Ask HN: 5 years from now; what do devs do? - <AUTHOR> 1. What languages do they write in?
2. Which stacks do they use?
3. What hardware is king?
4. Why software is king?
5. What are they developing? <comment><USER2> _Languages:_ Lots of Javascript ( _maybe_ more Typescript, but would be shocked if that had taken over completely). Probably quite a bit of Python, Ruby, Go, PHP. I'd be pretty shocked if something we haven't already heard of gains a big market share in five years. New languages are a slow-burn thing today. One plausible shift would be Rust edging out C/C++ in lower-level application/library development. But will be a slow transition, as a fraction of total code written, it'll still be quite small.

 _Stacks:_ I suspect we'll see more emphasis on making new-built software that can be sold to management as "cloud aware". Which in practice, probably translates to more Kubernetes. But again, mostly stuff we're seeing today.

 _Hardware_ : amd64 still dominant for servers and desktops. ARM for mobile, gradually making some inroads into the server space (but if it takes over completely, that's still >5 years off). Maybe some ARM desktops. Hopefully POWER will be hanging in there, and maybe some RISC-V hardware -- but only in niches. Number of cores will continue to increase, but addressable RAM and memory bandwidth will be even bigger limiting factors than they are today.

 _What are they developing?_ : Line-of-business CRUD apps.

 _Edit:_ Re-reading, this comes across as quite negative. I _do_ think we'll see a whole lot of innovation in these areas -- just that it'll take multiple years to filter through to what the average developer is working on.

<comment><AUTHOR> To your hardware section I'd add the rise and rise of the GPU, and possibly FPGA in scientific computing.

In terms of "what". I expect these transitions to continue strongly:

Backend -> Data Engineering

Backend -> Machine Learning

Analytics -> Data Science

I expect something like WASM to up-end front-end development totally at some point, maybe in the next five years, possibly leading to "web desktops" that run true "web applications".

</comment></comment><comment><USER3> 1\. The same variety of languages they use now. Remember, most developers/engineers are not 'trendy'. Most companies are not on top of the latest trends and fad frameworks.

So while there will be inevitably be a fair few using completely new languages and frameworks we can't even currently imagine, there will also be people using the exact same stuff they're using now, or have been using for decades. We'll have people still using React and Angular and Vue. People still using PHP and MySQL and .NET and Python. Hell, some people will still likely be using Cobol or Fortran or assembly code 5 years from now. Hell, some people will be writing ASM in 2050.

2\. Every type of stack imaginable today, plus various others created in the 5 years from now. There are still many devs out there using Apache and a LAMP stack for their work, likely even with CPanel or Plesk still running on it to boot.

3\. Don't have much experience with hardware, so won't guess about that.

4\. What kind of software are you speaking of? The kind the dev uses to write code, or the kind that runs on the server/servers? For the former, probably Visual Studio Code or Brackets or what not, with Git for version control and Mac OS/Windows/some Linux distro as the operating system. Don't see much of that stuff being replaced any time soon.

5\. Exactly what they're developing now. 99.9% CRUD apps and sites for businesses, 0.01% more interesting things for startups and FANG companies.

Hope that doesn't come across as too negative, it's just that from my experience, people always assume the future is going to be far more different than it actually is and that tech will be uniformly replaced in some major revolution. That's usually not how it works. Usually it's the old and new co existing, and both tech and business models being unevenly distrubuted among people and organisations.

</comment><comment><USER4> _Languages_ : If framework bloat hasn't hit the global reset button on front- end development, something new in that space. .Net Core ~7 should be out by then. More Python. More Rust. Less PL/SQL(Oracle) & Java(Oracle) due to the licence issues. Possibly a lot more Java(Open source).

 _Stack_ : In ~5 years we should be in the peak of the performance focus sine wave, moving away from microservices to tighter, more responsive architectures. In an ideal world devices like Google Glass will finally become mainstream and require the supporting developer resources to leverage them.

 _Hardware_ : Nothing that will affect the average developer but I'm hoping some niche applications will have access to synthetic neuron cpus.

 _Software_ : is _always_ king.

 _What_ : I hope the hype from machine learning/advanced memorisation will have died down (but still have it's place) though mostly replaced with clever and considered algorithms built by what will probably be a new job title that is a hybrid of data scientist and software architect - what computer scientists should have been doing all along.

</comment><comment><USER5> Five years is too little to expect much change in any of these departments - possibly apart from the stack (which seems to change every six months...)</comment>


Memcached - Report Card for an Open Source Project - <AUTHOR> http://dustin.github.com/2009/10/22/memcached-reportcard.html <comment><USER2> This such a greatly written appeal for bug reports. It explains why users need to file bugs, and dives into great detail to show that bugs do get closed and the policies of closing them (crash bugs vs other types). Kudos.

<comment><USER3> Unfortunately filing bugs is not enough. Memcached seems to be a well managed project, which is an exception rather than a rule (they close almost as many bugs as are opened! - that's really amazing!) And that attitude makes a difference.

<rant> About a year ago I got to the stage where I stopped filing bugs for projects where I don't have a direct contact with any developer, because usually it's just a waste of time for me. I've got issues opened with OO.o, ubuntu, firefox, f-spot and others that weren't looked at for years. I didn't even get a response from developers to verify most of them... OO.o is the winner with 4 issues opened and 0 closed since 2005 followed with ubuntu with 16 triaged / confirmed (but no fixes).

Developers - please take example from memcached. If you let someone wait for 3 years, and then ask "so how do I reproduce it" the only answer you're likely to get is "don't know, I'm using some other app since 2005, because you can't be bothered to fix bugs"

<comment><USER4> it's difficult to compare a project like memcache to firefox. the memcache bug list page can probably fit on a single screen, whereas firefox probably has hundreds if not thousands of open bugs due to the size of the codebase.

once a list of open bugs gets too big, users won't bother searching for duplicates or can't accurately find them, and new developers won't know where to jump in, so the list just keeps getting bigger.

add to that the fact that many users don't include proper information like how to reproduce the problem, test cases, backtraces, etc. and once developers actually get around to looking at those bugs, they have no interest in tracking down a user whose email will often bounce or isn't running the software anymore, just to reproduce an issue that may have been fixed by some other change months ago.

<comment><USER5> The lesson I take from that is to work hard to keep your buglist low.

As an example look at OpenBSD. By my count from <http://www.openbsd.org/query- pr.html> they have 208 open bugs, of which they are actively working on over a third of them. That's for _a whole operating system!_

<comment><USER4> yes, a few things have been done to get to that point.

1 - make the kernel tell the user exactly what to report in the case of a kernel panic

[http://www.openbsd.org/cgi- bin/cvsweb/src/sys/ddb/db_trap.c....](http://www.openbsd.org/cgi- bin/cvsweb/src/sys/ddb/db_trap.c.diff?r1=1.13;r2=1.14)

2 - rewritten sendbug to remove useless fields and automatically add useful information for developers (dmesg output, acpi dumps, etc.) to make it easier to trace problems to specific hardware

[http://www.openbsd.org/cgi- bin/cvsweb/src/usr.bin/sendbug/se...](http://www.openbsd.org/cgi- bin/cvsweb/src/usr.bin/sendbug/sendbug.c)

3 - quickly respond to new bugs. if they are valid, poke a developer that will know something about it. assign the bug to someone or at least mark it as verified. if the bug report doesn't have the required info or isn't valid, respond to the user and close it right away. don't let things pile up.

</comment></comment></comment></comment></comment><comment><USER6> Since users/fans of memcached will be reading this I wanted to ask a quick question: I wrote a debug version of memcached in Python that has a couple of "x" commands in it - xdump which dumps all the data in the hash using the same return format as get and xtrace which keeps the connection open and dumps the incoming commands, values and results as they come in.

I was thinking of writing an Adobe Air app that uses xdump and xtrace to let you view/edit usage of memcached. A friend has a project on github that lets you do this in 1 app on a mac but the Air app would be cross platform.

Thoughts on releasing this as an open source project?

btw, the Mac app is at <http://github.com/gerardg/mcinsight> \- its a fork of another project.

<comment><USER7> > Thoughts on releasing this as an open source project?

The only reason I'd say you _shouldn't_ release something as an open source project is if you strongly feel that someone is going to hand you a sufficient amount of cash to keep it proprietary (and even then, it's pretty easy to convince them that there's potentially more value in your project as open source).

I have regretted _not_ pushing projects forward as open source in the past. I have never regretting making something open source.

</comment></comment><comment><USER8> It's refreshing to see such a level of humility from an open source project!

</comment><comment><USER9> I hate to immediately divert the discussion off topic, but does anyone know what tool can be used to make attractive graphs like the ones in this article?

<comment><USER7> I used this thing: <http://www.omnigroup.com/applications/omnigraphsketcher/>

<comment><USER10> OmniGraphSketcher is a great little app. It approaches the graphing problem from the opposite direction that traditional graphings apps take.

</comment></comment></comment><comment><USER10> This is a great report. I intent to try and start doing something similar to this on our projects in the future. Thanks!</comment>


Remember the $9 Cardboard Bicycle? It is now a reality for $20 - <AUTHOR> http://nocamels.com/2012/10/20-recyclable-cardboard-bicycle-is-now-a-reality/

<comment><USER2> Cool!</comment>


Alert About Missile Bound for Hawaii Was Sent in Error, Officials Say - <AUTHOR> https://www.nytimes.com/2018/01/13/us/hawaii-missile.html <comment><USER2> Just watched an interview on CNN with the Governor of Hawaii and their director of emergency management. Pretty impressed that the director didn't throw anybody under the bus. He basically said "An employee pushed the wrong button. It's my responsibility, so this is my fault. We're going to make procedure and technical changes to make sure this doesn't happen again."

<comment><USER3> A lot of people are calling for the person who did this to be instantly fired, but I've always been of the opinion that the guy that pushed that button would be an outstanding hire - because he'll never, ever do something like that again and he's learned an important lesson.

<comment><USER2> BINGO. If someone makes a mistake like this, unless it was deliberate or negligent (e.g. he/she didn't follow established procedures), you don't fire them! You fix the technical or procedural failures that allowed them to make the mistake in the first place. Heck, you should probably THANK them for making the system better by uncovering a bug!

