Navigating Amazon's Occasionally Successful, Borderline-Incoherent TV Strategy - <AUTHOR> http://grantland.com/hollywood-prospectus/up-a-river-navigating-amazons-strange-occassionally-successful-borderline-incoherent-tv-strategy/

<comment><USER2> FWIW, I tried Mozart in the Jungle on a whim without high expectations and found myself watching five episodes in a row. It's not the best half-hour comedy show, but it's a lot of fun.

<comment><USER3> I had high hopes for the original series, but couldn't watch a single one past 2-3 episodes, including Alpha House (which had the great pilot with Stephen Colbert). They just didn't have the writing quality for me. They were like some average network show.</comment></comment>


Like puzzles? Puzpix.com -  give us your feedback!! - <AUTHOR> http://puzpix.com/ <comment><AUTHOR> We like puzzles and pretty pictures - so we made this little baby in the last week :). We'd love to hear your feedback, what you think and see what your top scores are...

enjoy!!

Puzpix.com - by Sumon Sadhu (sharpshoot), Jamie Quint (jamiequint) and Tim Davey (Timmmah)

<comment><USER2> Nice puzzle guys, now all those twitters make sense :)

Is Tim the one I met at opencoffee?

</comment></comment><comment><USER3> Nice job jamie :) Great interface. Have you thought about allowing users to upload their own puzzles & share them w/ friends?

Maybe you can create some sort of javascript widget that users load into their myspace profiles / websites??

</comment><comment><USER4> Cool stuff, guys. I aced that PG puzzle in 10 seconds flat.

Is this using the script.aculo.us effects library?

<comment><AUTHOR> how many moves?

<comment><AUTHOR> also try the more difficult ones...not only the 9 , but the 16 and the 24 (correction :)

<comment><USER5> 9 (3x3) - 16 (4x4) - 25 (5x5)

25x25 would be INSANE

<comment><USER6> isn't 5x5=25? there are definitely 25 tiles on the hard puzzle.

<comment><USER5> heh, yeah, oops

</comment></comment></comment></comment></comment></comment><comment><USER7> Hey Jamie and Sumon, that's awesome. The interface is great since it took me about 2 seconds to figure it out. Though, you guys might need to increase the complexity of the game in order to make it more addictive. Nobody likes to solve puzzles they know they can solve :)

<comment><USER5> did you try one of the hard puzzles (5x5), if you search for your own images you can find some that are pretty hard! thanks for the suggestion

</comment></comment><comment><USER8> I'm struggling with how the pieces shift around. As I'm dragging a piece across the puzzle it messes up everything else I've done. I'd prefer to have it not affect other pieces until I drop it, at which point it swaps places with the piece I drop it on.

</comment><comment><USER9> Building small apps like this is a great learning experience -- I'd love to read more about what you learned by doing it, and what kind of traffic you are seeing

</comment><comment><USER5> puzpix.com - have you got the moves?

My Record - 8 seconds!

Also, IE Warning - Using this site with IE may hurt your eyes - New layout in the works...</comment>


The online tool which tells you how much money you should be making - <AUTHOR> http://uk.businessinsider.com/this-online-tool-can-tell-you-how-much-you-should-be-earning-just-from-you-cv-2015-5

<comment><USER2> I was sceptical about the possibility of a tool like this to be accurate but I gave it a try and it nailed it! You should try it all! :)

</comment><comment><USER3> This is an awesome tool - I am so underpaid - off to hunt for a new job straight away

</comment><comment><USER4> Whoa!!! I knew I was being underpaid, but did not expect a 10K difference.

</comment><comment><USER5> What's with all the throwaways? Seems fishy

</comment><comment><AUTHOR> Please note - the tool only works in the UK.

</comment><comment><USER6> 5 issues with my CV - thanks Adzuna

</comment><comment><USER7> the email my boss feature is a nice touch</comment>


Show HN: ATable - Fast, interactive Javascript table - <AUTHOR> http://jwoah12.github.io/aTable/index.html

<comment><AUTHOR> ATable creator here. My goal was to develop a functional, interactive grid that is easy to use with any data source, can handle huge amounts of data, and is as small as possible. This is my first open source project, so I'm definitely looking forward to getting feedback.</comment>


More Irish people committed suicide under EU austerity than 30 yrs of conflict - <AUTHOR> https://www.thejournal.ie/suicide-austerity-troubles-ireland-tim-pat-coogan-3124487-Dec2016 <comment><USER2> Suicide is a weird statistic. It can almost be a indicator of progress and prosperity in some respcts e.g. suicides rates are high in places like Sweden and Japan and low in places that are very deprived parts of Africa/Asia. Theres a cultural component, a chronological one, a climate one, a psychological, phsiological one etc.

I found the whole article pointless really.

Plenty of intersting things can be said about the Troubles/Irish Financial Crisis but comparing the Troubles to the austerity policies in the Republic during from 08' to 12' isn't that useful nor does it produce insight.

<comment><USER3> >Suicide is a weird statistic. It can almost be a indicator of progress and prosperity in some respcts e.g. suicides rates are high in places like Sweden and Japan and low in places that are very deprived parts of Africa/Asia. Theres

Ted Kaczynski intensifies. Bring back the freedom from Industry... Opsss I am anarchistic again.

</comment></comment><comment><USER4> Why have you added "EU" to the title? Don't editorialize. "EU" doesn't even appear in the article.

<comment><USER2> He shouldn't editorialize but as an aside the EU/IMF did encourgage the austerity policy on Ireland on condition for receiving bailouts so there is some partial truth there.

</comment></comment><comment><USER5> Does this account for the historical reticence of coroners to record a suicide as such because of the stigma that might be heaped upon the dead person, and their surviving relatives? In the 1970s religion was a much stronger force in nearly every aspect of Irish society than it is now.

I'm inclined to believe the modern data more readily than the numbers from the troubles.

<comment><USER6> Despite the headline here, it isn't looking at suicides during the troubles, but people _killed_.

</comment></comment><comment><USER7> Is Ireland in such bad shape? I thought they were a big success story during the 90s and 2000s.

<comment><USER2> Ireland is in very good shape economically. Current problems though include a property crisis in Dublin, sharpening inequality and the problem Brexit presents to certain industries like Tourism and Agriculture.</comment></comment>


A Front-End Developer's Ode to Specifications - <AUTHOR> http://www.smashingmagazine.com/2014/10/09/front-end-development-ode-to-specifications/

<comment><USER2> The article makes reference to Specctr [[http://www.specctr.com](http://www.specctr.com)], which looks like an interesting tool. I hadn't heard of it before, but it is one I will be taking a more detailed look at.

Thanks for sharing.</comment>


System Design Methodology – Simplified - <AUTHOR> https://www.linkedin.com/pulse/system-design-methodology-simplified-reema-majumdar <comment><USER2> This is a really cool guide, can somebody point me in the right direction for ressources for using this practically, prefering not isolated (like: 10 Steps to master HTML) but rather a more holisitic project? Really struggling to find something like this</comment>


Nassim Taleb: "People are just voting, finally, to destroy the establishment." - <AUTHOR> https://www.facebook.com/nntaleb/posts/10153654273663375 <comment><USER2> What does Taleb even mean by that? It's not a good thing that mainstream politics is so much full of shit that Trump actually has a very good chance of being elected. This is a bad sign for the country in general. Reform your way idiot politicians.</comment>


Startup Poaches Groupon's Salespeople, Groupon Fires Off Legal Warning - <AUTHOR> http://www.techvibes.com/blog/top-hat-monocle-poaches-groupons-salespeople-groupon-fires-off-legal-warning-2012-07-27

<comment><USER2> Headline discards context. The issue isn't that it's unlawful for THM to target and hire Groupon associates. It's that Groupons have nonsolicits in their contracts. Groupon is (reasonably) concerned that, having hired a quorum of ex-Groupons, THM is now in a very good position to persuade those ex- Groupons to ignore their nonsolicits and reach out to current Groupons.

Groupon hasn't told THM to stop poaching employees. It has simply warned THM not to use ex-Groupons to do it.

<comment><USER3> _It's that Groupons have nonsolicits in their contracts._

It isn't that, either. It's that Groupon is rather fancifully implying that, beyond being merely unseemly or in bad form, it is somehow "tantamount to contractual interference" for THM to do so. It also implies that THM would "expose itself to litigation" for encouraging Groupon employees to violate their _non-competes_ , an even more baseless assertion.

</comment></comment><comment><USER4> It is true. We ensure that the only people included in our recruiting process haven't worked at the companies we hire from and we don't ask for referrals from people we hire to avoid putting them in a compromising position.

We've interviewed well over 100 Groupon salespeople and have only made a handful of offers. The reason people take our call is really because we're an exciting company that's making a meaningful impact in education, not because of unscrupulous hiring practices.

