Should we ask governments and corporations to temporarily halt the creation of AI? - <AUTHOR> Many of us have likely read various warnings from the likes of Hawking, Musk, Gates and countless others - should we heed these warnings in order to request a more coherent explanation from corporations and governments as to why they are seeking AI?
tl:dr - I am hoping for your thoughts, favorite essays, readings and lectures on the subject, and your concerns. I have a limited but sufficient notion of the potential benefits of AI - this said concerns are more desirable for my purposes.
I too am excited over the potential AI (either partial and perhaps even full) has to offer us as a global society. Specifically self-driving cars and improvements to services such as Siri entice me. I am an avid user of Siri, despite its short comings, for simple queries and tasks and I detest the time I spend driving, which could be spent reading, coding, or drawing.
AI has the potential to be a massive boon to our existence, this much is clear; however I am not naïve enough to assume that a passive posture from the public at large will produce an AI (or lesser adaptive intelligence) that will benefit the majority and help provide long term solutions to current issues we face as a species.
My current opinion is that if we passively accept what is given us and don't help to shape what the ideal implementation of this technology is - we will miss a great opportunity and likely more bad than good will come of it. <comment><USER2> 1) It would be ridiculously unfair to people that would benefit from AI most: 6 billion of poor people living lives that are unimaginably unpleasant to a western person.

2) Hype about "superintelligent AI coming soon" is pretty much unfounded, current deep learning approaches have a lot of limits, hardware progress stalled as well (moore's law is officially dead). AI technology is like a fragile flower on a life support, it is so weak you can easily kill it with regulation and FUD. Instead of questioning if we suddenly achieve "real AI" one could wonder if the tech will ever reach any level of moderate general AI, considering the death of moore's law.

3) Nobody will listen to scaremongering, people will just continue doing their thing anyway.

<comment><AUTHOR> Thanks for your response.

I realize my wording may have seemed a tad strong.

My hope was not that we use fear tactics, but rather begin a global conversation regarding: ideal off limit zones for implementation (ie military uses & surveillance), how we can implement said technology in order to address climate degradation and limit waste and how it could provide us with the capacity to reenvision our global economy.</comment></comment>


How extreme isolation warps the mind - <AUTHOR> http://www.bbc.com/future/story/20140514-how-extreme-isolation-warps-minds?src=hn <comment><USER2> > _For starters, isolation messes with our sense of time._

Interestingly, people who have lost their sight or hearing, at birth or from a young age, experience this too.

From my own experience (back when I was deaf), I would (and occasionally still do) perceive relatively large stretches of time (up to a few hours) as considerably less, and vice-versa.

Funnily enough, though understandably I suppose, I also have a very hard time placing events in time in relation to each other, it very often becomes an exercise in rationality (i.e. event A could only have happened if event B had too).

Sadly, I can't find much information about this, except maybe this (which I don't have full access to) [http://www.mitpressjournals.org/doi/abs/10.1162/jocn_a_00135...](http://www.mitpressjournals.org/doi/abs/10.1162/jocn_a_00135?journalCode=jocn#.U-0kJZA- iXg)

<comment><USER3> Do we have a "sense of time"? I ask because upon reflection, it seems that I have to get back to my sentinels and time tracking devices _constantly_ to know where I am in time. What day is it? What's the current time? I comprehend time ordering, cause and effect, but I can't measure nor track time worth a damn. If I go on holiday and avoid reference a watch and calendar, I can easily lose track in short order.

I'm not blind, nor deaf. I have a family and have never been isolated. I just assumed this is How Things Are, that attention must be paid in an effort to stay "in sync."

<comment><USER4> I found with the right schedule I would generally wake up 10 minutes before my alarm when off even when it was still dark outside. I can often guess what time it is +/-10 minutes throughout the day. I even stopped using a watch at collage as my internal clock was enough to get to class on time.

Granted, I was keeping a vary regular schedule and there where plenty of clocks around which helped, but I think most people can probably get to that level of precision.

</comment></comment></comment><comment><USER5> It's worth noting that Kalin at UW-Madison is looking to resurrect Harlow's work on socially deprived primates[1], something that was previously posted here at HN.

Some of the primate researchers' work is (to a layman like me) just bizarre -- one study involved isolating mother-deprived rhesus monkeys in individual cages and giving them unrestricted access to food, water, and ethanol, in order to test their postmortem CSF 5-HIAA levels and study "early life stress on drinking and serotonin system activity." (Conclusion: if you deprive a monkey of maternal contact and then give it booze, you'll end up with a drunk monkey.)

For me, I'm both fascinated and repulsed by research into, e.g., rh5-HTTLPR polymorphisms and anxiety. Fascinated because it really is inherently interesting, and repulsed because I'm not at all certain that torturing monkeys through isolation and/or maternal deprivation and then killing them is really advancing the state of 5-HTTPLPR research far beyond what is already being done with studies that don't involve the psychiatric destruction of presocial primates. (PubMed shows 75 animal-based 5-HTTLPR/rh5-HTTLPR studies, and 1221 human-based studies.) There are some truly thorny questions here -- and I'm a _proponent_ of animal studies in many cases -- that I feel researchers, particularly those involved in psychiatric animal models, are hand-waving away.

[1] Fellow UW-Madison researcher A. J. Bennett's view of Harlow's work is available at [http://speakingofresearch.com/2014/08/03/harlow-dead- bioethi...](http://speakingofresearch.com/2014/08/03/harlow-dead-bioethicists- outraged/)

<comment><USER6> No need to study primates when isolation is given out like free candy at prisons across America. If you make guards angry enough, you could get years "in the hole".

</comment></comment><comment><USER7> The article seems to mix up sensory deprivation with isolation.

Suppose you are stuck on a deserted island with no human contact, like Robinson Crusoe.

Surely, you're not going to get hallucinations?

You're not in a box or dark prison cell; you have day and night, the beach, woods, animals. Survival activities to keep you busy, like making shelter and gathering food.

Maybe the sensory deprivation causes the brain slide into another kind of consciousness which is not exactly sleep and not exactly wakefulness. The hallucinations are perhaps related to the mechanism which produces dreams, and not evidence that you're going bonkers.

<comment><USER8> > Surely, you're not going to get hallucinations?

And yet we all cried when Wilson died.

<comment><USER9> Wilson didn't die. Wilson left him. I assume that Wilson dying would require severe degeneration or destruction such as a shark ripping the ball in pieces.

</comment></comment></comment><comment><USER10> This article from May is extremely pertinent to today's news: [http://www.bbc.co.uk/news/world-asia- china-28793055](http://www.bbc.co.uk/news/world-asia-china-28793055) about how Chinese detention ad isolation has "Destroyed" the most famous Chinese human rights lawyer.

<comment><USER9> Boy that article just made me sad. I'm not angry at those responsible for his abuse exclusively though, the sadness grows when you realize that this is done all over the world. Justice being silenced by 'justice'.

</comment></comment><comment><USER11> I've noticed when I don't speak to people for very long my mind becomes less active, almost switches off. I lack inspiration or life.

Solitary confinement must be the worst torture, I can't bear to imagine it. Yet it is used around the world as standard practice, in the USA, Israel, all over!

</comment><comment><USER12> More on Michel Siffre:

[http://www.cabinetmagazine.org/issues/30/foer.php](http://www.cabinetmagazine.org/issues/30/foer.php)

</comment><comment><USER13> Previous discussion: [https://news.ycombinator.com/item?id=7750935](https://news.ycombinator.com/item?id=7750935)

</comment><comment><USER14> "researchers have found that in darkness most people eventually adjust to a 48-hour cycle: 36 hours of activity followed by 12 hours of sleep". Wondering if this would be possible under normal circumstances (without the isolation, in daylight, with no psychological side effects).

</comment><comment><USER15> Ill have to tell you that this theory is wrong,

<comment><USER9> I agree that the title of this post backs itself into a corner, so to speak.</comment></comment>


Show HN: Iam-SSH-agent, SSH-agent for AWS IAM entities without raw key access - <AUTHOR> https://github.com/keithduncan/iam-ssh-agent <comment><USER2> Anyone here using this and feedback on it?</comment>


Moving to Ireland - <AUTHOR> http://hvasconcelos.github.io/articles/Moving-To-Ireland/

<comment><USER2> I like this kind of feedback and I am happy to see one on the front-page :)

Shameless plug: I am also an expat, I moved to Oslo from Paris a few months ago. Not because of the economy (I am a front-end developer, I am lucky to have a lot of opportunities anywhere) but because my wife and me wanted to live abroad and unfortunately we weren't able to find a job in Oil & Gas risks analysis for her in California ;)

Turns out that it was the best decision I ever made (after my wedding of course). I would recommend to anyone who could afford it to find a job in another country. Obviously your will immerse yourself into a new culture better than if you visit just for the holidays. Who knew that from Oslo you could take public transportation and be at an alpine ski station in less than 45min? Or that with the same ticket you could take the ferry to one of the many fjord islands? Even more shameless plug, if you are tempted by this experience and like skiing, we are recruiting: [http://soundrop.fm/jobs](http://soundrop.fm/jobs) Winter is coming, fast.

