Ask HN: Cases where software patents have prevented progress? - <AUTHOR>

A student writing a thesis about software patents emailed me asking about cases "in which having a patent on an algorithm prevented some significant technological progress."  HN seemed the best place to find answers.  What are the clearest examples of this happening, and how much did they slow things down? <comment><USER2> I have a couple of examples from my personal experience, neither earth- shattering, but when you consider X million engineers running into similar issues, the cumulative tax on innovation is pretty large.

Working on F1 '98, we had to scrap a whole training mode where you'd see your time compared to previous laps because lawyers were concerned it overlapped with the Atari 'ghost car' patent:

<http://kotaku.com/270035/patents-are-interesting-ghost-mode>

We spent a lot of time and energy trying to work around this, we weren't showing any kind of ghost car, just a time indication, but apparently the patent was broad enough to cover any kind of comparison.

The second was a patent on controlling any kind of video effect based on a sound input(!). This severely constrained what we could do on a major video- processing package, forcing us to avoid some features. They tried to extort independent developers out of a lot of cash, despite being a painfully obvious idea that had been around for decades before the patent was filed:

<http://www.trapcode.com/US_SK_advisory.html>

</comment><comment><USER3> Xerox Parc has a patent on a type of filter viewer that acts like a looking glass to see the effect of the filter. Every year, someone reinvents it and presents it at some HCI conference, only to be told they can't use it. They are sitting on it, not building it, and also enforcing it.

SIFT is a vision technique that is patented and works very well. Patents are getting in the way of commercial progress [http://en.wikipedia.org/wiki/Scale- invariant_feature_transfo...](http://en.wikipedia.org/wiki/Scale- invariant_feature_transform)

Amazon Onc-Click is an absurd patent. If we grew to scale, Tipjoy would probably have had to pay them money, like Apple does.

<comment><USER4> Does Amazon actually enforce that? My understanding (perhaps incorrect) was that they quit after the hubbub when they tried it on Barnes and Noble. Also, isn't Bezos notoriously opposed to software patents?

<comment><USER5> Beso et al. are bullies. btw:

<http://webshop.ffii.org/>

"Reback often tells the story of how a team of IBM patent lawyers went to Sun Microsystems Inc. in the 1980s and claimed that the then start-up was infringing on seven of its patents. After Sun engineers explained why they were not infringing, the IBM lawyers responded that with 10,000 patents, they would be sure to find some infringement somewhere." The Washington Post

"One could be tempted to consider ever stricter IP protection regimes to provide ever more stimuli for innovation. This conclusion is wrong, however. A prime example is patents on software, which might at first sight be seen as a logical expansion of the classic technology patent. But creating software differs markedly from creating machinery and the like." Deutsche Bank Research

"If people had understood how patents would be granted when most of today's ideas were invented and had taken out patents, the industry would be at a complete standstill today." Bill Gates (1991)

"The world's patent systems need reform so that innovation can be properly rewarded. (...) It is becoming ever more apparent that the patent system isn't working." The Economist (11 November 2004)

"Building up a patent portfolio by engaging in defensive patenting cannot always protect against hold-up." Federal Trade Commission of the USA

"More patents in more industries and with greater breadth are not always the best ways to maximize consumer welfare." Federal Trade Commission of the USA

"The mild regime of IP protection in the past has led to a very innovative and competitive software industry with low entry barriers. A software patent, which serves to protect inventions of a non-technical nature, could kill the high innovation rate." PriceWaterhouseCoopers

"SMEs are crucial providers of pathbreaking innovations, but would be most adversely affected by patentability. The majority of them is deterred by the costs of patenting themselves, but would have to navigate around software patent portfolios of large corporations." Deutsche Bank Research

"Many large companies operating on a global scale, including European ones, seem to be in favour of a software patenting regime. But most small enterprises are strongly opposed." PriceWaterhouseCoopers

Microsoft Corp. warned Asian governments on Thursday they could face patent lawsuits for using the Linux operating system instead of its Windows software. Reuters (18 November 2004)

"A future start-up with no patents of its own will be forced to pay whatever price the giants choose to impose. That price might be high: Established companies have an interest in excluding future competitors." Bill Gates (1991)

"Patent law provides to inventors an exclusive right to new technology in return for publication of the technology. This is not appropriate for industries such as software development in which innovations occur rapidly, can be made without a substantial capital investment, and tend to be creative combinations of previously-known techniques." Oracle Corporation Patent Policy

<comment><USER4> Wow was that off topic.

Guy A: "Doesn't Amazon get software patents mainly to protect themselves rather than enforce them?"

Guy B: "Here's a long, extensive list of actions by other companies proving that software patents are evil!"

Sometimes I think people need to drink less Kool-Aid.

<comment><USER5> Read B again, and recognize that there is no such thing as a software patent "mainly to protect themselves". Consider the patent portfolio effect right from the first, wsj quote.

<comment><USER4> That you can find examples of people abusing patents is not proof that all patents exist to be abused.

<comment><USER6> It is hard to tell either way until the engineers in a startup have created the "infringing" technology and it is well established in the marketplace.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> One thing that's difficult to measure but probably not trivial is the overall cooling effect. What I mean is that the tangible cases in which patents really ran into conflict don't indicate the number of cases in which technologies were never researched to begin with because of the risk of infringing a patent.

The cooling effect probably isn't significant for the mythical basement hacker who does it for love, but decisions about what research to pursue are made all the time in larger companies, and one of the factors is potential for legal trouble.

<comment><USER8> This is an excellent point. Basically the patent minefield concept. The insanity of software patents has created an overall sense of fear. There is no way to quantify this aspect of patents' negative effect on progress.

</comment></comment><comment><USER9> Microsoft's long filename in FAT filesystem patent was recently threatened against TomTom (<http://lwn.net/Articles/320737/>).

Instead of working on new features (whatever they may have been), TomTom must instead commit resources to working around the patent.

<comment><USER10> Excellent example.

Many camera manufacturers faced similar obstacles, and ended up fragmenting the market with proprietary formats or paying the 'microsoft tax'.

</comment></comment><comment><USER11> I would point to the current HTML5 video element debacle:

[http://lists.whatwg.org/htdig.cgi/whatwg- whatwg.org/2009-Jun...](http://lists.whatwg.org/htdig.cgi/whatwg- whatwg.org/2009-June/020620.html)

Patents are playing a large role in ensuring that what could be a wonderful thing for the web will almost certainly not be.

<comment><USER9> I'd say that HTML5 is the tip of that particular iceberg.

I mean, what was HTML 5 supposed to change? The fact that video (and audio) is broken on the web, leaving to flash as the closed de-facto standard. The whole situation that HTML5 was supposed to fix is, itself, a result of codec licensing/patent issues.

I'd venture that without those issues, the <object> and <embed> tags would have had a bigger impact.

<comment><USER12> _I mean, what was HTML 5 supposed to change?_

Nothing. It was supposed to be, and is, a description of what browsers actually implement in common, just like every other HTML spec before it.

</comment></comment></comment><comment><USER13> Singular Value Decomposition was held back for 20 years by patents owned by BellCore. I had to scrap large interesting portions of Dowser to avoid potential problems.

As a counterexample, Autonomy has a patent on Bayesian text classification dating from the late 90's. I've always wondered why they didn't say anything after Paul popularized it for spam filtering.

</comment><comment><USER14> Elliptic curve cryptography and LDPC codes are two that come to mind.

Though afaik the latter hasn't really been improved since ~1960 and were only patented after rediscovering them in 1993, and I have no clue whether progress in elliptic curve cryptography stalled due to patents or because they don't offer any practical benefits over RSA.

</comment><comment><USER10> The GIF patent is the first one that comes to mind.

A more recent one is Acacias patent on video transmission via networks and this gem: [http://arstechnica.com/tech-policy/news/2007/04/acacia- claim...](http://arstechnica.com/tech-policy/news/2007/04/acacia-claims- patent-on-cd-hyperlinks-sues-for-billions.ars)

Are there cases where software patents can be proven to have fostered innovation?

<comment><USER15> Except moving to PNG _was_ progress...

<comment><USER10> It could have been a backwards compatible extension to GIF instead.

More formats = fragmentation = consumer confusion and problems.

Progress is not a single variable either, there are plenty of ways that you can define progress that are more or less orthogonal to each other.

Forward, sideways and 'up' are all movements that you can interpret as 'progress' depending on where you are and where you want to be.

From that point of view PNG was sideways and 'around' rather than forward.

Any kind of dataformat, any kind of protocol, anything that is not a completely closed box that performs a function (an 'appliance') should be as open as possible.

And that should be enshrined in law, interfaces and formats are automatically in the public domain, and have to be documented.

PNG as a GIF replacement is superior, for most applications. But if you think in terms of browser support then you could interpret it as a step back during the introduction phase as well.

<comment><USER16> I'll back this up. Been banging my head against a brick wall because WindowsCE doesn't load .pngs properly..... sometimes (it's one of _those_).

Convert to .jpg and everything is fine.

<comment><USER17> Yes, but .jpg is not always what you want. The artifacts can look ugly on schematic drawings.

</comment></comment></comment></comment></comment><comment><USER18> Blackboard's patents come to mind.

<comment><USER19> They ended up losing a lot of those claims recently if I recall correctly, but that being said I agree for a long time it did and still does hurt the LMS environment.

[http://mfeldstein.com/all-44-blackboard-patent-claims- invali...](http://mfeldstein.com/all-44-blackboard-patent-claims-invalidated- by-uspto/) (2008)

</comment></comment><comment><USER20> I still don't know what the issue with supporting multi-touch devices in North America is but I strongly suspect it's because of software patents. Anytime a corporate rep is asked why their device doesn't support it they hem and haw and say that it's complicated but never give a real answer.

</comment><comment><USER21> There is a ton of really interesting and cool stuff that was done in wavelet research years ago which got patented and hasn't really seen the light of day in the way it should.

If the patents hadn't existed I'm sure we'd now have much better widely available voice recognition, image recognition, and related data processing software than we do now.

</comment><comment><USER22> During development of Doom 3, id Software fell into a bit of a patent conflict with Creative. Relevant snippet from <http://en.wikipedia.org/wiki/Doom_3>:

"A week before the game's release, it became known that an agreement to include EAX audio technology in Doom 3 reached by id Software and Creative Labs was heavily influenced by a software patent owned by the latter company. The patent dealt with a technique for rendering shadows called Carmack's Reverse, which was developed independently by both John Carmack and programmers at Creative Labs. id Software would have placed themselves under legal liability for using the technique in the finished game, so to defuse the issue, id Software agreed to license Creative Labs sound technologies in exchange for indemnification against lawsuits."

