Ask HN: Tell me why this auth system is a bad idea - <AUTHOR> EDIT: It has been pointed out that slack already does essentially this, which gives me hope.
I'm no security expert, and it's probably about to show.
I've had an idea for a simple passwordless auth system bouncing around in my head. I've seen similar ideas floated once or twice before but don't see it used anywhere, so I'm assuming it's not as good of an idea as I think it is. The idea is essentially to use a password reset flow for all logins, not just when you need to reset your password. So it goes something like this:
User prompted for and inputs email address Server sends them an email with a randomly generated key. The key expires in a short period (5-10 minutes) or after first use, whichever is sooner. User inputs key (possibly automatically by clicking a link in the email). Server verifies the key, generates a random token, and sets it in a cookie/local storage which is valid for a reasonable session period (a day or two, maybe a week).
Advantages:
* Very simple to implement. Few moving pieces.
* Authorization can be handled by associating resources with lists of authorized email addresses, so technically users don't need an "account" in order to "login" and access the resources.
* User doesn't have to remember a password. If you can prove you control the email address, you're authenticated.
* No passwords to hack/phish from the database.
Disadvantages:
* If someone gets control of your email address, they have complete control over any service relying on this system. However, I don't see this as different from password reset flows which rely on email (ie Slack's magic links).
* User has to open their email every time they login.
* You tell me. <comment><USER2> Something very similar is used by Slack, Medium (also Discord and Quora, iirc), wherein they just send you an email with a link. You click on it, are logged in, cookies set and all that jazz.

I hate it, however. Quoting from another HN comment of mine:

It's _not_ convenient in many cases, such as if you're using an incognito/private window, or on a friend's computer, school PCs, don't have access to email, etc.

I much prefer the traditional username+password system. You shouldn't be memorising passwords anyway, use a password manager.

Your system doesn't allow password managers to work. Password managers are quicker than clicking on links in emails, and if you're on a stranger's PC that doesn't have the browser extension, you can just look the password up in the phone app and type it in.

<comment><AUTHOR> Would you mind linking to where you originally made that comment? Sounds like it might be a relevant conversation I should read.

I feel like you're making two somewhat contradictory arguments. The first is that this is inconvenient in several specific situations. The second is that passwords aren't a problem because people should use password managers. But the specific situations you mention are exactly the situations I've encountered in the past where my password manager isn't available either (which you acknowledge).

I do agree though that these are real problems. One advantage of using short- lived random keys for the emails is they could be short enough to manually enter (shorter than a secure password). Obviously you'd need to implement rate-limiting on the login page to prevent people from brute-forcing outstanding logins.

<comment><USER3> > But the specific situations you mention are exactly the situations I've > encountered in the past where my password manager isn't available either > (which you acknowledge).

I assume by "specific situation" you mean, "when I'm on someone else's computer."

Does your password manager not offer a web vault? That's what I use when I'm on someone else's computer and don't have my phone with me.

<comment><AUTHOR> Yeah basically I was referring to the situations mentioned above. Someone else's computer, private browser, etc.

But then don't you have to login to your web vault? Why not just login to your email? Unless a web vault is something specific I'm not familiar with that makes it simpler.

EDIT: Didn't realize parent was not same person as great-grandparent.

<comment><USER3> Well, yes, at some point I have to login to something.

However, my email password is stored in my password manager. I can't login to gmail unless I login to my web vault first.

If a third service requires me to click a link in my email, this becomes a semi-rediculous three steps: web vault → email → other service.

<comment><AUTHOR> Ah yes that makes sense. I wasn't considering that because my email password is one of the few I have memorized.

</comment></comment></comment></comment></comment></comment><comment><USER4> As others have mentioned there are apps in the wild that do this. I use a notes app Notion.so which does auth like this.

To be honest I didn't/don't like it because it's an extra step and I use a password manager anyway that makes it easy to fill in my passwords.

As I'm reflecting on it though, it's not that big of deal as I use the mobile and desktop apps which I'm signed into all the time. I would imagine if it were an app I had to log into again all the time or frequently I would be pretty annoyed with it.

<comment><USER5> Came to mention Notion.so too.

My email is a mess for I should switch between several work/home mailboxes — and from time to time I just have to wait for an email too.

This is one of the reasons I avoid launching Notion.so.

</comment></comment><comment><USER6> FWIW My bank here in the UK does this (Monzo) and I worked at a startup where we also implemented "magic link" to log in. It also seemed to fit nicely with a pre-account workflow idea that I'd had for one of my projects.

But... ignoring the potential security issue of trusting your email, which (like your post points out) most forgot-password routes do anyway, you then get onto usability.

Turns out some of our users really hated it, and couldn't get their heads around it. Including some key members of our snr. management team. Slack IIRC was originally magic-link only, but then reversed course later, and tbh -- even I find it frustrating when using it with my banking app. It's way slower than just having 1Password fill in the user/pwd details for me – as has been pointed out, it adds a cumbersome second step.

That said, I think it still has a place for places where the user won't necessarily need/want to create a "full account" but you can use it to at least do some email validation. Then if they want an account later, you can simply turn this "shadow" account into a full one by letting the user set a password, as that's really the only difference.

</comment><comment><USER7> I came to this post late but this is a terrible idea simply because of email. Now if you said push notifications to an app, Duo does this already and it's great.

I have personally logged into people's accounts simply by opening links sent in an email. It is routine to inspect URLs and attachments in emails, email is not confidential. Period.

You mentioned slack does this? Alright then, search for similar URLs in virustotal or any other public malware or spam URL repository and tell me how many slack accounts you can login to (assuming someone started the login and did not finish).

It's not just man in the middle attackers but many othet han and automated processes inspect email at most larger organizations.

I remember someone claiming an email security appliance vendor was "brute forcing" them,turns out they mass-emailed something with their URL in it and the appliances at different companies were detonating the URLs in different virtual environments to see if they cause anomalous behavior.

You can substitute 2FA with signal,telegram,matrix,push notification and I personally would have no problem with it.

<comment><AUTHOR> I agree I'd 100% prefer something like Duo if people were already acclimated, but I think we're 5-10 years away from that reality, if we ever get there.

But I think a lot of the risks you're talking about are mitigated by having the initial link/code expire in 5 minutes. Not completely removed, but mitigated. The risk profile isn't great but it's not any worse than an email- based password recovery flow.

> I remember someone claiming an email security appliance vendor was "brute > forcing" them,turns out they mass-emailed something with their URL in it and > the appliances at different companies were detonating the URLs in different > virtual environments to see if they cause anomalous behavior.

This is interesting. That might make prevent me from being able to make the codes single-use, which greatly increases the risk.

<comment><USER7> SMS is more secure than email. I challenge anyone to prove me wrong.

</comment></comment></comment><comment><USER8> It is just unreliable to depend on an external system and external UX to delegate the authentication on its whole. It is the cheapest way of delegate auth I think and has notable flaws. It can work.

1\. bad UX, extra email step. Every. Single. Time.

1.1 Sometimes email servers take a while to send/receive emails.

1.2. Constant flood of emails. Swipe to delete might be OK a few times, but at the end it is a user overload.

2\. No 2FA as with the process here, if added the process will get real very soon.

3\. you still need tokens for the session and prevent someone else steals the key and makes a double login (e.g. looking at someone screen)

4\. User might want to change email, so you auth system will need to implement real world UX sooner or later.