<comment><USER3> Using Vanilla JS & your own architectural design as opposed to a mainstream framework? Reason I ask is just with regard to maintainability of the codebase, and the ability to attract more candidates perhaps

<comment><USER2> I share your sentiment that it could drive away candidates and from time to time we reevaluate the costs and benefits of switching to a mainstream framework.

Concerning maintainability I am really happy with our codebase. Strict rules and tooling help us keeping a clean state. You can write non maintainable code with any mainstream framework or even confuse a new developer when writing idiomatic code for this framework is not well defined.

</comment></comment></comment><comment><USER4> US Expat living in Dublin... Here's an article that just came out about some cool startups in Ireland.

[http://www.geektime.com/2013/09/29/10-hot-irish-startups- to-...](http://www.geektime.com/2013/09/29/10-hot-irish-startups-to-watch-for- in-2013/)

</comment><comment><USER5> Do you still think that there's a dynamic fast-paced IT industry here? I'm a native, and to me it feels, for the most part (excluding some exceptional companies), stagnant and dependent on cheap non-EU labour.

<comment><USER6> I feel that a vibrant tech industry is often a reflection of a vibrant tech community.

Granted, a community is only a small part of an overall industry, but an industry without community is lacking heart and soul.

And I can say, with authority, that _Dublin has a vibrant tech community_. My company, Engine Yard, runs or hosts two meetups a week in our Dublin office, covering subjects such as Ruby, PHP, Node JS, Scala, as well as database, Open Data and designer / UX oriented meetups.

If you want to come to any meetups on these subject, or become more involved in the Dublin tech community, drop me a line - firstname.lastname@example.com.

In addition, for the past three years, I've been running Pub Standards Dublin, the largest monthly gathering in Ireland of developers, designers and anyone interested in tech - we get about 150-180 each month. See [http://pubstandards.ie/](http://pubstandards.ie/) or [https://twitter.com/pubstandardsdub](https://twitter.com/pubstandardsdub) for details, you're welcome to join us any time.

I'm sorry you feel that things are "stagnant and dependent on cheap non-EU labour". I don't feel the same, and I invite you to come out, meet your peers and properly engage with your local tech community.

You wont regret it :)

<comment><USER7> I am totally agreeing with Eamon. Besides the mentioned meetups there is a paper reading meetup, a google developer meetup, devops, python, coding grace, coder dojo, TOG (a really great hackerspace) and plenty more.

I arrived a year ago in Dublin and was surprised about the variety and diversity of the tech scene in Dublin. I really think that Dublin has a strong and thriving tech scene.

</comment></comment></comment><comment><USER8> Hi! I am from Portugal too and I would love to work in another country but the problem for me is my English is lacking. How good was your English when you lwft?

<comment><USER2> FYI my English was terrible (it's still not awesome TBH) but it didn't not prevent me to find a job abroad. You should just apply when you see an interesting opportunity.

My first interview in English was over the phone and it was really stressful. It was enough to go to the second round (I didn't get the job though).

The upcoming interviews will get better. If you read HN and comment in English, that's enough to give it a try.

<comment><AUTHOR> It was the same for me. In my firsts interviews my english was my handicap.

</comment></comment></comment><comment><USER9> I am constantly thinking about moving from the US to somewhere nice, please advise me some countries, here are my "wish list" of the country where I would love to live:

\- Civilized people

\- No extradition

\- Government is small and it respects people's freedom and privacy (which are protected by constitution), real freedom of speech, not the one when you can be arrested for a tweet, even if it leaked state secret or offended someone or infringed a copyright. No copyright laws at all would be awesome.

\- No secret services

\- Reasonable laws, no death penalty or life sentence, very small quantity of law enforcement

\- Small ratio of NumberOfPeople/NumberOfPeopleInJails

\- >1 million population in at least one city

\- At least _some_ IT industry

\- Good and affordable health infrastructure

\- No CCTVs in public places and no traffic cameras

<comment><USER10> Somalia might fit your bill. They have a non-functioning government. No working law enforcement. Not sure about the health infrastructure though.

<comment><USER11> But I'm sure it's a paradise compared to the cultural ignorance and savage tyranny of life in these United States...

<comment><USER10> Maybe it is because I have been living too long in this country, but I am not actually sure whether you are being serious or not. This country irrespective of whatever its faults is still light years ahead of many parts of the world; Ethiopia where I grew up used to have a policy where the family of people who used to get shot by the government had to pay for the cost of the spent bullets before the body would be released.

<comment><USER11> I'm not being even remotely serious. I was mocking slashdotaccount's "wish list", which amounted to little more than a list of prejudices and grievances about the United States.

</comment></comment></comment></comment></comment><comment><AUTHOR> Yes i understand your point but if you try to compare it with another European IT realities, the Irish IT Industry has his own strengths.

</comment><comment><USER12> Sorry for the rant, but as someone who has done the process I find this post cringeworth (and not only because of the lowercase 'I's or the huge image on the header)

1 - Daft.ie. Period.

2 - It's not a "Welfare office", and you should go there (or not) depending on your address

3 - Or you just slide it on their mailboxes (depending where you are, the mail option may be more convenient)

4 - NIB? Well, AIB is good (but expensive), Bank of Ireland is not good, Ulster bank can't get their cronjobs right, but these three (and not NIB) are everywhere

5 - "Buy a mobile phone" or you just, you know, buy a sim card for your phone. This can be had in 5 min. And don't worry, it's cheap

6 - No crap sherlock.

"and compare the cost of living and taxes with your city in order to properly negotiate your salary"

And here's some good advice. I learned this, let's say, not the hard way, but I was "surprised" nonetheless. Always ask how much your net salary would be (and how much rent costs). For Ireland, expect around 40% of your salary to be taken for taxes, and you can have a small single apartment in the city center for between 600€ to 900€ (of course it's always possible to go higher)

<comment><AUTHOR> it is not 40%, it depends on your civil status and your tax credits. For single person your annual salary will be taxed at 20% until €36,400 and taxed at 40% the rest. You have to pay also the Universal Social Charge.

[http://www.citizensinformation.ie/en/money_and_tax/tax/incom...](http://www.citizensinformation.ie/en/money_and_tax/tax/income_tax/how_your_tax_is_calculated.html)

<comment><USER12> And that's why I said "around 40%" but you're right, civil status changes it significantly

Well, effective final % as taxes/gross pay relation is more like around 30% unless you have a very high salary.

There are some online calculators that make it easier to calculate

</comment></comment></comment><comment><USER13> One piece of advice that's missing: be sure to be born in Europe.

<comment><USER6> If you're from outside EU / EEA and are looking to startup something, this might be helpful:

[http://www.citizensinformation.ie/en/employment/types_of_emp...](http://www.citizensinformation.ie/en/employment/types_of_employment/self_employment/coming_to_set_up_a_business_in_ireland.html)

[http://www.enterprise-ireland.com/en/Start-a-Business-in- Ire...](http://www.enterprise-ireland.com/en/Start-a-Business-in- Ireland/Startups-from-Outside-Ireland/)

If you're looking to work, you need a company to sponsor you, there's a green card programme, and in practice, it's not that difficult to get in if you're a programmer with a CS degree or equivalent experience. Sure there are forms and red tape... but it's not as many hoops to jump through as moving to the US.

More info on work visas / green cards for Ireland here: [http://www.citizensinformation.ie/en/employment/migrant_work...](http://www.citizensinformation.ie/en/employment/migrant_workers/employment_permits/green_card_permits.html)

<comment><USER14> I was working in Ireland until 2011, under the older work permit scheme. The major downside to this scheme was that the permit was tied to the employer - lose your job and you have to start all over. This is what happened to me right as the housing bubble was bursting, so we decided to leave the country rather than try to find a new job and deal with the time, expense and hassle of new paperwork. The Green Card sounds like a nice upgrade. I wish it had been available when I was first applying for my job.

Paperwork aside, Ireland is a fantastically beautiful country. I suggest you leave Dublin and head West to see the postcard Irish countryside. Get off the Motorways and onto the backroads. It will be well worth your while. :)</comment></comment></comment>


A Gentle Introduction to Randomized Decision Forests - <AUTHOR> http://bertolami.com/index.php?engine=blog&content=posts&detail=randomized-decision-forests <comment><USER2> Who knew gentle could be so painful? I recommend anyone with a reasonable grasp of mathematical notation look for a less verbose introduction.