I remember something about Carmack coming up with a workaround that paid a performance penalty so others licensing their engine could bypass the Creative mess.

Creative has also taken quite a bit of heat over the years for sitting on Aureal's IP and stifling innovation in sound technology, but I don't have specific examples to cite.

</comment><comment><USER23> I worked at a company called Pica9, generating PDFs on the fly. Another company has the patent on that, so we had to spend a considerable amount of effort working around it, making sub-optimal choices at easy decision point in order to make it legal.

</comment><comment><USER24> The most obvious one that comes to mind is LZW, which basically killed the entire compression scheme.

</comment><comment><USER25> This question is circular.

The potential "technological progress" doesn't exist because it was thwarted by software patents, so there really is no way of knowing what doesn't exist because it couldn't be created to begin with.

So, are you asking us what things don't exist?

<comment><AUTHOR> No; the question asks what things _would have existed._ This is a concept people use all the time in everyday life without provoking ontological crises. E.g. if you say "he would have scored a touchdown if that last defender hadn't tackled him," everyone knows exactly what you mean. You can never be 100% certain about things that would have happened, so you qualify your conclusions, but it's not the case that you can't reasonably talk about such things.

I can't believe I just had to write that. This is why forums are such a time sink. If you were watching a football game with your friends and someone said "he would have scored if that guy hadn't tackled him" and you replied "how can you talk about touchdowns that don't exist?" everyone else would just roll their eyes and not invite you over anymore. But here in the world of text these subtly graduated social cues don't exist; all you can do is reply with more text. I wonder if there is some kind of solution to that.

<comment><USER26> > This is a concept people use all the time in everyday life without provoking > ontological crises.

+1 for common sense; however:

> This is why forums are such a time sink.

I doubt that you can realize the benefits of an open forum without paying what we might call the _free speech tax_ \- the inevitable disruptions of pedantry and/or trolling, which under the right circumstances are insightful and even revelatory.

<comment><USER27> Sadly, you're probably right. What's depressing is that HN wasn't like that for a very long time (2 or 3 years, maybe?), but it seems to be descending into a Reddit-like cesspool of crazy very rapidly.

Having said that, this is still by far the best non-trivial online community that I know of.

EDIT: Wow... downvoted in 4 minutes, for a mostly harmless comment. I guess we've become closer to Reddit than I thought. I normally hate elitist groups, but there's a part of me that would like to see every account newer than, say, 200 days just get nuked. <sigh>... I really loved this site.

<comment><USER26> Please note that I'm not saying HN is turning into reddit - I don't believe my score is high enough for me to be allowed to make that claim. (I do believe HN would benefit from a measure of reddit-style levity: right now it's all Serious Business, all the time.)

What I'm saying is that real constructive critical debate _requires_ strong- willed, pedantic, even curmudgeonly debaters. The marketplace of ideas doesn't work without the push and pull of challenges, refutations and even meta- refutations ('You're asking the wrong question').

If Paul Graham wants good answers to his question, the price he has to pay is an allotment of bad answers - answers that are revealed as such on the marketplace of ideas. You can't get the good stuff without also allowing the bad stuff (and having reasonable filters to distinguish them).

P.S. Not sure why I was downvoted for my comment above.

</comment></comment></comment></comment></comment><comment><USER28> By progress do you mean creation of new technology or making technology available? A case I followed (involving infringement on a fingerprint recognition patent) shows how even weak patents slow the development process.

Summary - Small company receives patent, sues large companies for infringement, two years and more than a million dollars later patent is invalidated, technology moves on. All the gory details here:

[http://www.legalmetric.com/cases/patent/utd/utd_206cv00115.h...](http://www.legalmetric.com/cases/patent/utd/utd_206cv00115.html)

</comment><comment><USER29> It's been speculated that Apple dropped ZFS due to patent concerns.

<comment><USER30> Yeah, the NetApp-Sun ZFS lawsuit is like a big "patent minefield here" sign.

</comment></comment><comment><USER31> Were there patents on compression algorithms? Are there any weird things Linux has to do to work around patents?

<comment><USER32> In general, anywhere you find Huffman coding being done, it could achieve superior compression with Arithmetic Coding but is not because of IBM's patents.

This is essentially every JPEG image on the planet. The standard provides for arithmetic coding, but no one implements it because of the patent. Wikipedia asserts that arithmetic coding saves about 5% of the files size.

So that is 5% of every flash card sold for a camera wasted and 5% of the bandwidth costs for images on the internet wasted.

If GATT hadn't tacked on three more years in 1995 these would have expired by now, but it looks like 2012 or 2013 is the date now.

The MPEG series of standards probably could also have benefited similarly from Arithmetic Coding.

<comment><USER17> And isn't MPEG (or at least mp3) covered in patents, too?

<comment><USER32> There are about 1000 patents covering MPEG. Just the MPEG2 list runs 36 pages.

But maybe YouTube could be saving 5% of their bandwidth bills if arithmetic coding weren't patented.

<comment><USER17> Or at least if the patents weren't enforced.

</comment></comment></comment></comment></comment><comment><USER33> Not an example, but there are many cases of people "working around" a patent. In this case, it is a _spur_ to technological progress. That is, preventing progress can encourage progress.

There's a "prospect" theory for patenting (which with this student is probably familiar), that a patent is like staking a claim to minerals, with a samilar effect: that it encourages others to stake claims nearby, and so explore that region. If others could use the same area as the patent, they wouldn't be encouraged to explore, and you'd get a technological monoculture (in another sense, this would be greater _progress_ , in that it is more widely adopted).

I've been trying to think of an example, but I can't. I think the main way a patent can block progress is if the technology is not exploited well by the owner (like smalltalk being too expensive), and in such cases, we don't hear of it. When a patented technology is exploited successfully, money and time is reinvested in developing it, so that progress on it is accelerated.

<comment><USER17> However --- imagine that the claims on minerals would be hard to see [1], and accidental violation would put you at great legal risk. Then people might get discouraged from staking claims in that general region.

[1] It's not easy to look through all the patents before building anything --- and may even be harmful to your legal position.

</comment></comment><comment><USER34> Apple's patents on sub-pixel text anti-aliasing. The text in both Windows and Linux looks hideous by comparison. You can enable these features in certain situations on Linux with extra packages, though.

 _Correctional update: Microsoft holds patents in this area but Apple has a cross-licensing agreement on them._

<comment><USER35> Apple has patents on truetype hinting, not subpixel anti-aliasing. Ironically, when working around this patent, it is easier to get results similar the OSX, rather than similar to Windows.

<comment><USER36> The patent covers the bytecode interpreter that reads the hinting instructions in the truetype file, not the hinting itself.

</comment></comment></comment><comment><USER37> it's hard to find any examples where patents have stiffled innovation. Of all the hundreds or millions of patents it's only possible to find very few if any historical examples where patents stifle innovation.

What patents do achieve is exactly what they are there for. which is to protect the inventor of something usefull for a period of time.

If you want to use innovation that has patent protection, you should reward the person who invented it, OR invent something better youreself.

That applices to things like Ogg Thorbis, where new technologies were developed in spite of patents. If there were not patents on MPEG Ogg would not have been innovated.

Same with file systems, if there were no patentson NTFS or FAT, then why would ext3 and so on mabey would not be where they are now.

Fact is patents are there for a reason, (apart from it being law). They appear to work, and they dont appear to be affecting innovation to any degree.

Sure, there are groups who would be happy to ride the coat tails of others innovations and inventions. But that is only so they are not able to innovate themselves. They like something that works, and have a 'me too' attitude.

(why should someone else get rich, when I can copy that and get rich as well).

</comment><comment><USER38> I would direct the student to the working Paper by James Besser and Eric Maskin, Sequential Innovation, Patents, and Imitation, which builds an economic argument against software patents. It and other relevant papers on software patents are available at <http://www.researchoninnovation.org/>.

</comment><comment><USER39> <http://mises.org/story/3280>

<comment><USER40> That was one I was going to mention, along with the Wright Brothers, before I reread the question and realised it was only software patents they were interested in. Still fascinating how people that I'd always heard venerated as inventors could have spent so much time and energy holding other people back.

</comment></comment><comment><USER41> <http://en.wikipedia.org/wiki/Marching_cubes#Patent_issues>

</comment><comment><USER42> Not software patents, but SCO v. Novell is certainly relevant as an example of commercial/legal forces hampering process.

</comment><comment><USER43> There certainly have been cases where alleged software patent violations result in lawsuits. There the lawyers get rich while very senior engineers cool their heels in court or give depositions in places unusual, uncomfortable, and distant.

I don't know how measurable this is but it is patently obvious it is preventing progress.

<comment><USER44> Sorry, no time to do the legwork to see if this would work, but I wonder if this "wastage" could be crudely measured by taking some aggregate number of patent related lawsuits per year, multiplying by some factor to include those settled out of court, multipy again by a conservative mean cost of a patent action (attack, defense, commonwealth) == $wasted/year.</comment></comment>


Ask HN: "Expert Level" JavaScript questions? - <AUTHOR> I'm just curious what kind of in depth, JavaScript specific questions you've seen before or asked candidates. I'm working up the courage to apply for senior roles, but I'm terrified of looking stupid not knowing about XYZ technical thing that 99% of devs don't know. <comment><USER2> A good interviewer will start at a high level and drill down into what you're experienced with, rather than pick an obscure topic and assume you've done your homework.

For example, they might ask for a hard problem you've recently solved in your last company.

If you say something related to code splitting, you can expect he'll drill down more specifically into webpack, dependency cycles, etc.

If you say something related to frameworks, you'll get questions asking you to back up the choices you've made. Was it mainly developer productivity or performance you optimized? If you say performance, how did you measure? What metrics are you logging?

...

You should prepare by just reviewing hard problems you've done and brushing up on aspects of it you might've forgotten or remind yourself what was difficult about it.

This applies to the coding portion of your interview as well. If you write "===", you should be able to answer what that's for. If you use ".bind(this)", you should know why you had to bind it. For this portion, you can prepare by looking at code you've written and trying to pick out those parts which you never bothered to figure out but always "just did" (e.g. for many people, the === is just something they do because they see it everywhere).