5\. Think like a business. When problems arise you might want to assist the customer in a personal way. What will happen when their email got compromised? 2FAA to the rescue?

<comment><USER9> To add a couple other thoughts off the top of my head:

Your login link now passes through one or more third parties (SMTP servers) which may or may not use TLS, and which may or may not have their certificates validated by each other. So technically a targeted MITM would be possible that would not have been possible with a normal HTTPS password authentication.

Also from a privacy standpoint, your email host and any relays involved now have a detailed record of every time you logged in.

</comment></comment><comment><USER10> Used this in the past to allow Kickstarter backers to access their pledges (set shipping address etc.). We only had emails which meant that ownership of the email identified them already as the sole owner of the pledge. There would have been no benefit to ask them to create an additional account. It actually had the benefit that we could control transfer of ownership because people couldn't simply give up their email to others to sell their pledge. They had to get in contact with our support to change the email.

Worked really well, I would do it again if the terms allow it. But I think as everything this is a case by case decision.

</comment><comment><USER11> First of all, what if you lose access to your email address? Now you can't access your service anymore?

Second, why use email? It's not secure. Depending on your threat model, it might not be a good idea.

What about a (phone) app associated to your email address that generates a short passphrase (think magic-wormhole style) every few minutes which will allow you to login to any associated service? (Caveat: one login per passphrase). Of course, now you need to make that app secure and compatible with login services..

<comment><USER3> > First of all, what if you lose access to your email address? Now you can't > access your service anymore?

Isn't this basically already true for all of the services that require two- step authentication?

I'm not saying this is a good state of things, per se, but at this point I've basically accepted that I can never change my email or phone number.

<comment><USER11> 2FA _could_ be via email, but is often with SMS / app on phone. There is a backup mechanism here with printed one-time-use numbers. This is not friction- less nor optimal in my view, but there is some backup.

The proposed login mechanism has no backup. Email address hacked, expired (new job, graduated from uni) or forgot password? You're out of luck.

<comment><AUTHOR> No explicit backup, but I think you're also assuming Google-level lack of customer service. If someone contacted me telling me they lost control of their email, there's a lot of steps I could take to help them out short of telling them tough luck and them never being able to access their account again.

<comment><USER3> This actually strikes me as a quite dangerous mindset! A lot of "hacked" accounts happen when someone tricks customer support. How, exactly, would you verify the customer's legitimacy?

<comment><USER12> By asking them their mother's maiden name, of course!

</comment></comment></comment></comment></comment></comment><comment><USER13> Just fyi, NIST is currently recommending against this flow. (I recently gave a talk about 2FA at BSidesSF, mentioned magic links via email, and after the talk a person from NIST came and pointed out that's against their recommendations.)

I personally believe they're taking more the "business" point of view, where users may have a business email which may not be very secure or always under their control.

For consumers I think it's ok, especially considering most of them use gmail. However this slows down login compared to other approaches like OAuth, so I'm not sure how applicable this may be at scale.

</comment><comment><USER14> I'd hate this. I'm using random strings as username and other random strings as passwords whenever allowed, my password manager keeps track of them. I have a physical backup of my password manager (two physical devices) which I keep synced, because I realize how screwed I am if I lost them.. I would prefer the option to set an "I do _NOT_ want to be able to reset my lost password" when creating an account.

</comment><comment><USER3> I'm inclined to like this. It makes sense for users who don't have a password manager.

But, OP should add an _option_ for users to add a password to their accounts, which could be used instead. It need not be a part of the standard user registration flow, just an option available in settings.

<comment><AUTHOR> I agree, but maybe encourage a U2F key option instead. I really like the idea of completely removing the possibility of password phishing.

<comment><USER3> Relying on a U2F key alone is single factor authentication. If a user is going through the very real/significant effort of using a U2F key, they presumably want/need real two factor authentication. That requires _two_ forms of authentication, generally something you know (a password) and something you have (a key).

</comment></comment></comment><comment><USER15> I think slack does this, you don't need to type in password, instead it emails you a temp link, you use that to open the client.

<comment><AUTHOR> I guess you're right. I was thinking they only do it for password reset, but you don't actually have to reset your password to use the link option.

</comment></comment><comment><USER16> How are they going to 'login'? If it's a link with a unique id associated with the email address, it's essentially a password that can't be changed.

The fact that a person will need to keep opening their email is really a deal breaker. Usage will drop off pretty quickly.

<comment><AUTHOR> The email is the unique id.

</comment></comment><comment><USER17> Please don't assume that people can correctly enter their email address on a regular basis[0]. I get several emails per month that someone else with the same family name requested.

[0] [https://xkcd.com/1279/](https://xkcd.com/1279/)

<comment><USER18> My mother currently has 8 entries in the alias file for this very reason.

</comment></comment><comment><USER19> Papa Johns does this, I think they call it a quick login.</comment>


I Became a Savant For a Day - <AUTHOR> http://www.nytimes.com/2003/06/22/magazine/22SAVANT.html?ex=1371614400&en=0497e5b30fc4a9d8&ei=5007&

<comment><USER2> This article is from 2003... would be cool to get an update.

Here's the news page of the "Centre for the mind" (but it's mostly about media coverage): <http://www.centreforthemind.com/newsmedia/WHATSHOT/index.cfm>

And Wikipedia on the technology (with no mention of temporary savantism): [http://en.wikipedia.org/wiki/Transcranial_magnetic_stimulati...](http://en.wikipedia.org/wiki/Transcranial_magnetic_stimulation)

<comment><USER3> Thanks for pointing that out, I was reading the article on the tram this morning and didn't notice the age of the article. It would be very interesting to see if there have been additional research done, or if other teams have been performing research to help verify the early results Snyder found.

</comment></comment><comment><USER4> _"You're not going to be damaged," he said. "You're going to be enhanced."_

That sounds just like a pre-supervillain scenario in just about every superhero movie I've seen.

<comment><USER5> "You're not going to be damaged," he said. "You're going to be enhanced."

Is that about whiskey, isn't it? =)

</comment></comment><comment><USER6> Apparently, a Medtronic MagPro Compact's street price is around $1000* . I might try to find me one.

* [https://www.medwow.com/item.php?search_results=&sale_id=...](https://www.medwow.com/item.php?search_results=&sale_id=525012022&xlang=)

<comment><USER7> Who wants to start a business? A legal "high" for $25. I know I would pay $25 to try this thing out and I bet hundreds of people in any given town would too. Only takes 40 people to recoup the cost of the machine.

<comment><USER8> Hire a damn good attorney.

<comment><USER9> Or just take an ordinary attorney and TMS him...

<comment><USER10> But you'll have to do that recursively..

</comment></comment></comment></comment></comment><comment><USER11> I'm reading On Intelligence by Jeff Hawkins, which is about how the human brain thinks (with the angle of replicating this as artificial intelligence).

In brief, the neocortex has layers. Inputs from senses arrive at the lowest layer, and the data is propagated upwards through the layers to the top, where inputs from different senses are combined and - simplifying my already simple understanding massively - decisions are made. At the lowest layer of the hierarchy, if it is a visual input, it could be a fragment of a line. This could be combined with neighboring inputs to be an eye, and with more inputs, even further up the hierarchy, to be the face you're looking at.