</comment><comment><USER3> I enjoyed reading this. I understood possibly none of it. I still enjoyed reading it.</comment>


What happens when you put a PC in the wall of an Indian slum? - <AUTHOR> http://www.greenstar.org/butterflies/Hole-in-the-Wall.htm

<comment><USER2> I have to say I don't find this all that surprising. It's rare to come across a slum without a television or radio--at least in Bombay where I grew up.

While television and radio are relatively old things that took their time before reaching the slums, it's amazing how fast the cell phone has penetrated even to the poorest of folks in India.

</comment><comment><USER3> Really cool article. I wish there was some site that recorded the most interesting things these kids did with the computers. I'm curious to know the limits of what they can teach themselves.

</comment><comment><USER4> Kids' creativity and problem solving abilities are significantly underestimated.</comment>


Casimir Effect - <AUTHOR> http://en.wikipedia.org/wiki/Casimir_effect

<comment><USER2> My favorite (im)plausible thruster using this effect.

[http://en.wikipedia.org/wiki/Quantum_vacuum_plasma_thruster](http://en.wikipedia.org/wiki/Quantum_vacuum_plasma_thruster)

<comment><USER3> Ya sounds like the NASA EmDrive (possible) verification from a couple days ago:

[http://www.wired.co.uk/news/archive/2014-07/31/nasa- validate...](http://www.wired.co.uk/news/archive/2014-07/31/nasa-validates- impossible-space-drive)

I heard about this independently from JLN Labs and other replication groups, doing lifter experiments with asymmetric electric fields in near-vacuum:

[http://jlnlabs.online.fr](http://jlnlabs.online.fr)

[https://www.youtube.com/watch?v=G359-G4SZlE&list=FLBsZga0Y-s...](https://www.youtube.com/watch?v=G359-G4SZlE&list=FLBsZga0Y-s2-p8HVZput4VQ)

[https://www.youtube.com/watch?v=CGN65lse5yE&index=5&list=FLB...](https://www.youtube.com/watch?v=CGN65lse5yE&index=5&list=FLBsZga0Y-s2-p8HVZput4VQ)

[https://www.youtube.com/watch?v=5QuHgzrPuGk](https://www.youtube.com/watch?v=5QuHgzrPuGk)

Running in the atmosphere, the electric field created between a small conductor like a wire or point charge and the larger foil is asymmetric, meaning that the field strength on the surface of the wire is stronger than the electric field holding the electrons to the atoms of the gas molecules. The molecules become ionized and get accelerated by the electric field to the large conductor. This would ordinarily cause no net force, because the action and reaction of the molecules bouncing off the large conductor are exactly balanced. However, the molecules drag on the order of 100 other molecules in the air along with them, creating a frictional force against the air and propelling the craft forward. The most efficient lifter uses pulsed DC and is about on par with a helicopter:

[http://jnaudin.free.fr/html/lftphv.htm](http://jnaudin.free.fr/html/lftphv.htm)

However for near-vacuum, the electric field would have to be strong enough to separate virtual pairs, which would then be sent in opposite directions. There would probably be no interaction with other virtual pairs, so there should be no frictional force and no propulsion:

[https://en.wikipedia.org/wiki/Vacuum_polarization](https://en.wikipedia.org/wiki/Vacuum_polarization)

My best guess is that if they aren't running the experiments inside Helmholtz Coils, then they are actually creating a homopolar motor that interacts with Earth's magnetic field by way of the Lorentz force, or possibly resonances set up in the surrounding metal that create small magnetic fields:

[https://en.wikipedia.org/wiki/Helmholtz_coil](https://en.wikipedia.org/wiki/Helmholtz_coil)

[https://en.wikipedia.org/wiki/Homopolar_motor](https://en.wikipedia.org/wiki/Homopolar_motor)

The big question is, if one of these drives eventually does work, then why is the force stronger than light pressure? I just mean that it's straightforward to build an accelerator that creates photons with high enough energy that they oscillate between waves and say electrons/positrons, then separate the pairs and fire them out the back like an ion drive. But the momentum delivered by the energy to do that that should be less than or equal to light pressure.

I suppose if a way can be found to pull virtual pairs from the vacuum that takes less energy than splitting photons, then a Q-thruster might work. It would work by creating mass at one location, propelling the engine against it, and returning the borrowed mass to the vacuum.

I know there's a lot about quantum mechanics that I don't understand, and there's probably a specific reason this won't work (probably because virtual pairs are created randomly and can't be coerced into existence?) so if anyone knows, please explain. I've tried to write this as scientifically as I can because I dislike psuedoscience.</comment></comment>


WebBundles harmful to content blocking, security tools, and the open web - <AUTHOR> https://brave.com/webbundles-harmful-to-content-blocking-security-tools-and-the-open-web/ <comment><USER2> Things like AMP and WebBundles clearly appear like a self-interested attack on the open web by Google, all the while making reasonable-sounding noises about efficiency and speed.

With the inexorable rise of ad-blockers, allowing 'User Agents' to be true agents of the user is a threat to Google's business model, and any significant engineering and standards efforts by that company can and should be evaluated by assuming the driver is not web altruism, but ferocious defence of their business model.

Interesting to see Google accounts drop in to misdirect on the essence of the argument outlined in the article: the essence being that bundles create private namespaces for URLS, which is an attack on the agency of a user in consuming content.

It should be unsurprising that Google wants to blackbox websites. If these kinds of initiatives succeed the philosophical debate around whether a user has the right to filter content running on their machine becomes moot, because technically they won't be able to.

The bottom line is: Google's business model is threatened by users being able to control the content they consume. Splitting hairs on how bad WebBundles will be in practice wilfully or otherwise misses this larger, more important point.

Operating in an Australian context, it's exasperating arguing forcefully for Google and Facebook [1] in regards to the new shakedown laws outlined brilliantly by Stratechery [2], all the while knowing there are very real criticisms that should be discussed, such as AMP and WebBundles.

[1] [https://news.ycombinator.com/item?id=24186376](https://news.ycombinator.com/item?id=24186376)

[2] [https://stratechery.com/2020/australias-news-media- bargainin...](https://stratechery.com/2020/australias-news-media-bargaining- code-breaking-down-the-code-australias-fake-news/)

<comment><USER3> I just don't get this criticism, nothing in web bundles appears to be particularly new, nor would it make it much easier to create private javascript namespaces. Years ago I built web apps that were packaged as zip files, which then were decompressed in a worker and then had javascript loaded from them. If you want to do this right now, it's not hard.

<comment><USER2> The blog author summarises the core issue here [1].

WebBundles are an attack on user agency: the right to filter content on the open web.

Google putting forward a proposal which directly attacks the ability of general-purpose blockers to operate is not a case of "nothing to see here, I did something I think approximates this situation years back".

The moral case of "blocking = theft" clearly isn't getting political traction so an alternative or accompaniment is pushing standards to destroy the rights of user agency.

Keep in mind Gorhill's statement on justifying uBlock Origin [2]:

"That said, it's important to note that using a blocker is NOT theft. Don't fall for this creepy idea. The ultimate logical consequence of blocking = theft is the criminalisation of the inalienable right to privacy."

Noble and correct, but if this technical war is successfully waged as mentioned it all becomes moot.

Some may desire that the internet moves to a set-top box model of pressing buttons to get an un-inspectable, unmodifable content window for consumption, but many of us do not.

I can't think of anything worse: the open web transformed by ad-tech behemoths into some kind of locked-down hotel entertainment system.

[1] [https://news.ycombinator.com/item?id=24276819](https://news.ycombinator.com/item?id=24276819)

[2] [https://github.com/gorhill/uBlock#philosophy](https://github.com/gorhill/uBlock#philosophy)

<comment><USER3> You're talking to someone who hasn't used a browser without ublock origin since 2014. Just looking at the spec, it's not any more effort to build a zip file than it is to build a web bundle.

<comment><USER4> Google pushing this does more to normalize the practice than anybody in this thread who 'tinkered with an equivalent idea a few years ago' or whatever.

<comment><USER3> I don't think that is an important distinction to make. Google isn't alone in wanting this, with a simple search you can see by now there are multiple webpack plugins that produce zip files: [https://www.npmjs.com/search?q=webpack+zip](https://www.npmjs.com/search?q=webpack+zip)

If someone really wanted to sabotage the URL right now, they would have already been doing it by hacking these to randomize the filenames, which is the same thing you would have to do to deliver that type of obfuscation in a web bundle anyway.