</comment><comment><USER3> A very callow and pretentious move on Groupon's part, if true.

<comment><AUTHOR> Full letter from Groupon's lawyer is attached to the Techvibes' article.

<comment><USER3> Right, but what it amounts to is a bald attempt at intimidation with no legal standing. What they're saying, basically, is "we don't like that you're doing this, and if you don't stop, you're going get whacked."</comment></comment></comment>


Introducing QUIC support for HTTPS load balancing - <AUTHOR> https://cloudplatform.googleblog.com/2018/06/Introducing-QUIC-support-for-HTTPS-load-balancing.html <comment><USER2> Quicly is another interesting repo which is developed by the same author who built H2O HTTP server now at Fastly ([https://github.com/h2o/h2o/](https://github.com/h2o/h2o/))

[https://github.com/h2o/quicly](https://github.com/h2o/quicly)

<comment><USER3> Because QUIC + Fastly = Quicly. Genius.

</comment></comment><comment><USER4> Note that this seems to be gQUIC (the Google-internal variant of QUIC that it has been using for a few years), and is thus not interoperable with most non- Google QUIC implementations, which follow the IETF drafts.

<comment><USER5> > most non-Google QUIC implementations, which follow the IETF drafts

... which in practice means that you would be able to actually use QUIC with the most widely deployed client implementation (which might in-fact be the _only_ client implementation that's not a development build right now).

IETF QUIC doesn't really exist yet, so offering it over Google's QUIC which exists in Chrome would provide next to no benefit to everybody.

However, I do hope, or rather, expect google to very quickly move both Chrome and the load balancers to IETF QUIC once that is finalized.

Until then, I keep my pitchfork safely stored in its closet because what is being offered here certainly is the practical offering and the correct offering would be completely impractical.

<comment><USER6> Similarly, SPDY was not compatible with HTTP2 before the standard was finalized, but then Google quickly switched to the standard once it was available. I don't think there is too much to worry about there.

</comment></comment></comment><comment><USER7> I'm afraid to enable this. When I had AT&T Business Internet (maybe irrelevant), we frequently got QUIC protocol errors for many Google sites like YouTube (see others crying for help in [1]). My fix was to disable QUIC in Chrome. I don't want our users to hit that as it's not something a normal user could easily diagnose and remedy. No idea how common it is.

[1] [https://support.google.com/chrome/forum/AAAAP1KN0B0xKFfhDvhj...](https://support.google.com/chrome/forum/AAAAP1KN0B0xKFfhDvhjU8/?hl=en)

</comment><comment><USER8> From a client perspective, QUIC seems like it would provide the most value on mobile devices. Any word on how well supported this is on Android clients? I'm assuming iOS adoption will take some time.

In many enterprise networks, TLS MitMboxes rule QUIC out completely. I'm not aware of any middleboxes that support it. Nevermind that even on many guest networks, I see udp/53 hijacked, and all other UDP dropped.

</comment><comment><USER9> HTTP/1.1 to the backend? How about HTTP/2 so people can run gRPC services straight through without translations?

<comment><USER10> To be fair, the majority of benefits for HTTP/2 and QUIC are for the browser and experienced at the edge of your service. While that's not to say having the option to pipe HTTP/2 to your gRPC servers wouldn't be nice the majority I've seen are using HTTP/1.1 at their application layer and what happens from there is a matter between consenting servers.

<comment><USER11> HTTP/2 would still be great for upstreams to ensure HTTPS and make things much more efficient via compression and multiplexing. It makes a difference in higher-scale situations.

<comment><USER12> HTTP/2 as a spec doesn't demand HTTPS. Only browsers enforce this requirement.

From a technical perspective, HTTP/2 makes little sense when you're commingling requests from different user agents. Header compression is ineffective. Persistent connections provide little benefit, as keep-alive works just as well in a data center environment. Between servers, there is no connection limit (as there is with browsers) so there isn't really head-of- line blocking issues that would go away when using HTTP/2.

In general, you're unlikely to benefit materially from using HTTP/2 (versus vanilla HTTPS) between your edge servers and your application servers.

<comment><USER11> Yes, with low traffic it won't matter, but " _it makes a difference in higher- scale situations_." We benefit materially when doing billions of daily requests.

Servers don't have unlimited connections so HTTP/2 provides more throughput and concurrency over the same TCP connection pool, while also preventing any slow requests from affecting all other requests queued on the same connection. HPACK compression operates on individual headers and saving the keys alone can save significant overhead for smaller payloads, along with the binary protocol.

</comment></comment></comment></comment></comment><comment><USER13> "But HTTP/2 uses TCP as its transport, so all of its streams can be blocked when a single TCP packet is lost-a problem called head-of-line blocking."

But see [https://datatracker.ietf.org/wg/httpbis/charter/](https://datatracker.ietf.org/wg/httpbis/charter/)

"It is expected that HTTP/2.0 will: ... Address the "head of line blocking" problem in HTTP."

Dislaimer: I am a longtime (satisfied) HTTP pipelining user for retrieving multiple resources from single domain over single connection and a CurveCP user since 2011 on own network. Never had any problems with HOL blocking that I am aware of, but I am only a dumb end user and wish to learn what I might be missing.

<comment><USER14> Different kind of head of line blocking. In HTTP it refers to a technique where a client sends multiple requests without waiting for their respective responses. However, the server has to send the responses in order - so if the client makes request A and request B, the response for B can't be delivered until A's response is delivered. So if A's response is large, B will be delayed.

In HTTP/2, it's all multiplexed - so the server can interleave responses.

</comment></comment><comment><USER15> How does QUIC work together with µTP/LEDBAT? Also is there any plan to implement this type of congestion control in QUIC? Would it make sense? It could certainly be useful for background synchronization in PWAs.

</comment><comment><USER16> The unfortunate fact of QUIC is that it's based on encrypted UDP packets, which many ISP routers will happily drop during peak traffic/high load periods.

EDIT: oh come on down voters. This comment is stating a fact. What's your problem with it?

<comment><USER17> > This comment is stating a fact

You are sneaking in an opinion: "unfortunate".

A protocol that implement congestion control + multiplexing + encryption over UDP is excellent progress over TCP. It should have happened decades ago.

<comment><USER18> But should disagreement be expressed as downvotes?

<comment><USER17> No, according to policy, but people don't seem to care.

<comment><USER11> Actually yes, this has been determined to be OK here.

</comment></comment></comment></comment></comment><comment><USER19> _QUIC makes the web faster, particularly for slow connections_

QUIC is a characteristic Google standard -- dictated, poorly thought through, and destructive for the rest of the web. See e.g. [https://blog.apnic.net/2018/01/29/measuring-quic-vs-tcp- mobi...](https://blog.apnic.net/2018/01/29/measuring-quic-vs-tcp-mobile- desktop/) "our experiments showed that QUIC always consumes more than half of the bottleneck bandwidth, even as the number of competing TCP flows increases."

QUIC improves speed for high-latency connections (at the cost of cohoused TCP flows, as above), but is worse than no change for the reality of poor connectivity on the ground, which has highly variable latency, packet loss and/or duplication, and (sometimes profoundly) asymmetric routing.

<comment><USER20> Criticizing QUIC becasue of its interaction with existing TCP flows is tricky, because the most efficient protocol isn't necessarily the one that interoperates best with existing protocols. There have been a lot of iterations on TCP congestion control algorithms that improve bandwidth/latency of TCP connections under the new congestion control algorithms at the detriment of legacy TCP connections.

I don't know enough about QUIC to say whether it's good or bad, but the standardization process by which SPDY evolved into HTTP/2 seemed good to me: there was a lot of external feedback that was incorporated and addressed, and the protocol evolution and standardization happened over a reasonable timeline. Do you see a problem with how QUIC is being developed by the IETF?

<comment><USER21> As the article that the guy linked to points out, this unfairness is due an aggressive configuration of the CUBIC congestion control algorithm in QUIC.

TCP also uses CUBIC. So, you would have just as well already been able to be a dick by configuring your CUBIC in TCP to be more aggressive.

Lots of research has gone into an optimal configuration of CUBIC for TCP, under the presumption that everyone will use this implementation, and therefore with the goal of optimal results for everyone.

QUIC now falls out of line because early adopters get better results, as they can unfairly compete against the fair TCP implementation. In the long term however, if QUIC is adopted by everyone, this will lead to a worse result for everyone, because this optimal configuration that's been researched under TCP has been thrown out for no good reason.

At least I'm not aware of a good reason. Maybe QUIC is actually somewhat less impacted by packets being dropped or something like that and does work better with everyone just trying to squeeze everything through aggressively, but even if that is the case, I cannot imagine it being the case to the degree that this CUBIC configuration has been made more aggressive.

<comment><USER22> To be fair, that's from my understanding "aggressive configuration of CUBIC in Chrome", not something dictated by the protocol.