Importantly, data runs down the hierarchy too. This is your brain making predictions of what to see, hear, feel, etc. Suppose someone says "my hands are cold so I'll put on my dloves" (not a typo). Say this to an English speaker and they will hear "gloves"; their mind has predicted the word "gloves" from context and experience (some Eastern European speakers won't be fooled, since their languages do have the "dl" sound). Or if you're listening to a song, your mind is primed to hear the next note at the right time. If I understand it correctly, cortical columns in some regions basically transmit the signal "song going as expected" - just passing up a summary, not the details. If you hear a wrong note, the prediction fails, and the details get passed up to the next layers instead.

It occurs to me that some of the abilities described might be the result of impairing the prediction mechanism. Qualities of autistic people/savants/TMS- enhanced people were mentioned in the article: -Being unable to recognize the same area when subtle details like shadows were altered. -Being able to draw accurately -Being able to count hundreds of matchsticks.

As mentioned in other comments, accurate drawing requires us to _not_ use the mental categorization we're so used to. Without the prediction mechanism, maybe the details of the inputs propagate higher in the hierarchy, closer to what we might consider consciousness. Similarly, counting matchsticks might require us not to group a heap of matchsticks into "a heap of matchsticks" but instead still see each individual matchstick.

But I Am Not A Neurologist.

<comment><USER12> As I discovered as a child, English speakers tend to hear "dl" as "gl" even absent any semantic-level clues; words like "dleebs" and "dlabs" get interpreted as "gleebs" and "glabs". Even the single level above the raw phonemes, containing the phonology of English, is enough.

...and really that's unavoidable. Absent aspiration, the difference between the /k/ of "sick" and the /t/ of "sit" is not contained in the /k/ or /t/ itself (almost no sound is being emitted during that time) but rather in the offglide of the vowel.

</comment></comment><comment><USER13> This badly needs to go through the research checklist "Warning Signs in Experimental Design and Interpretation" by Peter Norvig (director of research at Google).

<http://norvig.com/experiment-design.html>

<comment><USER14> This is not and was not intended to be about "research". This is something that has already been so well researched that it can be casually demonstrated on demand to a journalist with no significant concern that it will fail to impress. This was "mere engineering".

The research has already been done; I've been reading about this for a couple of years now. It's not fringe science. Cutting-edge, maybe, but not fringe.

</comment></comment><comment><USER15> "But 'on the machine,' he says, 'you start seeing what's actually there, not what you think is there.'"

In the world outside the machine and his experiments, I like how this statement ties in with Zen/meditation/Mihály Csíkszentmihályi's concept of Flow. I think we can all think of times when we've just been totally aware and immersed. But those are few compared to the too-many times when I've been thinking too much, worrying, and not being aware.

<comment><USER16> This also reminds me of the fact that the reason most people can't draw is because they don't really see their visual field, instead they translate it into a series of symbols representing physical information. It makes sense since that is the higher survival purpose of vision (ie. it makes more sense to know how big something actually is than how big it appears in your field of vision). That also explains why it took until the Renaissance for art to achieve any kind of realistic perspective. Most people's relative lack of drawing ability is really just a lack of understanding how to see. Fortunately there are numerous exercises which you can use to break through that barrier and eventually learn to see as an artist, one good one is drawing the negative space around a still life. Of course you still need your 10,000 hours to actually master drawing, but I don't think talent has much to do with the initial learning curve.

It's unfortunate that most people give up drawing at a young age when the fundamental difficulty of "seeing" properly is conflated with manual dexterity issues.

<comment><USER15> What do you think of this book?

"The New Drawing on the Right Side of the Brain" by Betty Edwards.

Has glowing testimonials like: "I have a degree in commercial art and learned more about drawing from this book than I did in four years of undergraduate instruction. If you practice everyday what Ms. Edwards teaches you will be drawing as good as any professional artist in six months. This really is the best book on drawing ever published!"

[http://www.amazon.com/New-Drawing-Right-Side- Brain/dp/087477...](http://www.amazon.com/New-Drawing-Right-Side- Brain/dp/0874774241)

<http://www.drawright.com/>

<comment><USER16> I think one of my undergrad drawing teachers incorporated elements from this book in her lesson plan, but I've never read it myself.

It strikes me that different people need different approaches to learn how to make the mental shift. The very fact that it's a right-brained thing means it's impossible to give someone a process. You can explain it at a meta-level, but I think the only thing that really produces the desired result is some sort of suggestive technique--like a koan.

<comment><USER15> One of my artist friends has always told me that 'Drawing is about learning to see.'

I am starting to believe him. Since I do fantasize about being able to pull out a sketchpad in a public park and draw convincingly and/or do caricatures, I've ordered the book. I feel like I can be open to a non-traditional approach.

Just ordered the book along with another book I've always wanted to get 'Impro by Keith Johnstone'

</comment></comment></comment></comment></comment><comment><USER17> Amazing!

I've often wondered whether it would be possible to temporarily re-engineer myself into a tool for solving a specific hard problem.

I'm just re-reading On Lisp, and I'm struck by the similarity to the bottom-up programming paradigm. You build the language up to your problem, as well as breaking the problem down to your language.

This reminds me of the Focused in Vernor Vinge's A Deepness in the Sky. In that case, they were no better than slaves, but one could imagine voluntary focusing. Like the book's protagonist, I was at once horrified by the conditions of the subjects, but thrilled by the prospect of human automation.

<comment><USER18> It's generally a bad idea to give away major plot points of a story without first providing a spoiler warning.

<comment><USER17> This so-called spoiler is on the back cover.

The book is full of surprises, of which that's one of the least. Oh, did I say too much?

In any case, I'd be more interested in discussions of my main points.

</comment></comment></comment><comment><USER19> For those curious about mescaline (mentioned in the article) and how it supposedly removes mental filters to allow you to see the world "as it is", I recommend Aldus Huxley's Doors of Perception.

<http://mescaline.com/huxley.htm>

</comment><comment><USER20> Why not do it in reverse order? First drawing with the machine and then without.

<comment><USER21> Or better yet, have a control test. Tell a person their mental faculties will be enhanced, but don't actually run the test. See if just that knowledge increases their ability.

<comment><USER22> I'm sure the scientists behind this are on top of that. Just does not make sense for someone writing an article to be part of the control group.

<comment><USER21> Fair enough, but the article doesn't mention control tests at all. The "transcranial magnetic stimulator" is touted as voodoo magic.

I feel like I just read a 3a.m. infomercial.

<comment><USER23> It's the New York Times. That's what they do.

</comment></comment></comment></comment></comment><comment><USER24> I often have instantaneous insights that take minutes (or months) to understand conceptually. Maybe it's a temporary connection to the raw data?

</comment><comment><USER25> Since a computer based singularity is not arriving, I wonder if a human one might - can you imagine if this got good enough that large numbers of people were using it routinely?

*I am aware that that would not meet the typical definition of singularity. I'm referring more to a leap in technology, then technology inventing itself.

</comment><comment><USER26> "A bird in the hand is worth two in the the bush"

I could find the double 'the' at first sight - am I a savant or what?

<comment><USER27> I could too, but I think I've just been exposed to this trick too often.

</comment></comment><comment><USER28> Don't try this at home.

<http://transcenmentalism.org/OpenStim/tiki-index.php>

</comment><comment><USER29> Why didn't he draw 4 different common animals instead of the same one 4 times?