<comment><USER3> As an interviewer, you don't even exactly have to be an expert. Maybe you have no clue what .bind does. But you will learn a ton about the candidate by listening to them teach you about it.

<comment><USER4> My favorite interviews (both as the interviewer and interviewee) are the ones where I end up learning a lot from the other person. I love when a candidate mentions some technology I'm not familiar with, and then I get to make them teach me all about it.

</comment></comment></comment><comment><USER5> "here's a high-level description of a fictional product. Let's have a discussion about where you start, what kind of technical and and design discussion you make and what goes through your head as you would theoretically tackle this project".

Not exactly what you want, but that's still what I'd ask.

That will tell me more about the candidate's abilities than syntax questions or other silly things like that. INCLUDING how good they are at syntax and silly things (the way they speak will show it).

What I like about these kind of open-ended problems, is that it accounts for variety of backgrounds and skillsets. People can surprise you with solutions and ideas you'd never have thought about.

It does require 2 things: 1) make it absolutely clear that this isn't a question with a predefined answer. 2) you have to be open minded about how the candidate answers.

Most frontend devs will go through their frameworks of choice, project structures, backend tooling preferences, how they sketch a UI, how they work with designers, etc. I had one once walk me through a complete system architecture analysis. We gave them an offer to lead our devops team ;)

</comment><comment><USER6> Interview questions for senior roles won't (or at least shouldn't) be about language specifics but instead about managing a team, distributing technical work, managing timelines etc. Needless to say, depending on the company, ymmv.

<comment><USER7> Imo few questions should be. I've seen some "senior" devs that was just above typical junior, still not good enough to be called a "good middle". Filtering them out as soon as possible saves some time for both parties.

</comment></comment><comment><USER8> There are some weird corners of JavaScript that I went years without knowing. Did you know object literals support getter and setter methods[1]?

As other commenters will point out, such quirks are as easy to look up as they are irrelevant to actual software development.

[1] [https://developer.mozilla.org/en- US/docs/Web/JavaScript/Guid...](https://developer.mozilla.org/en- US/docs/Web/JavaScript/Guide/Working_with_Objects) "Defining getters and setters"

<comment><USER9> God, I used to go nuts with defineProperty and such back in the day. Kind of a bummer that it's even easier to do with ES6, cause that code was usually bad news.

</comment></comment><comment><USER10> Reimplement things from scratch. I'd recommend implementing Promises from scratch as well as several Async [0] functions like auto or series. Both are questions I've asked of senior level JS/Node engineers. This isn't exhaustive but it's good practice for sure. Good luck!

[0] [https://github.com/caolan/async](https://github.com/caolan/async)

<comment><USER5> > I'd recommend implementing Promises from scratch

That must be downright hilarious, depending on how the question is asked. Promises are an absurdly complicated construct considering how little they actually do. If you don't give the candidate the expected spec, 95% of candidates won't get even close. If you do, working through the answer will take long enough that the candidate (and honestly, the interviewer) might get bored.

If you simplify the problem space a lot and ask for a minimal "promise- like"-ish construct, then It can be an interesting coding exercise I guess.

<comment><USER10> Like any good interview question it leaves a lot of room for the candidate to take the lead, ask questions and define the scope of the problem. These are all useful skills to assess for a senior position.

Of course an hour long interview is not enough time to implement the full Promise spec but it should be enough time to gauge the level of a candidate.

</comment></comment></comment><comment><USER11> Explain why ['1','1','1'].map(parseInt) returns [1, NaN, 1] but ['1','1','1'].map(n => parseInt(n)) returns [1, 1, 1].

<comment><USER12> What the hell, who on earth thought that behaviour would be a good idea?

<comment><USER13> .map(fn) calls its callback with three arguments, the value, the index, and the full array. Then parseInt takes two arguments, the string and the base (radix).

"1" of base 0 is 1

"1" of base 1 is NaN

"1" of base 2 is 1

The gotcha here is if you map(fn), you're going to get all three arguments sent to the fn, where map(v => fn(v)) explicitly only sends the first one.

<comment><USER12> I see. I'll remember this example for when someone asks why you need types.

<comment><USER5> this is more than just types though. Typescript, even in strict mode, will still allow this! You need strict function arity/signature checking of some kind, which a dynamically typed language could have, and a statically typed language could lack.

<comment><USER12> If a language can't detect the difference between a function a => f(a) and a function (a,b) => f(a,b) then I would consider it very weakly typed indeed. Dynamic vs static isn't really the issue, Python will also complain if you call a function with the wrong number of arguments.

Then again I suppose that you _could_ recreate JavaScripts behaviour even in the fairly strongly typed C# if you wanted to, by defining two overloaded versions of Map as follows:

        IEnumerable<B> Map<A,B>(this IEnumerable<B> list, Func<A,B> f)
        IEnumerable<B> Map<A,B>(this IEnumerable<B> list, Func<A,int,B> f)

in that case C# would also choose the latter Map when you call it on a function with an optional int argument, similar to what JavaScript would do. However C# will _never_ ignore an optional argument when you're passing around functions, so it's more consistent in that sense. And overloading a function in this way is not the best idea in the first place, it's just that JavaScript kind of encourages it.

</comment></comment></comment></comment></comment></comment><comment> mind-blight Senior roles require that you can break down large problems into digestible chunks. "gotcha" questions don't tell an interviewer how good you are architecting, or how well you understand the language. "gotchas" are usually easily Google-able too.

I've asked a lot of code structure questions. JS really easily turns into spaghetti code if a dev isn't careful. I like to test candidates on whether they make code understandable with clean closures, modules, files, etc. I'll also ask about which libraries they used, why they used them, and what they liked/disliked about the library. Also, "because that's what the code base was in, and there was no reason to change it" is a legitimate 'why'.

For language specific things: \- How closures, scopes, and prototypal inheritance work is important. This is often tested with nested callbacks. \- Web API design \- HTTP methods (Not as important if a candidate's background is in RCP, GraphQL, or something that doesn't use HTTP methods RESTfully)

<comment><USER5> I completely agree with your core point. I really hate gotcha questions too (and have come close to walk out of interviews over them quite a few times).

On the other hand, ""gotchas" are usually easily Google-able too." isn't that simple. You don't know what you don't know. We're in a world now when even some extremely senior devs don't know the tools they use. A lot of it can be blamed on the whole "if you know one language you can learn any other in an afternoon!" tenet. Having so few people these days with vertical/deep knowledge of the tools they use gets really annoying when trying to deal with major production issues and no one in the room can debug them in a timely manner.

Almost makes me think that some form of "tech guru" role should start being a thing, and THOSE people could be interviewed with the stream of obscure gotchas...because sometimes you need a tech guru.

</comment></comment><comment><USER14> Know the details around bind, 'this', dot operator, 'new', call/apply, 'in', variable hoisting, the actual data types JS provides out of the box (Longs aren't one of them) and some assortment of new features/proposed features like classes, and you'll be ahead of lots of seniors. Personally I'd appreciate a good showing in knowledge of the standard library, where its gaps/gotchas are, levels of browser support... (e.g. even IE11 supports sets -- we can use actual built-in set data structures! -- just not the full API. But it has the minimum.)

I agree with others though that you probably won't get the trivia treatment, I wouldn't give one and I don't see them being done by coworkers... But it doesn't hurt to be prepared. So long as you don't present yourself as a "Master" I would think the knives would be less likely to come out. Things like this github has [https://github.com/denysdovhan/wtfjs](https://github.com/denysdovhan/wtfjs) are on the mean spectrum to use against some so-called master, the meanest might probably be demanding they do something with representations like in [http://patriciopalladino.com/blog/2012/08/09/non- alphanumeri...](http://patriciopalladino.com/blog/2012/08/09/non-alphanumeric- javascript.html)

</comment><comment><USER15> Some guy from "the book store" once asked me to implement memoization[1] in JavaScript during a live screen share.

A year later another guy from "same book store" asked me to center text in a div during a live screen share.

So, YMMV and its all parlour tricks anyway.

      just.apply(you, ['who', 'knows', 'anyway]);

[1] [https://jsfiddle.net/ronilan/c27n8f2j/](https://jsfiddle.net/ronilan/c27n8f2j/)

</comment><comment><USER16> Senior level JavaScript I would imagine it to be entirely about frameworks and ES6 shims a.k.a. things you don't actually need. I recommend using as many buzz words as possible.

<comment> 52-6F-62 > ES6 shims a.k.a. things you don't actually need

Though it sounds a bit jaded— can confirm. I've been asked to re-implement `bind` before.

I gave it a shot but ultimately shrugged and explained that I'd _rarely_ ever extend a native object and would rather use a community-supported polyfill. Nevermind that in my current field we haven't had to support ES3-capable browsers for ages.

I'd certainly be better off knowing, but rarely would I need to know on the spot. There is more beneficial knowledge to have up front.

</comment></comment><comment><USER17> I'd say these days "knowing" something is far less important than being able to "learn" something.

If I'm ever in a position where I'm responsible for technical interviews I'm pretty sure I'll give them open internet questions. Then ask them to talk me through their thought process. Even though questions could probably be answered by anyone with decent skills, the best will certainly stand out in how they talk you through their thought process.

</comment><comment><USER18> There are the run-of-the mill senior level generic questions about high level knowledge and procedure. I'll ignore those since you asked specifically about expert level general JavaScript knowledge (not specific to node or front end):

You might see a dumb question that is just a bunch of spaghetti nonsense you'll have to unravel. Explain what this ridiculous codeblock does.

Definitely expect to see closure-based problems. You can almost bet your money on seeing an anonymous function in a loop printing an unexpected value of i:

(copy these code blocks into your browser console and test them out)

        for(var i = 0; i < 10; i++) {
          setTimeout(function() { console.log(i); }, 1);
        }

Event loop: Explain it in words or pictures. Explain why

        setTimeout(func, 0);

works.

variable scoping with var, let and const. Variable and function hoisting. Expect brain teasers exploiting the differences in const / let and var:

        const x = [1, 2, 3];
        for (var i = 0; i < x.length; i++) {
          setTimeout(function() { console.log(i, x[i]); }, 1);
        }

Scoping and binding. Function.prototype.bind(), Function.prototype.apply(), Function.prototype.call(). Maybe explain why you have to bind ES6 class methods used in callbacks.

