internet.

<comment><USER4> _Fair point. You can argue that not regulating the internet at all is overall better than dealing with all of the bad proposals_

It's pretty never ending, and legislators and regulators don't seem to clue in over time. The downsides are very often potentially huge, and the upsides are almost always questionable.

 _We get to question 2 with internet legislation all the time._

Rather like living someplace where you get to kill cockroaches all the time.

 _Legislation doesn 't exist in a vacuum, and bad legislation is remedied in multiple ways, one of which is more legislation._

The solution to violence is more and better violence? The solution to hostility and hate is better backed and more potent hate? Laws and regulations are manipulated by big corporations to their advantage all the time, sometimes in direct contradiction to how the laws are sold to the public. The best move is to refuse them that power.

 _it 's too fuzzy to be non-ideological, and, practically speaking, the world has already moved on from the question of whether to regulate the internet._

The formulation isn't fuzzy or ambiguous. The proper amount to regulate the internet is as little as possible.

</comment></comment></comment></comment></comment><comment><USER5> YouTube (i.e., Google) already does article 13 (i.e., the extinction event is home-grown). Just today I saw a note from someone who got a takedown notice from YouTube after posting his own performance, done in his own home, of a Beethoven piece: the algorithm found infringement.

'Under Article 13 — the "censorship machines" — anyone who allows users to communicate in public by posting audio, video, stills, code, or anything that might be copyrighted — must send those posts to a copyright enforcement algorithm. The algorithm will compare it to all the known copyrighted works (anyone can add anything to the algorithm's database) and censor it if it seems to be a match.'

</comment><comment><USER6> Newspapers are dying off. Readers land on an article linked from Google then leave. Maybe in the interest of free speech, we do actually need the link tax. Users need to start using the homepages of these news sites and discovering their full reading experience.

<comment><USER7> Nonsense. Newspapers are dying off because they aren't doing their job. They all copy news from the same few sources, and do almost no decent investiation. Why doesn't anybody care for more than a title and a short snippet? Because what's left is filler.

I would really like a newspaper if it provided decent content. I would even prefer a weekly in depth edition instead of a daily dose of mcNews, we'll- give-two-sides-even-if-one-is-insane, and political opera. Now who can I give my money?

A tax means google pays, not me, and they can continue creating garbage. The market has spoken, newspapers. Please do your job or drop dead.

<comment><USER8> Have you tried "The Economist"? It is weekly, in-depth, no fluff (mostly). Give them your money. Well worth it.

<comment><USER7> I'm not English-speaking, but as I'm already reading bbc and Al Jazeera, I'll give it a try. Thanks for the hint.

</comment></comment></comment></comment><comment><USER9> Hysteria with few facts, recalling the Street View hysteria in Germany.</comment>


If you have too many visitors (e.g., due to a digg/reddit submission), should you give certain visitors higher priority? - <AUTHOR>

<comment><USER2> Alex covers this subject pretty well on how he handles different traffic:

<http://alexking.org/blog/2007/05/22/monetization></comment>


In Defense of Product Hunt - <AUTHOR> http://www.davidxgoliath.com/in-defense-of-product-hunt/ <comment><USER2> Alright, let's go 3-for-3 in Product Hunt threads today.

This is not an effective defense of Product Hunt and more of a "these are things that Product Hunt does that I like." More importantly, it does not dismiss the claims of exclusivity; in fact, one could argue that it _reinforces_ them, with name drops every other paragraph.

> This type of technology – Product Hunt's unique community culture – is also > hard to replicate and difficult for your typical, "neck beard" type of > programmer to understand.

What the hell?

<comment><USER3> Yeah, weirdly this post is positioned as a rebuttal but reinforces the point that people were making.</comment></comment>


Open Source Exploitation and Burnout - <AUTHOR> http://supportedsource.org/blog/open-source-exploitation-and-burnout <comment><USER2> This is the beauty of Open Source too.

There is no "social contract" for you to provide "support" for any of your work to individuals you can clearly see are working for companies (just view their profiles).

If you want to chill for 3 weeks and not write any code for your project, go ahead and do so. Any company or coder that depends on you and your code to earn his inflated-SV-salary job (or make millions for their SaaS) will have to deal with his/her boss (or investors) when he/she can't function without depending on you.

The only time a "social obligation" is placed on you is when all these asshole companies rank you by "how much you contribute to Open Source" but if you had to ask many of them how much money they contribute as a percentage of benefits they derive from Open Source, it will probably be in the single-digits.

The guys who wrote tools like "ls", "cd", "ping", "ssh", etc. are not sitting on Github answering questions to the millions of coders who use their tools everyday. StackOverflow is where those questions get answered by another "exploited" class of coders.

</comment><comment><USER3> It's on us, as individual developers and individual participants in the software industry, to come up with economic models for open source that 1) provide high value, and 2) allow us to capture that value. Companies have a different role in a capitalist system, and though we can have a mutually beneficial relationship, their interests are not perfectly aligned with ours and never will be.

</comment><comment><USER4> A lot of people have been looking to attack this problem from a legal (via licensing) or economic point of view, but really, I don't see either of these being nearly as effective as a cultural approach.

There are few other industries that consider 80h+ work weeks as a badge of honour, and in ownership of our ongoing work.

Instead, we should continue to encourage:

1) Better management of work/life balance

2) Better delegation of tasks and project ownership - as a side effect, this reduces the bus factor and also likely increases the quality of a project as more ideas are mixed in

3) Make it more acceptable to simply walk away from projects. While some might see this as "selfish", if you want someone to work on it full time, you can always offer to hire them, or pick up the work yourself.

</comment><comment><USER5> While I'm pleased about many open source projects, SaaS and the rise of big data seem to have shifted it from primarily benefitting the user to benefitting corporate interests significantly more often.

I still believe that open source is worthwhile, but the culture seems very different.

</comment><comment><USER6> I just read the article. Burnout sucks, but, maybe I'm missing the point of open source.

To me, it's not about 'creating value'; rather, developing open-source software is part of an ideology that believes humanity's knowledge should be available for examination; that all the moving parts are laid bare to see. Open source is more about 'showing' how it's done -- the proof is in the code -- than, y'know, doing it in the first place, which is a rather nice side- effect.

And therefore, I don't subscribe to the notion that if companies take open- source software and don't contribute back, they're exploiting the developer(s). It'd be nice of them if they donated, but by not doing so, they're not being evil. They are instead building on a common bank of shared knowledge, some of which is executable code, just like every single one of us can.

</comment><comment><USER7> Original oss licences were developed in a world where software was distributed and the licenses were developed based on that model. Business models shifting largely to XaaS wasn't accounted for in the original license mindset and this is being taken advantage of the fullest extent my commercial entities (as they would be smart to do). The differences between the original oss philosophy and the realities of software in the current world seems to be causing some stress on the system as envisioned by oss advocates. Will be interesting to see how this develops.

</comment><comment><USER8> Funny. When I stopped coding it came to me we may have been a tad mistreated: [http://beauty-of-imagination.blogspot.fr/2016/07/moving- out-...](http://beauty-of-imagination.blogspot.fr/2016/07/moving-out-from- coding-part-i-why.html)

</comment><comment><USER9> Food for thought: Can we create a license which allows source distribution and collaboration openly and is free to use for individuals and non-profits but companies have to pay if they use it for commercial purpose.

It could solve companies vs open source developers situation and give developers financial support. If current open source developers had means to support themselves without full time job, I think that would solve the problem of burnout and depression.

I mean just complaining that companies are taking full advantage without giving back is not working. So time to think outside box?

<comment><USER10> > Can we create a license which allows source distribution and collaboration > openly and is free to use for individuals and non-profits but companies have > to pay if they use it for commercial purpose.

These kinds of licenses have existed for a long time. They're not open source, though.

<comment><USER9> Could you post some references I could read? I am quite interested why they didn't work.