It's an interesting point though that move to UDP and doing congestion-control in higher levels, in user-space, makes it easier for applications to be overly aggressive, and there's some incentive for them to do so. Clear downside of how frozen the lower levels of the stack have become in some ways...</comment></comment></comment></comment>


Scaling Airbnb with Brian Chesky – Class 18 Notes of Stanford's CS183C (2015) - <AUTHOR> https://medium.com/cs183c-blitzscaling-class-collection/scaling-airbnb-with-brian-chesky-class-18-notes-of-stanford-university-s-cs183c-3fcf75778358#.rykucyq90 <comment><USER2> This is an awesome story and I am glad it worked out well for AirBNB. I have used their service a number of times and have only positive things to say. With that said, i think it is a bit crazy to go 30K in CC debt to get a company off the ground, given the chances of a startup succeeding being so low.

If things didnt work out for AirBNB, unless someone helped pay of that debt they would be in a pretty shitty situation given the way credit scores can affect your life in the USA.

</comment><comment><USER3> I must have heard their story from the full hotels, to the cereal boxes, to the cockroach analogy 10 times now, and it never ceases to impress.

Especially where Brian tells his mom he's a cockroach. Love it.

Many entrepreneurial successes seem to come from people who have their backs against the wall and nowhere to run, or ones that simply refuse to take no as an answer. The small successes that I've been most proud of were also under similar circumstances. Also: Brian's a great story teller.

<comment><USER4> Then again, so do many suicide stories. Sometimes accepting failure is ok.

</comment></comment><comment><USER5> The video in this post is part of a larger series that I just finished watching. I highly recommend watching through all of them:

[https://www.youtube.com/watch?v=s3RrVmv5WwA&list=PLnsTB8Q5Vg...](https://www.youtube.com/watch?v=s3RrVmv5WwA&list=PLnsTB8Q5VgnVzh1S-VMCXiuwJglk5AV--)

<comment><USER6> This is amazing, thanks!

</comment></comment><comment><USER7> This truly is an incredible interview. Brian has a ton of emotional intelligence.</comment>


Lisp Is Not an Acceptable Lisp (2006) - <AUTHOR> http://steve-yegge.blogspot.com/2006/04/lisp-is-not-acceptable-lisp.html <comment><USER2> > _If Lisp were acceptable, then we 'd all be using it._

What if 5,697 languages were deemed acceptable? Would each and every one of us be using all of these 5,697 programming languages?

There is nothing that we _all_ use; does that mean there is no acceptable language at all?

> _Every single non-standard extension, everything not in the spec, is "wrong" > with Common Lisp. This includes any support for threads, filesystem access, > processes and IPC, operating system interoperability, a GUI, Unicode, and > the long list of other features missing from the latest hyperspec._

Portable libraries which make those things look the same to the program are possible and exist in Lisp. (We go from "which Lisp?" to "which Lib?").

Some pretty successful languages do not have threads, processes, IPC, Unicode and other features. C and C++ have threads now, but this is very recent. No GUI, no Unicode, no IPC. Who cares? For decades there have been cross-platform libraries for those kinds of things.

Sticking a GUI into a language is risky. Suppose ANSI C had standardized a GUI interface in 1989. Would that be of any use today? Likely the API would just be a dead-weight that is ignored (if not an outright hindrance to innovation).

</comment><comment><USER3> You can always get free upvotes by linking to one of Steve's articles.

But I'm not complaining. It's still a good article.</comment>


Show HN: Using statistics to restore pixel art images - <AUTHOR> https://github.com/victorqribeiro/pixelRestorer <comment><AUTHOR> No one?! That's a bit disappointing. I thought if there was ever a place to talk about statistics it would be here.</comment>


Whoops, Students "Going Google" Get to Read Each Other's Emails - <AUTHOR> http://www.readwriteweb.com/archives/whoops_students_going_google_get_to_read_each_others_email.php

<comment> rm-rf I'm surprised that this didn't get more press.</comment>


Trump to launch artificial intelligence initiative - <AUTHOR> https://www.sciencemag.org/news/2019/02/trump-launch-artificial-intelligence-initiative-many-details-lacking <comment><USER2> speaker shared one concern

> its focus on industry and apparent lack of input from academia and civic > leaders

what can be done to give some voice or get input from academia and civic leaders?

it will be interesting to see more details on this.</comment>


Ask HN: Tips and Tricks for beginners to promote your Android app? - <AUTHOR>

Hey,
I've recently created a few Android apps to learn Spanish and French. The app basically has a long list of words, it dictates you a word in english, and then says it in Spanish. When I wanted to learn Spanish, I found that this technique  was really helpful to quickly learn vocabulary, and works while I'm commuting, which saves a lot of time.
Now this app is pretty original, and is very simple to use, but as there is tons of language learning apps in the Android market, my app is always listed like 20-30th in the list when searching. I would like to know if there is an easy way to promote my apps. I've previously tried to promote some apps on Facebook by paying 30$, but it never compensated for the price gained afterwards. I've created some free versions so that people can try it out, but still not a lot of purchases.
I would like to know if someone has managed to successfully market their apps, without paying 1000$ out of the pocket ? I'm not looking to make a salary with these apps, but at least compensating me for the time I spend programming them :).
Thank you for any help. I'm sure this topic will help other people discover some tricks!
Here are my apps if someone is interested:
Spanish: Free: https://market.android.com/details?id=com.pervychine.learn_spanish_lite Paid: https://market.android.com/details?id=com.pervychine.spanishincar
French: Free: https://market.android.com/details?id=com.pervychine.learn_french_lite Paid: https://market.android.com/details?id=com.pervychine.learn_french <comment><USER2> I think it's something that's marginally useful. Why not build a poor man's Pimsleur and dictate sentences and conversations and then tell them english meaning afterwards?

</comment><comment><AUTHOR> really no one ? :( iPhone developers maybe ?</comment>


Show HN: I made a Chrome Extension that blocks your social activity - <AUTHOR> https://try.socialdetox.app/2 <comment><AUTHOR> Hi all, I and my colleagues are testing the various product and primary goals Are to provide real value with a Browser extension.

What we notice and what is obvious today is how much just social media 1\. distracts you, 2\. takes your focus 3\. fill our heads with a ton of disinformation among others

and it just impacts our lives in a way I think we can't imagine yet.

This extension will monitor where you navigate on social sites primary but you can add other sites. You can limit your daily time on any site. When the time is out, we just put an overlay over that sites with the notice that you spend too much there. You can close it if you want.

We find that it just works for us.

We would love to hear your feedback.

If we find that there are people there that share our thoughts and like the app, we will continue to develop it according to community feedback.

Goran

</comment><comment><USER2> your _</comment>


Behind the Masq: Yet More DNS and DHCP Vulnerabilities - <AUTHOR> https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html <comment><USER2> Meta: that page is impossible to read for me on Firefox mobile - if I pinch zoom, or scroll, and move left or right slightly Google "helpfully" send me to a different page.

How many millions did Google spend optimising the code that makes that page useless for anyone who wants to zoom in on mobile? Man, that, wow, I can't express how terrible that is, Google, really!?

Edit: they have a "web version" ([https://security.googleblog.com/2017/10/behind-masq-yet- more...](https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and- dhcp.html?m=0)) without that massive UX bug, where instead you can't scroll to see the table. smh

<comment><USER3> Not just that page - the entirety of Blogspot/Blogger has that problem! Easy to accidentally do on Android Chrome too.

</comment></comment><comment><USER4> So were these vulnerabilities present, and missed by Cure53's audit ([https://wiki.mozilla.org/images/f/f7/Dnsmasq- report.pdf](https://wiki.mozilla.org/images/f/f7/Dnsmasq-report.pdf))?

<comment><USER5> Probably.

It's well known that it's generally (and practically) intractable to find all vulnerabilities in a typical networked C program using reasonable auditing effort. If auditing worked, we would know how to secure C programs and the world would be a much different place.

<comment><USER6> But we do know how to write secure C. It's just time consuming and requires discipline. Two things that most developers don't have or want.

<comment><USER7> That seems to indicate "we" as a profession don't actually know. Because the developer is always part of writing the code and thus, any process that results in C-Code has at least one insecure element.

<comment><USER6> "We" is inclusive - 'most developers' is exclusive. Mystery solved.

</comment></comment></comment></comment></comment><comment><USER8> My experience with implementations of these protocols is mostly from embedded systems, but I was under the impression that they could and should be written with almost no dynamic allocation at all, since everything has very small and fixed sizes. To see so many overflows and other dynamic-allocation related bugs is thus a little surprising.

Also interesting to note that 3 of the 7 in the list definitely appear to be in handling of IPv6-related parts of the protocol.

</comment><comment><USER9> The part that makes me happy is:

> In addition to these patches we have also submitted another patch which will > run Dnsmasq under seccomp-bpf to allow for additional sandboxing.