<comment><USER5> You're missing the point. It is one thing for a small percentage of websites obfuscating their code and assets in zip files, but it's a whole other thing if the practice is standardize and a large number of websites move to implement it.

<comment><USER3> I don't see how that is relevant at all. Obfuscating code and assets isn't in the spec. Either way, you have to go out of your way to do it. Web bundles actually seem like they would be significantly better for content blockers than zip files would be, because accessing them still uses the standard xhr APIs which can still be hooked.

If you're really worried about big mysterious obfuscated blobs of code running in your browser that can't be broken up and blocked individually, the real culprits are web assembly, and minimizing bundlers like webpack. Not some packaging scheme.

<comment><USER5> > Obfuscating code and assets isn't in the spec

By "obfuscate," I meant obfuscate the URL, which has been mentioned multiple times in this discussion, so I thought it wouldn't be confused with code mangling.

This comment illustrates the point very well imo: [https://github.com/WICG/webpackage/issues/551#issuecomment-6...](https://github.com/WICG/webpackage/issues/551#issuecomment-618776153)

<comment><USER3> Obfuscating of the URLs is a non-issue and I think that comment is being unnecessarily negative instead of looking at ways to deal with the problem. There is no reason an adblocker should not be able to get at the actual source (i.e. knowing that request A is actually going to be fulfilled with a resource included in web bundle B coming from site C). If ad blocking tools are unable to do this for reasons unrelated to the web bundle spec, that's a separate problem.

It also seems to paper over the fact that randomizing urls requires a server side component to keep rebuilding the bundle which is the same thing you would have to do with the zip file method, and has most of the same drawbacks (i.e. changing the url would invalidate cache).

<comment><USER5> > I think that comment is being unnecessarily negative instead of looking at > ways to deal with the problem [...] If ad blocking tools are unable to do > this for reasons unrelated to the web bundle spec, that's a separate > problem.

The Github thread starts with making the spec and adblockers compatible [0]. You seem to be of the opinion that they are, or that their incompatibility is better solved on a different layer. If so, your input would be appreciated at that thread, which is still active.

[0] And in response to the push back, explains the incompatibility.

<comment><USER3> I probably won't because I don't maintain any ad blockers at this time, in my opinion if you really care about this as an attack vector it's better to just block javascript entirely. As I've said before this type of circumvention of ad blockers is not anything new and has been possible for years. The sites that really wanted to mess with your url filtering are already doing it, with or without web bundles.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> I can already give everyone a unique URL to the same resource at the cost of it not being cached (which is a cost this mechanism doesn't avoid).

The article admits this, but then simultaneously tries to claim that the loss of caching would prevent that from being common... but this loses caching.

I can already give everyone unique resources for the same URL by keying the response on the Referer (which I would also add to the Vary header).

The article also admits this, but then tries to claim problems that are out of scope... the "first visit" will never be to a subresource of a page.

The article further tries to claim that this is difficult or defeats caching, but adding Referer to Vary is trivial and works with all CDNs and caches.

Meanwhile, if we believe this kind of argument about "people won't bother to do it because it is slightly hard" (I don't), then we need to be consistent.

It will take work to generate the multiple obfuscated copies of this bundle and be maximally disadvantageous to caching to do so for each visitor.

Ad blockers that work using URLs are fundamentally only possible because they aren't common: if you make them common, they will break.

I mean, ad blockers are so uncommon right now that you can often get away with blocking hosts at the DNS level... that is so trivially defeated!

If you want to do something useful, work on post-download ad "view" blocking by having an AI classify regions of the page as ads and then erase them.

This is also an arms war, but it is one that will more than likely at least result in subtle ads that you don't mind (as the AI "lets them slide") ;P.

<comment><USER7> One of the problems with ad "view" blocking is that the problematic code still downloads and loads, so you lose much of the benefits of content blocking making your page lighter and only get the benefit of removing mental overhead/distractions (I say "only", but I'm not trying to say it's not a huge gain). Ideally this AI would work at the network level, but the fundamental problem is that a URL doesn't have to tell you anything about what is on the other end, and we haven't tried "browser antivirus" software yet that blocks JavaScript by matching it against (say) an ad network's "fingerprint"…

<comment><USER6> Yeah. For various article-context reasons I am concentrating on the blocking of "ads" here rather than on "malicious code". The latter is a much more complex problem to solve in the first place, though: like, it relies on a specific model of opponent that is also extremely dumb; amazingly, this opponent exists in the wild, but I swear it is only because people who go out of their way to block them with simple techniques are so rare as to not be worth investing into including in your un-targeted resource utilization attack. (And FWIW, the ad pages I run into that are maximally bad -- ones that abuse the browser using history state tricks, popping up notification boxes and printer dialogs, sometimes even managing to lock up the entire rendering engine on purpose in an attempt to get the user to agree to the terms of the scam -- all have URLs that are constantly being randomized so often that I have a hard time showing them to other people.)

</comment></comment></comment><comment><USER8> Disclaimer: I wrote the article.

I'm not sure where the claimed confusion is above.

The argument is: I want to include something like fingerprint2.js in my page. I know filter lists block it, bc users don't like it.

W/o web bundles, you have to either inline it (bad for perf), copy it to a new URL (which could later also be added to a list), or add some URL generation logic to the page, and have some server side logic somewhere to know how to understand the programmatically generated URLs.

With WebBundles. I call it [https://example.org/1.js](https://example.org/1.js) (which is a diff than what [https://example.org/1.js](https://example.org/1.js) points to in a different bundle) or even just call it [https://example.org/looks-to-be- benign-to-the-web.js](https://example.org/looks-to-be-benign-to-the-web.js).

The claim is not that bundles are coming from random URLs, its that the bundles create private namespaces for URLs, and that breaks any privacy tools that rely on URLs.

<comment><USER9> Understanding your situation: you're imagining running a website that wants to include fingerprinting JS? So the site today looks like:

       <html>
       ...
       <script src=/fingerprint2.js>
       ...

The blocker sees ".*/fingerprint2.js" and excludes it. So far so good.

But your site could, with minimal effort, do:

       <script src=/asdf23f23g.js>

randomizing the URL on every deploy. This would circumvent url-based blocking today, with the downside of preventing the JS library from being cached between deploys.

Web bundles change none of this. Just as you can generate an HTML file that references either /fingerprint2.js or /asdf23f23g.js, so can you generate a bundle. Unlike your claim in the article, this does not turn "circumvention techniques that are expensive, fragile and difficult" into ones that are "cheap or even free".

(Disclosure: I work for Google)

<comment><USER8> Again random urls are just a demonstration of the problem.

At root is private name resolution. What one bundle sees as asdf23f23g.js is different from what another bundle sees as asdf23f23g.js is different from what the web sees as asdf23f23g.js.

A site changing URLs often is a pain filter list authors deal with (automation, etc). Private namespaces for URLs is the real problem here that makes the proposal dangerous (and using it to randomize URLs is just a demonstration of how the dangerous capability can be used)

<comment><USER9> Making it per-user instead of per-deploy is simple today, though! Assign each user a first-party cookie, and use it to generate per-user URLs. Now users can cache across deploys as well:

1\. First HTML request: Generate a random string, put it in a server-side cookie, use it to name the fingerprinting script.

2\. Later HTML requests: Pull the random string out of the cookie, use it to name the fingerprinting script.

3\. Requests for the fingerprinting script: see that the cookie is present on the request, return the script.

This is some work, but not that much. And unlike a WebBundle version, it is cacheable.

<comment><USER10> I might misunderstood how web bundles work, but it still seems significantly easier to implement with web bundles than without.:

Your cookie-based solution still requires the cookie as a sort of state tracker to memorize the URL in question. This requires some server-side logic to coordinate different requests and deal with cases where the cookie gets lost.

In contrast, implementing the same with web-bundles is as easy as generating a single HTML page: There is only a single script needed that generates the whole bundle in gone go and therefore can also ensure the randomized URL is used correctly without any kind of state.

<comment><USER9> If you serve a full bundle in response to each request then you've given up on caching for the fingerprinting library.

If you're ok with giving up on this caching then you don't need cookies, you can have the server generate random-looking urls that it can later recognize are requests for the fingerprinting library.

<comment><USER10> Yes, I understand that.

I think the point is that this part:

> _that it can later recognize are requests for the fingerprinting library._

is made significantly easier to implement by web bundles. (Because with web bundles, the server doesn't need to understand the URLs at all)

I agree however that it's questionable how well this technique would fit into real-life situations. I imagine as most ads and tracking scripts are not served locally, you usually wouldn't be able to embed them into a bundle anyway, randomised URLs or not.