As far as I see, popular licenses are: 1\. Commercial source 2\. Open source - copy left eg. GPL 3\. Open source - liberal, do whatever you like eg. MIT

which are just handful, when software is eating the world ;)

<comment><USER10> QT famously had a dual, "non-commercial" and "commercial" licenses, before they switched to LGPL.

From wikipedia / web archive: [https://web.archive.org/web/20031005175911/http://www.trollt...](https://web.archive.org/web/20031005175911/http://www.trolltech.com/developer/faqs/noncomm.html)

</comment></comment></comment></comment><comment><USER11> Just use AGPL and dont bother

</comment><comment><AUTHOR> Writing open source is voluntary, but when companies take so much without giving anything in return, it should be called exploitation.

I just don't want to keep reading this stories of open source developers burning out.

<comment><USER12> I'm baffled by this attitude.

A developer _chooses_ to develop something and give it away for free. Why they do that is up to them... perhaps it's ideology? A sense of charity? Community?

Whatever it is, though, they're choosing to release that work to the world. And barring a non-commercial use clause, they're opening up that work for use in for-profit settings.

That's a choice. By definition it cannot be exploitative as there's no coercion involved.

If the developer doesn't like it, relicense the code to bar commercial use (gSOAP is the first example that comes to mind that does something like this), use the GPL to discourage commercial use, or don't release it. These are your choices.

<comment><AUTHOR> The definition of exploitation doesn't require coercion.

[https://www.google.com/search?q=define+exploitation](https://www.google.com/search?q=define+exploitation)

Exploitation: the action or fact of treating someone unfairly in order to benefit from their work.

It comes down to whether you think it's fair or not, which is a question of morality.

<comment><USER12> How are developers being treated "unfairly"?

The work is being released as open source. The developer has already chosen to give up the rights to any profit they might obtain from commercial use of the software. If that isn't desired there's any number of alternative licensing schemes that would require compensation for commercial use.

They aren't being forced to work on the software. They can contribute as much or as little to it as they like.

So what would make it fair, exactly?

</comment></comment></comment></comment><comment><USER13> To avoid being exploited and burning out, use the GPL for your projects.

<comment><USER14> How does using GPL avoid the issue? I'm just curious and trying to learn something new.

<comment><USER15> A commercial company writing software dependent on your GPL code is obliged to release their modifications/code under GPL. Not neccissisaraly so with other licences. So it's a way to force them to give back if they want to use your code.

<comment><USER10> This is a common misconception. They don't have to release them under GPL if they don't distribute the modified version. With SaaS, this is in practice true for any server side code that remains private to the company. Affero GPL addresses this but I haven't seen it much in the wild.

<comment><USER7> Also because of this many SaaS and IaaS companies do not permit the use of OSS where the license requires them to release their source.</comment></comment></comment></comment></comment>


If programming languages were weapons - <AUTHOR> http://bjorn.tipling.com/if-programming-languages-were-weapons <comment><USER2> Suggested alternative for Java, because making fun of NullPointerExceptions is too easy: "Java is a belt fed 240G automatic weapon that tries hard to avoid gun accidents: each round has to be individually authorized by ticking off a detailed questionnaire. By the time you get to actually shoot, someone may have already beaten you to death with a stick."

Scala would certainly have to build on that: "Scala is a variant of the 240G Java that tries to work around the problem by encoding pre-answered questionnaires directly into various types of ammunition. Unfortunately, the gun can detect lies and refuses operation when some of those answers do not match the actual situation."

</comment><comment><USER3> I would have liked to see HTML and CSS just because they aren't really programming languages, but are referred to as "coding."

HTML = construction paper, safety scissors, and glue, while you wear a dirty scuba mask. CSS = A gluestick, glitter, and pipe cleaners, while you wear mittens.

</comment><comment><USER4> Assembly is a piano wire, you're gonna get your hands dirty and nobody will hear about it.

</comment><comment><USER5> Not a proper weapon choice for Python.. Should have been a Swiss Knife..

<comment><USER6> Good at everything but not best at anything.

<comment><USER7> Python is the best at quite a few things these days, particularly if you need to accommodate projects (or developers) that require top-caliber tools for getting work done in several different problem areas.

The whole 2 vs. 3 is, if anything, an embarrassing interlude in getting to the fact that it's currently both amazing for beginners and one of the most versatile professional languages. Where it's not the best, it's often fighting "mainly good for this one problem area" tools and languages to a draw...while still being great for dozens of other problem areas.

Cracks about "really easy to use orbital death cannons being handed out to anyone who asks" aside - your best comparison is probably a trench knife. Simple, elegant, gets the job done whatever that job happens to be.

<comment><USER8> You need to build in some hyperbole. Python is a scripting language, and even amongst scripting languages, not a particularly fast one. So ...

Python, as a weapon, is like a government grant on which you have written "shoot a gun". You just tell it what to do and it somehow happens ...

using 500x the resources any sane human being would have used. If you examine what it did to launch a bullet found it built and operated an international airport including 5 passenger terminals and then used a very elaborate looking runway to fire the bullet. The amount of empty space between the buildings looks very impressive and significant.

<comment><USER7> The only reason Python should ever be problematically slow is if you're writing bad Python. (Well, almost ever.)

What you have to understand is that pythonic Python is largely a matter of invoking C libraries, and that Python only really runs at "interpreted" speed the first time you invoke the code.

It's no more slow than a shell script which serves to invoke grep and sed would be, because you're relying on the underlying optimized tools to execute the bits that would actually benefit from optimization. The microseconds it takes to switch from one to the other are almost never going to be a meaningful slice of the total execution time.

Instead of picking over the mostly insignificant delays that are left, Python has said "hey, let's optimize for readability & developer sanity instead — things that actually affect project outcomes." And then you go knock off 10 different issues you wouldn't have had time for, and you don't stab yourself in the eye with a fork while trying to make sense of the old code.

<comment><USER8> > What you have to understand is that pythonic Python is largely a matter of > invoking C libraries, and that Python only really runs at "interpreted" > speed the first time you invoke the code.

I do a bit of machine learning for work every now and then. I don't agree. Python is both really popular for machine learning and way too slow to let production stuff run in it.

<comment><USER7> I routinely do machine learning and computer vision, and have used a number of languages for them.

The main issue, irrespective of language, is that the implementation of your final model is often a distinct step from the last output of your experimental tools. If you just take what it gives you and try to deploy that, it will often provide extremely suboptimal performance.

The methods for implementing your final model could involve raw Python, NumPy, the Python wrapper for an external library, writing and consuming custom C libs...it depends on the complexity of the hyperplanes.

But e.g. scikit-learn already wraps libsvm and liblinear. If your SVM (etc.) is slow, it's very unlikely to be because you used Python.

If you're e.g. trying to do Facebook-level heavy lifting, your experiences may vary. But again, that would be a challenge for any tools. The solution is to use sampling, parallelism, etc. - and to implement and optimize your final model as a separate step from designing it.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Looks like an argument that C and Ruby are the only languages that you can use repeatedly without unintended consequences.

<comment><USER10> The M1 was known for "M1 thumb" [1] which typically involved catching your thumb between the bolt and the back of the chamber if you weren't especially cautious. I'm not sure if the author considered this, but it seemed a fitting choice for C. It works and works well, but it can bite you when you least expect it.

Although the source I've linked (below) claims it's impossible to encounter M1-thumb while loading, I have heard from reliable sources who've fired heavily abused Garands in ROTC (and hence saw all manner of abuse--besides WWII) that letting go of the bolt after forcing the clip into the firearm without removing your thumb will correctly strip the first round--and eat your thumb.

Edit: I do have to wonder if the experiences I was related some years ago was from the individual(s) in question loading a single round rather than the full clip.