It takes a while, but the more known projects start getting seccomp patches and this will lower the impact of exploits like this in the future.

<comment><USER10> Still I was very negatively surprised about the code complexity of the seccomp integration.

<comment><USER9> It's a very detailed implementation by dedicated people. It includes the namespace setup and mounts. It's not a great thing to show off IMO.

You can get good results with much smaller implementations too. See my patch to memcached for example: [https://github.com/memcached/memcached/pull/275/files](https://github.com/memcached/memcached/pull/275/files)

<comment><USER10> Thank you.

</comment></comment></comment></comment><comment><USER11> Damn, there's gonna be a _LOT_ of home/SOHO-type routers out there that are affected by this. I expect we'll see some exploits for these devices in the near future.

<comment><USER12> Of the three RCEs, two of them are in the DHCP server subsystem, which means they can only be exploited by a device that successfully authenticates to your local network.

The other RCE is in the DNS subsystem, and can apparently be exploited by making a PTR record lookup to an attacker-controlled DNS server:

[https://github.com/google/security-research- pocs/blob/master...](https://github.com/google/security-research- pocs/blob/master/vulnerabilities/dnsmasq/CVE-2017-14491-instructions.txt)

My first question is: can you induce people to make PTR lookups? I don't think there's a way to make a browser do a PTR lookup, which may limit the remote exploitability of this vulnerability.

My second question is: can the vulnerability be exploited with an A/AAAA record lookup instead? If so, that would open a very devastating remote attack vector, as a website would need only include a hidden image tag pointing to an attacker-controlled domain in order to get RCE on someone's router.

<comment><USER12> The author of dnsmasq says it has to be a PTR lookup: [https://twitter.com/SimonRKelley/status/914918747978305537](https://twitter.com/SimonRKelley/status/914918747978305537)

That's very good news.

Edit: never mind, he says a CNAME answer to a A/AAAA query can trigger vulnerability. That's very bad news.

<comment><USER13> If that's true this is really really bad news. I mean I can't even begin to describe how bad this is.

<comment><USER14> According to the blog post, that CVE (CVE-2017-14491) only allows a 2-byte overflow on Dnsmasq >=2.76, so hopefully that's enough to prevent it from being exploited effectively.

2.76 was only released 16 months ago though. There are probably tons of router firmwares out there that are way older than that.

<comment><USER5> It's unlikely that even the latest firmwares follow dnsmasq releases that closely, safe to assume that ~ all CPE devices are wormable.

(And most of the devices out there will never get updated even after this, just replaced one day)

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> This affects all versions of Kubernetes between 1.5.0 and 1.7.6.

Relevant posts:

\- [https://groups.google.com/forum/#!topic/kubernetes- dev/QWIzh...](https://groups.google.com/forum/#!topic/kubernetes- dev/QWIzhD3JhhE)

\- [https://coreos.com/blog/dns-vulnerability-patched-in- kuberne...](https://coreos.com/blog/dns-vulnerability-patched-in-kubernetes- and-tectonic)

<comment><USER15> I'm wondering how exploitable this is. Kube-dns doesn't listen outside of the cluster, so to you need to be able to run arbitrary code inside the cluster to make use of it.

Then it lets you escape to the dnsmasq container. Which does have a shell, but I'm struggling to think how this gets you more capability than "able to run arbitrary code inside the cluster".

Most likely I missed something. Help me spot it.

<comment><USER16> It is far harder to exploit on Kubernetes then on a laptop running a dnsmasq cache attached to a starbucks wifi.

You would need to middle man traffic between dnsmasq and upstream DNS or have some control over DNS records and be able to force dnsmasq to do lookups. As you point out the escalation is also far more limited. Ok, so you have a shell in the dnsmasq container. Now what?

</comment></comment></comment><comment><USER17> Think of all OpenWrt/dd-wrt devices - and possibly countless router-boxes around the world that use some proprietary firmware along with dnsmasq.

Just verified that my home OpenWrt WDR4300 is affected.

<comment><USER18> OpenWrt 15.05.1 "Chaos Calmer" was released more than a year ago. I haven't seen many updates. I wonder if there's an update channel that I'm missing.

Specifically, here is where all updates are coming from: [https://downloads.openwrt.org/chaos_calmer/15.05.1/ar71xx/ge...](https://downloads.openwrt.org/chaos_calmer/15.05.1/ar71xx/generic/packages/base/)

No updates since March 2016.

EDIT: Has development has moved to the LEDE project? I don't understand what's happening in the OpenWRT/LEDE split. There appears to be a fairly clean upgrade path, though: [https://forum.lede-project.org/t/upgrade-from-openwrt- to-led...](https://forum.lede-project.org/t/upgrade-from-openwrt-to-lede-does- the-config-compatible/6252)

<comment><USER19> Yes, you probably want Lede, not OpenWRT or dd-wrt. I used lede to flash some old routers last year, and on the whole the experience was similar to my last interaction with OpenWRT only better (more evolved).

[https://lede-project.org/start](https://lede-project.org/start)

<comment><USER20> I would like to add that you can usually in place upgrade from OpenWRT to LEDE. Though making a config backup and a backup of the list of additional packages you installed is highly recommended. Beside of that just flash and reinstall all additional packages.

<comment><USER18> Upgrading to LEDE worked flawlessly. Thanks guys!

</comment></comment></comment></comment></comment><comment><USER21> Here are some PCAPs of the PoCs from the GitHub repo:

CVE-2017-14491.pcap: [https://www.cloudshark.org/captures/016080cbeab5](https://www.cloudshark.org/captures/016080cbeab5)

CVE-2017-14492.pcap: [https://www.cloudshark.org/captures/fd4bfa9403fc](https://www.cloudshark.org/captures/fd4bfa9403fc)

CVE-2017-14493.pcap: [https://www.cloudshark.org/captures/1c30b56dc1d3](https://www.cloudshark.org/captures/1c30b56dc1d3)

CVE-2017-14494.pcap: [https://www.cloudshark.org/captures/657de976c0d1](https://www.cloudshark.org/captures/657de976c0d1)

Used this repo to generate these: [https://github.com/google/security- research-pocs/tree/master...](https://github.com/google/security-research- pocs/tree/master/vulnerabilities/dnsmasq)

</comment><comment><USER22> How should/would we design routers and any Internet-connected device that we expect the users to not patch themselves? e.g. SOHO users.

Let's not get into the discussion of whether or not everything that can be connected to the Internet should be. (I'm in the "should not be connected camp", but I think my question can stand on its own without this discussion).

<comment><USER23> The first answer is obviously auto-updates.

The second answer is also obvious: Try to avoid as many bugs as possible _before_ shipping the product. If you include a highly exposed software like dnsmasq make sure you look for bugs in it before shipping it.

I don't remember having seen any professional security audit for dnsmasq before. Such an audit is probably an almost irrelevant expense for all the router manufacturers out there, yet none of them chose to fund one...

<comment><USER24> The other one is that embedded devices need to running their components in sandboxes.

<comment><USER25> To be honest, a compromised dnsmasq can do quite a lot of harm even if it is running in a sandbox. The rest of the system expects to trust the output.

</comment></comment></comment></comment><comment><USER3> Is there any indication how these vulnerabilities were found? I'm guessing fuzzing given the ASAN reports.

</comment><comment> ryan-c Am I misunderstanding this, or is there not an updated version of the Debian package available?

<comment><USER26> Currently listed as vulnerable, I'm sure they'll get on it as soon as possible.

[https://security-tracker.debian.org/tracker/CVE-2017-14491](https://security- tracker.debian.org/tracker/CVE-2017-14491) [https://security- tracker.debian.org/tracker/CVE-2017-14492](https://security- tracker.debian.org/tracker/CVE-2017-14492) [https://security- tracker.debian.org/tracker/CVE-2017-14493](https://security- tracker.debian.org/tracker/CVE-2017-14493) [https://security- tracker.debian.org/tracker/CVE-2017-14494](https://security- tracker.debian.org/tracker/CVE-2017-14494) [https://security- tracker.debian.org/tracker/CVE-2017-14495](https://security- tracker.debian.org/tracker/CVE-2017-14495) [https://security- tracker.debian.org/tracker/CVE-2017-14496](https://security- tracker.debian.org/tracker/CVE-2017-14496)

<comment> ryan-c Looks like it's being worked on: [https://tracker.debian.org/news/876560](https://tracker.debian.org/news/876560)

<comment> ryan-c Fixed packages released - was just able to install. [https://security- tracker.debian.org/tracker/source-package/d...](https://security- tracker.debian.org/tracker/source-package/dnsmasq)

</comment></comment></comment></comment><comment><USER10> Yet another high impact vulnerabilities report related to C implementation. History repeats. Software engineering still didn't come to the point to make engineering of safe and secure software easy.