</comment><comment><USER30> Some of it sounds wishfull thinking and widely exagerated.

"I'm not sure I see how TMS can actually alter the way your brain works" Thats a renown scientist apparantly. Has he not read about the experiments that the main scientist has been doing. WHy can he not see how TMS can alter the way our brain works. How can these renowned scientists not believe the work that the times is reporting, whats wrong with it, why is the times not saying anything about the seemingly contradictory reporting of the views of these scientists?

</comment><comment><USER5> The simple idea that less is more (in terms of so-called brainpower) is as old as the world itself. The cows are holy animals in India because people belive that they are wise. Buddha told that you should cease all your mental activities to gain ability to see the things as they are. It is why Buddhas eyes is half-shut. And every one know that 100% idle is better (allows faster responce) than 100% load. =) Just think that computer is a weak and primitive model of our neourology.

</comment><comment><USER5> _By shutting down certain mental functions -- the capacity to think conceptually, categorically, contextually -- did this impairment allow other mental functions to flourish? Could brain damage, in short, actually make you brilliant?_

isn't cannabis works the same way?! =)

<comment><USER31> Apparently not :\

<comment><USER5> ..and your sources are..? =)</comment></comment></comment>


Less thinking. More testing. - <AUTHOR> http://stevereads.com/weblog/2010/05/22/less-thinking-more-testing/ <comment><USER2> > I no longer trust long chains of reasoning from seemingly self-evident low- > level principles.

The correct principle is not to "trust" long chains of reasoning which one doesn't understand in their entirety, especially ones with strong conclusions. The problem here isn't long chains of reasoning (we could hardly do without any of those), but rather failure to hold them to high standards in how understandable they are, and failure to put in the effort to understand the whole thing before accepting it.

<comment><USER3> Quite often a person believes they understand something when they don't. In this case, no amount of exhortation to understand the chain of reasoning will help. Unfortunately, I think there's a false dichotomy here; you have to understand the problem well enough to write useful tests, and if you don't understand a failure mode, you're probably not going to write anything to test it.

</comment></comment><comment><USER4> I had a thought along the following lines: if I have test cases for a feature, it would be really cool if I have an engine which can figure out code to satisfy thoses tests. I.e. I define the contract; the computer figures out how to solve. Kinda like Simonyi's intentional programming. Is anybody working on something in this area?

<comment><USER5> I did a thesis that explored aspects of generating code that passed tests, but it was limited to deriving adequate structural representations based on behavioural specifications.

Two approaches were shown: changing data structure representations to meet requirements and generating class structure/hierarchy. The thesis showed that it is possible to do this and how to do it, but it is a huge topic.

If you're interested, I'll put more effort into making my thesis available online in HTML format. In the meantime, you can get it in a variety of places.

[http://duckduckgo.com/?q=Structuring%20Data%20via%20Behaviou...](http://duckduckgo.com/?q=Structuring%20Data%20via%20Behavioural%20Synthesis)

Incidentally, generating behavioural elements (like entire functions) to pass tests would be very difficult although I have been toying with ways to try it out.

</comment></comment><comment><USER6> Because this article covers a lot of ground, it really struck me that the term _testing_ is ambiguous: it can mean _unit-testing_ or _user-testing_.

In prototyping _sprints_ , TDD seems to acknowledge that unit-testing slows you down and creates rigidity, and therefore encourages you to just get the basic thing working without unit tests. You can throw it away, or fundamentally change the outcome, or the architecture, or the structure of the code. _User-testing_ is how you test a prototype (including just playing with it yourself).

But in building a codebase that you will live with for sometime, that will be built-on and modified and bug-fixed and tweaked, _unit-testing_ becomes really helpful.

</comment><comment><USER7> creating a situation where users are separated into two different groups and then making a single variable different for each groups can indicate the effects of the variable given a large enough group size

but taking that experience and applying it to history where many things are changing and where you cannot separate everyone into 2 different groups will not necessarily tell you anything about one arbitrarily selected variable.

</comment><comment><USER8> "Talk doesn't cook rice."</comment>


Why Web 2.0 Is No Bubble: Corporations Are Willing to Pay for It - <AUTHOR> http://conversationstarter.hbsp.com/groundswell/2008/06/web_20_is_no_bubble_and_heres.html

<comment><USER2> I'm working for a large corporation right now and can definitely see the demand for Web 2.0 in business, especially in communication tools and Software-as-a-Service.</comment>


Why do most public toilet doors open inwards? - <AUTHOR> http://ux.stackexchange.com/q/18238/7235 <comment><USER3> It is interesting how the oddest topics sometimes make the HN front page.

I think the real question here isn't why bathroom doors open in or out. The question should be: Why aren't hand washing facilities just outside the bathroom?

Wouldn't you feel better if you actually saw the cook at the restaurant washing his hands when exiting the bathroom? Also, social pressure would probably cause more people to clean-up.

Just one of those "outside the box" thoughts.

<comment><USER4> if you have a manual misadventure and end up with poo on your finger, do you really want to be dancing out into public with it held out in front of you?

<comment><USER5> I'm guessing the washrooms in your area don't have sanitary paper(toilet paper).

<comment><USER4> I don't mean that it's dripping with poo. I mean that you've wiped it with paper and it still needs a wash. In this case, you're not going to be using your hand normally, picking up your things or putting it in your pocket, are you?

<comment><USER5> I gotta ask. After you wipe you still have your smartphone in your hands don't you.

</comment></comment></comment></comment></comment><comment><USER6> In the UK doors almost always open inwards. From the more public area to the less public area. I always figured this was for safety so you don't hit people in the more public area when opening the door. The comments on the linked site also indicate this could be to stop the possibility of the door being blocked from the outside.

Interestingly, in Finland, in my experience it's the opposite - <USER2> everything opens outwards. Which is surprising considering the much higher probability of being snowed in and not being able to push the door out.

<comment><USER7> In France, virtually all public areas have doors that open outwards. To the best of my knowledge, there is no law that make this mandatory, but the reasoning is that in case of an event that requires evacuation, doors that open inwards would trap people inside, whereas doors that open outwards would let them go outside.

<comment><USER8> The european building codes (Euro Code) recommend public areas have doors opening outwards. This is not a (european) binding law, it's a recommendation.

National building codes can make this law.

In Belgium, your building-permit contains a clause you need approval from the city fire-department. They send a fireman that has to check the safety of your building. If it's a public building, your main exit doors must be opening outwards, for evacuation purposes. But they don't care about the toilet door ...

Interesting fact in the same context: in the case of an emergency, your elevator would not be available and you should use the staircase. It is required by the same set of laws that if you follow the staircase all the way down, you have to end up at the ground floor, not in the basement. This is accomplished most of the time by adding another corner or a door to get to the basement level. Additionally, this door MUST open towards the staircase, so confused, scared people don't accidentally go through this door and end up in the basement.

(The fireman check emergency-sings & lightning, exit-routes, if there are fire extinguisher available in accessible places, ... If they find any violations, you get a grace period to fix things. Your building permit is actually revoked if you don't resolve the issues. I'm not sure what the consequences are actually ?)

<comment><USER9> > Interesting fact in the same context: in the case of an emergency, your > elevator would not be available and you should use the staircase. It is > required by the same set of laws that if you follow the staircase all the > way down, you have to end up at the ground floor, not in the basement. This > is accomplished most of the time by adding another corner or a door to get > to the basement level. Additionally, this door MUST open towards the > staircase, so confused, scared people don't accidentally go through this > door and end up in the basement.