[1] [http://www.garandgear.com/m1-thumb](http://www.garandgear.com/m1-thumb)

<comment><USER11> As a former M1 Garand owner (replaced it with a lighter weapon due to my RSI weakened arms), your link is to my knowledge correct. While I avoided the screw cases where the bolt was not properly locked back, I can attest to other examples, most especially loading a clip finishing with loading the top round. The cartridge is indeed where your thumb otherwise would be, your thumb is essentially pushed out the way, I'm pretty sure it's very hard to get hurt doing this. Or look at it this way, it would have been _very_ sub-par to have a real problem there when soldiers were loading clips while their minds were preoccupied with combat, and back then in the '30s the Army really really cared about the quality of our small arms.

The #1 screw case I knew about pertained to closing the bolt without loading the rifle, there is danger since it requires reaching past the bolt down to the follower that is locking it back. The trick is to hold your right hand in a rigid way so that while your thumb is depressing the follower, the bottom of your hand is holding the operating rod handle, keeping the bolt from flying forward. Depress the follower, then lift your entire hand as a unit up and out. Works like a charm.

Overall I rate the Garand as having better ergonomics than our following two service rifles, the M14 and M16/M4, it's for example very smooth in profile, very little to get caught while you're carrying it (that insight from someone who used it in Korea). If I had one today, and only that rifle, I would not consider myself to be under-equipped.

Hmmm, one other screw case it has in common with all weapons with the common pattern of an operating handle that is linked to the bolt, i.e. reciprocates with it, is that if you have a hang-fire---you press the trigger and the weapon goes click, but unlike the Java example ^_^ there is a round in the chamber---you'd best pull the handle back with your smaller fingers, palm upwards and under the bolt. Because if the round fires while you're doing this, if your palm is reversed and you're using your forefinger and on without taking precautions, the handle will smash into your thumb or the web of you hand between it and your palm. That'll do some serious damage....

C is not quite as good as the Garand is, although I'm not sure what I'd use as an alternative.

</comment></comment></comment><comment><USER12> _PHP is a hose_ No, PHP is a double-clawed hammer [0] :P

[0] [http://blog.codinghorror.com/the-php- singularity/](http://blog.codinghorror.com/the-php-singularity/)

</comment><comment><USER13> C is more like a smithy, very good for making weapons; but not so good as a weapon itself.

JavaScript is more like a kitchen knife, everyone has to use one even if is far from the best.

<comment><USER14> C is a sniper rifle. But there are two barrels, one of which fires backward, and the triggers are right next to each other.

</comment></comment><comment><USER15> FORTRAN is a cannon if you know what you're doing you could take on the world, but no one knows how to operate the darn thing (anymore).

</comment><comment> vezzy-fnord _Perl is a molotov cocktail, it was probably useful once, but few people use it now._

If anything, Molotov cocktails are some of the easiest weapons to improvise and are used quite often, particularly by underpowered guerrilla warriors. So if we're to take it literally, this would imply that Perl is a limited efficacy hack that a lot of people use.

</comment><comment><USER16> As a past PHP developer, I don't think of PHP _that_ badly.

<comment><USER17> As a current PHP developer, I do. :-)

<comment><USER18> If you use it for new stuff with up to date frameworks (e.g. symfony) it's not that bad, really. Since 5.4 it's getting a lot better. If you're stuck with some old version and legacy codebase it's a problem unrelated to the language itself.

</comment></comment></comment><comment><USER19> APL is a maze of twisty little passages, all different.

<comment><USER20> APL is a missile array mounted on a ship. Only problem is you are landborne. And out of ammo.

</comment></comment><comment><USER21> Brainfuck is a backwards gun. [https://www.google.com/images?q=backwards+gun](https://www.google.com/images?q=backwards+gun)

C++, nunchucks? Ha, fair enough. But I'll continue to think of Go as my legion of tiny gophers under command, scurrying into battle or working relentlessly like Doozers.

</comment><comment><USER22> R is an alien ray gun, full of crazy features but all the buttons are in a bizarre language and require 10 fingers

</comment><comment><USER23> I object to nunchuks for C++.

It would be more accurate to say, "C++ is a set of nunchuks, powerful and impressive when wielded but takes many years of pain to master and often you probably wish you were using something else, because of the frequent accidental firing of the hidden pistols in the grips."

</comment><comment><USER24> In the same vein, here's how a Common Lisp programmer view other programmers: [http://kvardek-du.kerno.org/2010/01/how-common-lisp- programm...](http://kvardek-du.kerno.org/2010/01/how-common-lisp-programmer- views-users.html)

</comment><comment><USER25> Haskell: Predator self-defense tool ;)

</comment><comment><USER26> "Perl is a molotov cocktail, it was probably useful once, but few people use it now."

Yikes! I've worked for big tech companies you've heard of and Perl is all over the place and used in real production projects. We also regularly choose it for new projects.

<comment><USER27> > We also regularly choose it for new projects.

Ok I know this one will be tough to keep rational, but this is an honest question - we've got Python and (especially) Ruby now, whats the Perl USP in your case?

<comment><USER28> Choosing a language for a project rarely comes down to researching the languages that may best deal with the problem. More often than not from my experience, it's what the first engineer(s) on the project thought would be fun (annoyingly often in the case of using new languages in production), were most-familiar in, or the company is most familiar with, or because some library they need to use is only available in X language and it would take too long to do the project and implement the library in their "normal" language.

Perl, Python, and Ruby are all pretty competent and on the same level. Given that Perl is chosen as a language the question isn't "Justify the use of Perl to the exclusion of Python and Ruby." It's "What can Python or Ruby do that Perl can't?"

Some common arguments between Python and Perl can be found at [http://coosoft.wordpress.com/2013/02/24/the-perl-vs- python-d...](http://coosoft.wordpress.com/2013/02/24/the-perl-vs-python- debate/) (I would add the author should have expanded on Object Oriented in Perl more. While native OO in Perl is exceptionally basic, third party OO frameworks for the language exist such as Moose and Moo complete with introspection, roles, type constraint, triggers, attributes, etc, etc).

Perl is a powerful modern language, actively developed by a committed community[1]. We're just generally too busy doing things to blog about all the awesome stuff as much, so people's perceptions of the language are often stuck in 1998.

[1] [https://www.youtube.com/watch?feature=player_detailpage&v=hH...](https://www.youtube.com/watch?feature=player_detailpage&v=hHy5h6ZRL6M#t=155)

<comment><USER26> Yes, you nailed it.

</comment></comment></comment></comment><comment><USER29> Assembly is a big block of iron.

<comment><USER30> Why, Assembly is a Meccano set, with various screws and perforated planks, and no high-level parts.

Smaller Lisps, like Scheme, would be a barrel of generic Lego blocks.

</comment></comment><comment><USER31> I wonder what would lua be...

<comment><USER32> A bayonet for the M1 Garand standard issue rifle?

<comment><USER33> I'd make the bayonet C. It's good for all the situations in which the gun isn't.

</comment></comment></comment><comment><USER34> In light of all the recent talk of undefined behavior optimizations in C compilers, is that really a fair representation?

Maybe every once in a while, when you load it just so, the trigger vanishes.

<comment><USER35> Maybe it's a matchlock or a blunderbuss, then? It was here first, it's still a brutally effective way to get the job done, but it takes longer to make each shot than with a more modern weapon, and sometimes it will kill you.

</comment></comment><comment><USER36> MATLAB is a trebuchet.

<comment><USER37> A gold-plated one.

</comment></comment><comment><USER38> Swift is a lightsaber.

<comment><USER39> Too bad you need to join the dark side to use it.

<comment><USER40> Haha, thanks, that made me laugh.

</comment></comment></comment><comment><USER41> The good part of Javascript is far too big. You should turn the sword around. Just stab your opponents with the hilt...

</comment><comment><USER42> I've heard erlang equated to a tank before. Mean and ugly. (Though I don't find her ugly any longer)

<comment><USER43> Go's codename was Errlang, two 'r's.