</comment><comment><USER27> I love it when vulnerabilities are publicly disclosed the moment they have patches. Now we all get to choose between patching them ourselves and manually managing patches for the affected software from now on, or leaving them unpatched until the fixes eventually find their way downstream to us.

<comment><USER28> The alternative is to deprive people willing to manually manage patches of the ability to protect their networks, so that everyone can wait for people who don't take that level of responsibility over their networks to get a one-line installer. That's no alternative at all.

<comment><USER29> I agree. I used to be the sole maintainer of a small Linux distribution for my employer (only a side-project, responsibility wise). This was a Fortune 50 company. I'd often have patches applied and new versions released within hours. It's very easy to do. Usually by the time someone else in the office found out, it had been patched long ago. And I'd like to be clear that I am not actively subscribed to any lists, I just casually find these issues by reading where other professionals write, often. And lo, we were more up to date than most other companies.

Sure, we were vulnerable for a brief window, and without a doubt there were other vulnerabilities, but we were pretty much as safe as possible, let alone for a half-person team.

You just don't leave windows broken. You don't leave the holes unfilled. If you find a crack in the foundation, you fix it. To do otherwise is not only irresponsible to your peers and employer, but to your customers.

My only criticism is that often the roles responsible for such things are unpleasant, come with little respect, visibility and/or pay. Companies should just suck it up and overpay a handful of engineers and security specialists, charged with the responsibility of ensuring the company avoids being vulnerable. Think of it as insurance -- it's worth far more than a bad press cycle or having your customers exploited and rightful loss of trust. The bang for your buck is off the charts.

<comment><USER30> Executives don't realize that it can end a company until it does. Apple gets it. Google gets it. Facebook gets it. But very few other companies do. Cyber vulnerabilities _killed_ Nortel back in the day. Huawei got not just designs, but details about bids, key people, everything.

<comment><USER31> Maybe 5-10 years ago companies didn't realize it. I think every major corporation has started to consider that kind of scenario now. Smaller companies may still delude themselves into thinking they aren't targets, but they probably are much less capable than big companies of investing in the required preparations to prevent those attacks.

The "black swan" events aren't costless to mitigate. In fact, they are extremely expensive. And just like there can be a black swan for cyberattacks, there can be a black swan like a terrorist attack (like companies in World Trade Center Towers 1 and 2), a massive natural disaster (think businesses in Puerto Rico right now), massive electrical outages (say an EMP or simply just Enron malfeasance), etc.

Spending to protect against and mitigate all possible black swans approaches infinity and doesn't every pay off until the extremely rare but extremely impactful event ever happens. And in cyber security, you never know because your defenses prevented it before it ever started.

<comment><USER30> If they were doing as you describe they would at the very least keep their versions of Windows updated and they would enable things like two-factor authentication and TLS for their email. They don't. We're not talking expensive to prevent black swan, we're talking routine defences against white swans.

</comment></comment></comment></comment></comment></comment><comment><USER5> Why do we tolerate these C death traps in unmaintained devices? There needs to be legislated liability for device peddlers or security regulation.

This, the Broadcom wifi RCE and the Bluetooth RCE are like a concurrent land, sea and air pwning of people's personal and home devices.

<comment><USER32> Write a better replacement in your magic language of choice then.

<comment><USER5> Why so defensive, surely it's the vendors responsibility? Anyway, DNS and dhcp impls in safer languages exist in some numbers.

<comment><USER32> Vendor? This is open source software. It's not proprietary. There is no "vendor".

The reason these devices are cheap/affordable is because of the open source community. The reason the internet has made it to this current state is because of the open source community. If you want the internet to be better and safer you have to roll up your shirt sleeves and contribute in any way you can.

<comment><USER5> I find it really hard to understand the view that a company shipping a defective product that may cause great harm to users should be excused from responsibility because the bad software choices they made happened to be open source.

I suspect the consumer protection laws take similar views in many countries.

Like I said before, there are a number of available DHCP and DNS implementations in memory-safe languages. Many of them are open source. So the vendors don't even have that excuse.

<comment><USER32> What are they? I've certainly never heard of them or used them. Are they used in production or are they toys?

DHCP: isc-dhcp or dnsmasq

DNS recursor: dnsmasq, unbound, bind, djb's dnscache, maradns

None of these are written in memory safe languages, but they're the only ones I would trust because they have YEARS of testing and getting the RFCs right.

</comment></comment></comment></comment></comment></comment><comment><USER33> Help me understand these vulnerabilities. What could happen if someone exploited these?

<comment><USER34> They could get access to the device dnsmasq is running on, your pc, your router etc.

<comment><USER33> Wow... So you're saying a computer on the internet, just by knowing my IP adress, could just get access to the LAN at my house?

I'm glad Arch Linux has such strict firewalls by default!

<comment><USER35> Three of the issues would allow an attacker to take over your router from inside your LAN (not externally). Only one of the issues is an RCE that would usually be exploitable from outside your LAN, and there's some debate as to how hard that one would be to exploit. It might be as simple as getting you to visit a web page, but the published proof of concept would require something like tricking you into manually running a query via the command line or some other administrative tool.

<comment><USER33> Thanks for explaining. This wasn't obvious to me.

</comment></comment></comment></comment></comment><comment><USER36> I have never understood why so many people, including commercial projects, use dnsmasq. _Convenience_?

With djbdns I have never felt the need for it. Nor do I use DHCP. Or even ARP. At least, on computers that allow control over such things.

I guess I am missing out on the _convenience_ , or perhaps there is an alternative selling point I have overlooked?

<comment><USER26> So if you have a wifi network that other people are to use, do you ask them to punch in a manual IP address on their phone's wifi config every time?

<comment><USER36> "... you have a wifi network that other people are to use..."

I prefer wired networks and to attach particular RFC1918 IP's to particular devices. Works for me.

<comment><USER26> Yeah ok. In case you're still wondering why people use dnsmasq and dhcp, your regime wouldn't work well in most places where visitors expect to just connect and go online.</comment></comment></comment></comment>


Leaks Reveal US Military Use of IMF, World Bank as "Unconventional" Weapons - <AUTHOR> https://www.mintpressnews.com/leaked-wikileaks-doc-reveals-how-us-military-uses-of-imf-world-bank-as-unconventional-weapons/254708/ <comment><USER2> Maybe add the Federal Reserve and the Bank of England to this list [0]

[0] [https://www.businessinsider.com/venezuela-gold-reserves- froz...](https://www.businessinsider.com/venezuela-gold-reserves-frozen-by- bank-of-englandf-2019-2)

</comment><comment><USER3> So access to (large amounts of) capital becomes a highly politicized, US- centric proposition. Imagine if you could control the backbone of a global information network and access to capital in the 21st century.

Better than aircraft carriers.

</comment><comment><USER4> This doesn't mention at any point how Venezuela is very much in debt to Chinese banks because of the current corrupted regime [0]. Opposition in Venezuela asked for the accounts to be frozen.

[0] [https://www.cnbc.com/2019/02/07/venezuela-china-and- russia-o...](https://www.cnbc.com/2019/02/07/venezuela-china-and-russia-owed- debts-as-presidential-fight-rages.html)

</comment><comment><USER5> The article jumps into Venezuela, but that is after the fact. Maduro invited Russia and China into the Americas and has received a prompt and harsh lesson on the Monroe Doctrine.

</comment><comment><USER6> Out. Leaks like this certainly hurt the perception of the IMF and World Bank around the world.

<comment><USER7> More than their neutering during formation or the end of Bretton Woods?

</comment></comment><comment><USER8> WikiLeaks sure does seem like they've got an agenda.

</comment><comment><USER9> > Leaks Reveal Random Musings From Some Guy In Army-SOF Who Doesn't Even Know > What The IMF And World Bank Are About, But Somehow Thinks They Might Be Used > As "Unconventional Weapons".

FTFY.

</comment><comment><USER10> John Perkins right again!

</comment><comment><USER11> throwing money at a problem :'D

</comment><comment><USER12> "Economics is war by other means."</comment>


The True Story of How Amazon Went from Bedlam to Behemoth - <AUTHOR> http://www.linkedin.com/today/post/article/20131015184150-25760-the-true-story-of-how-amazon-went-from-bedlam-to-behemoth

<comment><USER2> Sounds great, just bought it (on Amazon, for my Kindle, with one click).

For another great read about a would-be Amazon that didn't turn out quite the same way, and an entertaining look into the internet business environment at the turn of the millenium, I recommend _Dot Bomb_ by J. David Kuo.