When I was still mostly a Noogler, I took a large portion of Google completely down worldwide for 6 minutes. Guess what? We did a postmortem, fixed the procedural and technical problems that allowed it to happen, and I'm still here!

<comment><USER4> An interesting variation to this thought is:

When is appropriate to fire someone for making a mistake?

Some ideas:

\- gross negligence / malice

\- ethics

\- publicity damage / internet pitchforks

Additionally, it doesn't seem like the forgive mistakes approach meshes well with the startup advice of "it's never too early to fire."

<comment><USER5> Incompetence should probably be number one.

There is a big difference between someone making a mistake due to unclear or incomplete process and someone doing that mistake because they are not competent to perform that task.

This then raises the issue that hiring and leaving incompetent people in place is itself proof of an organisational incompetence...

</comment></comment></comment></comment></comment><comment><USER6> This kind of accident has happened many times in the history of the Emergency Alert System (EAS)[1] and the earlier Emergency Broadcast System (EBS). The false alarm of 1971[2] actually revealed a major flaw in the EBS. During the incident, a legitimate national alert initiation message was erroneously broadcast instead of the scheduled test message. Many stations did not propagate the message as required because of confusion caused by receiving it within the time window of a scheduled test. Interestingly, this revealed a major flaw in the system in the event of a real emergency: that an adversary could time its attack with a test broadcast of the EBS, rendering the system generally ineffective.

[1] [https://en.wikipedia.org/wiki/Emergency_Alert_System#Inciden...](https://en.wikipedia.org/wiki/Emergency_Alert_System#Incidents)

[2] [https://en.wikipedia.org/wiki/Emergency_Broadcast_System#Fal...](https://en.wikipedia.org/wiki/Emergency_Broadcast_System#False_alarm_of_1971)

</comment><comment><USER7> If I were going to erode public trust in emergency broadcast systems in order to increase the amount of damage I would do by launching an actual missile, this is how I would do it. A series of false alarms.

A similar, if obviously much smaller and less disastrous example, happens at my apartment about 4 times a week: the fire alarms for entire floors of my apartment building are easily triggered by people smoking in the breeze ways or burning their dinner. The result is that I routinely ignore fire alarms because the likelihood of a real fire is has been demonstrated to be exceedingly small.

<comment><USER8> A ballistic missile heading for Hawaii would be nuclear, the amount of additional loss of life that would incur from "damaging the public's trust" in the early warning system would be pretty much negligible if the missile hits any major population center. This is basically not an issue for nuclear missiles for something more like to the situation in southern Israel with conventional unguided munitions blindly shot at their general direction it might work but if a nuke could get you it would do it regardless if you duck and cover or not.

<comment> Tuna-Fish > but if a nuke could get you it would do it regardless if you duck and cover > or not.

This is just not true. The area in which the nuke will get everyone regardless is less than a tenth of the area where taking precautions would save you.

This is a bit of a pet peeve of mine. People widely laugh at "duck and cover" as if it was some huge joke. Even at the height of the cold war when the nuke stocks were at their largest, only a small portion of the population would be screwed regardless of what they did. While the majority of the population would be at a distance from the closest explosion where ducking and covering would save them.

<comment><USER9> Another thing that constantly astonishes me is how the immediate direct damage caused by any kind of intentional explosion is consistently overestimated by public at large. I largely blame action movies where C4 block of the size typically used for initiating industrial explosives in bore holes is often shown as leveling complete buildings.

<comment><USER10> Or war movies, where a round from a tank gun or small artillery piece completely wrecks a house. I have a handful of decommissioned 76mm tank destroyer rounds, probsbly from an M18 Hellcat - comparable to most WW2 tank guns. It's about the size of a one-liter soda bottle, and a significant portion of that is aerodynamic casing, propellant, and fuse.

It's interesting, too, to read historical accounts of sieges in the Napoleonic and earlier eras; it would take days or weeks of pounding by breaching batteries of heavy cannon to reduce masonry walls to effect a breach and allow an assault over the pile of broken rubble remaining, in a bloody, hand-to-hand melee. And often there would be so much time between firings that the defenders could rebuild new defenses in depth behind the breach. Unless a powder magazine was struck, massive damage was relatively rare.

</comment></comment></comment></comment></comment><comment><USER11> An interesting Reddit comment described a chaotic traffic situation for 20 minutes (people running lights, wrong-side-of-the-road driving, extreme speed, etc.). Human nature in these moments is very "Tragedy of the Commons" apparently.

<comment><USER12> Link?

<comment><USER11> [https://www.reddit.com/r/news/comments/7q67a1/emergency_aler...](https://www.reddit.com/r/news/comments/7q67a1/emergency_alert_about_ballistic_missile_sent_to/dsmp325/)

</comment></comment></comment><comment><USER13> I woke up to this this morning on the island of Oahu. People running around on the street freaking out and police / fire engine sirens going off.

Everyone cheered when the "False alarm" SMS came through across the phones.

Secure your networks people - this electronic psyops stuff is real.

<comment><USER14> Why are people running around in the streets freaking out when they are told to seek cover because there is an incoming missile?

<comment><USER15> Nobody teaches anyone about cover during a nuclear strike anymore. In fact, the concept is frequently mocked as cynical Cold War era propaganda.

<comment><USER16> The mocking isn't unjustifiable though. I mean the turtle/duck and cover is quite pointless, at least in the case of a nuclear strike (unless you're maybe on the far edge of it, in which case a ditch might save you..and that's big might).

In the documentary "Iraq: The Untold Story", the creator shows civilian air raid shelters in Baghdad. They were four stories down, with the upper floors all reinforced concrete. Yet there were powerless against US bunker busting bombs, and the hundreds of civilians in the shelters that were hit all died.

<comment><USER17> Have you ever looked at pictures of the aftermath of Hiroshima? People who weren't behind cover survived the immediate blast but got horrifying burns.

<comment><USER18> What happened to the people who were behind cover?

<comment><USER19> If I remember correctly, others was a man in a basement only a few hundred feet from ground zero who survived relatively unscathed.

Don't underestimate the protection cover can offer!.

</comment></comment></comment></comment></comment></comment></comment><comment><USER20> A lot of comments making fun of the "duck and cover" advice, but consider this: Many people suffered serious injury from the Chelyabinsk meteor when they went to a window to see the spectacle, not realizing the shock wave would follow a few seconds later and shatter the windows into their faces.

If they had gotten away from the windows and ducked and covered, they would have been fine.

</comment><comment><USER21> So it took 38 minutes to send out a new message informing this was a false alert. How is that possible if this was simply a human error during a "shift change"?

You'd think the people who "pressed the wrong button" would be able to press the same button again?

<comment><USER22> > _You 'd think the people who "pressed the wrong button" would be able to > press the same button again?_

Absolutely not. Once you say "fire" you need official confirmation to say "no fire".

That means certification from the military. The official needed being in a meeting or tending to something of greater importance could easily introduce delays.

In any case, I presume the system's designers didn't build in an "oops, fat finger" notification. Getting that ready could have easily taken 30 minutes. This happened on a week-end. The coders could have very well been at home.

<comment><USER23> If you're engaged in a drill that's a completely predictable failure mode which you should have a standby plan for.

 _This happened on a week-end. The coders could have very well been at home._

Again, why would you perform a drill involving mass emergency mobilization and not manage that risk? What if this had happened during a morning commute or in some part of the country where people are more easily panicked?

With great power comes great responsibility, remember?

<comment><USER22> > _why would you perform a drill_

Was this a drill? I understood it to be an unplanned mistake.

<comment><USER24> The White House put out a statement calling it a drill, but that hasn't been confirmed anywhere else, so.

</comment></comment></comment></comment></comment><comment><USER25> So a test drill went wrong.

It makes sense to have drills right now, India (tests with war against China and Pakistan), China (Telling their soldiers to be prepared to die for China), Russia(tests against Nato), and North Korea (getting ready for war with the US) are all having military tests for basically what will quickly become another world war.

We are really at a big crossroads as a large amount of people are rejecting globalization in many different countries. And with such major powers willing to fight hard for resources like Ukraine, South China Sea, Oil Eu pipelines, and not even mentioning the increasing gulf between various countries on core ideologies and creeds.

We really are at a new and dangerous crossroads.

<comment><USER26> I'd argue it makes sense to have test drills simply because the system exists: much like backups need testing, so do emergency systems. I'm not sure that the current state of the world should influence whether or not the systems are tested.

<comment><USER27> tests and training shold be done ever as possible. But in times like now, that war seens more iminent than ever it would make sense intensifing this tests.

</comment></comment></comment><comment><USER28> "Amid public outcry over the incident, the Hawaiian government also released a timeline of what transpired after the false alarm:

Approx. 8:05 a.m. – A routine internal test during a shift change was initiated. This was a test that involved the Emergency Alert System, the Wireless Emergency Alert, but no warning sirens.

8:07 a.m. – A warning test was triggered statewide by the State Warning Point, HI-EMA.

8:10 a.m. – State Adjutant Maj. Gen. Joe Logan, validated with the U.S. Pacific Command that there was no missile launch. Honolulu Police Department notified of the false alarm by HI-EMA.

8:13 a.m. – State Warning Point issues a cancellation of the Civil Danger Warning Message. This would have prevented the initial alert from being rebroadcast to phones that may not have received it yet. For instance, if a phone was not on at 8:07 a.m., if someone was out of range and has since came into cell coverage (Hikers, Mariners, etc.) and/or people getting off a plane.

8:20 a.m. – HI-EMA issues public notification of cancellation via their Facebook and Twitter accounts.

8:24 a.m. – Governor Ige retweets HI-EMA's cancellation notice.

8:30 a.m. – Governor posts cancellation notification to his Facebook page.

8:45 a.m. – After getting authorization from FEMA Integral Public Alert and Warning System, HIEMA issued a "Civil Emergency Message" remotely. The following action was executed by the Emergency Alert System (EAS): 1\. EAS message over Local TV/Radio Audio Broadcast & Television Crawler Banner. "False Alarm. There is no missile threat to Hawaii." "False Alarm. There is no missile threat or danger to the State of Hawaii. Repeat. There is no missile threat or danger to the State of Hawaii. False Alarm." 2\. Wireless Emergency Alert (WEA) "False Alarm. There is no missile threat or danger to the State of Hawaii."