</comment></comment><comment><USER44> I want a GIF of the Death Star blowing up Alderaan, under the entry for Common Lisp.

<comment><USER45> More like a Tnuctipun Soft Weapon.

</comment></comment><comment><USER8> C is like a frag grenade, dipped in glue. It is strangely enticing to use it. It was more popular in the past but for some reason most of those guys aren't around anymore.

C++ is like a nuclear weapon, that automatically disables any means you have of getting clear of the blast radius when you activate it.

Perl is like a leaky vat of nitroglycerin. It can be used as a weapon, but one wrong character and it kills you, most of your family, and half the neighborhood.

Java is a 500000 pound KalashnikovFactoryDesignerFactoryProducerSingleton "weapon". I hear there's actually a way to fire it, using 50000 programmers, however as 90% of those programmers commit suicide on any given friday nobody has ever seen it successfully fired. It helped quite a few large company's IT departments grow to impressive sizes. You know, on thursdays.

Scala is a way to fire the KalashnikovFactoryDesignerFactoryProducerSingleton with only 500 programmers, provided they have a deep working knowledge of ancient Egyptian algebra.

Javascript is like a machine gun with two barrels pointed into two different directions. You can aim it at someone, but when you fire it, both the target and some poor bystander you liked will go down.

Go is like C, except the glue on the grenade has been replaced by handcuffs, there's a million grenades chained to you and you're required to cite the error checking oath which goes "if I check my errors I will not die". What happens next can only be described as "humor".

Bash is a row of unlabelled black buttons, which in order mean "coffee", "milk", "sugar", "lemonade", "global thermonuclear war", "diet lemonade" and "tea". I am not sure about that order. Neither is anyone else. Great lemonade though, you should try it.

Python is the government's version of a normal pistol. If you aim it at the person in front of you it will proceed to start an Apollo program, design a moon rocket, put a bullet in an orbit that will take it around the moon and then into it's target, which of course has long since killed you, taken your wallet, and left the scene.

There, I'm out.</comment>


Netflix's fast-forward viewing feature - <AUTHOR> https://www.nme.com/blogs/the-movies-blog/netflix-fast-forward-viewing-opinion-2562569 <comment><AUTHOR> So this article is pretty fluff & goes off about quality vs quantity etc. But I'm curious what other's experience with fast forward is

One thing I noticed,

> For those with sensory processing disorders or other disabilities, or even > for those who don't have English as a first language, being able to slow the > speed at which they watch something might actually improve their access to > films and television.

But I think being able to speed up is also a potential aid to some

I've personally always had trouble actually focusing on speakers. I was diagnosed with ADD like everyone born in the 90s, & in class I found I either had to clock out & not pay attention, otherwise I'd start interrupting. Whereas in fast forward I find my full attention is occupied enough that I'm able to hit a very input-only mode which is desirable when consuming information outside of discussion

That said, after years of watching everything with at least 1.5x, I'm starting to experience some minor issues such as falling asleep in Teams meetings (& then watching the recording at 1.5x when I wake up)

Some parallels with Philip K Dick's _Martian Time-Slip_</comment>


Ask HN: Correlating bad startup names with failure? - <AUTHOR>

Whenever I see startups pick a bad name, I think "If they can't even get the brand right, forget about product!" Especially names that try to be clever or fail a basic phone test. For example, "Toodu" is a local startup that closed recently and it's a spelling nightmare. Anecdotal cases aside, is my correlation spurious? Has anyone correlated the clarity of a name with likelihood of failure? What are some good counter-examples of startups that worked despite a bad name? (Reddit is one) <comment><USER2> I'm a naming expert and I've actually written a book on 'how to name your startup'. Currently working on a Kindle version.

As a part of the book, I interviewed Sahil Laviniga, the founder of Gumroad. He invests a little on the side, and he told me that a bad name is a bad sign. From the transcript:

 _I think a name is actually quite representative of the long-term commitments of the founders / founding team. A name that sounds ridiculous or uses an uncommon TLD may seem throwaway and imply a lack of product sense. Founders should be picking a name with a long-term potential._

Fred Wilson also wrote about domain names at [http://avc.com/2011/04/finding- and-buying-a-domain-name/](http://avc.com/2011/04/finding-and-buying-a-domain- name/)

 _I believe that a good domain name is an important success factor in building and launching consumer web services. It 's not in my top ten but it could be. It's certainly something we think about a lot when making investments and working with companies post investment._

So for at least two investors, the name definitely matters.

If you're looking for specific examples, look into Wesabe (lost to Mint) an Fukime (no longer exists). In general, a good name won't make you successful, but a bad name _will_ hold you back.

More reading on Mint vs. Wesabe: [http://kcovia.com/why-mint-beat- wesabe/](http://kcovia.com/why-mint-beat-wesabe/)

</comment><comment><USER3> I judge startup names too (agree "Toodu" is bad) but there is at least anecdotal evidence that bad names do not guarantee failure. My favorite example of the moment would be Whatsapp. I didn't check it out for years simply because I thought the name was trite and indicative of being a throw- away quality app effort. I suspect if one could do a real correlation study, it would back up the bad-name-to-failure theory.

</comment><comment><USER4> Toodu and Reddit aren't bad name. They are simple bi-syllabic words that are completely original. If you want your company to list easily in Google, this is how you do it. I suggest you think a bit more deeply about names before calling them out.

Plus it's fairly obvious that name is a small factor in success. A simple, original name (Google!) is simply best practice.

<comment><AUTHOR> Thanks for the input, @Metatron. Sure, there are all kinds of factors that determine whether a name is good. And uniqueness helps with Google ranking. But I suspect that a simple, original, unspellable, unsayable name can adversely affect your chances of success. And that's why I'm asking whether there is a statistical basis for my assumption.

I would agree that Google is a good name. Certainly slightly better name than "googol", because it's easier to spell. And you would agree that "SearchEnginez.com" would have been a terrible name for Google, no? My question is specifically concerned with whether there is good evidence that if they had chosen a much worse name, they might not be _as_ successful today, or perhaps irrelevant.

</comment></comment><comment><USER5> I suspect there's very little correlation between the "quality" of startup names (how do you even quantify this?) and the startup's success.

I mean, fool.com is pretty huge.

<comment><AUTHOR> Fool.com is a great name! Easy to spell, easy to say, relevant to its content. And a short .com!

So those would be some of my criteria.

</comment></comment><comment><USER6> You should turn this into a start up idea. I think it will work. I think you should call it......

StartupNameGenerator</comment>


9 Differences Between Men and Women Learning to Code - <AUTHOR> http://women2.com/2016/01/12/men-and-women-learning-to-code/ <comment><USER2> "As all answers were self-submitted, they are, from a technical standpoint, unverifiable."

let alone the fact that the analysis could be coming from a position of bias, but it's an interesting start. I'd want to see the results of research into learning trends between primary genders in different cultures to see if any of the trends level out depending on upbringing.</comment>


GoDaddy Purchased the Domain Name Market Today - <AUTHOR> http://kevinohashi.com/20/09/2013/godaddy-purchased-domain-name-market-today

<comment><USER2> _GoDaddy is now the biggest player in the domain name sales channels both for new registrations and selling in the secondary market. With the upcoming release of new gTLDs, they couldn 't be better positioned to sell more domain names and make more money._

The author's conclusion here is kind of obvious, but wow is he wrong in his sentiment that this is going to somehow be good for consumers. Because GoDaddy is private, its strategy to dominate by size and market share alone is kinda evil. How this company has managed to stay private for so long while getting so big and controlling so much bandwidth -- now this would be an interesting case study.

 _A lot of domainers don 't use GoDaddy and don't want to put their domain names there. Acquiring Afternic solves the technical and business problems that may have blocked GoDaddy in previous attempts to gain more of the secondary market._

Hmm. So GoDaddy is trying to hide from itself?