<comment><USER19> can someone explain why setTimeout(func, 0); works?

<comment><USER20> 1) setTimeout is a Browser/Node API, not a Javascript method

2) Functions that are being returned from the Browser API are pushed to a special waiting area (called the "Callback queue"), not to the immediate Call Stack

3) Functions are only taken from the Callback queue when both the Call Stack and the other higher priority queues (like the "Job" Queue) are empty.

When setTimeout is invoked, the Javascript engine sends _func_ and _0_ as arguments to the API, then moves on. The engine doesn't get blocked by setTimeout, nor does it wait to see the end result. Javascript's job is done here, and so it just moves on to the rest of the code.

When the API receives setTimeout's arguments, it executes the Timer(?) method, passing to it an argument of 0 seconds. This resolves immediately.

However, the API isn't allowed to send functions straight back into the Call Stack. Functions are forced into an intervening waiting area called the Callback Queue. (In the case of promises, there's also a higher priority queue that functions can be sent to instead: the "Job" or "Micro-task" Queue).

Javascript's event loop will only pull functions from the Callback Queue when 1) the main thread of execution has finished all of its synchronous code, 2) the Call Stack is empty, and 3) no higher priority queues have functions left to be pulled either.

Therefore, in the case of "setTimeout(func, 0)", _func_ can be forced to wait a very long time, indeed. If the intervening synchronous code takes 10,000 ms to run, the _func_ from setTimeout(func, 0) will, at a minimum, run at the 10,000 ms point.

However, back in the days of "callback hell", this was often the reason why you'd do a "setTimeout(func, 0)" or two in the first place: to manipulate the order in which certain functions were run by the thread of execution.

Since, literally, what it does it knock a function out of the normal order of events and places it into a lower priority queue.

</comment></comment></comment><comment><USER21> I'm not sure if this can help you prepare for an interview quickly but most advanced JavaScript things I've learned is by taking a deep dive into existing frameworks like AngularJS, jQuery, etc source code.

You see a lot of things happening which may not make sense like "The Great Mystery of the Tilde(~)"[1], etc which are not only fun to figure out but you also see them being used practically too.

[1] [https://www.joezimjs.com/javascript/great-mystery-of-the- til...](https://www.joezimjs.com/javascript/great-mystery-of-the-tilde/)

</comment><comment><USER22> Good lord OP don't rule yourself out before someone else does. Just apply. You need to apply to go on at least 4-5 interviews (and bomb some of them) before you get a hang of it anyway.

</comment><comment><USER23> Bad advanced JD questions will involve quirks of the language that experienced JS developers will have learned to avoid, like details of how type coercion and == work.

Good advanced JS questions (in my opinion) will involve things that are useful but also challenging, like details about promises, prototypical inheritance (that one is debatable, since some JS experts avoid that), the browser event loop, etc.

</comment><comment><USER24> I was once asked about what I would remove from JS. The following discussion touched JS linters and coding style.

But as other have already pointed out, quiz-type questions that are trivially searchable and irrelevant for practical programming tell about a culture of the company. Use that as hint if you want to work for them.

</comment><comment><USER25> IMHO serior roles isn't really about javascript question but more about architecture, high-risk operations, leading/managing teams, testing, software trade-offs, etc.

</comment><comment><USER26> Why creating an element and afterwards setting it to invisible, will never end with a 'blinking' element.

<comment><USER27> Not a JS Engineer - is it because the DOM isn't updated until the script yields?

</comment></comment><comment><USER28> I pay you for a day to pair program with us in our codebase.

</comment><comment><USER29> trickiest/deepest questions ive ever gotten are:

variable hoisting

how to extend a class/prototype

es6 features

typescript/flow

tdd

tooling/webpack

<comment><USER7> Nothing about context? Sad. You can find many tricky questions and all of them would be about context.

</comment></comment><comment><USER30> write your own version of function.bind()</comment>


Simplifying SSH-based deployment with wercker - <AUTHOR> http://blog.wercker.com/2013/08/22/Simplifying-ssh-based-deployment.html

<comment><USER2> You should be able leverage this to deploy to EC2, Rackspace, Digital Ocean and others.</comment>


Against DNSSEC - <AUTHOR> http://sockpuppet.org/blog/2015/01/15/against-dnssec/ <comment><USER5> There are at least two more arguments against DNSSEC:

1) DNSSEC does materially make DDOS reflection attacks worse. djb has gone on about this at length, so I won't.

2) DNSSEC also degrades a DNS server's ability to respond to requests. A regular non-DNSSEC DNS server can look up responses in O(1) time; see djb's TinyDNS for an example (it uses a CDB hash table to do it). A DNSSEC server must either use an ordered index to find "nearest match" for NSEC(3) ... and hence is O(log N), or it must sign the response on demand (which is against DNSSEC religion) and takes something like quadratic time.

It is a meaningful increase in both the computational and space complexities of serving a core infrastructural protocol - but for no meaningful benefit.

<comment><USER6> Well I'm sure that plain DNS look up responses are faster but I have been tought that that the difference between O(1) and O(log N) is really just theoretical and in practice the constant factor is typically more important. log N grows really slowly in the function of N.

<comment><USER7> O-notation lacks utility. It isn't sufficient for a thorough analysis of the space/time complexity of algorithms, and profiling is much easier anyway.

In this case: The constant coefficient in a DNS lookup is very small, whilst the constant coefficients in a DNSSEC response are very big.

</comment></comment></comment><comment><USER8> I agree with everything Thomas has said here, but I also think that it might be a good idea to explain why proponents believe DNSSEC is a good idea for those who don't have a good handle on it.

1\. DNS is vulnerable to man in the middle attack. Any authority with access to a root server or another router in the DNS resolution chain can tell a computer that a web page goes anywhere they want. This actually happens - <USER2> example, Turkey tried to go this with Twitter, and redirected Twitter's domain name to a government IP address instead for anyone within the country.

2\. There is a dangerous vulnerability called DNS cache poisoning where UDP packets can be used to manipulate DNS servers to incorrectly respond when queried for a domain's IP address until their cache expires. This attack was described in 2008 by Dan Kaminsky, and on the whole, a methodology of preventing this sort of vulnerability would be good enough motivation for repairing the failings of present-day DNS.

The motivation is great, but DNSSEC is largely the wrong tool for the job - it's a blunt instrument with no support for nuance and it will make DNS harder. What Thomas explains in greater technical detail is that DNSSEC is a move towards even further internet centralization that will make implementation more difficult without really solving the principal issues.

<comment><USER5> It's worth keeping in mind that the Turkish government hi-jacked DNS resolvers; as-deployed DNSSEC would in no way have helped.

The 2008 attack was not novel and was described by DJB about 7 years prior to Kaminsky, and DJB's utilities included a mitigation: randomized source ports. At present there is an equivalent vulnerability: UDP/IP fragments can be spoofed in such a way that poison records can be injected to resolvers. It is possible to mitigate this, but many DNSSEC proponents - including the Bind maintainers - refuse to consider mitigations because they feel that people should be moving to DNSSEC instead. It bears repeating that as-deployed; DNSSEC doesn't help protect against cache poisoning towards stubs - <USER3> towards caching resolvers.

<comment><AUTHOR> DNSSEC was also the reason why source ports weren't randomized, and thus the reason that Kaminsky's attack was briefly so viable. Somewhere there's a NANOG post with the BIND maintainers talking about the "scoreboarding resolver" they'd implemented but wouldn't release, because (even back in 1997) the real answer was DNSSEC.

I'm not sure I agree about the novelty of Kaminsky's attack. Ruefully: I remember arguing with him about that on Twitter, him getting me on the phone to explain how his attack refined the older cache poisoning attacks, me conceding it, and then bad stuff happening a few months later.

<comment><USER9> > and then bad stuff happening a few months later.

Are you referring to [http://www.gonullyourself.org/ezines/ZF0/zf0%205.txt](http://www.gonullyourself.org/ezines/ZF0/zf0%205.txt) perchance?

<comment><AUTHOR> No.

</comment></comment></comment></comment></comment><comment><USER10> I understand DNSSEC may not be the perfect solution, but many arguments are misguided. Worse yet, no real solution has been posed in its stead that works perfectly. But here I go again. In fairness, there are some valid arguments. I'm cherry picking pieces I find questionable.

DNSSEC is a Government-Controlled PKI - DANE is not DNSSEC. Why conflate the two?

DNSSEC is Cryptographically Weak - Wait, what? That's like saying openssl is cryptographically weak, since it allows you to create weak keys. You can use ECDSA with DNSSEC. Minimal research would have revealed that.

DNSSEC is Expensive To Adopt - It is up to the software to decide how to handle failure cases. Software with security in mind should do the proper checks. Others should display warnings. Others should probably just accept the answer.

DNSSEC is Expensive To Deploy - What? DNSSEC is braindead simple to deploy. It literally takes a handful of minutes.

DNSSEC is Incomplete - Unclear...not positive how DNSSEC relates to browser implementation.

DNSSEC is Unsafe - I'll possibly give you this one, but stand by that you shouldn't hide in plain sight. That is, why put 'hidden' records in a public zone?

DNSSEC doesn't have to happen. Don't support it. - DNSSEC has already happened. People ask for it. However, largely, I support the argument. Start a working group, propose a better alternative, and replace it. I'm all for that, believe it or not.

<comment><AUTHOR> There is a real alternative solution, and it has the virtue of being exceptionally simple: do nothing. The DNS doesn't need to be secured, just like raw IP isn't, nor every individual BGP4 update.

DANE (using DNS as an alternative to TLS CAs) is the primary real-world use case for DNSSEC.

No site in the world is secured purely using ECC DNSSEC, because the roots and TLDs rely on RSA. Moreover: find the most popular site that uses ECC DNSSEC and report back what it is. (It'll be tricky, because very few of the most popular sites use DNSSEC at all). And, of course, the ECC variants DNSSEC uses are already outmoded. Which is why I was careful to refer to modern deterministic Edwards-curve signature schemes. Also: did you really look at the links in that post and think it lacked even "minimal research"?

I don't see any other arguments in this response, but you can call me out if I missed any.

<comment><USER10> DANE is not DNSSEC, and was not and is not the motivation behind it. That thought is incorrect.