</comment><comment><USER3> I read another Amazon biography sort of thing, and was a bit disappointed because it was clear the author did not have access to Bezos - not even a brief interview, it seemed to me. Access is critical for this kind of book, and it'd be interesting to hear how much the author had, to who.</comment>


The Bus Stop (2010) - <AUTHOR> http://www.radiolab.org/story/91948-the-bus-stop/ <comment><USER2> Such a great idea for such a terrible disease. Not being able to trust your thoughts is terrifying.</comment>


First round of life in the Universe might have been possible extremely early - <AUTHOR> http://fcsuper.blogspot.com/2017/01/first-round-of-life-in-universe-might.html <comment><USER2> 1\. Why would planets be required at all, if the universe was uniformly warm?

2\. My microwave oven also heats things to the melting point of water, but I would not call it hospitable to life.

<comment><AUTHOR> 1\. True. Organic compounds have been found in Nebula. We don't know if gravity and "ground" are necessary to turn it into life. 2\. Although the study uses the traditional term for the background radiation "Cosmic Microwave Background", technically, it likely wasn't microwaves at that time, but closer to the visible light spectrum (maybe even beyond that). We only see the background radiation as microwaves now because the EM waves have stretched out due to expansion of the Universe.

<comment><USER2> 2\. You're right, I feel silly for not realizing that.</comment></comment></comment>


Jpm4j - just another package manager for Java - <AUTHOR> http://jpm4j.org/

<comment><USER2> The home page is _really_ unclear; all of the explanatory text means basically nothing. The key question of "how is this different from maven" should be answered very obviously.

I think I figured it out: this is for installing java-based command line programs. Neat!</comment>


A Guide to Minimalist Web Design (2017) - <AUTHOR> https://ismailelazizi.com/blog/a-guide-to-minimalist-web-design <comment><USER2> I keep checking those minimalism-related websites and guidelines, as well as software projects, just to find out how much views on such a seemingly simple thing vary.

For instance, this article argues against unnecessary elements, yet it's about 1.8 MB, has rather useless (IMO) pictures, and I had to scroll down 1.5 screens (in a desktop FF) to see the beginning of the article. And then there are regular vague advices.

Apparently some focus on visual minimalism, others -- on pages being lightweight, yet others -- on minimal technologies. And what some would see as necessity others see as bloat.

<comment><USER3> Agree. Shouldn't a "minimal" website have everything it needs on one page? Huge images you have to scroll past to read anything useful isn't being minimal, it's just cruft. Surely it's possible to build a website that doesn't take up a lot of screen real-estate, has everything necessary to function, and still looks professional and aesthetically pleasing?

<comment><USER4> > Surely it's possible to build a website that doesn't take up a lot of screen > real-estate, has everything necessary to function, and still looks > professional and aesthetically pleasing?

Given that we're on HackerNews, I think we can answer that with certainty.

Well, I suppose _looks professional_ and _aesthetically pleasing_ are subjective, but I wouldn't change HackerNews's look.

</comment></comment></comment><comment><USER5> It's strange how different things mean to different people; Some people see web pages as images and so minimalism is an aesthetic decision while others (most people here probably) see a tree of boxes and the aesthetic minimalism should (usually) be a consequence of a simpler description of that tree.

</comment><comment><USER6> I like a data-first approach when designing websites. Or another way to think of it: how HTML was intended.

You write HTML and later use CSS to give that data a nice look.

Let's say you want to create a blog. Then you might have the following HTML tags in your page: H1, H2, TIME, P, A, IMG

That's it.

Then style those element and you are done.

Now ofcourse the above is an extreme simplification.

But with frameworks like Bootstrap you take the complete opposite approach. You fill your HTML with loads and loads of DIVs just to make something look good. Imho this is a mistake.

It also makes people to add data they don't need because 'every bootstrap page has a hero'.

As for a minimalistic design: just use 1 or 2 margins/paddings and around 3 to 4 colors everywhere.

<comment><USER7> Although I mainly agree with you — I pretty much take exactly that minimalist approach with my own site — I think you're being a bit unfair on Bootstrap. Using just your example tags in conjunction with Bootstrap is perfectly acceptable, and it would only really take a single DIV (container) to wrap the content. Bootstrap gets more complicated when it comes to layout, navigation, and additional content, though, but this also becomes an issue in plain HTML anyway.

I would, though, like a really good 'minimalist' framework that just works — almost as a reset — with no classes at all. '<table class="table">' has always bugged me in Bootstrap, and there are other examples with certainly feel overengineered, that lead to spaghetti HTML.

<comment><USER8> The difficulty here is that the word "div" is still highly overloaded in CSS. That said, I can probably put something together which satisfies what you're asking for - a set of "sensible defaults", like halfway between normalize.css and bulma. It might be an interesting design challenge!

</comment></comment></comment><comment><USER9> [http://motherfuckingwebsite.com/](http://motherfuckingwebsite.com/)

<comment><USER10> Let me just preempt the whole comment thread:

[http://bettermotherfuckingwebsite.com](http://bettermotherfuckingwebsite.com)

[https://thebestmotherfucking.website](https://thebestmotherfucking.website) (actually significantly worse)

[https://bestmotherfucking.website](https://bestmotherfucking.website) (the best design of the lot)

and probably other niche ones

<comment><USER11> "Significantly worse"? Just getting away from a serif font makes the third you linked way better to me. The text contrast is still good (to head off the "but it's not pure black on white!" cargo cult) and colored headers are distinctive but not obnoxious.

<comment><USER2> > Just getting away from a serif font makes the third you linked way better to > me.

The original one doesn't use CSS at all (and doesn't set fonts with serifs), while all the others try to alter fonts and/or their sizes, potentially changing them from ones set/preferred by a user to ones set by a webmaster. thebestmotherfucking.website also tries to override colors. I think these are good (simple, hence easy to reason about) examples of the awkwardness that comes out of styling (and complexity of relatively simple decisions): some would assume certain user agents and settings, and possibly that users don't configure those. Not to mention that some may actually prefer serifs and other common defaults.

Would be amusing if that progression of websites grew even further, to heavy and heavily styled SPAs, completely reversing the original message.

<comment><USER11> Oh no, they used CSS! Heaven forfend one delicately and with restraint use something supported in nine thousand, nine hundred and ninety-nine out of ten thousand browsers. Heaven forfend. A pox on their house.

"Sets fonts" is misleading--the creator knows and must know that the default in virtually every browser is whatever dog's-breakfast default serif there is. (Yes, yes, "the browser can change it," because we all know that every user is an artisanal crafter of browser preferences and truly, deeply cares to do that instead of go to a site where somebody thought that through in its presentation.)

It's not 1997 anymore. HTML is no longer a document markup language, it is an application-and-presentation toolkit, and whether or not you or I like it--I don't particularly, there are better ones--doesn't excuse doing _bad_ work because we pretend users who happen to be fully congruent with ourselves want it.

</comment></comment></comment></comment></comment><comment><USER12> Unfortunately, everyone else is not reading this... and for those bastards that make you click through 3 popups and then scroll jack you in the middle of reading etc: I really frickin love FireFox's "reader view" (top right in your address bar), it's also beautifully minimal text.

Now my first reaction to a popup opening as soon as I navigate to an article or a terribly illegible and busy design is to reach for the reader - guarantees one click, minimal, legible text.

In other words, if you can't trust the designers, remove the design.

<comment><USER13> Turn on reader view with either F9, or Ctrl+Shift+R, depending on your version of FF :)

</comment></comment><comment><USER14> hacker news has been incredibly influential on me in exemplifying what a site could be.

I too have been thinking about the philosophy of a minimal amount of "design." After a certain point or certain amount of "design" I feel like we have to ask ourselves, "what's it all for?" I've been getting into more front end territory and have been delighted with how much HTML does.

For me, it's not so much about minimalism. I feel that minimalism semantically conveys, "the absolute bare minimum possible." Whereas I like to see the design goal as, "what is necessary to fulfill the required purpose."

Shameless little plug here, this is a little experiment I've been working on:

erictheread.org

<comment><USER15> if it had [?] == list of keyboard accelerators, and honours the vi hjkl/asdf type keying for steerage, it would be better.

if it did that, and had some elements at top and bottom of the list, so you can [more] even from the top of the new view..

<comment><USER14> I could not agree more; especially with the vi advice. I'm still a work in progress, but I agree this would be cool. (I have `ESC` remapped to `JJ` and I find myself trying to exit insert mode in emails, papers, etc. all the time...)

I've also structured the site in a way so that it kind of has a schema for each article and the next step was to write a little client so one could read from a terminal.

Baked into my design philosophy is "reuse" hence not opting for a custom light-to-dark-toggle. Thanks for this though, I'd just reminds me I gotta keep it up ha. Do you think browsing in the terminal would be a hassle for people?

I'm also trying not to go too far overboard, thanks!