<comment><USER3> Does GoDaddy control that much bandwidth compared to some hosts like Hurriance Electric/OVH/Hetzner/etc?

Also GoDaddy was recently (past 5 years I think) bought by a private equity firm, so the owner cashed out via that rather than an IPO.

<comment><AUTHOR> Bob Parsons is still the largest single share holder I believe. KKR, Silver Lake bought in for 2.25B.

Not sure on actual infrastructure size vs other companies since they are focused on small business market rather than being an infrastructure provider.

<comment><USER4> Based on a five year time line from KKR/Silver Lake, I would expect an IPO within 2-3 years. This recent change in leadership, direction, and acquisitions is evidence of the push toward IPO.

<comment><AUTHOR> Maybe this time around it will actually happen. They tried to IPO in 2006 as well. I am guessing at this size there aren't many potential buyers considering their revenue was 1.3B last year. I think their growth might have slowed down a bit, not sure how/if that would affect a potential IPO.

I've got some gaps in years I could find data for:

2003 39M

2004 73M

2005 140M

2006

2007

2008 500M

2009 750M

2010

2011 1.14B

2012 1.3B

<comment><USER4> Growth has been around 15% this year, but it's expected to get up to 20% as various new marketing and internationalization strategies take place.

</comment></comment></comment></comment></comment></comment><comment> rkuykendall-com Can someone explain how this affect my searching for, purchasing, managing, and renewing domains on NameCheap?

I just didn't see it in the article, so I'm having trouble placing it in context.

<comment><AUTHOR> It doesn't. But NameCheap is a drop in the bucket from an industry perspective. Take a look [http://www.webhosting.info/registrars/top- registrars/global/](http://www.webhosting.info/registrars/top- registrars/global/)

They have 32% of the market. WildWest is also GoDaddy (another 3% market). So They have 35% of the market. The next biggest (Enom) has 8% and really that's a split between them and NameCheap (NC had 3M in 2012).

GoDaddy is much bigger than anyone else on the consumer side. A lot of those competitors are focused on domain holders/resellers (Tucows, Enom, ResellerClub, Moniker).

Now they are going after the other side of the domain business. And they just secured the missing channel which comes with technology and distribution.

It won't affect consumers that much (my prediction), but it just positioned GoDaddy to dominate all the key aspects of the domain market.

<comment><USER5> I'm pretty sure that site's numbers are wrong. Try digging into the details on any registrar - the "gain/loss report" for GoDaddy, for example, says that they're registering and transferring in exactly -2560 domains every single week. (This is separate from the transfers out and deletions, so it should NEVER be negative.) Other registrars have similarly "quirky" numbers.

<comment><USER6> Can you potentially point me to a reliable source for this type of number (or tell me how to calculate it myself, assuming I can get the zone file from Verisign)?

I had similar issues with the data, and I tried emailing these guys to find out more about their methodology. Didn't get a response.

Are they crawling DNS for every domain that has changed info (or is new, or drops) from the prior zone file? How would one recreate this data, hypothetically?

EDIT: I'm aware of the ICANN delayed data (as the site below uses), but I am hoping for a more up-to-date source.

</comment></comment></comment></comment><comment><USER4> News travels fast. We just got the email from the CEO today about the acquisition. However, I don't work in the domains group, so I don't have much additional information to share.

</comment><comment><USER7> FWIW godaddy management is being run by ex-Microsoft people. CEO Irving was a VP at MS number of years ago.

</comment><comment><USER8> Assuming facts not in evidence, etc., I don't see any indication that Afternic is "the domain market." Looking at the author's Tweets, on the other hand, illustrates their depth of knowledge quite effectively.

<comment><AUTHOR> I am not making the argument that afternic is the entire domain market. I do believe it was/is the missing piece for GoDaddy owning both the consumer and secondary marketplaces and it will allow them to be the only company to put them together. Afternic's DLS system and the agreements with pretty much all the relevant registrars just made them a one stop shop for everyone on both sides of the domain market. With other parts of the business contracting and becoming irrelevant. They just pretty much sealed all the gaps I can imagine for the next few years. It also places them quite well for new gTLD introduction which should see a flurry of speculation and buying.

<comment><USER8> _I am not making the argument that afternic is the entire domain market._

Your title is.

<comment><AUTHOR> We'll have to agree to disagree on how it was meant then. They bought the DLS system which turned them into the dominant player on both sides of the market today by a large margin. They own the market now.

<comment><USER8> I'm not talking about how it was meant, I'm talking about the actual words. As a reader, "the Domain Name Market" is a singular term that refers to the entire sector of business and economy concerned with domain names. Amazon is the "dominant player" in online retail, but they do not own it, and someone who somehow acquired Amazon could never be said to have bought the online retail market unless you were writing clickbait.</comment></comment></comment></comment></comment>


Life after the personal computer - <AUTHOR> http://www.cringely.com/2012/06/30/life-personal-computer/

<comment><USER2> The following quote burns me everytime I see it or it's ilk on blogs:

"What matters is the data and keeping it safe, but the cloud is already handling that chore for many of us, making the hardware more or less disposable."

No the cloud is not handling that chore for most or many people. What it's handling is the data we always wanted to have, but are willing to lose. IOW, that snapshot that I probably wouldn't have taken the time to DL from my phone, but am more than willing to post with Instagram.

When the cloud allows me to store my 4TB of photos and videos and other creative work for a price that is competitive with a HD, and at an upload and download speed where I can use the data where it is (rather than spend a week uploading and pre-downloading a large file), THEN I will agree the cloud is at a point where I could use it instead of a PC with storage.

<comment><USER3> In many parts of the world (probably not the US due to the broken cable monopoly system) home broadband speeds are increasing at a decent enough rate. I've now got 38 Mbit down and 8 Mbit up, which is fast enough to sync any new photos we take. We use JungleDisk and only pay ~ $14.00 per month for storing a lot of treasured family photos.

If I used a portable disk drive I'd have to make sure it's always offsite.

<comment><USER4> I'm so jealous.

I pay $50 a month for the privilege of and 8mb down/ .5mb up connection.

<comment><USER5> I have satellite internet. Not only do I have to worry about the weather, but also 900 ms ping times, mediocre speeds, and a daily bandwidth cap.

It's painful for me, as I came from having 35 down and 1 up not long ago. However, it has opened my eyes to the fact that many people in the US (especially in rural areas) do not have access to decent internet.

</comment></comment></comment></comment><comment><USER6> "Radio was invented with the original idea that it would replace telephones and give us wireless communication. That implies two-way communication, yet how many of us own radio transmitters?"

Um... all of us? It has been at least five years since I last made a phone call with a landline phone. An invention over a hundred years old at the time that quote was written is now serving us in a way Cringley apparently couldn't envision twenty years ago. I think it's quite reasonable to expect the personal computer still has a trick or two up its sleeve.

If the smart phone is going to replace the PC it will have to offer much of what the PC does now - to the point where the distinction becomes irrelevant. In fact I believe the distinction is already irrelevant and in fact downright stupid. It only serves those who for whatever reason want to limit what those pocket sized computers we all have can do.

A smart phone can replace the traditional PC - but only when it starts to offer the functionality a PC has now. By which time it will seem funny to call it a phone.

<comment><USER7> This was written in 1991 though quite funny to read today for that reason.

</comment></comment><comment><USER8> I saw something recently, a skeleton laptop that would act as a terminal for your android phone. My money is on the mobile phone being a mobile personal cpu/storage that can be tethered to skeleton interfaces like tablets and laptops.

But the PC as we know it will be kept around for a long long time by gamers alone.

<comment><USER9> I think the desktop market is here to stay maybe not for consumers (who are aggressively changing from desktop to laptops/tablets and mobile only) but certainly in the business and specialized markets.