As for algorithms, you're insulting DNSSEC as it's been implemented, not as a protocol. DNSSEC reserves purposely up to 255 slots for algorithms, and has added them as it's evolved. But claiming it depends on RSA and doesn't support modern eliptical curve schemes is at worst wholly false, at best half false depending on the definition of modern.

<comment><AUTHOR> All I can say is that I've read, I believe, every dnsext and namedroppers post and the archives of the old mailing lists from the 1990s, when DNSSEC was a government funded project of my then employer, for whom I was busy writing DNS security testing tools, and I believe you're wrong: DANE is the motivating use case for DNSSEC.

It's a pretty weird rhetorical spot to put yourself in, by the way. Without DANE as a motivation for deployment, there is _no_ reason to deploy DNSSEC. DNSSEC can't provide end-to-end security, and TLS and SSH already authenticate themselves without DNSSEC.

I don't know what your second paragraph means. You can see what I'm referring to empirically by playing with DNSviz. Like I said: go find the largest DNSSEC site that uses ECC records. Then, for fun, and not counting the TLDs themselves (sigh), the largest that use RSA-1024.

</comment></comment></comment></comment><comment><USER11> So just to be clear, the thesis here is that we should not secure DNS in any way, correct? Or is part 2, in a series of articles going to detail a different solution?

In other words, is the objection to DNSSEC the idea, or the implementation?

Lastly, what is our best hope for getting rid of CA's?

<comment><AUTHOR> The thesis here is in fact that we should not secure DNS in any way, just like we don't secure raw IP and won't for the foreseeable future secure BGP4. We instead do what we've done for 20+ years: assume the network is untrustworthy (because it is, with or without DNSSEC) and build security on top.

<comment><USER11> Thanks for clarifying! I have followed many of the discussions in which you participated talking about this issue, but this is the most concise way this has been put.

If I may suggest something, the article talks a lot about the implementation flaws in DNSSEC, giving the impression that if only it was designed better, or even redesigned, that we could actually have a secure DNS.

</comment></comment></comment><comment><USER12> DNSSEC is probably OK if all you use it for is within an organization for your own stuff (ie, with your corporate root CA, for your corporate domains only, where you control for and vouch for every node connected), and then using it to enhance other things like distributing SSH keys through SSHFP (again, totally internally, not internet facing).

But everything else said here I totally agree with - if you don't control the root, you don't control a whole lot of anything.

If you want something that hides the contents of DNS packets in transit, DNSCurve at least does that, and is relatively easy to deploy - the current best server appears to be the curvedns in the freebsd ports (updated to use libsodium, etc.): [https://svnweb.freebsd.org/ports/head/dns/curvedns/](https://svnweb.freebsd.org/ports/head/dns/curvedns/)

<comment><USER13> > if you don't control the root, you don't control a whole lot of anything.

What's of course valid for TLS too. Do you suggest people use HTTPS?

</comment></comment><comment><USER14> > DNSSEC is Expensive To Adopt/Deploy

I live in .cz domain and almost every registrar there have DNSSEC in one click (without changing price) - adoption here is 40%! - <USER4> [https://stats.nic.cz/stats/domains_by_dnssec/](https://stats.nic.cz/stats/domains_by_dnssec/) and I am not experiencing any mentioned problems at all

Maybe DNSSEC is not best DNS proto in the world, but these arguments are not entirely based on facts.

<comment><AUTHOR> This is like saying "TLS is easy if you just let GoDaddy manage your keys for you".

<comment><USER15> Incorrect. You don't have to let CZ.NIC manage your keys for you.

<comment><USER16> That's not what he's saying. DNSSEC is a pain in the ass to operate on your own, and that's with guides like [http://users.isc.org/~jreed/dnssec- guide/dnssec-guide.html](http://users.isc.org/~jreed/dnssec-guide/dnssec- guide.html) (which is itself relatively new). BIND, at least, has a lot of bad defaults (e.g., NSEC), and the docs make poor recommendations about algorithms and key sizes (SHA-1? 1024-bit RSA keys? and what's this about RSA being depreciated after September 2015?)---even NIST's guidelines make stronger recommendations than that ([http://csrc.nist.gov/publications/nistpubs/800-131A/sp800-13...](http://csrc.nist.gov/publications/nistpubs/800-131A/sp800-131A.pdf), and that still has Dual EC DRBG on the books). Furthermore, ISC's guide downplays the importance of DNSSEC on private networks, which is probably the most important (in terms of opsec) and most difficult (in terms of complexity) place to implement it.

DNSSEC doesn't offer any privacy guarantees, either, so at this point DNSSEC doesn't really do much for me.

<comment><USER15> That's not what I am saying at all.

I am saying "almost every registrar [in .cz] have DNSSEC in one click (without changing price)" is nothing like "letting GoDaddy manage your keys for you".

The first is a matter of cost. The second a matter of convenience.

It's not at all like letting a third party manage your keys in any reasonable way to interpret it.

</comment></comment></comment></comment></comment><comment><USER17> _Securing those DNS lookups therefore enables no meaningful security._

When you're reasonably sure that the DNS response you're seeing is actually what the zone owner meant it to be, you can have records for SSL certificates (DANE, mentioned later), or GPG keys for users with email in that domain, all kinds of things which were not previously possible. Each of those may or may not be a good idea but it clearly enables meaningful uses.

 _DNSSEC is a Government-Controlled PKI_

Sure. But once you're willing and able to forge registry information about a domain, you can also usually get a valid (DV) certificate for it. Assuming you don't control a CA to begin with. So at least we're being honest with ourselves and stop paying for the security we don't get.

And DNSSEC doesn't get in the way of any replacements, does it? You can sign the certificate with your personal key. Or you can use some sort of convergence mechanism to see if you're seeing the same public key as everyone else.

 _Authenticated denial. Offline signers. Secret hostnames. Pick two._

The first two, right? (Secret hostnames?)

Articles like this (whole lists of criticisms) sound lawyery and unconvincing to me. I can't tell which ones are the meat and which are garnish. Not that a committee design cannot be flawed in multiple ways (death from 1000 cuts style) but this feels as if the author didn't like the idea first, perhaps for a perfectly valid reason, and came up with a bunch of additional reasons later.

Full disclosure: I signed one of my zones and I run validating resolvers for my private needs (unbound, both on servers and my home network). Nothing blew up. Yet.

<comment><AUTHOR> Governments today have too much control over Internet crypto keys. I am baffled by arguments that suggest it might be a good thing to just give up and give them total control over them.

<comment><USER18> Today many many governments can create TLS certs for _any_ website domain.

With DNSSEC, only the USA can, and other governments can only create TLS certs for a small and distinct subset of website domains. That's better.

(It would be even better if dns resolvers included certs for all TLDs they knew about, and did not rely on the root keys for those TLDs. Just like pinning TLS certs. Then, you can choose a TLD run by an organization you trust, and even the US won't be able to forge your certs.)

<comment><USER19> > With DNSSEC, only the USA can, and other governments can only create TLS > certs for a small and distinct subset of website domains. That's better.

I fail to see how that is better.

<comment><USER20> Less organisation that can forge = less weak-points = better security

</comment></comment></comment></comment></comment><comment><USER21> Thomas - I'm still looking for the walk-through of how you see the attacks by a government against DNSSEC. I don't see them!

And to your repeated refrain both in your post and here on HN that "DNSSEC has virtually no real-world deployment", I would again refer you to various DNSSEC statistics sites that do indeed show a good amount of deployment happening in different parts of the world.

Here's a list of those sites: [http://www.internetsociety.org/deploy360/dnssec/statistics/](http://www.internetsociety.org/deploy360/dnssec/statistics/)

I know you wish it were NOT happening, but the reality is that DNSSEC deployment _is_ going on... and many of us see it as a way to provide another solid layer of security on the Internet.

Yes, it's always great to be exploring other alternatives, too. My personal interest is in "securing the DNS"... and right now DNSSEC is to me the best tool we have going _today_. If we can develop other tools over time that are even better, that will be outstanding. Meanwhile, I want to see what we have today get better deployed.

<comment><AUTHOR> I keep seeing a claim that something like 10% of DNS requests are signed with DNSSEC, but that's an awfully hard number to square with the top sites on the Internet, virtually none of whom are DNSSEC-signed. Reconcile for us, please?

<comment><USER22> _" signed with DNSSEC"_ is an ambiguous statement. You need to take into account that, while nameservers may enable DNSSEC, resolvers may:

(a) validate (include the AD bit) but strip the RRSIGs (i.e. regular DNSSEC resolver)

(b) omit the AD bit but include the RRSIGs (i.e. you have to validate yourself)

(c) omit the AD bit and omit the RRSIGs (i.e. regular non-DNSSEC resolver)

(d) validate (i.e. include the AD bit) and include the RRSIGs (i.e. alleluia!)

My own study [0] (using the Atlas network [1]) found 30% of resolvers doing (a), and 65% doing (b), including some overlap. There are people way more qualified than me doing this kind of stuff, namely APNIC's Geoff Huston, see [2] for instance.

[0] [https://www.os3.nl/_media/2013-2014/courses/rp2/p14_report.p...](https://www.os3.nl/_media/2013-2014/courses/rp2/p14_report.pdf)

[1] [https://atlas.ripe.net](https://atlas.ripe.net)

[2] [http://www.potaroo.net/presentations/2014-06-03-dns- measurem...](http://www.potaroo.net/presentations/2014-06-03-dns- measurements.pdf)

</comment></comment></comment><comment><USER23> How much more centralized does DNSSEC make the Internet? It's already bad enough that people are calling for mandatory TLS for all websites (though with free certs from the EFF/mozilla that will be a bit less painful) but if I want to have my own DNS root, or play by my own rules on the net, will running my own infrastructure be harder with DNSSEC?

<comment><AUTHOR> Yes. If a CA egregiously misbehaves today, Google can kneecap it with an update to Chrome, and end-users can remove it from their configuration entirely (this should be easier to do, by the way, and there's no technical reason it can't be).

If the signers for .LY or .COM misbehave, nobody has any solid recourse. .COM's role in the post-DANE certificate hierarchy is _baked into the fabric of the Internet_.

DNSSEC represents a massive move _towards_ centralization of Internet trust, which is a baffling thing to get behind in 2015.

<comment><USER24> There are in fact organizations that scrupulously audit the certificates in all browsers/cert stores in their organization. One I know of is etsy.