One of the previous places I worked, we had a fireman talk us through the emergency procedures for the building at one point, and he recounted how it was relatively common for them to find dead people immediately inside exits that were locked, but where the key was in the door, or that opened the wrong way, or in other situations where anyone would've trivially gotten out in seconds in normal conditions, as a way of illustrating just how confusion and fear or carbon monoxide/lack of oxygen would sometimes make people totally unable to overcome even the most basic obstacles during a fire.

</comment></comment></comment></comment><comment><USER10> I'm disappointed. I thought this was going to be about why stall doors always open toward the actual toilet. And I thought the accepted answer was going to be so the user can hold the broken door closed with his foot.

<comment><USER11> From the headline I thought that might be the topic, also.

Your theory is good, but I suspect the main reason for stall-doors to open-in is to prevent the door swinging-out to collide with other people, as with the dominant explanation for the full-bathroom door. This is likely an even bigger concern in typically cramped bathrooms than the entry hallways.

Also, to the extent that stall walls/doors are often generic hardware, reused in many cramped spaces, having the doors open inward may give designers more confidence that the swinging of the door is not obstructed by local constraints. (Allocating the rectangle footprint for the stall ensures entry works, as opposed to allocating the rectangle-plus-outward-swinging-door- semicircle).

Another lesser consideration might be that an inward-swinging door makes occupancy by more than one person somewhat more difficult.

</comment></comment><comment><USER12> As an architect, the confidence and speed with which these 'UI'-people put forward half-baked (and mostly-incorrect) ideas is both heartening and disheartening.

A better question which I'm yet to find a good answer for - why do American's feel the need to fill their toilets to the brim with water as opposed to everywhere else in the world?

<comment><USER13> I think the German "Poo Shelf" toilets are weirder [1] [2]. I heard this was because of the large quantites of Pork consumed, and the need to check for worms.

No wonder Veronica Moser (NSFW!!) is so popular in Germany.

[1] [http://en.wikipedia.org/wiki/Flush_toilet#Reverse_bowl_desig...](http://en.wikipedia.org/wiki/Flush_toilet#Reverse_bowl_design_.28Flachsp.C3.BCler.29) [2] [http://www.spiegel.de/international/hold-your-nose-toilet- sh...](http://www.spiegel.de/international/hold-your-nose-toilet-shelf-on- trial-a-406547.html)

<comment><USER14> Hah, there was a toilet like that in our hotel in Budapest, and I was wondering what that's for! It seems like nobody knows of a reason, other than "to gross you out".

</comment></comment></comment><comment><USER15> While it's not the main problem he's talking about, I think Marco Arment blogged a related solution for this. Here's the link, <http://www.marco.org/2012/02/25/right-vs-pragmatic>. It's a great post guys, I encourage you to read it. :)

</comment><comment><USER16> This has already been solved to the satisfaction of germaphobes in virtually all US airports. It is also the norm in public sports venues.

...no doors.

</comment><comment><USER17> I prefer public toilets that have no door at all.

<comment><USER18> I don't know how to take this (joke, irony or genuine) but that's a good example of thinking outside the box vs focusing too much on the apparent cause of the problem. Designing the restroom so that there's a corner obscuring the view solves all problems.

<comment><USER19> but without a door, you can't guarentee that the stall is private, and anyone could just walk in while you do your business - a rather unpleasant thought.

<comment><USER20> I think they're talking about the big room containing all the stalls, not the individual stalls themselves.

</comment></comment></comment></comment><comment><USER21> The Toepener lets you open the door with your foot - <http://www.toepener.com/> .

<comment><AUTHOR> Brilliant, all that's left is to install the device on the door before entering the bathroom, then remove it when leaving. Just make sure you bring a drill and some screws when going to the bathroom.

</comment></comment><comment><USER22> Bathroom doors are lockable so that the bathroom can be closed; ordinary single doors that can be locked swing away from the locked-out side so that the jamb and hinges are on the correct side.

</comment><comment><USER23> I usually avoid using the handle and open the door by pulling on the top of the door. Even when I open a door, I try to pick a place that's least likely to be used by other people.

<comment><USER24> What if everyone all thinks like that and pick the same spot as you.

</comment></comment><comment><USER25> for toilet, people usually hurry in, but not so hurry out.

</comment><comment><USER13> What I have always wondered is why USA toilet stalls are so lacking in privacy with massive gaps round the doors where you can see the occupants.

In the UK you usually can't be observed without someone sticking their head over/under the partition.

<comment><USER26> People in my office hang toilet paper down like crepe streamers to cover the "gap". It's a little disconcerting sometimes, I'm not sure why that's a design choice. Perhaps to get a glimpse of whether someone's in there or not without actually seeing what's going on?

</comment></comment><comment><USER27> What interests me more is: Why are the free/occupied indicators on those doors always so small?

Especially since the light in rest rooms are usually insufficiently bright to distinguish between red and green.

<comment><USER28> I can't say I've ever noticed difficulty distinguishing green and red in anything short of "full moon" light levels. Is it possible that you are partially colorblind? It is fairly common among men, which really should make us wonder why we use red/green at all...

<comment><USER29> In Finland it's usually red/white. I'm sure I'm speaking on behalf of all the red-green colorblind people when I say I'm very pleased by this.

</comment></comment></comment><comment> slash-dot It's because of fire safety codes. When doors open outwards it is easier to evacuate the building of panicking people

</comment><comment><USER30> They are generally easier to kick in if they open inwards. Might be part of the reason.</comment>


Hands on with the iPhone 7 Plus' crazy new Portrait mode - <AUTHOR> https://techcrunch.com/2016/09/21/hands-on-with-the-iphone-7-plus-crazy-new-portrait-mode/ <comment><USER2> It's not so crazy. I think this attempt at fake bokeh doesn't look so good. Real bokeh is much better than that.

<comment><AUTHOR> If it's good enough for Stu Maschwitz, it's good enough for me.

[https://twitter.com/5tu/status/778670689930752000](https://twitter.com/5tu/status/778670689930752000)

<comment><USER2> Well, I only judged by scaled down web photos, maybe it's the compression artifacts. But real bokeh seems to do something else than gaussian blur. For example,

> A small light source will be rendered as an aperture shaped figure with > quite well defined edges in bokeh; but gaussian blur renders it as a spot > with fading edges. In bokeh, noise is present at the same level as in in > focus parts of image with same luminance; gaussian blur kills noise, so > there'll be less noise than in non blurred parts of image. In bokeh, light > areas will dominate over dark ones, while gaussian blur preserves the ratio > of dark light areas.

Source: [https://photo.stackexchange.com/questions/21459/whats-the- di...](https://photo.stackexchange.com/questions/21459/whats-the-difference- between-bokeh-and-gaussian-blur)</comment></comment></comment>


Ask HN: Is University of Waterloo a Reputable University in the United States? - <AUTHOR> I've always thought of Canadian universities as having sort of a reputation for being much lesser than those in the US. However, after reading posts here for a while, I've been surprised at the number of mentions of Waterloo. Is it well known outside of Canada for its CS program? <comment><USER2> Yes, that is generally considered a good school, but is not widely known like the Ivy League</comment>


Introducing Tera, a template engine in Rust - <AUTHOR> https://blog.wearewizards.io/introducing-tera-a-template-engine-in-rust <comment><USER2> As someone who spent way too much time building Django inspired template engines (Jinja, Jinja2, Twig, etc.) I must say this is really cool and very close to what I wanted to build myself for Rust but did not have the time.