Gaming will stay on desktops for some time, until at least it's effective from a pricing point to go mobile.

Here in the UK at least I can't remember the last office I went into where desktops weren't dominant.

<comment><USER10> Mobile gaming is already huge. They are mostly casual games, certainly, but they are selling quite well.

Also, I have been to a steadily increasing number of offices in recent years where everyone had laptops (typically Dell, I think) with docking stations and monitors. This is usually to make it easier for presentations, attending conferences/training days and working from home.

<comment><USER11> I have yet to find someone who thought themselves a gamer before mobile gaming became a thing, who actually likes more than a couple of mobile games.

They are mostly utter garbage, more in the Zynga 'social' angle than anything else. The majority of what's left have incredibly simple gameplay mechanics, because the control schemes open to you just don't allow any more complexity. apart from the gyroscope, which I'm not convinced anyone will ever use well, all your input methods involve you obscuring the screen with your fingers!? And can never provide feedback to the user!? Madness.

Mobile gaming is huge, and it makes money, but mobile gaming is a bit like 'social' gaming: it is not actually 'gaming', as gaming is on other platforms. These things exist side by side, one does not replace the other.

<comment><USER10> True enough, but there are also the mobile ports of older games -- notably the touch-friendly ones like monkey island, but more serious 'gamer' games are also coming, such as the Baldur's Gate rerelease. There are variations on C&C and Starcraft (official for the former, less so the latter). There are board games like monopoly and card games like poker and even magic the gathering.

On the social gaming side, I agree that very little of what you do in things like FarmVille actually seems like gaming, but then that was also my experience with much of World of Warcraft…

I think you just have to give it time -- gaming on mobile devices will probably grow up with the users, who seem to be predominately younger folk and teenagers from what I've seen (referring to mobile gamers here, not smartphone users in general).

Also, I have high hopes for the low initial cost and easy in-app purchases finally leading to some decent story-driven episodic games.

<comment><USER11> I agree, there is certainly potential there. However, much in the same way playing street fighter is crap on a keyboard compared to a joystick/pad and any FPS is crap on a controller compared to a mouse + keyboard, a huge portion of game types just aren't suited to the 'slate of immovable glass' form factor.

Imo, mobile gaming is good at: \- The tiny subset of games where the controls are naturally dragging your finger over glass (Fruit Ninja, those airplane landing games, not much else) \- Turn-based games where the primary form of interaction is suited to a one-click mouse / finger. Turn-based because there is not enough feedback for accuracy in real-time games, and because it means you pick them up and put them down really easily (as long as state is remembered) which suits on the go play.

So stuff like Civilisation, turn-based 4x games, final fantasy style RPGs and XCOM style games are all good deep game genres that will hopefully make a competent jump to mobile.

I see that Frozen Synapse (XCOM style-ish) is coming to iOS, which is particularly awesome (more awesome if it was on tablet android, but that's just my selfishness talking)

<comment><USER10> I actually prefer controllers for FPSs now, but mostly because I rarely game on PC anymore.

In addition to those you list, I would say that anything largely mouse controlled on PC should work reasonably well on mobile devices -- RTS games, Diablo-type games (looking forward to infinity blade dungeons) and sim games (theme hospital, etc.).

In fact, the only games I'm really missing on iOS are the FPS games. And it really is just the attempt to have virtual dual-stick controls that I dislike -- the games are there (mass effect infiltrator, dead space, etc.). If someone could just produce a decent Bluetooth controller and get developers to support it, I'd say that iOS could be the most well rounded gaming system out there -- capable of both console-style gameplay as well as game types that are weak on consoles (RTSs and the others listed above).

I'm also excited about onlive, which I already use with the TV-connected box. I think they were also working on a universal controller…

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> This is an oversimplification -- many (if not most) PCs are superfluous, but this is because they belong to people who do not need a computer at all.

Even with them all replaced with tablets or whatever, PCs will still live long and prosper in their original niches.

</comment><comment><USER13> Add me to the "nah, I'm not convinced" crowd.

Gaming and visual apps in general still require vast amounts of horsepower, far more than most mobile computers can provide. Hell, I'm on something very close to a top-of-the-line PC for 3D purposes, and Skyrim can still get my computer to chug.

And if you want to discount gaming, forget Skyrim - Photoshop and After Effects will happily chew through as much RAM, processor power and GPU as you can throw at them.

Also, I really don't see a problem with the form-factor. Big, colour-balanced, carefully-placed screen, ergonomic chair, easily-accessible printer, second monitor, decent sound system and high-quality condenser mic, sit-stand desk - I'll take that over hunching in a coffee shop staring at a tiny screen with sciatica-inducing posture and uncomfortable earbuds any day. Sure, I can move around with a mobile device, but how often do I really want to?

Mobile devices have their uses, and iPads and similar are clearly awesome for some use cases, but as a universal replacement? I think not.

<comment><USER14> You're thinking linearly. Remember, at least right now technology is growing exponentially. In 5 years your cell phone could potentially have as much power as your laptop today. Though i'd guess it will be more. It'll have all the power it needs. Combine it with glasses, or some other yet unknown form factor, we might be stumbling on something really unique. There's a lot of value in only having 1 computer device. We're only 1 or 2 innovations away from real pervasive computing.

<comment><USER11> I don't think you should discount different form factors being useful in different situations.

Tablets are great for consuming content, and creating certain types of content, but as much as you _can_ write a novel on one, a real keyboard is _better_ for writing one.

(yes I know you can buy a keyboard dock, but that sort of misses the point, doesn't it?)

And as much as I _can_ play games on a tablet, unless it's a very specific niche where the gameplay revolves around your input method being a static slate of glass (e.g. Fruit Ninja, arguably Angry Birds) having actual buttons for input is _better_ for gaming.

So I can totally see 'normal' people just owning one device that does everything OK-ish (but at least it does everything) and I think for all 'new' normal people that's basically happening, but I really don't think you're going to see other form factors go away. Authors still want to type quickly, gamers still want actual controls where they can exercise muscle memory, and I hackers still want to be able to tinker with their devices and build cool new shit.

</comment></comment></comment><comment><USER15> I like what Steve Jobs said about Cars/Trucks in this instance. However I can't help but feel most of the "mobile" devices we have seen thus far have been closer to motorcycles (this analogy works especially well if dumbphones are pedal bikes).

The closest I have seen to a "desktop killer" is the MS surface devices, but I have a feeling that people will still refer to these as "PCs".

<comment><USER16> Lets say scooter, not pedal bike because bicycles are awesome!

</comment></comment><comment><USER17> "Though I had no inkling of it back in 1992, what's rapidly replacing the PC in our culture is the smart phone."

The desktop as a form factor will never go away. I know for me personally the day I need to turn in my machine (including keyboard/mouse/large monitors) for a smart phone or tablet is the day you can go ahead and just shoot me to put me out of my misery.

<comment><USER18> Aw, don't say "never"; you're pretty much guaranteed to be proven wrong.

Monitors and mice might be replaced with a device which tracks your head and eye movements and paints an image on your retinas with a laser. Keyboards could be replaced by pre-speech recognition, measuring the impulses sent to your jaw and mouth muscles, probably in the form of a headset.

Your "desktop" computing needs are filled by a headset which occupies your entire field of view with its environment, and your "mobile" computing needs are filled by the same headset, but it only occupies the periphery of your field of view. When you sit at your desk and face forward, the environment goes full-screen, and when you look away or go away from your desk, the environment retreats to your peripheral vision.

<comment><USER19> When I was suffering from carpel tunnel syndrome I tried many alternate mice including on me hands- free mouse that tracked your head movement.

At the end of one day of using that my neck and back were so sore I could barely stand to sit at my desk!

<comment><USER18> Yeah, head movement as a direct input won't work, for the reason you mention. Eyeball-tracking, however, can likely be made to work well.