<comment><USER24> Here is a reference well worth reading about how they approach security: [http://www.slideshare.net/zanelackey/attackdriven- defense](http://www.slideshare.net/zanelackey/attackdriven-defense)

</comment></comment></comment></comment><comment><USER25> You know, it's possible to simply lift the guts out of the TLS protocol and wrap them around a directory service, or to take the architecture of DNSSEC and kludge it into TLS. Basically we can keep TLS's good points and support an _alternative_ to CAs within the protocol itself. All a service provider'd have to do is pick one or both to support, and advertise in the protocol what combination they use. That'd be a fun weekend project.

</comment><comment><USER26> Non-expert here, why are secret hostnames important? Aren't the machines either reachable by IP Address or not regardless of whether the hostname is known or not?

<comment><USER27> I guess it's a form of defense in depth. Hostnames often contain information about the role of a server that wouldn't be obvious from an IP scan.

</comment></comment><comment><USER28> While DNSSEC certainly deserves a lot of criticism, I think some of the points are unfair.

> Had DNSSEC been deployed 5 years ago, Muammar Gaddafi would have controlled > BIT.LY's TLS keys.

(DNSSEC's, and thus) DANE's security can break down at every parent DNS zone. For bit.ly the parent zones are the .ly top level domain and the root zone. Each of them (but only these two) can forge valid DNSSEC records. With the current X.509 certificate infrastructure there are more than a hundred root CAs who can issue malicious certificates for use with TLS. Even though I certainly dislike the centralized nature of DNSSEC, it is hard to argue that reducing the attack surface from over a hundred institutions to two or three doesn't constitute a marked improvement. Specifically, domains like tumblr.com whose domain path is completely US hosted will no longer have to worry about "obscure" foreign CAs like "Unizeto Certum".

> In fact, it does nothing for any of the "last mile" of DNS lookups: the link > between software and DNS servers. It's a server-to-server protocol.

DNSSEC is decidedly not a server-to-server protocol. The signatures are created offline and can be verified by any party, even when they come out of a cache. In contrast, DNSCurve _is_ a server-to-server protocol, which only secures the transport layer, but not the data itself. The post refers to the aspect, that stub resolvers (those software parts of your OS that look up the query at your ISP caching DNS server) where not envisioned by the designers of DNSSEC to verify the DNSSEC entries themselves. Nonetheless, there is nothing that hinders them from doing so and I would expect that feature to be included once DNSSEC is spread enough to justify the effort. In fact, you can already check how this would work using the dig request `dig @188.8.131.52 +dnssec example.com` which replies with the A record and the signature on the A record (you still need to get and verify the zone key of example.com though).

> DNSSEC changes all of that. It adds two new failure cases: the requestor > could be (but probably isn't) under attack, or everything is fine with the > name except that its configuration has expired. Virtually no network > software is equipped to handle those cases. Trouble is, software must handle > those cases.

I'm curious about why software would have to handle these cases. For the end- user a binary "lookup went well, here is the result" / "there were some errors during the lookup, sorry I can't or won't give you a result" should be totally sufficient. Firefox should not confuse the user with detailed difference between "I can't verify this record, even though the parent zone says it is DNSSEC enabled" and "I can't resolve the name at all", so why does Firefox need this information?

<comment><AUTHOR> Look at the code in Firefox that handles certificate failures, presents user interface to end users to resolve the ambiguity, and then completes the operation once that happens. Then look at the sample code I linked to. The code I have there is a decent approximation of "idiomatic". The code I'm referring to in browsers is larger by a factor of, what, 100? 1000?

Browsers and operating systems aren't going to add full DNSSEC resolving caches. They're going to use stub resolvers and delegate this problem to "DNS servers" (caches), like they always did. DNSSEC does not protect the last mile. You can dodge this point by redefining the concept of "last mile", but that's not a persuasive argument.

The US NSA controls both the CA hierarchy and .COM. It is amusing to see people try to rescue DANE from criticism by evoking the CA system to protect it.

<comment><USER29> > Browsers and operating systems aren't going to add full DNSSEC resolving > caches.

Actually they already did. OS X for instance has this baked into mDNSResponder.

<comment><AUTHOR> Fire up a terminal, run "tcpdump -s0 -i en0 udp", open Safari, resolve "www.enteract.com", and tell me if you see a full recursive DNS lookup happening, or if instead you see Safari's stub resolver asking the DHCP- configured DNS cache server for help over the insecure Internet.

<comment><USER29> mDNSResponder supports DNSSEC validation, please look at the source code:

[http://opensource.apple.com/source/mDNSResponder/mDNSRespond...](http://opensource.apple.com/source/mDNSResponder/mDNSResponder-522.92.1/mDNSMacOSX/DNSSECSupport.c)

<comment><USER30> That doesn't really respond to the point. Does Safari use DNSSEC or not?

<comment><USER29> Of course it does, Safari uses the resolver provided by OS X, which is mDNSResponder. (It superseded the stub resolver in libSystem.dylib starting with 10.6.)

<comment><USER31> You are mistaken. [https://news.ycombinator.com/item?id=8896092](https://news.ycombinator.com/item?id=8896092)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER32> I've never understood the criticism that DNSSEC places control of TLS keys with governments - it seems like they already have that control. For example, Libya could change the dns records for bit.ly and get a certificate. I suppose an EV certificate with offline verification might help that, but you could use those with DANE, but DANE doesn't seem any worse than domain or email validated certificates.

<comment><AUTHOR> They can do that because of domain-validated certificates, and they can do that after the DNS is secured.

<comment><USER33> And the CA that issues the cert will be flamed and possibly removed from Chrome/Firefox.

(Edit: If they are caught.)

<comment><USER32> Why would they be removed? If the CA correctly follows all of their procedures and approves a domain-validated cert, why punish them for approving what is a legitimate request?

If the CA is coerced into issuing a cert, however, I agree with you.

<comment><USER33> You're right. I misunderstood the scenario we were discussing.

</comment></comment></comment></comment></comment><comment><USER34> _There are better DNS security proposals circulating already._

Tease.

<comment><USER24> Perhaps he is referring to [http://dnscurve.org/](http://dnscurve.org/)

<comment><USER15> DNScurve solves a different problem. It does not implement offline signing. It is not something you could trust your cryptographic keys with.

</comment></comment></comment><comment><USER15> These are just the same old arguments all over again.

1\. DNSSEC is unnecessary, we have SSL.

Do you really want to argue that the CA PKI infrastructure is working? Placing your trust in your top domain solves 99.5% of the problem, roughly (considering there is about 500 CAs that you trust right now, that is not a made up number).

2\. DNSSEC is a government-controlled PKI.

No, it's not. It is ICANN-controlled, which is under government mandate but not government control. You already trust ICANN for the root zone, and they have so far stayed out of politics, and has so far never meddled with domains even when the US administration wants them shut down. Because if they did, the Internet would route around them in a heartbeat.

This is actually one thing that DNSSEC did absolutely correct. If you want a cryptographic assurance that a domain belongs to an owner, who better to make the assertion than the TLD responsible for delegating it? Sure, if you get a Libyan domain, you have to trust the Libyan TLD to sign it. But they are already trusted to delegate it! They run the whois. If they decide to transfer the ownership to Ghaddafi himself, there is absolutely nothing you can do about it. If this is a problem for you, don't get a Libyan domain name.

3\. DNSSEC is insecure.

It's ugly, but it's not insecure in any practical way. It could be a lot more modern, but it is in no way worse than SSL (see 1 above).

4\. DNSSEC is expensive.

It is already deployed. You are already paying the price for this, whatever it was.

5\. DNSSEC is hard.

It adds complexity to your operations, but your tools already supports it and it's included in courses already. No competing standard is.

6\. DNSSEC makes for DDoS.

That wasn't actually included in the list, but this one is true. DNS is a DDoS vector, and DNSSEC strengthens it. That should be addressed. Better deployment of filters would do much to improve the situation.

7\. DNSSEC allows for enumration of zones.

Also not included in the list. Yes, this is a real issue you need to be aware of. Don't store private data in public zones. Use split zones for this.

All technical decisions is a matter of pros and cons. Pro is that it builds on a proven infrastructure and is already deployed in most of the world. You could absolutely build a modern standard, but these things take at least ten years to roll out. Start today and build the successor to DNSSEC!

But remember that DNSSEC did get a few important things right: Assurance follows delegation. Your DNS operator does not have your key. It protects against negative answers. Make sure your successor inherits those.

<comment><AUTHOR> First, I'd be a little happier if you didn't misquote me for the convenience of your comment. These _weren 't_ my subheds. You've rewritten some of them, condensed others, added one, and misread another, which lead you to suggest that I hadn't "allowed for enumeration of zones" when in fact there's a whole subhed dedicated to it. You could just clarify at the top of your comments that your numbered list is your own, not mine. I'd then strike this part of my comment.

Now then:

1\. I do not argue that the CA PKI infrastructure is working. In fact, I state explicitly that it is not. The problem is that DANE's replacement for the TLS PKI is _controlled by world governments_. At a broader level, the problem is that centralized PKIs don't work against nation-state adversaries. The solution for the TLS CA problem is (a) a race to the bottom for CA pricing, led hopefully by EFF, (b) widespread deployment of public key pinning, which serves both to thwart CA attacks and to create a global surveillance system against them, and (c) the eventual deployment of alternate opt-in TLS CA hierarchies, such that users could for instance subscribe to a hypothetical EFF CA hierarchy. DNSSEC accomplishes none of this.

2\. Yes, DNSSEC is a government-controlled PKI. Your whole argument here is that if governments abused it, the Internet would "route around it". You can't make that argument without conceding my point.

3\. I didn't write "DNSSEC is insecure" (though I think it is). I wrote that it's cryptographically weak, which it is: it's PKCS1v15 RSA-1024. Crawl signatures back to the roots: you'll see RSA-1024 all the way at the top of the hierarchy. TLS has already deployed forward-secure ECC cryptography and will by the middle of this year see widespread deployment of Curve25519 ECDH and Ed25519 deterministic signatures. DNSSEC simply will not: it will be RSA-1024 for the foreseeable future.