9:30 a.m. – Governor makes initial media notification.

9:34 a.m. – Governor's message posted to his Facebook and Twitter accounts."

[http://www.washingtonexaminer.com/hawaii-releases- timeline-o...](http://www.washingtonexaminer.com/hawaii-releases-timeline-of- what-transpired-after-false-ballistic-missile-warning/article/2645874)

</comment><comment><USER29> I'm surprised the discussion here hasn't veered toward what actually happened. Technical glitch/human error? Hacked emergency alert system? Missile actually was on the way, but being a cheap North Korean one, it fell into the ocean on the way?

There are lots of potential explanations...whatever happened, there is stuff to work on in the aftermath of this. Barring the idea that it was an actual missile that failed to hit its target, if these alert systems are vulnerable, that's a bad thing. This could have caused serious chaos in a large city like New York. Techniques like this could be used to cause gridlock before a terrorist attack, suppress voter turnout on election days, etc.

<comment><USER30> The emergency notice was triggered after an "employee pushed the wrong button" during a shift change at the state's emergency management agency, Governor David Ige said at a press conference in Honolulu.

Source: [http://fortune.com/2018/01/13/hawaii-false-missile- alert/](http://fortune.com/2018/01/13/hawaii-false-missile-alert/)

<comment><USER29> I'm aware that he said that, and that may be the actual explanation (let's hope so), but even then there is work to be done - maybe adding authentication or confirmation to it etc. That said, this is a situation where if it were more serious (someone hacked in, for example), they'd almost certainly lie about it.

</comment></comment></comment><comment><USER31> Human error or crying wolf aside, it's an interesting exercise from which residents can learn what is truly lacking in the case of such an emergency.

Hopefully instead of seeking to cast blame or personnel firings, etc., folks will learn what it is they lack in emergency response.

<comment><USER32> I am sure that I will also get buried here, but if someone intentionally pressed that 'button' then I believe they are the actual emergency response leader and should be put in charge of the effort statewide.

A drill is supposed to tell you how close or far away you are from being prepared. A surprise drill is going to be much more effective. The threat is so great, if there haven't been serious drills in a long time then they were overdue.

</comment></comment><comment><USER33> Well, it will be interesting if any researchers look into people's actual behavior within the first few minutes of the notification before the 'false alarm, never mind' message went out to see how effective this was as an emergency alert, even if unplanned.

</comment><comment><USER34> Not a terrible thing to have happened, tbh

Now we get to see & analyze the "real life" reaction to this dress rehearsal. I'm sure everyone knew without this that a real alert would be full of SNAFUs, but you don't usually get a chance to see what they would really be if everyone actually believed the alert was real.

Hopefully (and I think they will ) they'll be smart enough to use this rare opportunity.

</comment><comment> f- So I posted something along these lines in another, now-duped thread... but I know that many folks were caught completely off guard and started wondering what they would have done in case of a real threat. Many just cracked Twitter jokes about dying in a blaze of glory.

For folks who want to understand the actual dangers and survivability of an ICBM strike, I strongly suggest a book from the 1960s written by one of the folks involved in the US nuclear program during the Cold War:

[http://www.madisoncountyema.com/nwss.pdf](http://www.madisoncountyema.com/nwss.pdf)

It cuts through many of the Hollywood-perpetuated myths - the certain and painful death in case of a nuclear strike, or the 10,000-year radioactive wasteland that's going to be left behind.

For example, it discusses why the oft-ridiculed duck-and-cover strategy is actually surprisingly effective. The primary threat from an air burst is very conventional - a shockwave and an intense burst of thermal radiation. Shelter - any shelter - greatly improves your survival odds.

The fallout from air bursts is comparatively modest (i.e., tends to be far lower than from an event such as Chernobyl) and while lethal, it decays very rapidly - dropping to reasonably safe levels in a matter of days, not centuries. Staying sheltered for 2-10 days greatly improves your odds, and the thickness of material between you and any surfaces that gather dust (roofs, ground) matters more than anything else. Here's a handy chart:

[http://static3.businessinsider.com/image/58cc34b9112f7043268...](http://static3.businessinsider.com/image/58cc34b9112f7043268b4bb4-1151)

In other words, having enough food and water in your home to weather out a nasty stowstorm also makes you well-prepared for the nuclear apocalypse. Mattresses and bulky furniture provide decent shielding when all other options fail.

The long-term effect of fallout tend to be exaggerated, too; water from streams, deep lakes, or wells should be safe or get safe very quickly. Removing a layer of topsoil allows relatively safe crops to be grown. Mild radiation sickness, at the levels where people start experiencing vomiting and hair loss, is actually pretty survivable and has a relatively modest impact on your odds of developing cancer later in life.

(Plus, keep in mind that more than 2,000 nuclear tests have been conducted so far, including around 900 in Nevada alone; while they had some statistically observable negative effects, they have not turned the world into a nuclear wasteland.)

Of course, don't get me wrong - even a single nuclear strike would be awful, and a large-scale confrontation would mean untold damages and loss of life. But the important point is that a lot of people would survive and would be able to do well in the aftermath - more so if we teach them about some common- sense preparedness steps.

The main reason why our understanding of the nuclear risk is so lopsided is because for decades, many nuclear disarmament activists (including many prominent screenwriters, celebrities, and pundits) had a vested interested in portraying the already-awful outcomes of a potential nuclear war as far less survivable and far more hopeless than in reality; the mockery of duck-and- cover, the "barren wasteland" imagery in the movies, and the largely- discredited scientific theories like the "nuclear winter"... all helped to advance (otherwise noble) goals, but at the expense of teaching people that there's nothing they can do save themselves.

Plus, of course, after Cold War, we have fewer reasons to worry. It's hard to top the Cuban Missile Crisis. There's plenty of politicized hyperbole around nuclear tensions right now, but the reality is that a large-scale strike on the US is a lot less likely than throughout a good part of the 20th century.

PS. I have a short summary of NWSS and some other points about this topic (and other, more mundane but plausible hazards) in my "Doomsday Prepping for Less Crazy Folk" \- [http://lcamtuf.coredump.cx/prep/](http://lcamtuf.coredump.cx/prep/)

<comment><USER35> >[http://lcamtuf.coredump.cx/prep](http://lcamtuf.coredump.cx/prep)

Did you write this? This is great!

<comment><USER36> It was discusson on HN 5 months ago: [https://news.ycombinator.com/item?id=15110850](https://news.ycombinator.com/item?id=15110850)

</comment></comment></comment><comment><USER37> This should not happen, yet time after time we see that critical American infrastructure and systems are run worse than a pre-revenue bay area chat startup. American infrastructure needs to invest and hire/pay for the same quality that bay area startups do. Let four people go that are inept and less qualified and pay a single solid person market salary.

Besides the fear and chaos potentially caused to people in Hawaii there are financial implications if the stock market were open.

<comment><USER38> _American infrastructure needs to invest and hire /pay for the same quality that bay area startups do._

Looking through the Github and Slack system status pages for this month so far ... I don't know that's exactly the model to follow.

<comment><USER39> 20 minutes after everyone has already figured out that they've been hit by a missile, you'd get an alert: "We are currently investigating reports of increased explosion rates."

<comment> FLUX-YOU >"We are currently investigating reports of increased explosion rates."

Status lights will still all be green

<comment><USER40> All status lights were hosted on S3 and the AWS datacenters were hit first.

</comment></comment></comment></comment></comment><comment><USER41> I'm in Hawaii and received it this morning. First thought: there is probably no shelter close by anyway, and if they would send a missile they would probably target Honolulu (I'm in Kauai).

<comment><USER42> I know this isn't a comforting thought, but: Missiles from the most likely source (North Korea) are not thought to have very good accuracy. They may be as likely to hit Kauai or the big island (or the ocean nearby) as Honolulu.

I hope this event wasn't too stressful for you and your family.

<comment> ju-st They would probably send multiple warheads to increase the odds...

<comment><USER43> That's trickier than you'd think. You either have to send the warheads one _well_ after the other, or you have to set them up so they detonate at _precisely_ the same time, so as to avoid the first warhead to detonate destroying all the others. (This is why, at one time, missile silos were placed relatively close together. The enemy could presumably get one of them in a preemptive strike, but not all of them.)

At Korea's level of technology, for example, you'd probably just pick a secondary target in some other place entirely.

</comment></comment></comment></comment><comment><USER44> I've read that it was a human error when someone pushed the wrong button. I feel bad for that person.

<comment><USER45> I'm sure the UI looked like this:

[clear] [send and cause panic in 1.4 million people]

<comment><USER46> But it was on a Windows CE device with a resistive screen and the user lost the stylus.

</comment></comment></comment><comment><USER47> Any reason why it would take 30+ minutes to rectify the mistake?

<comment><USER22> Civilian governments would have had to get clarity from a military caught off guard. Something as simple as the appropriate official being in a meeting could introduce delays.

<comment><USER48> You'd assume a potential strike by an incoming missile is important enough to interrupt said meeting?

<comment><USER22> If NORAD said "incoming missile strike," sure. That isn't what happened.

The civilian notification system sent out a false positive. Saying "false alarm" would require, at that point, asking the military for affirmative confirmation nothing is wrong. That is a lower priority than responding to an active threat.

<comment><USER23> This is irrational. If you know a false alarm has occurred then you are endangering people by allowing them to believe the existence of an active threat. I feel like I'm stuck in a car with someone driving off a cliff because the GPS said so even though the edge of the cliff is perfectly visible though the windscreen.

<comment><USER22> You're bickering over a thirteen minute delay between a mistake and a correction.

<comment><USER23> A mistake that could easily have caused mass public panic and which there was no contingency in place for. That's not OK.

<comment><USER22> > _could easily have caused mass public panic_

Could. It didn't. This was a mistake. You're being irrational.