</comment></comment></comment></comment><comment><USER20> In this case Cringely is largely correct. I would bet that many of us will be using Android or iPhone like devices docked when necessary with large monitors and keyboards as our primary computers in a few years. I use my MacBook Air now only for programming (consulting and side projects) and writing. Everything else is my iPad and Droid and I like it that way. Setting up a term with SSH on my iPad was initially a "I can do it and fun is good" kind of thing but now when I want to look at a remote server, I'll often use my iPad rather than suffering through the 15 second bootup time for my laptop.

<comment><USER21> I'd wager it's going the exact opposite direction.

With cloud services, documents/bookmarks/media/apps/settings/etc can all be effortlessly in sync all the time between all the different devices so the question is just one of form factor.

I don't want to give up any of my main form factors (phone, tablet, laptop computer, desktop computer) because there are times when each is significantly better than the other for the task at hand. But I don't want to be having to plug and unplug one into the other to make the whole thing work - I just want to grab/sit-down-at whichever is most appropriate for my context and get right to work (or "work").

It'd be different if a processor+RAM+GPU+enough-flash-storage-to-be-usable-in- a-mostly-cloud-environment weren't all shrinkable to a tiny chip that costs nearly nothing to make.

But since they are [1], why should we have to deal with the hassle of docking/undocking and not being able to use our tablet (as a tablet) while we use our computer? Or have to unplug our phone (and not be able to use our "computer") when a phone call comes in?

The one place I use such a solution is that all my (personal) computing happens on a tiny laptop that I occasionally plug into a larger monitor with wireless keyboard/trackpad. That works really well, but it's _still_ a bit of a hassle. If that monitor had the smarts in it to actually be a computer _and_ it was constantly up-to-date with all the data from my laptop, then I'd rather just have it be separate. Why not?

So I think we'll continue to have separate form factors and they'll all only increase in "smart"ness. Anything else is going to be a tough sell to customers and have marginal cost savings, at best.

[1] How much does it cost Apple to make the A5 chip in the Apple TV and the iPad 2 at this point? How much less would it cost them to make a chip that was _just_ for handling networking/display/user input/etc? Barely any less at all — in fact it'd probably be cheaper for them just to keep using A5s because they've already got full OSes to run on them.

<comment><USER7> Yep, an easy way to look at it:

* The SoC + display is the unit of computing.

* The CPU + GPU is the unit of compute.

And storage is an opaque object storage device, with backup in the cloud.

</comment></comment></comment><comment><USER22> I'm glad he mentioned Google glasses I think that's what smartphones and tablets will evolve into.

Who knows maybe we'll see blank white walls solely for staring at as a polite area to stare at instead of someone's ass.

</comment><comment><USER23> What's wrong with wired docking stations?

</comment><comment><USER24> Microsoft's monopoly on computing lasted for at least 17 years, if you count from Windows 95. I think it's time for a change of leadership in the market. That sounds more interesting to me than 30+ years of Microsoft monopoly.

<comment><USER25> Not sure I agree. The are the most compelling provider of IT at the moment, simply because they've started to listen to people.</comment></comment>


Facebook launches new Groups feature - <AUTHOR> http://www.facebook.com/groups/

<comment><USER2> From what I can tell, there are no privacy settings, and you can be added to a group without your permission. My friend just did a test where he created a group, added me, and it showed up in my feed to others without any confirmation from me adding myself to the group. To any readers here:

1\. Is it correct that this is the default setup?

2\. Is there any way to change these settings? I don't see any, but I may not be a power user of facebook's security settings.

3\. If the answers to 1 and 2 are yes and no, respectively, are people as appalled by this as I am? As an example, right now someone could make a group called "Americans for Anal Fingerings", add me to it, and now it shows up in my grandfather's feed. I have done a lot of work to keep from my grandfather that I like anal fingerings, and now all that work is all down the drain!

</comment><comment><USER3> I'm curious how the frid.ge folks feel about this one. Seems very close to what they are doing.

<comment><USER4> Our startup aimed at college students is basically shot in the head by this :). Yesterday we even talked about how we could pivot and every one of those options is dead in the water. It's back to the (nearly blank) drawing board.

<comment><USER5> what are you guys up to? I am doing something in this space but I think there are still tons of ways to create value.

<comment><USER4> Check out <http://thescholarapp.com>. Feel free to email me at firstname.lastname@example.com if you want to chat.</comment></comment></comment></comment>


New UK mobile operator donates 10% of your bill and 25% of profits to charity - <AUTHOR> http://news.techworld.com/mobile-wireless/3411845/uk-mobile-network-peoples-operator-donates-quarter-of-profits-charity/

<comment><USER2> This doesn't appear to be tax efficient.

They donate 10% of your bill _after VAT_ , so 8.3%. I'd actually be paying VAT on my donation. Meanwhile the charity can't claim back my income tax on the donation.

e.g. if my phone bill is £24/month, then £4 of that goes to the government as VAT, and TPO passes £2 of the remaining £20 to a charity of my choice.

Alternatively, if we don't tie the charity to the phone service, then I get charged £21.60/month for phone service (£18 + £3.60 VAT). And I can separately give £2/month to a charity, on which they can claim back 50p/month income tax (assuming 20% rate), so they actually get £2.50/month. (Unless they can claim back national insurance as well?) So I would pay less, the charity would get more, and the phone operator would do just as well... but would have to rely solely on the "25% of profits to charity" shtick in their marketing.</comment>


Unauthorized access to Docker Hub database - <AUTHOR> https://success.docker.com/article/docker-hub-user-notification <comment><USER2> I've found Docker's communication about this incident to be pretty poor.

1\. The email they sent out didn't specify whether your account was included in the 5% of compromised users, or whether you had linked GitHub or BitBucket accounts that they unlinked. The only way to know seems to be if you still have a linked GH/BB account then you're (probably?) ok.

2\. They mention you should "check security logs to see if any unexpected actions have taken place" and linked to GH/BB security audit log pages, but I don't believe that's sufficient, you also need to check for rogue commits.

3\. They haven't said when the breach occurred, so there's no way of knowing how far back to look. They "discovered" it on Thursday, and say it was a "brief period", but that's meaningless.

4\. They downplayed it as "brief", "non-financial user data", and "less than 5%" of users. I care more about the integrity of source code and builds than any financial information I might have given to Docker.

I can sometimes forgive companies for breaches like this, _if_ they own up to it and do an excellent job of communicating what happened, how, when, what the impact and mitigations are, both internally and for their customers. That was not the case here.

EDIT: they discovered the breach Thursday, but still haven't given a timeframe for when it may have first occurred.

<comment><USER2> Oh, and if anyone with write access to your repositories had _their GH /BB account_ linked to _their DockerHub account_ , your source code could be compromised.

AFAIK the only way to check is to ask every person who has write access and hope they tell the truth.

Honestly, _everyone_ should probably check their repos for recent activity / commits.

We need more fine-grained permissions for things like this. Principle of Least Authority, people.

Now is a good time to review authorized application [https://github.com/settings/installations](https://github.com/settings/installations) and if you're part of a GitHub organization I highly recommend setting up OAuth application restrictions [https://help.github.com/en/articles/about- oauth-app-access-r...](https://help.github.com/en/articles/about-oauth-app- access-restrictions)

<comment><USER3> Signed commits would be useful, right? I don't know much about GitHub permissions, but I've skimmed GitLab's. Why would Docker hub have write access to the repo? Is there really no read only access for repos?

<comment><USER2> I think it's possible, but I'm not sure what DockerHub does. GitHubs OAuth tokens can't be restricted to be read-only or to specific repos ([https://stackoverflow.com/questions/26372417/github- oauth2-t...](https://stackoverflow.com/questions/26372417/github-oauth2-token- how-to-restrict-access-to-read-a-single-private-repo)) but I think Deploy Keys can.