4\. "DNSSEC is expensive" is not a subhed in my post. "DNSSEC is expensive to adopt" was, and it is: virtually no networking software currently handles soft failures from lookups, which are a universal shared experience among HTTPS users, and will occur just as frequently with DNSSEC (should it ever be deployed). "DNSSEC is expensive to deploy" is another point I made, which is also true: of the top 50 Alexa sites, why not go look how many are DNSSEC- signed?

5\. "DNSSEC is hard" isn't something I wrote at all, so I don't know how to respond to it.

6\. "DNSSEC makes for DDoS" is something I think is probably true, but also an argument I wasn't willing to go to bat for, because amplification attacks using ANY queries against normal DNS also work. But sure, if you want to add fuel to the fire.

7\. "DNSSEC allows for enumeration of zones" is captured under "DNSSEC is unsafe" in my post. If you answer to this is "don't use DNSSEC for important zones", then we agree, modulo that I think you shouldn't use it at all.

<comment><USER9> > a race to the bottom for CA pricing, led hopefully by EFF

Also Startcom. [https://startssl.com](https://startssl.com) (free TLS certs, each good for one subdomain + your base domain, for one year)

<comment><USER35> Startcom is great (I use it for a bunch of domains), but there are some caveats:

* They are only free for personal, non-commercial use. You can't (contractually) use them for your startup.

* They are free to acquire, but they charge to revoke them. So don't lose your key (even accidentally, via something like heartbleed).

* Their roots are not in the Windows XP base install. They _are_ included in an optional update, but my experience with a web site that had old machines in its demographics showed that practically no one had it installed. Given that XP is no longer supported by Microsoft, this point is getting less and less relevant as the days go by.

<comment><USER36> I think even WinXP had auto root update by default, and even Win7 don't have the StartCom root installed by default.

</comment></comment></comment></comment></comment><comment><USER37> I think the internet would benefit from more competition in protocols, especially those to do with security, and especially those that have historically done a bad job (TLS, DNSSEC, PKIX).

These are obviously hard to design, with a bunch of trade-offs and decisions to make along the way. I'd argue that this makes practical research and competition more important, not less.

</comment><comment><USER38> "Had DNSSEC been deployed 5 years ago, Muammar Gaddafi would have controlled BIT.LY's TLS keys."

No he would have had their TLS public key, assuming they were deploying DANE, which he could have got by going to their website.

<comment><AUTHOR> I think you're a little unclear on the concept here. The problem isn't that Libya gains the ability to _read_ the TLS keys.

<comment><USER38> Since Libya can't write a valid certificate to DNS, the ability to make changes doesn't help them. At worst, they might be able to make browsers reject the certificate (as the one served by the server won't match the one in DNS, or the one served by the server and in DNS (if your A records and DNS key gets changed) isn't signed by a CA), but they can already do that. If you don't trust your DNS Zone, you can already be trivially taken offline by them deleting your DNS records.

Once DANEs is deployed widely browsers should require both a certificate from a CA, and that certificate to be in DNS. Two factor authentication for SSL.

<comment><AUTHOR> If the CA signature means anything, you don't need DNSSEC.

If it doesn't, you've given control over the certificate to Libya.

It is easier to see the problem when you look at the real issue, which is that the NSA controls _both_ the CA hierarchy _and_ .COM.

<comment><USER22> _Perseids_ made his counter-arguments clear in many places on this page, but your comment allows me to summarize.

> _If the CA signature means anything, you don 't need DNSSEC._

If DNSSEC is fully deployed and supported, you don't need CAs.

> _If it doesn 't, you've given control over the certificate to Libya._

If it (DNSSEC) isn't, you've given control over the certificate to any trusted CA in the world.

> _It is easier to see the problem when you look at the real issue, which is > that the NSA controls both the CA hierarchy and .COM._

Neither DNSSEC nor the CA system can prevent the NSA from doing their evil stuff.

<comment><AUTHOR> The problem with the CA system is that it fails to resist nation-state attacks. DNSSEC not only has that problem, it has it _by design_. That's the point made by the post. All you've done is restate it.

<comment><USER22> You are right, so let me sum up:

Centralized architecture leaves DNSSEC vulnerable to nation-state attacks. This is by design.

Decentralized architecture leaves the CA system vulnerable to attacks coming from any trusted CA. This is by design.

National Security Letters (and their non-US equivalents) leave the CA system vulnerable to nation-state attacks.

DNSSEC 2 - 1 CAs

<comment><USER39> Why is DNSSEC not vulnerable to NSLs?

<comment><USER22> I am distinguishing on the attacker, not the means. Sorry if that was not clear.

Of course DNSSEC is vulnerable to NSLs, but that is not relevant. What is relevant is:

\- DNSSEC is vulnerable to nation-state attacks.

\- The CA system is vulnerable to nation-state attacks.

\- The CA system is vulnerable to attacks from any CA.

<comment><USER19> Missing points:

\- I, as a user, have mean to circumvent or mitigate CA issues (using certificate patrol as one possibility, certificate pinning as another,...)

\- There is no user work around for the DNSSEC vulnerabilities

Furthermore, I'd guess that the majority of CA attacks are nation-state attacks so that both boil down to the same. I don't know of any criminal attacks (such as attacks on online banking) on the CA's. Conclusion: I, as a user, don't gain anything from DNSSEC.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER29> Reaction when @tqbf, again, claims DNSSEC is NEVER GOING TO HAPPEN

[http://dnsreactions.tumblr.com/post/92623693242/when-tqbf- ag...](http://dnsreactions.tumblr.com/post/92623693242/when-tqbf-again-claims- dnssec-is-never-going-to)

<comment><USER30> I like this one: [http://dnsreactions.tumblr.com/post/108069740597/dnssec- ince...](http://dnsreactions.tumblr.com/post/108069740597/dnssec-incentives)

</comment></comment><comment><USER13> Why all do we get so many articles with missleading text arguing agains DNSSEC recently?

> DNSSEC is Unnecessary That's opinion.

> DNSSEC is a Government-Controlled PKI And TLS is an all-governments- > controlled PKI, where any of them can subvert it when they want.

> DNSSEC is Cryptographically Weak Nope, it isn't. But yes, there are people > using it with weak crypto... Exactly like TLS.

> DNSSEC is Expensive To Adopt A bunch of overblow technical issues that won't > make any difference on practice. If the domain is being attacked, the lookup > failed, if there's a configuration problem, the lookup failed.

> DNSSEC is Expensive To Deploy Oh, that's correct. TLS needs an entire hour > to deploy for the first time, DNSSEC needs some 3 or 4.

> DNSSEC is Incomplete Yep, it's goal is to do the same as the TLS PKI. > There's DANE for the rest of it.

> DNSSEC is Unsafe Yes, also because it's DANE's job to do that.

> DNSSEC is Architecturally Unsound I can't make any sense out of that.

<comment><USER30> Your rebuttal would be a lot more convincing if it were more specific. For example:

> DNSSEC is Cryptographically Weak Nope, it isn't.

So you're saying that 1024-bit RSA keys are just dandy? You're saying that PKCS1v15 padding is a good idea?

<comment><USER13> DNSSEC does not mandate any cryptography algorithm. Why are you associating it with 1024 bit RSA? (I know, because some article appeared here that claimed it was limited to this. It isn't, and most roots do not use it.)

<comment><AUTHOR> No article claimed that DNSSEC was limited to RSA-1024, and you clearly haven't looked at the roots recently.</comment></comment></comment></comment>


Ask YC: Give Us Your Best Elevator Pitch - <AUTHOR>

Last week sometime a few people thought it might be a good idea to do a weekly roundup of elevator pitches. I wanted to start it off this week.
So, what's your best elevator pitch?
As a bonus question, what makes a good elevator pitch? <comment><USER2> Six word pitch for tarsnap (<http://www.tarsnap.com>): Online backups for the truly paranoid.

Longer version: Security is hard. Governments and organized crime are getting increasingly involved in identity theft and corporate espionage. Tarsnap is a backup system designed from the ground up to keep your data out of the hands of the US government (and anyone else who might want to steal it).

<comment><USER3> Like the pitch but it reads - Backups for Criminals - to me. Isn't it possible to encrypt already and then backup?

<comment><USER2> _Backups for Criminals_

Is Airbus a company of criminals? They have a perfectly good reason for wanting to keep their data out of the hands of the US government: Every time the US government gets some information about Airbus, Boeing has it the next day.

Sadly, industrial espionage is something which many governments are actively involved in; wanting to make sure that your foreign competitors don't have access to your trade secrets does not make you a criminal.

 _Isn't it possible to encrypt already and then backup?_

Yes, but if you do that, you lose the benefits of snapshotting (performance of incremental backups, convenience of full backups).

<comment><USER4> _Is Airbus a company of criminals?_

I think that misses the point though. From a rational perspective, of course, companies don't want the US government grabbing their private data. But from an emotional impact perspective, which seems to be the idea of a pitch, it makes it sound sketchy.

Possibly more emotive, and catering to the (annoying) zeitgeist would be "[...] designed from the ground up to keep your data out of the hands of hackers and cyber-terrorists [...]"

<comment><USER2> _keep your data out of the hands of hackers and cyber-terrorists_

I'm not good at marketing: I'm too honest. I simply can't grossly exaggerate threats like that. Black hats, sure. Cyber terrorists? Not a very real threat.

<comment><USER4> Sure. But on the other hand, what "security" is about is selling protection from a perceived threat, whether it really exists or not. On the plus-side, in the US these days, "terrorism" has been redefined to "people doing things we don't like". ;-)

<comment><USER2> _what "security" is about is selling protection from a perceived threat, whether it really exists or not_

No. As anyone who works in the field can tell you, the first step in any security work is to analyse what threats exist (which involves assessing both opportunity and motive -- if you're the US Air Force, you probably don't consider the NSA to be a threat even if the NSA is able to break into your systems).

<comment><USER4> But that's my point (and that of several others here -- and really I'm just providing this commentary in hopes that it will help) -- your elevator pitch isn't for _anyone who works in the field_ , it's for your customers and their bosses and investors. I understand that factually you're solving a real problem and noting that in your pitch and that other security experts will understand that too, but if customers / investors read it and immediately think, "nutjob", then it's going to work against you.

<comment><USER2> Fair enough. :-)

Given that I have trouble with dumbing things down for a non-security-literate audience, I think the right solution here is for me to work at educating people -- I'm already planning on doing this, actually, by providing information about all the potential attacks which my code is designed to prevent (and which other code isn't).