<comment><USER23> No I'm not. Imagine the same mistake happening in New York at 9 in the morning on a workday (remind you of anything?), or during some large public event where there was the potential for a stampede - hardly uncommon. Just because you get away with something without serious consequences once doesn't mean it's not problematic.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER49> Hopefully, THAAD and Aegis work in real life as they have practice. I guess the other comfort is that North Korea is likely a one-trick pony with a nuclear device (if they _have_ managed to miniaturize it). What is scarier is the anthrax antibodies found in the North Korean defector :/

I'm hoping the withdrawal of exercises of the USA and peace talks actually get us somewhere, but we've been to the table 100 times, I don't see much changing.

</comment><comment><USER50> Pro tip: if you are conducting a drill, refrain from using the words "THIS IS NOT A DRILL".

<comment><USER51> Now that they've already said that, next time they have to add "WE REALLY MEAN IT THIS TIME".

<comment><USER52> Do we really use capital letters for an alarm?

</comment></comment></comment><comment><USER53> Serious question: where would one seek shelter if that notification were true?

<comment><USER54> The more underground you are, the better. Shield from those gamma photons!

If that ain't an option, jumping into the ocean doesn't seem like such a terrible idea.

<comment><USER22> > _jumping into the ocean doesn 't seem like such a terrible idea_

That's a terrible idea. You'd be directly exposed when at the surface and end up inhaling fall-out.

<comment><USER54> Of course I was sarcastically implying that you would immediately swim to the mainland

</comment></comment></comment></comment><comment><USER55> I actually wonder why this warning can be send in the first place. As this unwanted "test" has shown, people have absolutely no idea what to/where to go in that situation. Instead there was a lot of panic. If there is the possibility that you will send out such a message it would be a good idea to give some advice on what to do.

<comment><USER56> When they reinstated the alert system, they also put out a bunch of campaigns about how you should take shelter. [https://www.nbcnews.com/news/asian- america/hawaii-reinstates...](https://www.nbcnews.com/news/asian- america/hawaii-reinstates-attack-warning-siren-prepare-possible-north-korean- missile-n823821)

</comment></comment><comment><USER54> [https://www.nytimes.com/2017/04/08/us/dallas-emergency- siren...](https://www.nytimes.com/2017/04/08/us/dallas-emergency-sirens- hacking.html)

<comment><USER54> [https://twitter.com/DEFCONWSALERTS/status/952248265260634112](https://twitter.com/DEFCONWSALERTS/status/952248265260634112)

</comment></comment><comment><USER57> There you again: it is useful to have a testing environment.

[https://nwschat.weather.gov/p.php?pid=201801131825-PHFO- NOHW...](https://nwschat.weather.gov/p.php?pid=201801131825-PHFO- NOHW40-PNSHFO)

</comment><comment><USER16> So either this was a security breach, a human mistake or a psyops/test on a small isolated American population.

In the first case, we'll probably only be told about it if they actually make an arrest and the system is patched.

The second is an interesting case, we'll come back to.

The final one: it was intentional and used to track what happened on the islands, and to also watch that information propagate back to the mainland. I feel like all of America has forgotten about PRISM/the NSA. With their immense data collection architectures and ties to large tech companies, they could easily filter the keywords and images they want, and get measurements of how quickly this information propagates and how people react.

Even more freaky, they can use language processing to even get numbers about what people might be feeling! I think we've all forgotten about this and it should be a chilling affect.

In the final case, we will, of course, never know. Anyone who suggests it will be called a conspiracy theorist (even though there is evidence the US government has preformed operations like this in the past, e.g. COINTELPRO) and the official line will be either reason 1 or 2 .. possibly with a patsy to arrest if need be. The truth will be declassified in 30~40 years so some people will be able to say "I told you so," but long beyond the time period anyone will actually care.

<comment><USER58> I'll go right ahead and call you a conspiracy theorist. If you think The US intelligence community would go out of their way to stir up a panic like this just because CoIntelPro was a thing 50 years ago, with no other evidence or reasonable motives, you must be a UFO chasing loon.

If there is anything nefarious here (seems like it), this is the work of a foreign state actor probing our infrastructure for exploitable weaknesses and sizing up our response. I'll put my money on Russia, who has already been attacking our elections¹, energy infrastructure², social media, and spearphishing candidates and elected officials³.

They have conducted similar attacks in the past, sending out tweets and text message alerts to hundreds of people for nonexistent emergencies⁴.

[1] [https://www.bloomberg.com/news/articles/2017-06-13/russian-b...](https://www.bloomberg.com/news/articles/2017-06-13/russian- breach-of-39-states-threatens-future-u-s-elections)

[2] [https://www.washingtonpost.com/world/national- security/russi...](https://www.washingtonpost.com/world/national- security/russian-hackers-penetrated-us-electricity-grid-through-a-utility-in- vermont/2016/12/30/8fc90cc4-ceec-11e6-b8a2-8c2a61b0436f_story.html)

[3] [https://www.secureworks.com/research/threat- group-4127-targe...](https://www.secureworks.com/research/threat- group-4127-targets-hillary-clinton-presidential-campaign)

[4] [https://mobile.nytimes.com/2015/06/07/magazine/the- agency.ht...](https://mobile.nytimes.com/2015/06/07/magazine/the- agency.html?_r=0&referer=https://duckduckgo.com/)

<comment><USER59> You say he's a conspiracy theorist and then jump to Russia gaining access to the emergency alert system? Seriously? Both these scenarios sound equally probably or improbable to me.

<comment><USER60> Pranksters hack the emergency alert system on a semi-regular basis.

So the plausibility of Russia doing it would be based on whether they would bother or not.

<comment><USER61> Pranksters=/=Russia.

<comment><USER60> I didn't say otherwise. I implied that if pranksters can pull off a hack it is likely that Russia also can.

<comment><USER61> So why implicate Russia at all, if its so easy? Sounds like a red herring to me, and also just as conspiratorial as the parent comment.

<comment> FLUX-YOU Both Russia and NK have obvious motives and capability to do it.

It doesn't mean you stop looking for causes or eliminate human error though.

The viability of Russia/NK depends on how the EAS network is set up in Hawaii. If they have internet-facing servers, it's completely possible.

<comment><USER61> Still, implicating other countries so soon seems premature and reactonary to me. Its like corporate news jumping to 'terrorism' immediately after any domestic tragedy. Our threat models need to include more than just nation states. Otherwise, we end up contributing to escalation through untethered fear.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER44> Serious question: for those of you reading this, how would you have responded in those 30 minutes?

<comment><USER62> I would seek shelter in a subway station. It's not perfect in terms of protection, because the ventilation system would pump in radioactivity as long as there's still power. But it would allow me to get to any place 20km away from city center without going above ground once.

Or, you know, a vodka soda.

<comment><USER63> Some lines, like part of the M1 metro line in Warsaw, are somewhat prepared to serve as a shelter.

</comment></comment></comment><comment><USER64> Every public warning system processes will be under scrutiny Monday morning. I wonder what the military was thinking when they saw that message, like "what dumbass sent this out"?

</comment><comment><USER65> Why was 'test' button even attempted only to worker 'hitting' wrong button, it's not the 1st of the month ( usual test day for alert siren test)?

</comment><comment><USER66> I was just thinking they are testing the network on one of the smallest areas in the US. You know with NK threatening to press the button

</comment><comment><USER67> damn man.. we have a more robust process in place for releasing our CRUD web app than they have to triggering a nuclear alert. That entire vertical branch of gov agency needs a heavy dose of slap in the face

</comment><comment><USER68> A number of folks have asked if anyone knows more details on how a false alert could have been issued. I had some exposure to conversations about these alerts a few years ago, so a few thoughts. This isn't based on extensive experience, but provides a bit more background than you'll get from the news stories I've seen, and if you're burning with curiosity this should give you some jumping off points to research it further.

Although FEMA is actively developing more robust controls for their IPAWS system, the controls on user behavior and what functions can be triggered in the system have limited capabilities to enforce restrictions (one would be the requirement for a digital signature to accept a CAP message as valid). If you listen to the press conference [2] Hawaii says they will now be using a 'two person rule' which indicates that the most significant controls they have are manual/behavioral (not automated in the system by user roles or automated workflows based on state policies). Few information systems do much more than have a few coarsely-permissioned user roles, though, so it's not like FEMA or Hawaii has tried to cheap out on the functionality - it's just not a very common capability and emergency alerts isn't a mission where you want to be using 'interesting new tools' that aren't well tested.

There are several alerting systems - the Emergency Alert System (EAS), the Wireless Alert System (WEA), and Non-Weather Emergency Alerts (NWEM). States use FEMA's IPAWS system for sending alerts, which [1] this one seems to have been sent through (localities don't necessarily participate in IPAWS, which is voluntary, but the Hawaii EMA was the one that sent this). Some questions I would have about this would be: \- IPAWS messages must have a digital signature to be accepted by the system, however based the Hawaii EMA press conference and articles which say 'an employee made an error' I would guess that the digital signature is not used in a way that is actually tied to the official authorized to declare the alert but to is accessible to their whole emergency Operations Group. \- Are they sending test messages with that signature? With a 'two-person rule', it sounds from the press conference that it isn't enforced by the machine (not like having two keys which both have to be turned to send the message) but by the first person stepping away from the machine and letting the other person push the "are you sure you want to send this?" button. That doesn't seem much better, but changing the system to do that gets away from the basic CAP architecture and isn't likely to happen soon.

The FCC is currently working on a proceeding regarding updating WEA to allow more geographic targeting of alerts, the way the other alerts can be targeted at specific locales. The current system dates back to 2011 or 2012, and is pretty coarsely-targeted, which is probably why you're getting Amber Alerts on your phone for a town that is 6 hours away just because it's in your state. You can find it at Proceeding Numbers 15-91 and 15-94 [3].

[1] You can see the message here, which archives messages sent via IPAWS: [http://ipawsnonweather.alertblogger.com/?p=18764](http://ipawsnonweather.alertblogger.com/?p=18764) [2] [http://dod.hawaii.gov/hiema/press-conference-missile- alarm-l...](http://dod.hawaii.gov/hiema/press-conference-missile-alarm-live- stream/) [3] [https://www.fcc.gov/fcc-announces-comment-dates- rulemaking-s...](https://www.fcc.gov/fcc-announces-comment-dates-rulemaking- strengthen-wireless-emergency-alerts-public-safety-tool)

This gives some more technical details on IPAWS and the Common Access Protocol that these messages use: [https://www.fema.gov/pdf/emergency/ipaws/ipaws_cap_mg.pdf](https://www.fema.gov/pdf/emergency/ipaws/ipaws_cap_mg.pdf)

</comment><comment><USER69> Hackers?