<comment><USER9> _> is made significantly easier to implement by web bundles. (Because with web bundles, the server doesn't need to understand the URLs at all)_

I agree it's a little easier than what I described because there are no longer separate requests to connect, but it's not much easier. On the other hand, if you're going to give up on caching and bundle everything into one file you could just have your server inline the tracking script. (Or use HTTP2's server push.)

Taking a step back, your last paragraph looks right to me. Ad scripts are very rarely served locally because there is an organization boundary between the ad network and the publisher (and a trust boundary), and they're large enough that you do really care about caching.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> This post is very confused. If one entity generates the page and the ads, then they can already reasonably easily randomize URLs and circumvent ad blockers. Facebook does this. On the other hand, if one entity generates the page and another handles the ads (the typical situation where a publisher uses an ad network to put ads on their page) then web bundles don't do anything to resolve any of the coordination problems that make url randomization and ad blocker circumvention difficult.

I'm currently exploring using WebBundles to serve multiple ads in response to a single ad request, because it allows ads to be served more efficiently while keeping them secure and private, but ad blockers would still prevent the ad js from loading before the ad request was ever sent.

(Disclosure: I work on ads at Google)

<comment><USER11> _> I'm currently exploring using WebBundles to serve multiple ads in response to a single ad request, because it allows ads to be served more efficiently while keeping them secure and private, but ad blockers would still prevent the ad js from loading before the ad request was ever sent._

Why is this a use-case that I as a web user should care about? Frankly, I don't find it very comforting that an article raises privacy concerns, and an engineer working on ads at Google responds with "these concerns are misguided; I'm exploring this technology to make ads better."

<comment><USER9> _> Why is this a use-case that I as a web user should care about?_

If you block ads, then my work will have no effect on you. If you do not block ads, then my work decreases bandwidth usage and makes it harder for ads to deface each other.

 _> I don't find it very comforting that an article raises privacy concerns, and an engineer working on ads at Google responds with..._

The article describes privacy concerns, but those concerns are based on a misunderstanding of what WebBundles make easier. Specifically, they're concerned about URL randomization, which _is no easier_ with bundles.

<comment><USER8> This is just super wrong. With WebBundles I can call 2 different things, in two different WebBundles [https://example.org/good.js](https://example.org/good.js), and that can be different from what the wider web sees as [https://example.org/good.js](https://example.org/good.js).

Random URLs are just an example of the capability they are not the fundamental problem

<comment><USER7> > With WebBundles I can call 2 different things, in two different WebBundles > [https://example.org/good.js](https://example.org/good.js), and that can be > different from what the wider web sees as > [https://example.org/good.js](https://example.org/good.js).

I can also do that on my server based on whatever criteria I want, just by returning different content. How is this significantly different than the problem you've brought up?

<comment><USER10> The criteria are well-known and basically restricted to what is contained in an HTTP request. With web-bundles (like with service workers) the logic which actual resource the URL resolves to is instead deeply embedded into the browser.

At least, that's my understanding.

<comment><USER9> We're talking about what the server decides to put in the initial HTML file you request. Since those are almost never served cacheable to the client, the server can just randomize the URLs it produces.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Disclaimer: I work at Google, though not on this, and I very much want to see WebBundles succeed to solve many problems with asset distribution right now and reduce the gymnastics that bundlers have to go through.

So, this is a super unfortunate analysis that seems to be founded on a major logical inconsistently.

The post claims that:

1) It's costly to vary URLs per-user without WebBundlers because it harms caching. By caching I presume here they mean edge caching.

2) It's cheap to vary URLs per-user with WebBundles.

The costs are not any different:

* If you vary the bundle per-user then you _also_ harm edge caching.

* If you build a bundle per-deployment, like current bundlers do, then you're not varying URLs per-user

* If you build bundles on the fly per request, say in an edge worker, then you could also just as easily and cheaply vary URLs per user the same way, with the same or less impact on caching.

The whole thing just doesn't make sense, and undermines one of the most important proposals for fixing not only resource loading but also much of the tooling ecosystem.

<comment><USER13> > I very much want to see WebBundles succeed to solve many problems with asset > distribution

I'm wondering what those are. The use cases I've seen seem pretty tenuous to me (people don't want to send web bundles to each other. They want to share a link. They don't want alternate transports in general, really, or the complexities that come with that.)

I guess I may not know what the use cases are, but right now it looks like a complication with little upside.

<comment><USER12> The benefits to native bundling are _huge_. I really cannot overstate how much they will improve UX, and DX.

The core web file formats: JavaScript, CSS, HTML, and images, do not have native multi-file bundling support. Today's bundlers have to jump through serious hoops, which drastically reduces the effectiveness of the network cache, to emulate bundling. And those hoops bring constraints that limit the native features of the web platform that are usable with bundlers.

JavaScript is bundled by significantly rewriting it. At the very least imports and references to imports have to be rewritten. Live bindings from modules require special care. Dynamic import() is severely restricted. import.meta.url usually doesn't work well, or at all. Base URLs for all resources are changed, so getting assets with new URL() and fetch() is usually broken. That causes bundlers to support importing module types that the browser doesn't support, so at development time you still have to run the bundler. The whole thing just diverges from standard semantics.

CSS is bundled by assuming a global CSS scope so that the individual files are not needed separately. URLs within the CSS have to be rewritten. The upcoming CSS Modules specification allows JS modules to import CSS, but since you need to import the actual stylesheet you want, and CSS doesn't have it's own multi- module support, you really need native bundling to make this work well in production.

Images can be bundled _sometimes_. Maybe a spritesheet will work, or data: URLs. It all depends on how you're using them.

It's all a complicated mess that requires complicated tools and WebBundles just fix it all. You no longer have to rewrite any references in any files. If you do build files, it's purely for optimization, not because you have to.

What's important for users is that files in a WebBundle are individually cached. This makes it finally possible to do delta-updates on pages where you only send the updated files. Maybe the initial visit is with a bundle and subsequent visits use HTTP/2 push. Maybe when you deploy you build delta bundles against the previous X versions of the site. With current bundlers only the bundle is cached so you can't do this at all.

<comment><USER14> Explain to me why _any_ of this is necessary once HTTP/3 is widely adopted?

Isn't the whole point of HTTP/3 to "emulate" bundling without actually requiring content to be zipped up into a binary blob? Isn't it also quite good at caching, such as incrementally updating individual files without complexity? Isn't it also capable of pipelining a bunch of small logical files into a contiguous stream _as-if_ they were in one big blob? Isn't the head-of- line blocking issue, which HTTP/3 solves, going to be a problem with monolithic web packages? What's next... WebPackage 2.0 with a yet another head-of-line-blocking-solution!?

This all feels like the left hand not talking to the right hand at Google.

It also feels like Google is perfectly happy to bloat web standards to the maximum extent possible given the size of _their_ development team, permanently and irrevocably blocking anyone from ever again developing a web browser from scratch to compete with Chrome. Unless of course they can devote a few thousand man-years to the task. Which noone short of two or three companies can now.

I've never even _heard_ of this "problem" that Google is trying to solve, but clearly Google is pushing very hard for it to be solved... for some unstated reason.

From the outside, this feels incredibly self-serving.

<comment><USER12> HTTP/3 is just HTTP/2 over QUIC, fixing head-of-line-blocking will help some, but...

Having spent lots of time trying to optimize servers to correctly utilize HTTP/2+push, and building bundle-less deployments, not only is it quite difficult, it doesn't achieve the compression performance that bundling does. We measured ~30% better compression from a bundle over separate files.

And I don't see this as bloating standards at all, but fixing a huge problem in current web development and paving a cow path. Bundlers are central to web development today, maybe even more so than frameworks. And they cripple the features of many of the files types they bundle. WebBundles fixes that.

</comment></comment></comment></comment></comment><comment><USER15> Many of these complaints seem... odd. The primary complaint with Web Bundles is "they make the web like SWFs" \- last I remember, people LIKED the fact that Flash content could be bundled that way. You actually were able to distribute Flash content like a normal web application, broken up into multiple SWFs, images, and so on. The vast majority of Flash content was a single file, because it's easier to distribute that way.

With WebBundles, if you want to deny specific subresources, you can still have the browser block them by identifier or hash, which is the same as you can do with a regular web request. The reason why there are no content blocking tools for PDFs is because nobody's bothered to write a PDF reader with that capability. Furthermore, I don't see how putting the resource identifier in the content of a bundle makes it easier than changing the URL. Both of those will either defeat or be defeated by caching.

If you have a CDN that generates random URLs for a single cached resource and serves them on the same domain as user websites, then identifier-based blocking won't work with or without WebBundles. You can do this today with Apache rewrite rules and PHP, which are about as economical as you can get. If your threat model is "people who just know how to SFTP a handful of JavaScript files" then yes, WebBundles makes things "easier". But I'd argue your threat model is laughably unworkable if that's the case. The state-of-the-art in adtech is to smuggle your fingerprinting platform as a randomized subdomain of the client site - how do you even begin to block that with identifiers alone?