> Tera uses serde which means that in the example above

Very good. But serde needs to get stable :(

> beautiful html output out of the box (ie no need for the {{- tags)

This is a request that comes up often but I tested this so much and always came back to not doing magic. It breaks too many applications in unintended ways (particularly plain text output).

> able to register new tags easily like the {% url ... %} in Django

I would not do that again. Jinja has an extension interface and I regret adding it. I much rather have people just expose functions to the templates. That said, in Rust that might be not a good idea because there are no keyword arguments so make it makes sense there.

> no macros or other complex logic in the template […] include partial > templates

Another thing i strongly disagree with but I can see the motivation. Macros in Jinja I prefer so much over includes because it becomes clear what values exist. Includes become really messy unless you are very organized. Macros (which are just functions) accept the parameters and it becomes clear what the thing does. Just look at that macro as an example: [https://github.com/pallets/website/blob/master/templates/mac...](https://github.com/pallets/website/blob/master/templates/macros/navigation.html)

It's absolutely clear what it accepts as parameters. If that was a partial include the "caller" needs to set up the variables appropriately and there is no clear documentation on what the template wants etc.

But awesome to see this happen for Rust!

<comment><USER3> > Very good. But serde needs to get stable :(

I agree :(

> This is a request that comes up often but I tested this so much and always > came back to not doing magic. It breaks too many applications in unintended > ways (particularly plain text output).

That was even the first feature request I got. I don't think I'll go more into magic than what it currently is, seems to be okay-ish

> I would not do that again. Jinja has an extension interface and I regret > adding it. I much rather have people just expose functions to the templates. > That said, in Rust that might be not a good idea because there are no > keyword arguments so make it makes sense there.

That was my first thought on a better way to do template tags but not sure how to do that in Rust. If anyone has an idea, there's [https://github.com/Keats/tera/issues/23](https://github.com/Keats/tera/issues/23) now

Good point about macros, maybe I can have a look later. Macros and include feel like they fill the same spot in my mind in terms of features so I'd rather not have both.

<comment><USER4> > Good point about macros, maybe I can have a look later. Macros and include > feel like they fill the same spot in my mind in terms of features so I'd > rather not have both.

You could always repurpose includes as _imports_ , i.e. not generate any output from imports, but to allow their use as purely an organizational tool for importing macros.

</comment></comment></comment><comment><USER5> I've been expermenting with Mustache under the hood lately, so I'm interested in template implementations. It seems odd, you've chosen an odd middle-ground of "support arithmetic" and "no real heavy logic".

Having played with the subject a few times, I've come to the general feeling that it's best to choose a hard line on one side or the other - either the mustache "pure logicless" or just do straight string interpolation (assuming the language provides a good syntax for multi-line string interpolation - C# _almost_ does except that you have to escape all your quotes. Dunno if other languages to better).

Any particular reason why you chose to support _some_ logic instead of none or all?

<comment><USER6> Do you know if the quote escape is still required with C# 6 interpolation?

<comment><USER5> C#6 string interpolation is glorious, but if you use the multiline

        var myString = $@"
        Hey, string interpolation is nifty.
        Look ma, no { this.Hands.ToString().ToUpper() }
        More text.
        But this is a ""quote"".  It's ""ugly"" isn't it?
        ";

As you can see, you need to double your double quotes to escape them. Almost perfect. You can even nest string interpolations to do next template stuff with functional-programming loops and whatnot.

<comment><USER7> Scala seems to do what you want:

        val str = s"""
          Tripe quoted string interpolation
          Allows for $variables and ${method.foo(bar)}
          Mixed with "quotes"
        """

Can also use double quoted string interpolation for inline/one-liners where embedded quotes above aren't needed.

<comment><USER5> Neat! With facilities like that, Id be tempted to skip templating libraries altogether and just have a normal interface for templates and use the regular string expressions... Unless I needed then internationalized, and that's where Mustache shines, IMHO.

</comment></comment></comment></comment></comment><comment><USER8> After using many templating systems over the years, I'm sold on the opposite approach of embedding (a description of) the output language in the host language, rather than trying to embed logic in the output language. Think React or Scalatags. Logic becomes trivial, because it's the logic of the host language. And the output can be the output language, directly, or some other data structure (VDOM, in the case of React).

It's similar to the concept of the free monad [1].

[1] [http://underscore.io/blog/posts/2015/04/14/free-monads- are-s...](http://underscore.io/blog/posts/2015/04/14/free-monads-are- simple.html)

</comment><comment><USER9> Clean, meaningful syntax! Great job!

Edit: Why spread the ugliness of "endif" and "endblock"? Why not just "end"? Why have the unnatural "elif" as well?

<comment><USER2> > Edit: Why spread the ugliness of "endif" and "endblock"? Why not just "end"? > Why have the unnatural "elif" as well?

Not the developer but I did not remove endif for twig or jinja either coming from Django. Reasons for it: it becomes a lot more readable in the templates and it avoids lots of debug headache due to accidentally deleting things. It's already hard enough to debug template code sometimes but this way at least it's very quickly clear what the problem is.

What would you use instead of elif? `{% else if %}` is in no way nicer than `{% elif %}`. I picked `elif` in Jinja because it's what Python uses and that's where Jinja is at home.

<comment><USER3> I was about to reply exactly that, thanks!

<comment><USER9> You have to indent anyway. Then "endblock" becomes redundant. Also, you can't have a blank "{% elif %}" \- it needs to be followed by a condition. I think a more natural and English-like syntax beats having to memorize deviations.

</comment></comment></comment></comment><comment><USER10> Why add the requirement of naming the end tags? Seems like a relatively small change except if your trying to re-use templates everywhere

<comment><USER3> Just for the sake of readability. At a previous job we had pretty huge templates and I would forget the name of the block by the time I reached the end

<comment><USER9> Give people an option. I prefer "end" \- make "endblock" work like "end", but check nesting.</comment></comment></comment>


Love Affair with Mozambique's Once-Ravaged Gorongosa National Park - <AUTHOR> http://nautil.us/issue/28/2050/ingenious-greg-carr <comment><USER2> My university (Universidade de Coimbra) is creating a partnership with this park to start prospecting for paleoanthropological excavation sites. It's one of the last unexplored places in Africa with an enormous potential for finding hominid remains just like the recent Homo naledi in South Africa. And it really is a beautiful place and the country deserves its share of prosperity after so many years of civil war, cheers to that guy he has a great vision for the future of Africa.

</comment><comment><USER3> Went to high school with Carr. Delightful guy. Spending his tech fortune and last half of his life on something that matters. Looks a lot younger than his 56 years.

</comment><comment><USER4> Very inspiring interview. I do not think 50% of Earth dedicated to the preservation of life is too much, not at all.</comment>


SQL Injection Wiki - <AUTHOR> https://sqlwiki.netspi.com/ <comment><USER2> The only successful SQL injection attack I've encountered in the wild was interesting, because the injection point had no visible output. But by injecting timing calls (eg "SLEEP()") and appropriate conditionals, the attacker was able to extract a few bits of information each request. Their script executed some tens of thousands of requests, and they managed to extract all the table names, and start to extract data from our "users" table.