<comment><USER15> _Do you think browsing in the terminal would be a hassle for people?_

No. the basics of the site make this close to zero cost and proof-by-example is the alternate textual views of the site which just work (tm)

I am trying not to be a google fanboi, but the ubiquitous consistency of keyboard accelerators in gmail, photos, docs, &c by google is one of the reasons I enjoy using their tools. They "get" keyboard warriors, in the browser.

<comment><USER14> I like that. I feel similarly towards apple products. The consistency of these google products &/or the seamless-ness of apple products means that I can focus on what's important to me.

Good tools feel like good tools. Had to re-read,"ubiquitous consistency," nice. Thanks for the value added.

</comment></comment></comment></comment></comment><comment><USER16> Search for "minimalist design timeless google" and you'll find an endless number of posts exactly like this one. Bloating the web with these copycat posts isn't very minimalist.

<comment><USER17> The same could be said about pretty much every link on Hacker News. Do we need more posts about:

\- The death of personal websites?

\- Decentralized social networks?

\- Setting up a static website with Hugo/Jekyll?

\- Why we did X in Julia/Rust/Go and not [commonly used framework]?

</comment></comment><comment><USER18> I'm going to be honest, one thing I wish we could leave behind as we enter the 2020s is this obsession with flat/material and minimalist design as some kind of profound one size fits all design ethos that you can build your entire professional self around.

Don't get me wrong. There are plenty of occasions where so-called minimalist layouts are perfectly appropriate. Most of the lessons at the core of it are absolutely fundamental to design. And what it replaced, the very brief period of corporate skeuomorphic design was never that great and in my opinion had much more to do with companies wanting to showoff their fancy new technology than designing anything great in its own right.

However, I despair when I think of the amount of young designers who know nothing else and can barely imagine a life without the strict framework of minimalism and its accepted practices. They will never know the feeling of going off the beaten path and discovering something cool and valuable, because your inner minimalist has long since shot down that line of thought as frivolous self-indulgence. Only minimalist self-indulgence is accepted.

I'm sure most people here can agree that the web is kind of in a sad state right now. We're using staggering amounts of man-hours to run this thing. An enormous bloated stack of technologies maintained by a horde of programmers just so that designers can spend their days meticulously handcrafting minimalist websites that pretty much look the same and do the same thing, while being far heavier than they have any reason to be.

I can appreciate the programmers who build perfectly optimized "programmer minimalist" personal websites, but at the end of the day, I think that just amounts to a lot of really nice sandcastles. How do we translate that to the real world?

I'm hoping 2020s could be a decade when people get real about moving forward. Less aping of aesthetics and technologies from the 60s and 70s. More of productive experimentation, like in the 60s and 70s.

</comment><comment><USER19> Here's my take on minimalism, expressed as website design goals: [https://www.calebyers.com/blog/website-design- goals.html](https://www.calebyers.com/blog/website-design-goals.html)

</comment><comment><USER17> The article doesn't say anything about considering the needs of your users. It's a design choice unencumbered by the realities of your business.

Google's home page. What is this, 1999? Users spend just as much time on Youtube as they do on Google, and YT's interface is the opposite of "minimal". Even Google's SERP is littered with ads, and they're shown inline with regular search results.

</comment><comment><USER20> Website with white body text on black background wants to lecture me on design. Pass.

</comment><comment><USER21> The website does not implement what it advocates:

\- Scroll bar on left.. why?

\- superfluous links

\- messy typography

\- overly contrasty colour scheme.

<comment><USER22> Plus a javascript pop-up that shows when you highlight text with an option to copy the selection. Isn't that what the right click menu is for?

</comment></comment><comment><USER23> It looks like the playable version is down now, but this was my favorite game in 2014: [https://www.awwwards.com/sites/flat-design-vs- realism](https://www.awwwards.com/sites/flat-design-vs-realism)

Edit: 2014

</comment><comment><USER24> Be minimal design to avoid CSS and JavaScripts and usually pictures too. Do not specify your own fonts or colours. (There are sometimes cases to do otherwise, but normally you should not need to add all of that stuff.)

</comment><comment><USER25> My personal/company website is pretty minimalist, I wish I could keep all my sites and apps this simple

[https://redskyforge.com/](https://redskyforge.com/)

<comment><USER26> That background is a bit heavy. That 2 MB image could be less than 400k and still look OK.

</comment></comment><comment><USER27> Shameless plug [https://www.leanternet.com/principles/](https://www.leanternet.com/principles/)

</comment><comment><USER28> I really like data-first approach. For example, I scaffold everything in Rails, make it work with all the features then I proceed to edit fully the views, etc.

</comment><comment><USER29> [https://beta.trimread.com](https://beta.trimread.com)

No JS. Actual minimalism.

</comment><comment><USER30> Except Google, all the websites listed as example got more crowded in the last 3.5 years

</comment><comment><USER31> Personally I think the line spacing in that article is too much.</comment>


Lean Startups suck. Here are 10 reasons why… - <AUTHOR> http://nanodome.wordpress.com/2011/10/05/lean-startups-suck-here-are-10-reasons-why/

<comment><USER2> Lean Startup is some shady thing pushed through blogspam to the masses. This self-help industry is trying to create a science out of everything.</comment>


Crime is a Family Affair - <AUTHOR> https://www.theatlantic.com/family/archive/2018/10/crime-runs-family/573394/ <comment><USER2> Felon here. Like the article describes, my father was arrested and jailed, and his father before him. Many of my family have spent time in prison. When I turned 18, I also shared the same experience. Less than a year in min security prison.

Now I'm 35, moved away from my troubled youth, and have made millions of dollars building startups.

A few points:

\- To this day, I am terrified to speak to police or any authority figures. I sweat every time I pass through passport control when my wife and I go to Europe every summer.

\- I can't break my "guarded" way of thinking, that everyone is out to get me, that I need to take what I can when I have the chance because the chance won't come around again. I am never relaxed.

\- I have a 4 year old and not a day goes by that I don't spend working with him to provide things I never had. The fact that I can afford to send him to piano lessons or that we can afford to live in the "rich" part of town makes me emotional.

\- I lost every part of my childhood. My parents are ghosts and my friends from then are long sense forgotten. Some people go back to their home town to feel nostalgic, but all I do is feel anger. I am angry every day.

\- Many people are afraid to take risks for their careers, but as an ex- convict who spent over a year as a homeless person, I feel no fear. Moving across the country when I have no money, sleeping at my desk to launch a product due the next day, giving a speech in front of 1000 people, or aggressively gunning for a better company is nothing compared to begging someone for their half eaten sandwich. That's true fear.

Even the ones who escape a criminal family never really escape.

<comment><USER3> My father is a felon, and his father before him, and most of my uncles (one is even a convicted murderer). I didn't follow in their footsteps -- never even gotten so much as a speeding ticket.

The funny thing is I can completely relate. I had to cut off my father's family from my life to escape; all police make me nervous as I think they will arrest me; every interaction I have with non-best-of-friends is "fuck you, I'm getting mine".

I'm not sure how many generations it takes to escape the mentality, but I'm hoping my sons aren't the same way.

</comment></comment><comment><USER4> > a possible biological or genetic basis for crime could be misconstrued as > racism.

But what if it is isn't and it is something like impulsivity? I know someone who worked for a large state prison system for many years. They've observed one common trait of the majority of people incarcerated is that they are very impulsive. They react rather than think things through. Often they regret the crime, but could be too late by then [+].

However the same impulsivity is also a trait of someone we might consider a "hero". Say someone jumping into the river or a fire to rescue a person, a salesperson quickly responding to a customer need and so on. Someone quickly responding and standing up to a bully to defend someone being abused.

At the genetic level it could be the same low level drive, but family, society and culture have a chance of molding that into either something good or destructive.

[+] There is a lot to be said there for the society and the correctional system being punitive and not much correctional per se, and mental illness playing large role as well but that's for a different post perhaps.

<comment><USER5> Yeah, I found that strange. One of the things that stuck with me from reading "How Children Succeed"[0] was that violence/ crises in the household tend to make kids impulsive and short-sighted in decision making. The idea kids who grow up around criminal parents would wind up doing the same because of modeling and the likelihood of violence or other frightening events like being put in foster care makes sense to me and doesn't have to have a biological underpinning to be true.

[0] [http://www.paultough.com/the-books/how-children- succeed/](http://www.paultough.com/the-books/how-children-succeed/)

<comment><USER6> Factors like this mean that the heritability of such things is even larger than the purely genetic effect, as the "nurture" part i.e. home environment also is quite hereditary.

</comment></comment></comment><comment><USER7> The article traces the Bogle's family start in crime back to the Prohibition era. While there are, of course, a host of reasons why people become criminals, ridiculous laws are a contributing factor. The War on (some) Drugs is repeating the same behavior and expecting different results. It's well past time to end it, along with the human devastation it causes.

<comment><USER8> "Tracey Bogle, who served a 16-year prison sentence for kidnapping, armed robbery, assault, car theft, and sexual assault"

Yeah, he'd be a saint if drugs were legal.