<comment><USER16> _people LIKED the fact that Flash content could be bundled that way_

Developers did. People didn't. People hated Flash because it was bloated, downloaded slowly, and killed anything with a battery.

All this pining for Flash is just revisionist history inside the HN bubble from people who have forgotten how much Flash was hated by the general public.

<comment><USER17> Wasn't the majority of Flash content made before the rise of JIT-compliation and the use of mobile devices everywhere? For me, the downfall of Flash were security issues and its similarity to Java plugins. Additionally, Adobe never invested all that much in Flash, Macromedia is still more associated with the name.

<comment><USER15> Yes and no.

Strictly speaking, there is nothing particular to Flash that precludes JIT compilation. In fact, AS3 code runs on a VM specifically built with JIT in mind. AS1/2 code does not, but that could be remedied with shittons of guard statements like modern JavaScript VMs have.

</comment></comment></comment></comment><comment><USER8> Again I wrote the piece but…

Folks "who are well actually, you can already make URLs meaningless"'ing are missing the point of how practical web privacy tools work, including the ones you all have installed right now.

There is an enormous, important difference between:

i) circumventions that are possible but are fragile and cost more, and ii) circumventions that are effortless for the attacker / tracker

Every practical privacy / blocking tool leverages that difference now, the proposal collapses it.

<comment><USER18> I am not in any way pro-Google and I feel what they are doing with AMP is a perilous path, but your article was not convincing. It's trivially easy to rotate a JS name and serve it from the same cached edge file (eg with cloudflare workers) and not incurring any major additional cost. It's not hard to imagine advertisers doing something similar with their own CDNs. This could even be done at the DNS level with random sub domains. Unless we are ok blocking (star).facebook.com/(star), every other part of the URL is trivially easy to randomize.

</comment></comment><comment><USER19> > WebBundles Allow Sites to Evade Privacy and Security Tools

I completely disagree. Browser-level code can still effectively apply user- defined privacy and security policies onto WebBundles.

Didn't Firefox originally solve the issue of deep-linking into opaque bundles with it's jar: URI scheme idea? For example, this URI could be used to reference specific files in a zip archive in Firefox. iirc this scheme might not be supported by Firefox anymore.

        jar://https://site.example/archive.zip!/file%201.txt

The same concept could be applied for WebBundles with another similar URI scheme so that content blockers and security tools can effectively introspect the bundle before initializing resources from the bundle. For example, something like:

        bundle://[optional hash, origin, or regex?]![uri or regex]
        // e.g.
        bundle://https://site.example/!https://site.example/regulated-sub-bundle-file.html

<comment><USER20> So what does that solve? It will still load the whole bundle before it can do anything

</comment></comment><comment><USER21> Until the entire advertising community gets their s __t together I will block every ad and script that I can.

It has gotten to where there the line between advertising and malware is blurred or nonexistent.

It seems to me that every new API or web standard that Google creates is an attempt to stop ad blockers disguised as meaningful useful features.

<comment><USER22> There is a need for ethics in the technology industry. Without it, capitalism causes ordinary people to do unethical things for profit.

</comment></comment><comment><USER11> Yet another case study in why allowing a privacy-hostile advertising company to control the most popular web browser and influence web standards is bad for the web.

</comment><comment><USER23> Seems completely baseless.

There is no difference between an URL without web bundles, and an URL that refers to a "web bundle" and a path within in.

All the things that they claim can be done with Web Bundles can be done without just as easily by putting all dependent resources in a versioned subdirectory.

</comment><comment><USER24> > So-called "Binary Transparency" may eventually allow users to verify that a > program they've been delivered is one that's available to the public, and > not a specially-built version intended to attack just them. Binary > transparency systems don't exist yet, but they're likely to work similarly > to the successful Certificate Transparency logs via > [https://wicg.github.io/webpackage/draft-yasskin-http- > origin-...](https://wicg.github.io/webpackage/draft-yasskin-http-origin- > signed-responses.html#uc-transparency)

We are building a binary transparency system here: [https://transparencylog.com](https://transparencylog.com)

Having HTTP signed requests would be nice to prove that the origin server presented the contents.

<comment><USER25> The circumstances that enabled Certificate Transparency to succeed were pretty narrow, but people seem to keep proposing more of these X Transparency systems so maybe I should actually properly write down why I think that's largely futile, not because I expect it will stop anyone but because at least then I can just paste the link.

For now, let me highlight a really big consideration:

\- Most of the effectiveness of CT logs stems from the logging mandate _not_ the cryptography. The publicly trusted CAs proactively log either everything they issue or all but some relatively small controlled subset of issued certificates which purposefully fall outside the mandate.

Will your X transparency be mandatory? Who will enforce that? Won't it be more practical to reject systems that try to mandate X transparency than to implement it?

</comment></comment><comment> lachlan-sneff WebBundles would be great for distributing applications to users as a single, well, bundle.

<comment><USER26> Yes, especially you currently can't run .wasm based apps without a server on either Chrome or Firefox, but WebBundles will make this possible (I hope).

</comment></comment><comment><USER27> 2 things bother me about this proposal: [https://web.dev/web- bundles/](https://web.dev/web-bundles/)

1) The use cases discussed by Google are largely offline. So how is this a "web" standard when it doesn't involve the web? If Google wants to implement an offline app format, that's their prerogative, but it's not clear to me why it should be enshrined as a web standard, just because it happens to use HTML/CSS/JS.

2) Google keeps talking about it as a tool for you and your "friend". I'm suspicious that this is the real motivation. Is the Google Chrome team really very concerned about in-flight entertainment? (Especially now when hardly anyone is flying anymore.) A number of people have suggested that the real motivation here is AMP. The "spin" in Google's proposal is too "friendly".

<comment><USER27> To me the key part is this: "Loads in the context of its origin when cryptographically signed by its publisher"

Then it feels like a bit of misdirection to immediately pivot to "easy to share and usable without an internet connection". What if you do have an internet connection? What if the real goal is actually to republish entire web sites on google.com, i.e., AMP?

<comment><USER28> >What if the real goal is actually to republish entire web sites on google.com, i.e., AMP?

Why would Google have hosting everything on their domain be an end goal?

WebBundles address the technical limitation that causes AMP to serve everything from Google's own domain.

<comment><USER27> > Why would Google have hosting everything on their domain be an end goal?

To become the internet! Much like AOL was in the past, kind of like how Facebook is now. Each of the big tech corps is trying to set up a walled garden that you never leave.

In the beginning, Google Search was not a destination, it was merely the way to find your destination. But now a large percentage of searches never actually leave Google. The data is re-presented by Google Search.

Google has a search engine, DNS, browser, email service, office suite... oh yeah, and a mobile platform. All of which have millions or billions of users. They just need to host web sites too in order to create their own web-on-the- web. The Google Internet. It's about controlling the entire "experience".

Think about it: the web is supposed to be "free" (as in freedom), but increasingly web site owners have to design everything around Google: ranking high in Google Search, having the right format for AMP, rendering "correctly" in Google Chrome. Even being forced to adopt https (read Dave Winer on that issue) or be erased.

</comment></comment></comment></comment><comment><USER29> What is Mozilla's stand on WebBundles, SGX and Loading?

</comment><comment><USER30> Signed HTtp Exchanges are harmful as well

</comment><comment><USER31> Sounds like Brave is sore someone might keep them from skimming ad revenue off legitimate creators.

<comment><USER32> Do you have a rebuttal that's NOT an ad hominem?

<comment><USER31> Do I need one?

They're clearly speaking as a neutral source when to anyone with an ounce of knowledge they have a biased agenda.

Would you take an article from 1990's Microsoft about how Apple is evil seriously?

Also, pointing out a conflict of interest isn't ad hominem. I didn't call them nazis or morons.

<comment><USER33> We don't make revenue from ads in pages, or lose revenue if Google smuggles ads into SWF-like WebBundles via AMP imposed on publishers under pain of search rank loss. Brave user ads fill user inventory, not in-page ad slots (perhaps you heard misinformation claiming otherwise). So even as an ad hominem rhetorical ploy, what you wrote doesn't work.

<comment><USER34> I'm not here to agree with the who you responded to, but Google smuggling unblockable ads does 100% harm Brave. If part of Brave's selling point is the built-in ad blocking and in a hypothetical dystopian scenario the web were overrun with unblockable ads from WebBundles Brave would inevitably be harmed to some degree. I say that as someone who runs Brave on my phone primarily. I know I'd probably switch browsers if one of the primary reasons to use it were largely killed off.