In retrospect such an attack is obvious, and presumably tools like metasploit make them trivial to execute. But previously I'd had the idea that SQL injection was usually "literal raw data output".

<comment><USER3> You should take a look at [https://sqlmap.org](https://sqlmap.org) : this tool runs SQL attacks with « raw data output » as you say, but also without outputs (Blind SQL injections).

<comment><USER4> I'm getting SSL errors on that link: it is presenting GitHub's wildcard certificate which obviously doesn't match.

The site is accessible as plain http (or https if you skip the warnings, of course).

<comment><USER5> I thought that was sketchy too but it occurred to me that they probably are hosting this site with github but are using their own domain name.

sqlmap.org turns out to me an A record for an IP address owned by github.

<comment><USER4> _> it occurred to me that they probably are hosting this site with github but are using their own domain name_

That is exactly what they are doing, and in itself this is not at all a problem.

But presumably the link worked for the original poster, so either there is a dynamic DNS problem (we are being sent to an address that serves the _.github.com certificate an not the "right" one but he was sent somewhere that does have a certificate for that name) _or* someone is resigning content and his machine is set to trust their CA certificate. This latter cause could be normal/expected (his company having a MiTM policy for regulatory monitoring reasons) or his machine could be cracked by an external entity.

</comment></comment></comment></comment></comment><comment><USER6> Universities and managers must do a little bit of torture, spanking and ruler on the knuckles every time they see a student or a new dev not parameterize a query. It must become a reflex like watching for cars before crossing a street.

<comment><USER7> Some weeks ago an experience developer said to me: "Parameterize a query? Since years i don't care about it, because ORMs like Doctrine or Sequelize take care of that"... So it's not only students or new devs who should watch out, because even ORMs can open up SQL injections.

<comment><USER8> Rails is well know for this. Here is a nice page listing common ones: [https://rails-sqli.org/](https://rails-sqli.org/)

</comment></comment></comment><comment><USER9> When I did firewall/network support for managed hosting customers, the number of customers' custom/vendor apps that were vulnerable (and exploited!) by SQL injection attacks was astounding. Of course the very first thing they said was "but we have a firewall, why can't you ACL it?" Sorry, your Cisco ASA doesn't work that way. It's like people never expected their code to run in a hostile world.

<comment><USER10> It's because they don't. Two things I've found in less than a year of working in the security industry is that people only care if things work, not if they work well and, that they either believe security can be delegated or that they will never be attacked because they're special in some way.

</comment></comment><comment><USER11> > Javascript is required for viewing, please enable.

Someone should tell them about _progressive enhancement_.

</comment><comment><USER12> A common refrain from developers I hear is, "They can't inject SQL...the database is read-only."

Unfortunately, SQL Injection is a misnomer.

<comment><USER13> Is it a misnomer? "Injection" is not because you're injecting data, it's because you're injecting commands.

</comment></comment><comment><USER14> It seems that PostgreSQL is missing from this cheat sheet. Does anyone know why?

<comment><USER15> Hey Esnard! I'm one of the people who worked on the wiki at NetSPI. We're planning on adding more DBMSs in the near future. Was there anything specific you're looking for about PostgreSQL?

<comment><USER14> Hey! Thanks for replying. Nothing specific, I just find more and more apps using PostgreSQL in the wild, so I was just curious about its absence. Thanks for your work on the wiki. I'm going to use it a lot. :)</comment></comment></comment>


Firing mods and forced relicensing - <AUTHOR> https://meta.stackexchange.com/questions/333965/firing-mods-and-forced-relicensing-is-stack-exchange-still-interested-in-cooper <comment><USER2> I have an old coworker who works at Github now. He was on a date with a co- worker from another group (and another state) at a town hall. He at a bar after work, and 2 women who worked at github seen them flirt with each other, and reported him to HR.

HR made him sign a form that he wouldn't date co-workers, even if in another group. (Him only)

There was no rule against dating, but that didnt stop HR from getting into his life. If things are this bad at HR, I cant imagine the rules all over the place.

</comment><comment><USER3> Yet another company and community trainwreck caused by toxic individuals pushing agenda at the expense of everything else. Companies haven't yet learned to nip this in the bud, but they have learned to move on(GitHub). I expect some people will be leaving SE before long here..

<comment><USER4> More a demonstration that there is no such thing as "political vacuum" or "apolitical", eventually someone will manage to shove their own petty identity politics in any community at its expense. And it is just the beginning.

I predict that in a few years, people who disagree with this or that thing publicly on a unrelated social media platform and can be linked to their SO profile will get kicked out of the website because they are deemed to create an "unsafe and distressful environment for underprivileged groups".

</comment></comment><comment><USER5> The title is confusing, can it be changed?

There is no "forced GPL", they are still using a Creative Commons license although there are legal problems with their attempt to retroactively relicense some of it from 3.0 to 4.0.

</comment><comment><USER6> I like the idea of StackOverflow, hell I even like trying to answer a question from time-to-time... but I really hate StackOverflow.

There's this sort of like weird hierarchy on the site of people who essentially are there, to climb over others, socialize, and enforce their metaphorical "wet-dreams" of fatous pedantry to its absolute maximum.

1.) Lately, as I've been re-upping my frontend skills, I see questions from n00bs are totally shit on by moderators pointing to answers which are totally overkill, or nearly-incomprehensible for them sweet lil' baby n00bs...

2.) Related to #1, linked-to answers are often times incomplete or wrong because of outdated information, but newer versions are marked dupes... I can't imagine how many people new to JavaScript, probably spend the first year reading shit that literally doesn't work or hasn't been needed since 2011 because of an answer on StackOverflow.

3.) Edits for quite literally no reason. People will change the language of things to sometimes be flat-out incorrect ~5-10% of the time, and the other ~90% its purely cosmetic illustrating only the moderator's aforementioned lust for pedantry.

4.) Comments and suggestions which are clearly outside of scope. Personal example from this weekend.

I posted an answer to someone who I could tell was quite new due to their very strange looking HTML (which works, but wasn't semantically correct) and JS asking about how to bind an event to an element (a span). I replied with with how to bind their event, and had quite consciously decided against mentioning their usage of HTML could be better because I don't want to overwhelm them. I've taught folks before and too much information isn't useful..

What happens next is all to regular, I get a comment to my answer saying my answer is simply wrong; _because_, I didn't address the author's "mis-use" of HTML even though I actually answered their fucking question.

To me, it feels like StackWhatever, has a fucking giant culture problem somewhere and it's not being addressed or fixed on any level. There's no way this isn't a problem from the top-down... to be honest, I honest think their gamification may be part of the problem as it leads social-strata being created by the community, in a way that can only exclude instead of include.

</comment><comment><USER7> I have no beef in this fight. But seeing how the author exaggerates (to a point some would term lying) the license update makes me suspicious.

It seems any company or platform at some point sees an inflection of the public opinion, followed by an endless series of negative articles making the front pages on social media.

That could be consistent with good companies suddenly turning bad. But I suspect it's just as consistent with peoples' tendency to enjoy drama, tearing down the previous generation's idols, and being adored for speaking in one voice with the hive.