<comment><USER9> The article is scant on details, but if the ancestor's only crime during Prohibition was bootlegging, then actually, it's possible Prohibition caused generations of other crimes that wouldn't have happened otherwise.

<comment><USER8> Then we should also get rid of the prohibition on ivory- after all, think of all of those future generations of criminals we're creating by jailing poachers.

<comment><USER10> its not the same thing at all, and your argument is logically fallacious because of it. A person consuming a drug violates no other beings rights. This is obviously not true about ivory poaching.

<comment><USER8> The fallacy is defining all crimes as drug crimes, then saying legalizing drugs will end all crime. Might as well legalize violence directly.

<comment><USER9> But actually, crime IS crime, in important ways. Put it this way; marijuana can be a "gateway drug" without being addictive, because people who are _willing to break the law and social norms_ to do one thing are the kind of people who might break the law and social norms to do another thing; it's correlation in that case, though. To extent the analogy, maybe now the marijuana user's child begins using marijuana because their parents did, but then they move on to hard drugs. Their willingness to break the law and social norms in one way made them more open to doing so in another way.

Same thing here; if you create too many victimless crimes, children of 'crime' may grow up to do crimes that actually have victims.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> > "We need another solution," [Judge Norblad] told me, "something to separate > Bogle family members so they will not keep reinfecting themselves." Norblad, > who died in 2014, did not know how to do that.

Once upon a time judges could kick offenders out of their jurisdiction or a state entirely. I think this was eventually deemed unconstitutional, though I can't find any on-point caselaw and suspect it simply fell out of favor and assumed unconstitutional. IIRC the closest scholarly analysis I could find at the time (~10 years ago) discussed a governor's right to impose conditions on a pardon, and in particular the condition that one leave the state, which concluded that it was probably still constitutional because of how extensive is the pardon power.

In the 1960s or 1970s a relative of mine was kicked out of Wisconsin by an exasperated judge after drunkly shooting up a yacht in search of rumored hidden money; receiving a suspended sentence as long as he never set foot in Wisconsin again. He was happy to leave and both he and Wisconsin were probably the better for it. He was only in Wisconsin temporarily so it's not like Wisconsin exported its problems, either.

EDIT: 2013 Slate article on banishment and exile: [https://slate.com/news-and- politics/2013/01/banishment-as-pu...](https://slate.com/news-and- politics/2013/01/banishment-as-punishment-is-it-constitutional-for-states-to- exile-criminals.html)

<comment> barrow-rider I know at least one dude banned from the city of Richmond.

Anecdotally it worked, and he's now quite a successful programmer, married, kids, decent house, etc.

</comment></comment><comment><USER12> "Yet, despite the abundance of evidence showing the role of family in crime, criminologists and policymakers have largely neglected this factor—as the University of Maryland criminologist John Laub told me, it's because any suggestion of a possible biological or genetic basis for crime could be misconstrued as racism."

How exactly does a family connection imply a biological basis? Did nature defeat nurture when I wasn't looking? or is this just a poorly written sentence implying that connecting the two could then result in ascribing the trait to biology, and so was avoided?

<comment><USER13> > How exactly does a family connection imply a biological basis?

...because most families have a biological connection?

I don't believe it's poorly written, but the truth is closer to your third question.

Race is a very touchy subject, especially when it comes to crime, and making it known that you're looking into something that could lead to biological/genetic assertions about criminality is a good way to draw unpleasant attention.

</comment></comment><comment><USER14> Odd how many parallels this has to the "Jukes family" study that was used to justify eugenics.

[https://en.m.wikipedia.org/wiki/Jukes_family](https://en.m.wikipedia.org/wiki/Jukes_family)

</comment><comment><USER15> > as the University of Maryland criminologist John Laub told me, it's because > any suggestion of a possible biological or genetic basis for crime could be > misconstrued as racism.

Or, it is because biological and genetic factors aren't as powerful at predicting crime as other factors. The idea that crime runs in families indicates a biological factor in crime is nonsense. Families and children that start in lower deciles of wealth are likely to stay there. Social mobility is awful.

<comment><USER16> Seriously. I would say that also applies over to the author's claim that "doctors produce doctors, lawyers produce lawyers", etc. Sure, kids whose parents/relatives have forged a career in a particular industry have a much easier time making their way in, I would seriously doubt that genetics are a major factor other than general cognitive ability.

<comment><USER6> IIRC studies about career choice imply that "doctors produce doctors, lawyers produce lawyers" is somewhat true, however, not because ability (there was no evidence that there's much specialized ability, someone who has the qualities where they're likely going to be a good doctor is also likely to be a good lawyer and vice versa), but because career choice is highly influenced by the options you consider, by the choices that seem "normal" in your community, and that is highly influenced by having parents/relatives in that field.

</comment></comment></comment><comment><USER17> Err nope.

My Grandfather was a sex offender and my Uncle is a convicted Armed Bank Robber.

The rest of the family has their problems like all families do. Mostly recovering from abuse of the previous two guys.

What is a bigger problem (especially in the UK) is welfare dependence which does become a family thing.

<comment><USER18> > Err nope.

This is kind of a flippant dismissal based on the multiple findings backed up by numbers. Yours may be an anecdotal story (and not my place to comment on) but there's no evidence that welfare dependence causes crime. It seems to be more of a political talking point. There may very well be a correlation, but it doesn't imply causation.

<comment><USER17> Sorry welfare dependence does cause crime.

Almost all of my step family on the Isle of Wight (this in the UK) are doing this along with most of their friends.

I know what I saw with my own eyes. I know what some women have said "I can get X amount if I have another kid". I also know that almost all of my step brothers and step sisters abuse the welfare system mainly by having children with other people.

Telling me that it doesn't happen, when I know it blatantly does and then telling me it doesn't because of some academic release that for all we know probably hasn't been peer reviewer properly. A slight aside ... some dudes managed to get Mein Karph through peer review recently by changing the wording slightly.

Also guess the arrest rate for my step family? The first day I met them they got arrested. Every-time I hear something about them one of them or their mates or both have got arrested.

You know what the connecting thing is ... they are all on welfare and their parents were drunks and lived off of welfare on the Island because there are no jobs.

<comment><USER19> The poster above was respectful that they would not comment on your experiences, merely that a single persons experiences does not defy statistical data results. To argue further with more personal experiences does not adequately address the concern...

<comment><USER17> LOL. This is the problem with you guys. I don't care if he is respectful

Sometimes what is right in front of your face is true. That is why stereotypes exist.

No one has addressed the point I made. Just saying it in anecdotal when I have observed it in a number of instances by myself is incorrect. I am not saying it is one personal experience. I am saying it is a pattern I have seen 5 or 6 times myself and I have seen it as a recurring theme in news etc.

BTW I have been programming computers for 15 years. There are these things called Heuristics. They are based on experience. I am sure a lot of people would be will to agree with a lot of programming Heuristics ... but when it comes to something else ... it must be much higher bar all of a sudden.

<comment><USER20> "Anecdotal" doesn't mean "happened once" or even "wrong". Anecdotal means that's it's a relation of personal experiences filtered through memory. That's fine.

Evidence that meets scientific or academic standards is different than anecdote. Such data is gathered in a way that tries to minimize biases, and analyzed in a way that tries to account for random chance, and then presented with quantitative precision.

For example, suppose I saw an article saying that men are typically taller than women. "Nope" I reply. "My sister is taller than I am. My cousin is taller than her brother, my aunt is taller than my dad." That may so be true, but it doesn't refute the general claim that is backed by real data.

There's nothing wrong with telling about your personal circumstances. There is something wrong with imagining that your personal circumstances invalidate or even compare to real research.

You suggested that you are familiar with heuristics. To put things in those terms - the heuristic of using anecdotes and stereotypes may well produce better results for life's decisions than random chance would. Using real research and analysis to inform decisions is likely a better heuristic than anecdotes and prejudices though.</comment></comment></comment></comment></comment></comment>


Ask HN: what can be done with barcodes? - <AUTHOR>

What would you like to see done with barcodes?  How can they be leveraged to make shopping easier, more efficient, more fun? <comment><USER2> How about <http://news.ycombinator.com/item?id=2464063>

</comment><comment><USER3> oh, I could think of something...

convince the major (big box) retailers to provide an access point, so that you can price scan with your smart phone, instead of having to hunt all over the store for a working scanner. places like walmart, target, kmart, bestbuy, etc, etc could all benefit from this.</comment>


Alma Deutscher (12yo), piano concerto world premiere (2017) - <AUTHOR> https://www.youtube.com/watch?v=bWlAgksUQyo <comment><AUTHOR> The YouTube algorithm made this recommendation to me today. I'm beyond speechless at her talent, regardless of age, which in and of itself is remarkable!</comment>