<comment><USER2> no

</comment></comment><comment><USER70> ENV=prod is never a good default…

</comment><comment><USER71> I received a second alert just over an hour ago. [https://i.imgur.com/Rc8cfO7.jpg](https://i.imgur.com/Rc8cfO7.jpg)

<comment><USER71> Nobody else besides me has received a second alert, that I know of, I've posted it like 30 times on twitter under #Hawaii and #MissileAlert etc

Context: I tweeted to someone who was upset about it all, "All your alert are belong to us", then immediately received the second false alarm: [https://www.youtube.com/watch?v=KXGnAMp9Nvk](https://www.youtube.com/watch?v=KXGnAMp9Nvk)

</comment></comment><comment><USER72> Not to sound crude but if a nuclear bomb what can people on an island really do?

<comment><USER73> It doesn't matter if you're on an island or not.

An ICBM (which is what you're usually talking about with nuclear bombs) takes about 30 minutes to reach its destination, which will be a large population centre.

So, you have less than 30 minutes to get out of a large city. Because you won't be the only one to try this there will be major congestion on top of the usual city traffic. Public transport could be an option but I wouldn't be so sure that trains keep running either once such an alert has been issued.

<comment><USER74> The total destruction radius of current ICBM warheads is much smaller than large population centres - if you live in one, and a single 2-5 megaton nuke would hit it, you likely won't die even if you stayed where you are (but duck&cover'ed, preferably in a basement, to avoid the secondary effects) because that nuke would hit some other district of your city; for any major population center the expected casualties from a single hit are just a small portion of the total population.

</comment></comment></comment><comment><USER75> Nice going fools. Next time people will just ignore it. Hope somebody gets fired for this.

</comment><comment><USER76> Superfluous but still somehow angering part of the article:

"Per White House pool reports, Trump was out on a golf course when the alert was sent."

</comment><comment><USER77> Meanwhile, Trump went ahead and finished his 18 holes of golf while 1.5 million Americans were told a ballistic missile was headed their way.

<comment><USER78> Finished his 18 holes when the US military had issued no warning of missile attack, and the proper bureaucratic processes were dealing with the situation.

I don't like the guy, but it's not on him to immediately and personally react to this kind of situation. Maybe a nice reassuring speech after the fact (which I doubt will be forthcoming or satisfying).

<comment><USER77> It actually is his responsibility, since it's a Federally designed system by the FCC. All the faults and benefits of the federal government ends on his desk. The buck stops with him, and we need to hold his feet to the fire on this issue.

"Why did this happen? What are you doing to make sure it doesn't happen again?"

Right now there are way too many people apologizing for his complacency (I guess people have normalized his uselessness at this point?), when it needs to be clear that he's responsible for this shit, too.

</comment></comment></comment><comment><USER79> Classic destabilization tactics.

<comment><USER80> On whose part?

</comment></comment><comment><USER81> I will go out on a limb and say someone hacked the system and decided to prank an entire state.

Fun fact, in my small hometown you could and possibly still activate the tornado warning system using DTMF and a transmitter on some frequency in the 149mhz range.

To clarify, I never actually attempted it but I had a uniden radio scanner in my teens and noticed the pattern for the 12:00 test.

<comment><USER82> Perhaps similar to that town in Texas where hackers set off the air raid siren nonstop in the middle of the night.

</comment></comment><comment><USER83> Ok, I hope that the people who got scared shitless by this emergency start doing something against nuclear weapons. It's ludicrous: We can all die any day and ICAN, the people who helped to pass the ban on nuclear weapons and got Nobel prize for it are raising money at a rate of $50 a day.

<comment><USER17> What do you want to do about it? Go to war with North Korea?

</comment></comment><comment><USER84> Doesn't everyone know that the best defense against such an attack is: "duck and cover"? Further, the desks of school children could be used as shelter/cover since everyone knows that these desks are made of the most powerful adamantium/vibranium alloy.

<comment><USER85> I also keep an old refrigerator in my house to climb into.

<comment><USER86> [https://www.quora.com/How-did-people-survived-the-impact- of-...](https://www.quora.com/How-did-people-survived-the-impact-of-the- Hiroshima-atomic-bomb)

That refrigerator would have been very handy here too:

"DŌ-OH WAS ABOUT THREE-FOURTHS OF A MILE FROM THE HYPOCENTER, INSIDE A MITSUBISHI TORPEDO FACTORY. THE MASSIVE...FACTORY COLLAPSED ON TOP OF HER AND THOUSANDS OF OTHERS".

[https://news.nationalgeographic.com/2015/08/150809-atomic- bo...](https://news.nationalgeographic.com/2015/08/150809-atomic-bomb- hiroshima-nagasaki-radiation-world-war-II-ngbooktalk/)</comment></comment></comment>


Intuition on probability distributions - <AUTHOR> https://twitter.com/paraschopra/status/1074151026477936640 <comment><USER2> Don't know what this says but my intuition tells me that I'm probably the only person here without a Twitter account.</comment>


A bug I won't forget - <AUTHOR> http://paulasmuth.com/blog/a_bug_i_wont_forget <comment><USER3> "I hadn't noticed this before since the parser is written in a way that it will ignore everything that doesn't look like JSON."

and this is precisely why you want to fail hard if you encounter invalid input. Yes. It's annoying in the cases of "nearly valid" input or "valid input but with some garbage". Yes it's more work to deal with the error.

But it also means that something like this blows up before you end up in a "sometimes it works, sometimes it doesn't" situation.

Yes. I have been dealing with and even preferring the silently-failing kind of functionality, but over the years I've been bitten by it too many times to still being able to prefer it with a good conscience.

Overall you might still spend more time overall dealing with bitchy libraries, but at least you will hopefully never have to deal with bugs that happen only sometimes as those are really hard to track down and fix (if it's at all possible).

Sure. Sometimes you can get away with "yea - it fails at times - that's an unfortunate fact of life", but the moment that issue which only rarely appears costs the customers or your money, it all becomes really important and "it fails at times" just doesn't do. Of course, by then, the problem needs to fixed _right then_ \- which just doesn't go very well with "it usually works".

At that point you spend the hours it takes to track the problem down and you will curse your decision to fail silently once.

<comment><USER4> I'm currently having issues with em-http-request, resque and resque-retry. It's still sometimes dropping work before the retry limit and not behaving nicely with the retry timespans. Also the async http request is not using the timeout value, randomly...

It only happens with big traffic, like 0.01% just fails in a wrong way. It's not much, but still it's our and our customer's money. I hope our get together to solve this problem helps tomorrow.

<comment><USER5> I've noticed the same issue with that gem. It only happens randomly and with high density asynchronous traffic.

</comment></comment></comment><comment><USER6> This bug reminds me of what my dad taught me when I got my driver's license. He taught me that knowing how to drive carefully wasn't enough to prevent accidents. I had to drive for myself and for everyone else. I clearly remember "you don't know what kind of drunk will be blowing a red light".

In this bug, Paul was driving carefully - he relied on the parser to do a good job. But relying on the parser is like crossing in GREEN light without checking. 99.9% of the time you should be OK. Until that one time with the drunk blowing the RED light.

My dad was right. Had Paul not relied entirely in the parser and done accurate memory allocation (checked for that drunk blowing the RED light) - <USER2> would have been fine.

<comment><USER7> Sidenote: I'm pretty sure the author is Paul Asmuth, not Paula Smuth.

<comment><USER8> Ah, thanks.

I wonder how many people even know that dashes are legal in DNS names. (I mean, of course, the ASCII character that serves as hyphen, en-dash, and minus sign.)

I think there are lots of domain names that would benefit from a well-placed dash -- the most amusing example I've seen being Pen Island's.

<comment><USER9> Expert Sex Change. (Familiar to almost everyone here, I think.) Power Genitalia. (An Italian battery company.) Whore Presents. (A service for finding out about people's publicity agents, etc.)

</comment></comment></comment></comment><comment><USER10> It's a pity I can't read this blog post. On an iPad it specifically prevents me from zooming and the font is too small.

Please don't use "ipad-specific" or "mobile" themes. They break the web.

<comment><USER11> Zooming works fine here, ipad3, safari.

</comment></comment><comment><USER12> Would it be awfully smug to point out that Valgrind would've pointed this bug out in mere minutes? That's exactly why I make a habit of running my tests under Valgrind regularly during development; there's no point wasting hours debugging the classes of problem that tools can pinpoint in minutes.

<comment><USER13> Tangent -- it's crazy to me that _println_ passes as debugging.

</comment></comment><comment><USER14> So, wait. When you allocate a new array in the JVM, it's filled with random data instead of zeroes? That seems like a fundamental security model error. Or are these 'buffers' special native IO primitives that break all the Java security rules and guidelines? I haven't used Java in a while...

<comment><AUTHOR> Heh no, this was the actual bug (that it was reading "random" data from memory on the first iteration). I just hadn't noticed the issue until this "random memory" contained fragments of invalid json.

<comment><USER15> Were you or the network library reusing buffer objects (to avoid reallocating them), so the random data was leftover from an early socket read? I'm surprised the JVM would allocate a new buffer object with non-zero data.

<comment><USER16> Yeah, he was almost certainly reusing his byte[]s. My takeaway is that if you program a high-level language as if it's C, expect C-like bugs.

<comment><USER17> Likely reusing his directly allocated ByteBuffer and not checking the number of bytes that he filled it with.

From what I remember, directly allocated ByteBuffers are not guaranteed to be zeroed.

</comment></comment></comment></comment></comment><comment><USER18> Just out of curiosity: How much Scala are you using at DaWanda? And for what use cases?

<comment><AUTHOR> We currently use it extensively for analytics, our product recommendation engine (blog on that soon!) and we are writing a custom scala based http proxy for our new API. In general, we are trying to progessively do more scala and less ruby.