<comment><USER3> They have a lot of scopes compared to GitLab ([https://developer.github.com/apps/building-oauth- apps/unders...](https://developer.github.com/apps/building-oauth- apps/understanding-scopes-for-oauth-apps/)). I find it crazy that anyone would click authorize on a 3rd party app with the __repo __scope without having a way to (easily) identify unauthorized commits.

<comment><USER4> A lot of developers are in a hurry and interested mainly in getting their builds to work so they can move on to the thing they actually care about. They don't think about the potential consequences of the easiest thing they did to make it work.

This is how a sizable number of security incidents happen. The easiest thing to do is reckless, so people do it.

</comment></comment></comment></comment></comment></comment><comment><USER5> It would be helpful to include what specifically went wrong when there is a security incident at your company. Every failure should be a learning opportunity for others. Perhaps there should be some sort of safe harbor for disclosing security compromises as it benefits the greater community.

I can understand why you'd want to cover your ass in this type of situation. However, I think keeping these things secret leads to more harm over time as people brush off weaknesses in their own systems for lack of concrete examples of where it caused harm.

Was an employee careless with credentials? Was some service not updated? Was it a typical attack like a SQL injection that caused the leak? Having more real world info helps people model threats better.

<comment><USER6> I wouldn't take this disclosure as an indication that they _won 't_ do a public post-mortem. The latter takes time and you want to get it right and to be thorough, on the other hand you want the disclosure to come as soon as possible for users' security.

</comment></comment><comment><USER7> Have to bring this up again, but Docker specifically blocked manual automated builds before this happened from Docker Hub and required that you use their app to link your account. Therefore, it will be near impossible to trust them after this.

<comment><USER8> What is a "manual automated build"?

<comment><USER9> Docker hub used webhooks before to trigger builds from github. One-way and no compromise potential unlike the app which has write permissions.

</comment></comment></comment><comment><USER10> How does liability work in these cases? If you had a security breach due to this security incident, would it be Docker's liability or yours? It's probably in the terms and conditions, but I would think it's your liability since you can host your own registries and it's your responsibility to act on Docker's warnings (and I would think users expect and demand abundance of caution). But what happens if Docker mischecked and sent you a false negative on being compromised? And what happens if a full post-mortem is released detailing gaps in security best practices between what's Docker does and what you could do yourself?

This may well be a moot point; I think if you really wanted to be sure of what you were including in your code you would pull down tarballs and validate checksums for all dependencies before building on a secure network.

<comment><USER11> IANAL.

Typically Docker would only be held liable if misconduct can be proven. Incompetence is typically _not_ enough (which is why e.g. Equifax is not liable for the damages following their hack).

I do think these laws need to tighten up for security-related incidents, but right now, it is what it is.

<comment><USER12> Equifax has been found liable in court(s):

[warning: autoplaying sound]

[https://finance.yahoo.com/news/people-successfully-suing- equ...](https://finance.yahoo.com/news/people-successfully-suing-equifax- almost-10000-app-193607932.html)

<comment><USER13> From your link:

> ...the judge noted that Equifax had a duty to safeguard information, failed > to heed warnings from the Department of Homeland Security, and "willfully" > violated the Fair Credit Reporting Act and state regulations.

IMO, ignoring government warnings and violating regulations is _much_ different than failing to stand up to an attack.

I would be very resistant to making "being hacked" a crime - in almost all cases, the hackee is the victim of an attack. If you feel the need for legal action, we should increase our "anti-hacker" laws and enforcement.

We don't fine banks for being robbed. It's the robbers fault something bad happened, not the bank's.

EDIT: formatting

<comment><USER14> > We don't fine banks for being robbed. It's the robbers fault something bad > happened, not the bank's.

No, we don't fine banks for being robbed. However, if the bank had clearly insufficient security on their vault, was notified of this being a problem, and made zero efforts to fix the problem then yes they should be held liable.

<comment><USER13> Isn't that exactly what I stated in my comment?

</comment></comment></comment></comment></comment></comment><comment><USER15> 2 things that might be useful this week:

Implement PGP/GPG signed commits in your organization.

Learn how to create docker images from scratch. (my own very basic tutorial on this is here: [https://write.as/aclarka2/create-a-centos-7-docker-image- fro...](https://write.as/aclarka2/create-a-centos-7-docker-image-from-scratch) )

</comment><comment><USER16> Why is there no 2FA?

Why can't I use my Github account to login (which already has 2FA turned on)?

<comment><USER17> And why do we need to sign in with username and password to push an image!? I'd much rather either use some type of access token - or even better, a certificate - to push, hate to use passwords in CI!

<comment><USER18> I don't understand why this isn't supported, we have several system users in our organisation to try and replicate this, but I would much rather use access tokens, certificates or api keys.

<comment><USER17> Yeah, we have also been forced to create a few "users" to push to our org account too on docker hub, luckily, we mainly use gitlab for private images (and some public), in which we got tokens and even temporary tokens to use directly in the CI scripts.

I have felt quite unsatisfied with the security of docker hub since I created my first account, but after this issue, I can say that I'm seriously scared for it.

From now on, I'll use my own Alpine base image from "scratch" instead of the one on hub ;P

</comment></comment></comment></comment><comment><USER19> The race is on.

The first guys to implement a container hosting and building solution that is verifiable will dethrone docker.

I hope docker does this themselves, mainly because that will be the fastest route to this happening.

<comment><USER7> I'm not sure what you're trying to say exactly, but I'm pretty sure that this already exist and there are multiple solutions and self-hosted registries as well for it. Check out Harbor:

[https://goharbor.io](https://goharbor.io)

<comment><USER19> I'm not talking about private hosting of containers, I'm talking about an alternative to today's public registry of container images that is 100% verifiable so that when something like this happens it is possible to be certain that no one has tampered with any of the container images.

<comment><USER20> You mean something like posting signed hashes in a public place? So you can verify what you got is what you want?

</comment></comment></comment></comment><comment><USER21> I think when stuff like this happens there needs to be a public, technical, post-mortem. That way we can learn what went wrong and how we can protect ourselves from future breaches.

<comment><USER22> That is unlikely to ever happen...

<comment><USER20> In other industries it's done, and usually there's some regulation around it. It's possible that this would be added to our industry too, maybe via legislation or maybe the big giants all come together and decide on a format and guidelines on responsible post-mortems on data breaches and it's adopted by others. I think it can happen and I hope it does.

</comment></comment></comment><comment><USER23> Immediately deleted my Docker hub account, deleted my github ssh keys, changed all my passwords.

I want Docker to succeed as a company but they just haven't made a compelling case for me to give them money yet. I guess they are focused on servicing larger companies.

</comment><comment><USER24> > less than 5% of Hub users (x2)

That they know of. Not sure if I will keep highlighting this.

</comment><comment><USER25> This is a duplicate of [https://news.ycombinator.com/item?id=19763413](https://news.ycombinator.com/item?id=19763413) .

</comment><comment><USER26> The compromised information was sensitive, but wasn't financial. So what WAS it? It included usernames and hashed passwords. But what ELSE?

<comment><USER22> Probably everything you have stored in Docker Hub.

</comment></comment><comment><USER27> Side question: Since docker had lots of read/write access to private repositories that might have included sensitive data, is this a GDPR incident for the customers that would need to be reported?

Technically, a customer didn't have a breach/leak that may have resulted in data being exfiltrated, but they also cannot rule it out, and as they've explicitly trusted docker, is that an event that should trigger a chain of official reports?

</comment><comment><USER28> The reason that the intruder didn't get access to any of Docker's financial systems is that they use Netsuite for all of that fun stuff: This screams to me (at least) that the intruder probably had access to more than what they are discussing.

</comment><comment><USER29> "Q: Why did you delete my GitHub tokens before notifying me" \- I feel offended</comment>