<comment><USER33> If AMP2.0 emerges with ads and tracking embedded in bundles, we will not lose money from those ads. Our performance and battery+dataplan savings will be gone, but we will be no worse than Chrome for such content.

Because Apple and likely other browsers will not adopt SXG etc, such AMP2 content will have to include a fallback link (as AMP does today). We may in such a scenario automatically prefer the non-AMP2 content.

In any case, your argument fails because we are no worse off in the worst case, and in better cases we still block many requests for greater user wins.</comment></comment></comment></comment></comment></comment>


Arithmetic, Population and Energy  - <AUTHOR> http://www.youtube.com/watch?v=F-QA2rkpBSY&feature=BF&list=PL6A1FD147A45EF50D&index=1 <comment><USER2> You might be interested in the lengthy discussion from a previous submission of this item:

<http://news.ycombinator.com/item?id=1382456>

</comment><comment><USER3> >The greatest shortcoming of them human race is our inability to understand the exponential function.

Nice demonstration of rates of growth.</comment>


How to Prepare a Go Bag - <AUTHOR> https://whyisthisinteresting.substack.com/p/why-is-this-interesting-the-go-bag <comment><USER2> >"Never have anything in your life that you can't walk out on in thirty seconds flat if you spot the heat coming around the corner" is a good piece of advice if you want to avoid a bad situation.

I'm pretty sure most "bad situations" could not have been helped with a go bag.

This is an interesting thought experiment, but the selling points seem silly.</comment>


Stronger, Better, Faster Design with CSS3 - <AUTHOR> http://www.smashingmagazine.com/2009/12/16/stronger-better-faster-design-with-css3/

<comment><USER2> This article seems confusing, they are using the browser specific implementations of CSS3 and passing it off as the standard naming (eg. box- shadow vs -webkit-box-shadow) without saying anything about it.</comment>


This is my draft of first shot at romantic sci-fi. Just 10 min read - <AUTHOR> https://email@example.com/point-blank-a-romantic-sci-fi-19a98ccf791e <comment><AUTHOR> This is still a draft. I need some reviews on how the plot is and where I can improve. Thanks in advance!

</comment><comment><USER2> Not bad but was hard to get into as the ordering seemed off. I think start with something provocative to get the readers attention as the first sentence which will force them to read to the end

<comment><AUTHOR> Yes, that part worried me a bit too. Nevertheless I published the article after making a few more changes and clearing up the plot better. You can find it here [https://firstname.lastname@example.com/point-blank-a- romantic...](https://firstname.lastname@example.com/point-blank-a-romantic-sci- fi-19a98ccf791e)</comment></comment>


Show HN: I built a website to save you time searching for remote jobs - <AUTHOR> https://meerkad.com <comment><AUTHOR> Good Monday, HN community!

During the period from January 13 to 19, I collected 136 vacancies from popular job boards like Glassdoor, Flex Jobs, We Work Remotely, and others, as well as from Facebook, Twitter, and Reddit.

It takes about 3 hours a day to visit 78 sources that I prepared in advance. Here are the links for several job's categories by language:

JAVA [https://meerkad.com/remote-java-jobs](https://meerkad.com/remote-java- jobs)

PHP [https://meerkad.com/remote-php-jobs](https://meerkad.com/remote-php-jobs)

Python [https://meerkad.com/remote-python-jobs](https://meerkad.com/remote- python-jobs)

All developers jobs [https://meerkad.com/remote-developer- jobs](https://meerkad.com/remote-developer-jobs)

My name is Arsen, I am a full-stack web developer (php, laravel, javascript) and the creator of Meerkad. I started this Remote Job Board Community to connect companies with the current and hopeful remote working people from all over the world. So! If you are looking for a remote job I'm glad to help!

Ars

</comment><comment><USER2> This is what i have been looking for!

<comment><USER3> Me too!

Are you a developer btw? What language?

</comment></comment><comment><USER3> I'm a javascript web developer. Any full-time jobs for me?

<comment><AUTHOR> Sure! Take a look on the website or here is a direct link to jobs "php" tagged for example [https://meerkad.com/remote-php-jobs](https://meerkad.com/remote- php-jobs)

<comment><USER3> Thank you!</comment></comment></comment>


How to Choose the Right Incubator for Your Startup - <AUTHOR> http://mindovermeta.com/2011/06/how-to-choose-the-right-incubator-for-your-startup-notes/

<comment><AUTHOR> Notes from the event that Orrick held. May come in handy for anyone who missed it! Also, you can find notes from the 'How to Choose Your Angels' event here: <http://news.ycombinator.com/item?id=2686092></comment>


WeWork to Sell $500M of Bonds in Debut Sale - <AUTHOR> https://www.bloomberg.com/news/articles/2018-04-24/wework-is-said-to-sell-500-million-of-junk-bonds-in-debut-sale <comment><USER2> I spend about 50% of my time thinking about and working at intersection of tech & real estate at considerable scale.

WeWork is in a bizarrely weird spot.

Building cap rates eg trading multiples are at all time, insane highs.

This inflation has been driven by institutional investors desperate for yield, with a lack of viable options.

And huge tech cos that are learning that amortizing property is a better use for their hoards of cash than seeing it rot in the basement.

So for WeWork buying into this hugely competitive market doesn't really make sense.

But conversely WeWork needs real estate to grow, and they like to grow in premium markets.

In these premium markets they are competing with dozens of other fast growing enterprises in the current economy.

Which means they are having to sign INSANELY big / long leases - they have $5B in LEASE CONTRACTS aka debt on the books through 2022.

So they are signing leases that are in the record price per square foot range to deliver their core product.

And meanwhile, as best I can find 85% of their business is still driven by "Small businesses, fast-growing startups and sole proprietors". (1)

And these segments, as known to anybody who plays in the "flex space" world, are the first tenants off the boat in a recession.

It is easy to critique and hard to create, as they say, but I don't follow WeWork's valuations or strategy.

(1) [https://www.recode.net/2018/3/22/17119012/wework-massive- gro...](https://www.recode.net/2018/3/22/17119012/wework-massive-growth- second-biggest-office-tenant-new-york-city-manhattan-cowork-space-real-estate)

<comment><USER3> Does anyone have the bull case counter to this? Similar to aresant I don't mean to belittle WeWork's achievement but these facts, alongside the headlines from CEO claiming that: "Our valuation and size today are much more based on our energy and spirituality than it is on a multiple of revenue."[0] it's easy to be skeptical. Again - would be great to hear the optimist's take on this, if anyone has it.

0: [https://www.axios.com/wework-ceo-valuation-based-on- energy-a...](https://www.axios.com/wework-ceo-valuation-based-on-energy-and- spirituality-1513305939-280574cb-38c1-4d61-a49b-a74bc5ba4cb9.html)

<comment><USER4> WeWork might do exceptionally well in a recession. As businesses can't afford to keep their offices, they may downsize, and become WeWork customers.

<comment><USER5> I'm not sure about that WeWork is considerably more expensive than running your own lease or even renting old school managed offices.

I did succeed because it had a lot of customers with a lot of money to burn (startups) and it offered very good networking opportunities, later on it offered top of the line real estate and services but they were never the economic option.

In a recession when there won't be VC money to burn and an infinite amount of rounds to raise it I don't think they'll do very well.

Traditional businesses won't get much value from most of their offerings and if they would be cutting back then cheap lease in industrial parks and sub prime locations would be what they'll be after.

<comment><USER6> During a recession, businesses--large and small--are going to cut out all the frivolous VC-style perks: snacks, booze, trendy furniture, etc.

WeWork isn't cost effective vs renting your own office space, it just removes the friction (and yes, some of the related costs) involved with getting a "trendy" SV-style office.

During a crunch, I think we'll see alot of these businesses retreat to sparser accomodations in run of the mill office buildings removed from downtown. WeWork will be constrained in this environment, since the record leases they are signing will place a pretty high floor on how much they can lower prices to compete...

If the market rages for another 5 years, WeWork is gonna hit it out of the park. If we recession before that, it'll implode spectacularly.

</comment></comment></comment></comment></comment><comment><USER7> $20 billion for a co-working business with 234 locations (works out to about $85 million per location)... I know they own some real estate and stuff, but man, that's a serious valuation (for something that can be copied in a heartbeat, no?)...

<comment><USER8> They don't actually own any of the properties, the rent them, and sublease to wework members.

<comment><USER9> WeWork buys Lord & Taylor's flagship store for $850M

[https://www.usatoday.com/story/tech/news/2017/10/24/wework-b...](https://www.usatoday.com/story/tech/news/2017/10/24/wework- buys-flagship-lord-taylor-store-850-million/793595001/)

<comment><USER10> How high can they stack the cards before they may tumble down..