If you (or anybody else) is interrested in hacking with us, please drop me a note (link to your github profile is enough) at email@example.com :)

<comment><USER19> Oh, Paul. ;( Less Ruby??! What happened? Are you angry at her? Did she cheat on you? Did you catch her in bed with Mikael? I warned you about him.

<comment><AUTHOR> Oh, Don. No, everything is fine with ruby, I just got bored. And scala... she is so much faster! See you soon in AMS; I'll bring Mikael for fun and profit ;)</comment></comment></comment></comment>


CueKeeper: Gitting Things Done in the Browser - <AUTHOR> http://roscidus.com/blog/blog/2015/04/28/cuekeeper-gitting-things-done-in-the-browser/#acknowledgements

<comment><USER2> I'm greatly enjoying myself by using the Chrome developer console to see how the Irmin store (which is based on a git-like model) is logging and syncing the local actions.

It's intriguing that JavaScript compilation into a browser is a really nice way to debug complex logic that also ends up in Xen unikernel deployments...</comment>


Gorgeous glass sculptures let you see into the world's most deadly viruses - <AUTHOR> http://www.theverge.com/2014/1/2/5267800/luke-jerram-glass-microbiology-gorgeous-sculptures-of-deadly-viruses <comment><USER2> I like the sculptures, but they are a mix virus and bacteria. The first one is clearly a bacteria (and the caption confirm this: _Above: "Salmonella"_). They are very different.

To identify them "Visually": Viruses are very small and generally have a simple, crystal like, structure. Bacteria are much bigger and generally are more rounded, and have more internal structure.

(T4 is a virus, it has a complex structure, but each part has a simple geometric form.)

</comment><comment><USER3> Nice.</comment>


Web Scraping – Discovering Hidden APIs - <AUTHOR> https://ianlondon.github.io/blog/web-scraping-discovering-hidden-apis/ <comment><USER2> what about running puppeteer on the cloud with something like proxycrawl?

</comment><comment><USER3> Puppeteer is a NodeJS API for Chrome (and I've read tentative support for Firefox), it lets you browse via code and doesn't even need a visible browser window. This makes a defacto API out of any human-interface web site.

[https://github.com/GoogleChrome/puppeteer](https://github.com/GoogleChrome/puppeteer)</comment>


Apple JavaScript Coding Guidelines [pdf] - <AUTHOR> http://developer.apple.com/library/mac/documentation/ScriptingAutomation/Conceptual/JSCodingGuide/JSCodingGuide.pdf

<comment><USER2> > Just as you used the new

> operator to create an object, you should delete objects when you are > finished withthem, like this:

> delete myObjectVariable;

What a bunch of crap? Have these guys even looked at the specs?

And chapter on inheritance really makes me cry...

</comment><comment><USER3> Already discussed in <http://news.ycombinator.com/item?id=1854783> with the same consensus, it's a terrible guide. Read Crockford, Stoyanov, Bolin instead.

</comment><comment><USER4> For those who would prefer an HTML version: [http://developer.apple.com/library/mac/#documentation/Script...](http://developer.apple.com/library/mac/#documentation/ScriptingAutomation/Conceptual/JSCodingGuide/Introduction/Introduction.html)

<comment><USER5> Or the actual PDF itself, which lacks the Scribd™ value-added feature of banner ads on every page:

[http://developer.apple.com/library/mac/documentation/Scripti...](http://developer.apple.com/library/mac/documentation/ScriptingAutomation/Conceptual/JSCodingGuide/JSCodingGuide.pdf)

<comment><USER6> I think the OP's link is actually to the PDF. HN adds the automatic Scribd link whenever someone posts a link to a PDF.

<comment><USER5> Wow, that's horrible.

<comment><USER6> The original announcement (2008):

[http://www.scribd.com/doc/50406482/Hacker-News-Integrates- Wi...](http://www.scribd.com/doc/50406482/Hacker-News-Integrates-With-iPaper- Scribd-Blog-3-11-08)

</comment></comment></comment></comment></comment><comment><USER7> I have a _strong_ reason to suspect that this was written by an intern who was relatively new to the language. It seems to be written by someone in the C/C++/Java mindset (ie how they didn't list "function" as a primitive data type)

<comment> jarek-foksa Function is not a separate data type in JavaScript, but they could probably list Object there (EcmaScript defines 6 types and 5 primitive values, I can't really find any definition of "primitive type")

</comment></comment><comment><USER8> Man, what a piece of shit. Apple should pull this immediately.

<comment><USER9> Good that I saw this before reading the pdf. Can you point me to a better resource?

<comment><USER10> As seen elsewhere in the comments, Crockford's is very good:

<http://javascript.crockford.com/code.html>

</comment></comment></comment><comment><USER7> The example in this document of using the delete operator on a function is wrong.

<http://perfectionkills.com/understanding-delete/>

</comment><comment><USER11> I find it strange that the "Global Scope Considerations" section uses Ruby- style inline comments (#) rather than actual JS inline comments (//).

<comment><USER12> I find it strange that you refer to comments starting with # as Ruby-style comments.

<comment><USER13> I'm pretty sure Ruby is bigger than Perl and sh put together now, at least in mindshare.

<comment><USER14> python and PHP also support # for making comments. It could be argued that python has just as much if not more mindshare than ruby. :)

<comment><USER13> I agree. I think "Python-style comments" would be just as reasonable a term. My impression was that the comment I was responding to was objecting on historical grounds, since Ruby and Python borrowed that comment style from Perl, which in turn borrowed it from shell scripts.

</comment></comment></comment></comment></comment><comment><USER15> Most of the examples use C style curly braces, maybe Crockford needs to do an "Apple Tech Talk".

<http://www.youtube.com/watch?v=hQVTIJBZook>

<comment><USER16> Or just read this? <http://javascript.crockford.com/code.html>

I guess Crockford is like K&R for JS's conventions.

</comment></comment><comment><USER17> It's shocking that this document refers to "classes". JavaScript doesn't even have classes.

<comment><USER18> Why is this comment deprecated? He's absolutely right, if a little late to the party. Shockingly bad document from Apple.

</comment></comment><comment><USER19> Two years old?</comment>


How the U.S. military used social networking to capture Saddam Hussein - <AUTHOR> http://www.slate.com/id/2245228/

<comment><USER2> Interesting article about social networking and military thought. A long path, it seems, from a country who fought with a somewhat ragtag band against soldiers who marched in a straight red line and wore red in the forests.</comment>


How to Win the $1.6B Mega Millions Jackpot Without Ruining Your Life - <AUTHOR> https://www.nytimes.com/2018/10/23/upshot/mega-millions-what-do-first-if-you-win.html <comment><USER2> Relevant link which has provided by HN readers on other lottery-related stories:

[https://www.reddit.com/r/AskReddit/comments/24vzgl/you_just_...](https://www.reddit.com/r/AskReddit/comments/24vzgl/you_just_won_a_656_million_dollar_lottery_what_do/chba4bf/)</comment>


TrustPlus - uses your social network to provide a universal reputation - <AUTHOR> http://arstechnica.com/news.ars/post/20070912-trustplus-wants-you-to-build-your-rep-take-it-anywhere-online.html

<comment><AUTHOR> The Xobni blog had a post a little while ago predicting that Facebook would become a reputation engine. I think it's more reasonable that a person's whole social network, from Facebook and elsewhere, would serve that purpose, but the general idea is the same. And it's a very good one.</comment>


A (Relatively Easy To Understand) Primer on Elliptic Curve Cryptography - <AUTHOR> http://blog.cloudflare.com/a-relatively-easy-to-understand-primer-on-elliptic-curve-cryptography

<comment><USER2> [https://news.ycombinator.com/item?id=6607661](https://news.ycombinator.com/item?id=6607661)</comment>


Ask HN: How do you make dull projects interesting? - <AUTHOR>

I recently switched development positions for a better location even though I wasn't too sure I'd enjoy the position as much (the position was open so I jumped on it).
My thought process was: Do it for a year and then move into a position that I would be more along the lines of what I would be interested in. The company is growing quickly so there should be available positions.
I've been in the current position for a 2-3 months now and I really starting despise my decision. The project I'm working on is not challenging and I just feel like the return on the investment isn't what I'm used to seeing.
Has anyone in HN ever gone through a scenario like this? How did you handle it? Should I wait it out for greener pastures or look at other farms? <comment><USER2> why not outsource it for 50% or 25% of your pay and work on your own projects at work ;), or music+reddit ;)</comment>


Hackers attack Dota 2 and League of Legends servers - <AUTHOR> http://venturebeat.com/2013/12/30/hackers-attack-dota-2-and-league-of-legends-servers-in-quest-for-one-game-livestreamer/

<comment><AUTHOR> What I don't get is why Twitter didn't shut down the account?

[https://twitter.com/DerpTrolling](https://twitter.com/DerpTrolling)

I mean they are DDOSing game servers one by one right now! Runescape, EVE Online, LoL, EA... etc</comment>


Show HN: Static web hosting, CMS, and now blogging - <AUTHOR> http://900dpi.com

<comment><USER2> Looks like a great service. Just tried the CMS and it works beautifully; much better than the only other similar CMS I've tried (CushyCMS–which requires SFTP).

Perhaps a niche request, but are there any plans to add HTTP basic access authentication to select pages? I'm currently running a super simple static site for a research group, and I need a way to make a semi-private web page. Nothing properly 'secure' but more a method to prevent casual snooping. (I could set up my own web server, but I need to set up a website/system that other people are still able to look after once I leave.)

<comment><AUTHOR> That's a great question. We're at an interesting spot where we have to decide whether we want to stick with our basic service and become a company that provides really good hosting and services for small-business websites, or if we want to take on the giant behemoth that is WordPress, while still trying to hold on the the simplicity of the concept. If we go the second route then we'll be building out a plugin system that would definitely make it possible to build something like you described.

In the mean time, our blogging system has the ability to create unpublished posts that are only visible to content editors (individuals that you invite to manage the website). It's kind of a hacky solution but it might work for you.

<comment><USER3> @DBLA, It is great to see more services like this. I'm one of the guys behind Harp.js and Harp Platform. We have a lot in common! Basic Auth was a question that came up all the time and wasn't to challenging to add, as well as lock in - which was addressed by Open Source. Hope it goes well.

<comment><AUTHOR> I'm a big fan of what you guys have accomplished with Harp and really respect the decision to go open source. Great job!