<comment><USER5> That angle may work best. If you can prove to someone they have no pants on while they think they are fully clothed, that is sure to tag the amygdala, and hence attentiveness.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> A service that allows you to geotag things for your municipal government to fix: pot holes, poison ivy, graffiti, car accidents, dangerous trees, etc. This automatically creates a to-do list online for everyone to see, and lets people with an @town.state.gov email address check items off as they get done. Things like downed power wires would be submitted the same way and then automatically routed to the relevant authority.

I'm working on another project already, but if someone else wants to make this then I'll be your first user.

<comment><USER7> Is this the elevator pitch for Hacker News or the general public?

There are likely many people who would be interested in your service to whom "geotag" and "@town.state.gov email address" mean nothing.

<comment><USER6> It's actually not a pitch, it's just a free gratuitous idea. I just added it here because I didn't think it justified starting another thread.

</comment></comment></comment><comment><USER8> Elevator pitch for my poetry app (not a startup/business): The Internet is encouraging more poets to write and share, but it is not helping them collaborate and improve and most apps wall up an author's content.

Clarity and conciseness. Hope I didn't violate my answer to the first one ;-)

Of course, almost no one gives a toss about poetry anyway.

<comment><USER9> Untrue! I give several tosses! I'm working on an integrated touring tool for spoken word poets. It will allow them to rate venues, add tour dates & locations, map their trip, easily find bus or plane tickets between destinations (here's a place where I could work in Wondrbar...), and publish their schedules to various social networking apps. I also want to add a booking mechanism for the people who run poetry venues, so they can connect with poets on tour.

This is a labor of love. Google will not buy me, and I probably won't make any money.

<comment><USER8> We're way off topic, so how's about you send me a link or something by email. I'm not very knowledgeable about spoken word, but if it's good for poetry I'm at least interested in seeing what you're planning/doing.

</comment></comment></comment><comment><USER10> Short pitch: NewsCred brings you all the world's most credible news in one place.

Longer pitch: Do you trust the news? How credible are the journalists and sources you turn to each day? NewsCred is a digital newspaper bringing you all the world's credible news, from your favorite sources, in one place.

Interested in our Alpha? Drop me a line at shafqat[at]newscred.com.

<http://www.newscred.com>

<comment><USER11> I like the fonts you used (for the logo on top). What are they?

<comment><USER10> I'll have to ask my cofounder - we spent a lot of time debating the font, but I never asked for the name. Glad you liked it.

</comment></comment></comment><comment><USER12> MachineEnglish - a (self-)reflective subset of English which allows computers and robots to describe themselves by explaining their algorithm(s) to their users in natural language. Human-machine dialogue can include, but isn't limited to, the machine answering what, how, and why it's doing what it's doing while it is doing it. If I don't have to spend too much time working for rent and ramen money, the prototype will come online this Christmas.

(Disclaimer: No, I did't solve Artificial General Intelligence, nor did I do something equally "magical". I'm not trying to compete for <a href="<http://www.loebner.net/Prizef/loebner-prize.html>">Hugh Loebner's gold medal. I'll never be able to simulate a human brain which can explain its own workings. A human brain which could write such a simulation would have to be able to describe itself, which mine can't. A machine's "brain", however, can be much simpler, and the information about how it works usually does exist. The difficult thing is in encoding it so that it can be queried and used in coherent conversation. That's what I'm hacking on.)

</comment><comment><USER13> [Site Name Yet to be Determined] helps you organize, track, and follow up on your search for a [job|apartment|house|car|date|employee|vendor|whatever] on the web.

<comment><USER14> Good luck with it. That would be a Google killer.

</comment></comment><comment><USER15> We all have tons of photos, movies, and music on our desktops that we'd like to share, but don't have the time or patience to upload them all to an online sharing site.

We built CloudFire for people that want to share ALL their media...FAST...right from their desktop.

Don't waste your time free time UPLOADING.

<comment><USER16> That could be the prototype for Web 2.0 product names.

</comment></comment><comment><USER17> Snarfbot, a new way to search. It allows you to easily compare results from multiple search engines at once without altering or reinterpreting the results. Create custom search tabs and tab groups that you can share with your friends and colleagues.

<http://www.snarfbot.com> _in early alpha, but mostly works :)_

Still working on the pitch... Not sure how to word the last line, it doesn't make much sense until you have used the site which is likely a bad thing. I am open to suggestions...

</comment><comment><USER18> As an aside here, I watched startup school on justin.tv (all of it) here in Australia on the Monday morning.

Greg McAdoo's talk was excellent and included a few words on the elevator pitch; only I missed something. At one point he used Cisco as an example of an elevator pitch, first he said what they might have done. Then he showed a slide and said, "well I don't even have to introduce this...".

Only, I couldn't read the slide!

Does anyone recall what it said?

<comment><USER19> "Cisco networks networks" (or something highly similar).

<comment><USER18> Cool - thank you. I was expecting something more like, 'we are the Internet' - maybe that came later on.

</comment></comment></comment><comment><USER20> <http://openphotovr.org> \- 3D photo albums.

I didn't invent this pitch myself - it's how other people tend to describe my project. Strangely, all three words are (strictly speaking) false. There's no 3D, only image interpolation. The project is not limited to photographs. And it has no reified concept of "album". A truthful pitch would sound like "images connected by fluid transitions", pretty boring.

<comment><USER21> Reminds me a lot of Photosynth

<http://www.ted.com/index.php/talks/view/id/129>

</comment></comment><comment><USER21> "Does your soccer team have problems staying organized? My site fixes that. www.myurl.com."

It's good because anyone who has been on a soccer team knows how shoddy their communication methods typically are and will likely ask some barrier-breaking questions to allow me to explain the site further. Any leads the pitch generates is relevant (no one who doesn't care about soccer will want more information).

</comment><comment><USER22> Super-short version: Tagging that works.

Tagging is widespread and well-understood, but somewhat broken. Finding and browsing using tags is slow and clumsy because current systems are pretty dumb – they have little understanding of the meaning or structure behind tags. My app makes tagging work by finding structure and enabling users to add meaning to their tags.

</comment><comment><USER23> I suck at elevator pitches, but here goes:

HubSpot (<http://www.HubSpot.com>):

On demand software for inbound marketing. Helps small businesses get more website visitors and convert a higher percentage of them to paying customers.

</comment><comment><USER24> We help you get your work done in half the time with better quality. Our application helps you identify the critical path to getting your work done, and focuses you on the top priority tasks that need to be done now with all the information you need to do them.

<comment><USER25> OK, but what does it actually do? So many things could fit that description that it's hardly a description at all.

<comment><USER24> We integrate project, workflow, and action management into one application. Changing the dependency links for the critical path of the project immediately changes the action to do list. Rather than seeing countless tasks that need to be done, you only see those that must be worked on now.

Our system also expands the idea of a Project. Rather than an isolated silo of work that you have to do, a Project integrates all of the people involved together with our collaboration system, from customers to vendors to subcontractors. The goal of a project is the complete value being created for the customer or for yourself.

The system allows you to create workflow templates and capture process knowledge of commonly recurring sets of task steps so that you can assign many tasks with a single click. The system also automatically tracks all of your time and associates the work you do with what you've worked on.

</comment></comment></comment><comment><USER13> [VerbNounAdjective]: One click to read it later--a Netflix Queue for your web surfing.

</comment><comment><USER26> We make it easy for customers to provide feedback and ideas to companies, and to make it easy for companies to manage these ideas. <http://whisperlabs.com>

</comment><comment><USER27> <http://wwww.booksiamreading.com>

Books I Am Reading: A Book Reader's Tool

<comment><USER7> Elevator pitch as domain name. Well played.

</comment></comment><comment><USER28> <http://markkit.net> \- the web highlighter pen

</comment><comment><USER29> Nike+ with more sports, no flash, and discussions everywhere.

</comment><comment><USER30> Just came up with a new one for ezlearnz.com:

ezLearnz: this is your textbook on the internets

</comment><comment><USER31> We tatoo your ass, you get paid for showcasing corporate logos at volleyball tournaments.

<http://www.tatoomyass.com></comment>


Principles behind an effective landing page - <AUTHOR> http://www.tawheedkader.com/2010/03/9-principles-behind-an-effective-landing-page/

<comment><USER2> Interesting article, however, it is way too focused on software / services. For example, not every product "solves a problem" or provides any direct "benefit". Think of women's clothing, for example. You can't write "if you buy our clothes, you'll have 40% more chance of getting laid".

<comment><USER3> Sure you can! Show beautiful women hanging on a guy wearing aforementioned clothes. That's exactly the author's point.

</comment></comment><comment><USER4> when are you going to remove that ubuntu logo used as a place holder?

;-)</comment>


Yes, I'm a nine-year-old girl. But I'm still a serious reporter - <AUTHOR> http://www.theguardian.com/commentisfree/2016/apr/06/nine-year-old-reporter-orange-street-news-truth <comment><AUTHOR> [https://news.ycombinator.com/item?id=11434910](https://news.ycombinator.com/item?id=11434910)

</comment><comment><USER2> Reminds me of how I was banned from school computer labs for patching security holes, fixing proxy settings, and removing viruses, and framed & expelled by a network admin trying to cover his ass. Adults can be real douchebags to kids.

<comment> atom-morgan It's a real shame. I get so frustrated when I see adults, even parents, telling kids to stop doing something I would consider to be beneficial, practice, etc.

If I could talk to this girl I'd give her a high-five and encourage her to continue what she's doing. It's a shame adults do everything but sometimes.

</comment></comment><comment><USER3> That a 9 year old can be somewhat competent at it says more about reporting than it does the 9 year old.</comment>


'If you want people to do something, make it easy' - <AUTHOR> https://www.ft.com/content/a317c302-aa2b-11e9-984c-fac8325aaa04 <comment><USER2> Aka: "make it easy to do the right thing, make it hard to do the wrong thing".

Health care software doesn't do this concept very well. And I find it hard to get the vendor to make changes when their dev team is in a place where... personal protective equipment and/or safety isn't really in their culture (and 10+ year shorter life expectancy).

</comment><comment><USER3> Well, a paywall that wasn't easy

<comment><USER3> Let me rephrase as per[0], anyone have a source where I can read this?

[0] [https://news.ycombinator.com/item?id=10178989](https://news.ycombinator.com/item?id=10178989)</comment></comment>