</comment></comment></comment></comment><comment><USER11> I wonder who actually rents from WeWork. I checked their prices for Berlin, Barcelona, London and found cheaper alternatives with the same or better features after just one google search.

<comment><USER12> We paid less for WeWork in Chicago than we did for a private office in a relatively bad location, even before counting Internet and utilities, and got a month-to-month renewable lease to boot. WeWork is a lot of annoying things, but I don't think "terrible deal" is one of them. You can do better if you look (we're not there anymore), but it's a good satisficing default.

<comment><USER13> Really depends on your location. WeWork Berlin has absurd prices for the local market. The city already had plenty of great coworking spaces at half the price long before WeWork showed up.

<comment><USER14> Yes. I am digital nomading and the coworking in major cities in developing countries usually cost usd 100/mo, including free water, coffee and events. The WeWork places I checked were 2x-3x the costs and I can't imagine them to be that much better.

Having said that, 80% utilization is great and maybe catching all the premium market will work.

</comment></comment></comment></comment><comment><USER15> I can't see it in the article so hopefully someone else can give an opinion.

Why are these companies now using the bond market instead of hitting up VC's or listing? Considering interest rates are now creeping up it seems the least efficient time to do it.

<comment><USER16> To tack on to this, why would investors want to own WeWork bonds vs equity in the company?

In the case where bond holders do well, wouldn't shareholders do better? And in the bad scenario, with as many long term liabilities as WeWork has, are the bond holders going to be substantially more secured than the shareholders?

Does WeWork own anything real to secure the debt?

<comment><USER17> > To tack on to this, why would investors want to own WeWork bonds vs equity > in the company?

Because if the company goes bankrupt, bond-holders get paid before shareholders.

As such, bond-holders are always in a less-risky position. You'll always recoup some of your money during bankruptcy. (Don't estimate the value of the shelves and furniture!) While shareholders only get some $$ if the bonds are fully paid off.

> In the case where bond holders do well, wouldn't shareholders do better?

Not always. Bond holders will do well if the share-price stays steady or even negative. The company may stagnate over the next 7 years, at which point holding bonds would have been a better investment. The company is legally obligated to pay bondholders at its highest priority, until bankruptcy.

The Bonds aren't sold yet, but will likely be in the range of 4.5% to 5% (depending on market conditions during the sell-date). Over 7 years, the company needs to grow its share price by 36% for equity to beat a 4.5% bonds, or 40% to beat the 5% bond. Doable for sure, but its not too hard imagining a situation where they fail this benchmark and the bonds end up the superior choice.

For example: GNC's stock price doesn't help its shareholders, but the bond- holders would be doing fine.

<comment><USER18> I think OP is asking because he thinks that WeWork is closer to a startup where it will either grow quickly or fail. And that bonds don't look particularly appealing to a investors for a company like that unless they have significant real assets that are worth money in the event of the company failing.

</comment></comment></comment></comment><comment><USER19> I wonder what their customer base is like to protect themselves from downturns. Their customers can go month to month easily, but they're locked into long term leases.

</comment><comment><USER20> I hope they don't become a junk stock chasing their ambition.

</comment><comment><USER21> Those who refuse to study history are doomed to repeat it. The only difference will be the Milkens of today probably will never face jail time while their "investors" lose everything.

Got some Bitcoins or Pets.com to invest in instead?

</comment><comment><USER22> What's a good alternative to WeWork in SF?

<comment><USER23> Spaces.

</comment></comment><comment><USER24> So, Junk Bonds are a specific thing in finance. Sharing a link[1] for those as financially ignorant as myself, before others think this title is brazen well- poisoning.

1\. [https://en.wikipedia.org/wiki/High- yield_debt](https://en.wikipedia.org/wiki/High-yield_debt)

<comment><USER25> From the article:

>WeWork is issuing seven-year, senior unsecured bonds

This means that in case of bankruptcy the holders of these bonds will probably be the last ones to get paid back, if they ever do. This increased risk is usually compensated by a higher yield than regular bonds.

EDIT: As commenters point out, they wouldn't be the _last_: "In the event the issuer goes bankrupt, senior debt theoretically must be repaid before other creditors receive any payment."

[https://en.wikipedia.org/wiki/Senior_debt](https://en.wikipedia.org/wiki/Senior_debt)

<comment><USER26> Why would they be the last? In the case of bankruptcy these will be paid back before any money goes to junior unsecured bonds (if any) and before shareholders.

<comment><USER27> I'd imagine they have a lot of secured debt in the form of commercial mortgages. AFAIK they own some of their property rather than leasing it.

<comment><USER26> Probably. But the bond holders wouldn't be _last_ as the OP suggested.

</comment></comment></comment></comment></comment><comment><USER28> nobody involved in buy/selling High-Yield debt uses the term 'Junk'. It's a term from the 80s before every major investment bank serviced that market. Even the journalists at bloomberg are spinning clickbait language, sheesh ...

<comment><USER29> That's funny, because of the two terms, "junk bond" seems to me to be the more accurate and descriptive one, while "high-yield bond" seems like a deliberately deceptive euphemism.

<comment><USER28> [https://en.wikipedia.org/wiki/Bond_credit_rating](https://en.wikipedia.org/wiki/Bond_credit_rating)

when major banks/investors refused to deal with BBB or lower they called it 'Junk'. When they realized 1) the credit risk can be safely managed with modern financial theory and instruments 2) there was money to be made ... they quickly adopted it and had to figure something out to drop the 'Junk' pejorative.</comment></comment></comment>


Study finds that optimistic people sleep better - <AUTHOR> https://news.illinois.edu/view/6367/801754 <comment><USER2> That study actually didn't find that optimistic people slept better. They were just more optimistic about their quality of sleep :-)</comment>


Elon Musk's Answer To Stephen Colbert's Vision Of Wireless Charging - <AUTHOR> http://techcrunch.com/2014/07/25/elon-musks-answer-to-stephen-colberts-vision-of-ambient-wireless-charging-well-do-it/

<comment><USER2> [tangential topic]

I don't like techcrunch, I expect very little to no journalism from them. But that was one of the worst written, contentless, fluff writing bordering on vapid that I have had poor fortune to read.

<comment><USER3> Yup.

Elon Musk's Answer To Stephen Colbert's Vision Of Wireless Charging: laughing at Colbert's jokes.

Did anyone who voted this article read it or watch the interview?

</comment></comment><comment><USER4> I really wish people who talk about wireless charging would do some math.

To get any efficiency, you need to tightly constrain the EM field, at which point, you are effectively hitting a plug _anyway_.

Or, you are accepting enormous radiative losses and losing massive amounts of power. Doubling or tripling the power draw in every device just so it's powered wirelessly is a non-starter.

For cars, we're more likely to get automated charging stations that just plug themselves in. That's going to be a useful problem to solve.

<comment><USER5> Out of curiosity, how much does it typically cost to charge, say, an iPhone5? For some (many?) doubling this price might not be as much of a non-starter as you think.

<comment><USER6> Doubling is an underestimate. It's more like a factor of 10.

Still, multiplying the cost of charging an iPhone by 10 isn't bad. And in fact you can buy a lot of solutions that enable this, because you're right, it's not a big deal for a lot of people, and the convenience is worth the cost.

For an electric car, increasing the charging cost by a factor of 10, or even a factor of 2, is a much tougher proposition.

<comment><USER7> Where do you get a factor of 10 from?

<comment><USER6> From my butt, apparently. I was sure that was right, but checking into it now, and it looks like it's more like 60-85% efficient.

</comment></comment></comment></comment></comment><comment><USER8> Canadians can watch here: [http://www.thecomedynetwork.ca/Shows/TheColbertReport?vid=40...](http://www.thecomedynetwork.ca/Shows/TheColbertReport?vid=402651)

<comment><USER9> And people outside of North America can view it here: [http://www.youtube.com/watch?v=dUDCIfI- wRs](http://www.youtube.com/watch?v=dUDCIfI-wRs)

</comment></comment><comment><USER10> The thing about Elon Musk is if he says he'll do it, he WILL do it.

</comment><comment><USER11> There is already a startup in Boston doing this [http://www.witricity.com/](http://www.witricity.com/)

<comment><USER12> Nokia has already done what this company is doing in their Windows Phones. What Colbert was talking about is something much different.</comment></comment>


[pdf] Teenage hackers motivated by morality, reputation not money - <AUTHOR> http://www.nationalcrimeagency.gov.uk/publications/791-pathways-into-cyber-crime/file <comment><USER2> The Hacker Ethic is a wonderful book, written a while ago.</comment>