</comment></comment></comment></comment><comment><USER4> Really well thought product, I can attest that this responds to the basic needs of a typical web design shop. A couple questions:

1-Does billing work internationally? I imagine you probably accept CC but is there any associated fee?

2-I see you have a blog an a team of 4, but, is there any other guarantee you can give related to your stability as a service before I start switching clients?

3-Can I bill a custom amount(more than 5 USD) every month (to account for support, etc)

<comment><AUTHOR> Thanks for the questions.

1-Yes we're using Stripe and a good chunk of our current customer base is international.

2-This is a tough one for a start-up, and it's certainly a question we've gotten before. If we were to promise to open source the software if we ever shut down the service would that be sufficient? It's not a promise we have made yet, but I think it's something we could commit to.

3-Great idea! No, but this is something we should build out. I'm adding it to our dev backlog.

</comment></comment><comment><USER5> "No need for FTP, SSH or any other three letter acronyms." \- other than DPI, I suppose!

<comment><AUTHOR> Haha good point! We are actually considering supporting FTP as well at some point but we're still investigating to see if it's something our customer base would like. That sentence might need some tweaking soon.

</comment></comment><comment><USER6> [http://getsimplesite.com](http://getsimplesite.com) is a very good CMS which is very help full for designers. And these people also develop websites in a good price and website is of good quality.

<comment><USER7> Hmmm... any interest to declare?

<comment><USER8> Tried the trial version of getsimplesite.com. It looks quite fast and cheap. Models look wonderful to accept/display content on website dynamically.

</comment></comment></comment><comment><USER9> Just to make this clear - are the files hosted on your platform, or on dropbox? And what are the limits of your free accounts (if any)?

I see your site says you offer hosting - but I am getting confused a bit as there is no complete feature list on your website - just lengthy documentation.

Do you have some traffic limits?

Do you have bandwidth cap/space cap?

Are pictures etc. hosted on dropbox or your servers?

Congrats on front page and good luck!

</comment><comment><USER10> >Add the "900-edit" class to any element

I was under the impression that class names could not begin with a digit. Some discussion on it here...

[http://stackoverflow.com/questions/448981/what-characters- ar...](http://stackoverflow.com/questions/448981/what-characters-are-valid-in- css-class-selectors)

<comment><USER11> Classnames cannot begin with a digit, an oversight these bafoons have not clicked on yet

</comment></comment><comment><USER6> Simple Site frees you from the restrictions imposed by your hosted content management system. It allows you to run arbitrary javascript on the server to build your website. As a developer this means you don't have to jump through the hoops of a templating language forced upon you by your CMS.

</comment><comment><USER12> I always find these kinds of projects interesting ... then inevitably I'm reminded that having a server is a playground and can be fun. NGINX is easy (for 80 of 80/20 part anyway). SFTP/SSH too.

</comment><comment><USER13> @dbla

Your pricing goes from $5/mo. to Call us for pricing.

Call us for pricing implies super expensive.

That seems like a big jump in pricing.

Just my 2 cents.

<comment><AUTHOR> You're right. We really need to work on our pricing model. Thanks for the suggestion!

</comment></comment><comment><USER14> Aaron & team, congrats on the front page! You guys should do a HN traffic/signup teardown for us after a few days have passed. I would love to see your numbers!

<comment><AUTHOR> Will do!

</comment></comment><comment><USER15> Very similar to CloudCannon ([http://cloudcannon.com/](http://cloudcannon.com/))

</comment><comment><USER11> They claim fast - all of the websites in "Powered by" are painfully slow.

<comment><AUTHOR> Care to elaborate? I ran some tests and page speeds seem to be quite a bit faster than what google reports as their global average. Short write-up here: [http://900dpi.com/blog/Tech-Talk/How-fast-is-900dpi-We- put-o...](http://900dpi.com/blog/Tech-Talk/How-fast-is-900dpi-We-put- ourselves-to-the-test)!</comment></comment>


Ask HN: Best forum for web application development? - <AUTHOR>

Could you please advise me on forums or q&a sites for discussing technical issues related to web application development?<p>Where do webapp developers meet online? <comment><USER2> <http://stackoverflow.com> is a good place for answers to specific technical question.</comment>


Ask HN: Which websites use GPG public/secret keys for user password retrieving? - <AUTHOR>

I think email accounts are fragile because you must make sure both the client and the server are secure.
If you use GPG public/secret keys, then you don't need email for password retrieving any more. (and no email spams about that)
1. For registrations, upload your public key and use your secret key to verify that you own the public key. 2. Retrieve your user password is simple, too. The server encrypt some text with your public key, then you use the secret key to decrypt and submit the original text to verify.
Nowadays, more and more people use password managers to generate strong passwords. Why not use GPG? Is any website using GPG for password retrieving? <comment><USER2> The problem with using GPG for password retrieval is that we're assuming that the user is irresponsible enough to lose their password, but responsible enough to maintain backups of their public and private key.

To put it differently, if you have gpg authentication available, why are you even bothering with a password in the first place?

<comment><AUTHOR> The keys can be printed out on a paper. If you set a strong enough passphrase for the secret keys, you can upload them somewhere, too.

I should rarely use my special keys (or passphrases of the secret keys) so as to keep them safer. And simpler authentication is more efficient for normal web services. GPG authentication may not be fast enough.

</comment></comment><comment><USER3> GPG doesn't easily lend itself to be wrapped, or even used for that matter.

You are welcome to try.

</comment><comment><USER4> Tried to explain GPG, public/secret keys to non-tech guys. Not fun.

Something like that must be easy to use, and easy to understand to be used by the masses.</comment>


Ask HN: Why is Canada startup unfriendly? - <AUTHOR>

I've always wondered why Toronto, Vancouver and Montreal were so start up unfriendly. I know that there are tax limits to outside VC investment and that there are hardly any seed/startup funds in the country. However, with SR&ED as well as other innovation related tax benefits, I thought it'd get a little more love from start ups. Additionally, Vancouver, Montreal and especially Toronto are all hip tech-friendly cities...<p>The only major start ups I've seen come from America's hat are: Kontagent, FreshBooks, "RIM" and a few others. <comment><USER2> The problem is not with "startups". The problem is with scaling - there is TONS of startup activity going on in the Toronto, Waterloo, Montreal, and Vancouver areas. If you look for it you'll see that it's thriving as more and more people consider startups to be viable career options.

Very few of these companies manage to break out and go big - when the dotcom bubble burst, all of our former giants like Nortel and Corel imploded, leaving only RIM to pick up the pieces in the tech sector.

There are reams of tech companies in the $1MM-$300MM space, a few in the $300MM-1B space, and basically one (RIM) in the $10B+ space.

Getting capital to scale aggressively is a huge problem - it's just not as easy or as free-flowing as in the USA. However, foreign financiers are starting to notice that they can get better returns on Canadian companies because of a paucity of funding, so I'm hoping that will improve things over time.

Otherwise, Canada is a fucking awesome place to start companies. We just need more people with the balls, the drive, and the unwillingness to accept no for an answer when it comes to raising money.

</comment><comment><USER3> Canadian cities have the same problem most cities in the US have: lack of angels.

<comment><USER4> That's part of the story. There are also no "anchor" companies. The massive companies that go for a big sale in the Tech Industry are very rare in these Canadian Cities.

There is money, but there are relatively little opportunities for companies to source these funds.

<comment><AUTHOR> I suppose but I mean... I feel like Canada is a near perfect location for the start up.... furthermore, it's not as if Anchor companies are far away (like the US for example).

As a Canadian now in the US... I really wish that Canada would step its game up and get a group of angels together or a proper incubator program. My family friends have started a pseudo incubator at <http://www.thenext36.ca/>

<comment><USER5> I don't think an incubator program would be enough. There's something to be said to living in close proximity to hundreds of different angel groups and investors, which is why most of the successful start ups come out of Silicon Valley and why SV is the best place to be. There are start ups that can become successful despite the distance from SV, but it's just going to be another hurtle to overcome in a fragile start up's early life.

There are notable exceptions though, GroupOn from Chicago, and for a Canadian example - Shopify from Ottawa, Ontario.

</comment></comment></comment></comment><comment><USER6> I'm in Saskatchewan. Around here, it seems that there is a fair bit of startup investment but it's not quite the same as a lot of the programs in the States. Looking at things like TechStars or YCombinator startups, many of these startups are Great Ideas. Investment around here isn't nearly as focused on Great Ideas, but rather much more focused on Great Technical Secret Sauce. This shifts the types of startups that get funded; around here, there seems to be quite a bit of Biotech, Renewable Energy, some "hard" Computer Science-type problems, etc.

Would Twitter have been funded here? Not likely. Freshbooks? Not likely. RIM? Possibly.

<comment><USER6> That's not to say that there isn't startup activity though. In Saskatoon, there's definitely a push to try to make it easier for freshly-started companies. Some examples:

* A new "affordable small office space": [http://www.facebook.com/pages/Centro-Office-Lounge/170719902...](http://www.facebook.com/pages/Centro-Office-Lounge/170719902938487)

* Coworking space with advisors (lawyers, accountants, business consultants, etc) for low cost: <http://www.saskatoonideas.com/>

* Lots of startups have offices at <http://www.innovationplace.com/index-main.html> \- This is more for companies that have already established an income stream, but is a good common place for companies to grow.

</comment></comment><comment><USER7> I've always thought the biggest limitation for the start-up environment in Canada is the risk-averse nature of Canadians and particularly Canadian investors.

In the US, angel investors and VCs are more apt to take risks and aim for the huge rewards. In Canada, it seems the investors are looking for singles, and even then, they expect you to already have market traction.

Check-out Basil Peters stuff to get an idea of what I'm referring to. Early Exits, not going for the home-runs.

At the same time, there is a large Canadian contingent in Silicon Valley doing great things. So I don't think its the entrepreneurs, it's the investment market.

</comment><comment><USER8> Take the example of Waterloo,

There is enough passion and help for startups like Communitech (<http://communitech.ca>) and Velocity (<http://velocity.uwaterloo.ca>), there just isn't enough people willing to take the financial risk that an early stage startup needs to expand. Inevitably, once a certain maturity is reached, startups move to the Valley.

</comment><comment><USER9> I think that it isn't necessarily that Canada is unfriendly, but it's more that Canada isn't as easy to get over the certain bump (as others mention, that bump is funding). If you're boot strapping a startup then Toronto seems to be perfect - vocal community, good geography, lots of talent, and affordable businesses (also OK corporate taxes >$500k)

</comment><comment><USER8> The virtuous circle of startups that has occured in the Valley has yet to happen in Canada. The virtuous circle being Startups that make it big or have large exits, helping bring money to more up and coming startups. There are no Kevin Rose's that have startups ( arguably successful ) that are now funding other startups.

</comment><comment><USER10> Because in Canada, milk comes in bags. [http://www.myconfinedspace.com/wp- content/uploads/2006/09/ca...](http://www.myconfinedspace.com/wp- content/uploads/2006/09/canadian-milk-bags.jpg)

</comment><comment><USER11> Fundamentally Canada is conservative (risk averse).

</comment><comment><USER12> Don't forget Rypple.</comment>


Understanding Hessian Matrices and the Second Derivative Test - <AUTHOR> https://allyoudistrust.wordpress.com/2019/05/01/understanding-hessian-matrices-and-the-second-derivative-test/ <comment><USER2> It's nice to read blog posts on calculus and linear algebra, but I'm affraid that the author simply skipped some basic lectures on the topic if he was oblivious to the fact that the Hessian reflects the second derivative of a multi-variate function. That's the whole reason why all newton and quasi- newton methods rely on the Hessian (and its approximations) to find local maximum/minimum of a function.

Heck, IIRC Apostol's 2nd volume dedicates a whole chapter on how to derive the Hessian, including from directional derivatives.</comment>


What is App.net to you?  - <AUTHOR> http://blog.derrickko.com/what-is-appnet

<comment><USER2> At this moment in time, App.net is a service which I can't afford, an expensive girlfriend and a little sister who is dependent on me forces me to have to save my money very carefully, which is fine, because I don't mind advertisements too much anyway.</comment>


MSDN is down (500) - <AUTHOR> http://msdn.microsoft.com

<comment><AUTHOR> I'm getting 500s on all documentation pages (from Germany).</comment>


Facebook Ads don't suck - <AUTHOR> http://blog.adespresso.com/facebook-ads-dont-suck-bashing-great-marketing/ <comment><USER2> I don't think it's about Facebook Ads sucking or not sucking. That's the narrative but the underlying issue is people feel that Facebook Ads are a rip off.

I wonder how much of Facebook's ad revenue (and Google's for that Matter) consists of less savvy marketing efforts that don't understand or even care about the metrics which matter. The long tail?

I don't believe the argument in favor of Facebook Ads can be that you need to understand marketing better or differently.

The majority, I presume, of people using these platforms have little to mediocre experience. The disappointment in Facebook Ads comes from this large group.

I've talked to plenty of people and no one has been happy with Facebook Ads. The details of why don't necessarily matter - they've taken their $ elsewhere. Winning them back will be tough.

<comment><AUTHOR> Agreed but doesn't this apply to every Advertising platform? Are you going to get much better results if you spend $50 with no expertise on Google AdWords or display advertising ?

Would be really interesting to know how much the long tail account for :) But guess we'll never know!

For sure both Facebook and Google should do a better job training users with 0 expertise to better use their platform. I don't think in the long term they have much space to grow more in the enterprise, SMBs, the long tail are the segment where the future growth is ... and if they loose them after the first $50 it will be tough!

<comment><USER3> So what you are implying is that one cannot talk about his bad experience with Facebook ads because other platforms have the same problems?

</comment></comment></comment><comment><USER4> This guy's company helps people tweak their facebook advertising is rallying to promote facebook ad effectivenes. Not exactly an impartial voice.

And yeah, why not hop on the thread and get some SEO links of your own.

This guy is no better than the people he is slandering.

<comment><AUTHOR> Never claimed to be better :)

But if you like to bash something based on data, at least let's do it with some reasonable data set

<comment><USER4> Fine, but don't complain about people getting SEO marks when you are doing the same.

<comment><AUTHOR> I don't, I've written in the post I envy them for the great outcome they had out of $50 spent in Fb Ads ... that's what marketing is all about, getting the most out of your time/money :)

</comment></comment></comment></comment><comment><USER5> Interesting post and you are spot on with this from a high-level.

For advanced digital marketers, the next step of course is looking beyond last click data. The attribution model you view your data through plays just as large a role in determining the success of it as many of the other factors that this article and others focus on.

Since you have conversion tracking setup for FB, FB conversions will obviously be higher than what GA shows in its standard reporting since FB's own conversion data is the equivalent of awarding 100% attribution to all assisted click conversions.

What would be more interesting is to see how this stacks up along with your other channels with various attribution models.

For those that are wondering if FB is working for you and looking at last click conversion metrics, you're doing it wrong. For a large % of scenarios, Facebook tends to play a much bigger role at the beginning of the conversion funnel, ie. the "Awareness" stage. This is also true of many forms of display advertising. To expect it to perform strongly on a last click model is unwise. First click models are likewise not great, but even that stark comparison will give you a sense of the contribution, and the GA multi-channel reports can show you that overlap.

I'm constantly blown away by how many amazing attribution tools Google gives away in the free version of GA and I'm always disappointed that none of the marketing articles that hit HN focus on that piece of the puzzle.

<comment><AUTHOR> Thanks for the comment. Great considerations.

Totally agree that overall Facebook Ads is great for demand generation while Google Adwords is much better for demand fulfillment. Also you're right on the attribution model, Facebook clearly attribute to itself every conversion from people who clicked the ad no matter of the last click.

In the future I'll try to make a followup post playing with GA various attribution models and checking how they change the data!

</comment></comment><comment><USER6> This is the original author, you only targeted Desktop, so your analysis does not refute my original point (that mobile clicks are accidental).

I did learn after I wrote my post how to target Desktop only and am running a follow up experiment, but if you're going to talk shit, at least do a valid comparison. Also I'm not sure what SEO you think I care about for my random Tumblr... (I specifically did not post it under my company blog)

</comment><comment><USER7> Normally you would expect marketers to know that when you are dealing with a low amount of traffic (probably from a low spend), one or two errant clicks or a bot can totally throw off your numbers. This article does a great job of showing proving that you need larger datasets to get a better understanding of what's going on. It does a great job of showing the discrepancy in numbers from tracking platforms, but that's probably just because I'm sensitive to that right now, since I've been dealing with it myself fora while.

<comment><AUTHOR> Thanks :) Yep ... I wrote it exactly out of frustration for reading post after post here on HN bashing Fb Ads because of Fake clicks ... people should stop caring about clicks and focus on real metrics. Then a platform may not be a good fit for you, but still you cannot know if you test with a $50 budget

</comment></comment><comment><USER8> I think you make a good point about ignoring the visits because at the end of the day it all comes down to the effective CPA (cost per action) or conversion rate. Much of the misconception and disappointment in Facebook ads come from folks who don't have a nuanced view of the differences in marketing channel effectiveness. It doesn't really matter what you pay as long it works out to the same ROI - better channels can charge more per visit, worse channels charge less. The only downside to having lower quality channels is that they blend down your overall metrics so you have to segment your reporting appropriately.

In the last Facebook bashing post, the author compared the CPC on Facebook to the cost on AdWords which is a terrible comparison because the intent of a directed search on a search engine is so much more legitimate than just being somewhat interested in something on Facebook.

</comment><comment><USER9> It is not that Facebook ads suck. They are fantastic for particular, specific business goals. Companies that have access to expensive and effective software outside of Facebook can make even better use of their platform in conjunction with others.

The problem has to do with the messaging to small business people by the big online advertising platforms. The messaging is that it is easy, fast, and has a small minimum spend. It's akin to the '90s era messaging around discount stock brokerages that encouraged average bums to become day traders. While yes, the average bum can day trade, it is not a good idea for the average bum to day trade. It is the same for online ads for people unwilling to spend the time/effort to study, filter out the junk information, and practice.

</comment><comment><USER10> Ads may be not suck, but fake clicks and overcharging for them seems like a common theme lately.

<comment><AUTHOR> That's true but actually Facebook now try to charge for CPM not clicks so that soften the problem, and still, you should check your CPA ... if that makes sense some fake clicks are acceptable.

</comment></comment><comment><USER11> If you are advertising FB ad services, your conversion would obviously be higher in FB. The fact that it is only 63% better that Google Ads seems poor.

My experience with FB is that the conversion rate is essentially zero and limited by your ability to donate to FB.

<comment><AUTHOR> This is partially true ... but still promoting a b2b service on FB is always tough ... I see many of our customers with b2c products getting crazy conversion rates and spending more and more.

</comment></comment><comment><USER12> Kind of reminds me of:

Customer: "But using it, I'm loosing money on every purchase." Vendor: "Don't worry, buy more, you'll make it up on volume."

<comment><AUTHOR> Sorry that what the post remember you of. Was not the intention.

I'm the first to say that Facebook Ads don't work for everyone. And in advertising you should immediately stop spending on anything that don't have a positive ROI.

Still before stopping you should learn a bit how to use the platform and give it a fair try.

Then if it does not work ... stop it immediately and move on testing another channel :)

</comment></comment><comment><AUTHOR> I'd love to hear what the HN crowd think about my comments on FB Ads after so many stories trending bashing Fb Ads :)

<comment><USER13> "Facebook Ads Are OK, but supporting them on HN is great!" You have just followed suit and created backlinks, conversions, ad views, etc. Don't worry, we all do it! It's the cycle of internet flow these days.

I'm with you. There are far too many variables ranging from audience, timing, ad setup, money, etc to even begin measuring in any scenario. The million dollar per month investment may see a better conversion rate than the ten million dollar per month investment. There are just far too many variables at play.

While American Idol was becoming a thing, I acquired #1 ad placement on the keyword 'dance' for 2 cents per click through Adwords. I was getting 100,000 impressions an hour. For me, Adwords was the greatest thing known to humans. Then, I attacked more keywords for other sites. Horrid conversion/CTR. Just different sides of the spectrum. You win some, you lose some.</comment></comment>