FWIW I have seen no change in SO's usefulness over the years. I also still remember everything that came before, even though I would like to forget. And I'll continue to post answers when the opportunity presents itself.

<comment><AUTHOR> Fair points. I stand corrected on many of them

I posted it mainly because SO is copy-left, and not clear, but only really compatible with gpl

That is a negative reason tho, and we can say that SO really has had massive positive benefit -- and I should aim for something better

\-- But yeah, on the link topic...

We want to see people treated better. But part of that means accepting them when they don't do or believe what I want -- and we can't force that onto them -- or by extension onto SO or other companies either

So I guess I should do what you suggest, and aim for high standards, but build up, rather than tear down

... Going forwards tho, it's going to be sadly hard to use SO for BSD or cc0 projects

</comment></comment><comment><AUTHOR> Linking this partly because I just realized every snippet on stackoverflow is effectively gpl

It requires hyperlinking each of stackoverflow, the question page, the authors, AND those links are not to be nofollow

[https://stackoverflow.blog/2009/06/25/attribution- required/](https://stackoverflow.blog/2009/06/25/attribution-required/)

Also: ""Stack Exchange Inc; user contributions licensed under cc by-sa 4.0 with attribution required.""

cc by-sa 4.0 is viral/copyleft, and gpl compatible, see:

[https://wiki.creativecommons.org/wiki/ShareAlike_compatibili...](https://wiki.creativecommons.org/wiki/ShareAlike_compatibility:_GPLv3)

</comment><comment><USER8> I have used stack exchange properties as read-only for several years now. I would continue to contribute so I can payback the help I have received, but it is not a friendly place.

Is there a solution to this?

Someone will reinvent a new service, so a new community will form, and then most important data will be recreated?

Can I use the latest court ruling

[https://arstechnica.com/tech-policy/2019/09/web-scraping- doe...](https://arstechnica.com/tech-policy/2019/09/web-scraping-doesnt- violate-anti-hacking-law-appeals-court-rules/)

to repurpose stack exchange data? Or just to keep a stash of data for myself?

<comment><USER9> [https://archive.org/download/stackexchange](https://archive.org/download/stackexchange)

Note that every item in the internet archive has a torrent file for distribution purposes.

</comment></comment><comment><USER10> [https://meta.stackexchange.com/a/335509](https://meta.stackexchange.com/a/335509)</comment>


Anti-IF - <AUTHOR> http://antiifcampaign.com/

<comment><USER2> The only clear monster that's clearly displayed on their website is their code formatting.</comment>


Walled Gardens are Driving me to JavaScript - <AUTHOR> I fear that someday soon, native programs that I have written and rely on won't run on my own computers because I won't have the money to buy a vendor specific compiler tool chain or a vendor provided signing certificate. Because of this, I'm going to make an effort to port all of my applications to generic JavaScript and hope that the vendors won't try to devise ways in which to stop that from running.
Here's a demo of SHA1_Pass in generic JavaScript http://16s.us/sha1_pass/why. It's not as functional as the native, desktop application, but it's works for my needs. Edit: This demo only works with Chrome and FireFox.
As a kid who began writing code on a C64, it's really sad to see the move to app stores, signed code, approval processes and vendor required dev tools. What do others on HN think? Is there a future for independent developers who write native code? Will our native apps stop running on our own computers? <comment><USER2> App store and signed code are not a bad thing per se. I have never installed anything on by Debian/Ubuntu boxes that was not GPG-signed and coming from an apt repository (an app store fwiw). Nothing except software I developed my self.

The problem is when it is the hardware manufacturer that dictates which signatures are to be trusted and which are not. The user should be the one that is free to choose the software that runs on its hardware, not the hardware maker.

I suggest «The coming war on general computation: the copyright war was just the beginning» by Cory Doctorow <https://www.youtube.com/watch?v=HUEvRyemKSg> .

<comment><USER3> Apple dictates the apps can you use and restricts the OS. It's not a matter of signed packages and security, but of corporate domination of technology and restriction of use of a hardware device you legitimately own. Would you buy a PC that restricts what OS and software you can run on it? But when it comes to smart phone and tablets, we except this. Blocking nefarious apps is one thing, having absolute control of what your computer and or smartphone can run (yes smartphones are just portable computers)is a monopoly. We wouldn't except this in any other industry. If Ford decided that you cant modify, improve or repair their products based on a restrictive license you had to agree to on purchase, you probably wouldn't buy a car from them. In the tech or media industries this is acceptable. Why should we accept a "walled garden" on smart phones when we own the hardware? If it were any other industry, people would be outraged.

<comment><USER4> You say on the one hand _Blocking nefarious apps is one thing_ but on the other _having absolute control of what your computer and or smartphone can run_.

Which do you want?

The harsh truth is we've tried the 'run whatever you want' model and it sucks ass for the end user as they get infested with malware.

I say, which do you want?

<comment><USER5> That is a blatantly false dichotomy. You wouldn't use a browser that did not let you access potentially malicious pages at all, but you wouldn't want one that gave you no protection either. And so you run Chrome which gives you a scary warning page but lets you go see any page if you really want.

I really don't buy that Apple's absurdly draconian control is better than something akin to Chrome's warnings. You should make it difficult to install something potentially malicious by accident our without thought, but you should definitely not go out of your way to stop _determined_ users from installing what they want either! Apple goes well beyond the reasonable and helpful and into the absurd.

<comment><USER4> There's nothing false about this dichotomy, you're just setting up a straw doll.

My point stands, we tried the run anything model and millions of machines are infested with malware as anyone with any basic computer experience can attest.The number of times I've had to clean friends or families computers I cannot count. There is a very good argument for these sandboxes.

<comment><USER3> The issue isn't security. The issue is control. The Debian project uses signed packages to ensure integrity but is open regardless. Of course there should be security and a reasonable expectation of utility but not at the cost of free use of something you bought and own. The tech industry is moving to a concept that you "rent", for lack of a better term, rather than own something you purchase. I have no issue with commercial software but all software is useless without the hardware to run it. If I have the hardware, I should be able to do what I want with it, just like an automobile. What's the difference? If a car manufacturer decided which highways you could drive on, based on a restrictive license agreement, you wouldn't buy that car, but you wouldn't buy a car without seatbelts. We wouldn't accept this concept in any other situation, why do we accept it in this situation?

</comment></comment></comment></comment></comment></comment><comment><USER6> To play devil's advocate:

a) Money is a bit of a red herring. Or rather, if Apple gave away keys for free, would you no longer have a problem?

b) If you have physical layer access, you can override any security settings. Gatekeeper et al cannot change this fact. You will be able to write/run code, just not necessarily distribute it.

c) Code signing will nuke a large portion of malware. 99% of users are not developers, so why should the default state of the operating system be configured for our needs?

d) Code signing could be implemented on a javascript level, as well. Flash is/was an attempt at signed codebases/binaries distributed over the web. Presumably, for example, a site could required to pull resources from an HTML5 manifest style local cache that has been signed/verified. This could eliminate MITM style attacks (changing ads) that are already in use. Difficult? Yes. Impossible? No.

e) There's always Linux/BSD. Until the TPM security protocols of 2018 are implemented, of course.

<comment><USER7> Don't forget UEFI, which has the potential to make a large segment of consumer devices unbootable under linux and also invalidate your point b). If you think that walled-garden software signing is in the future, why wouldn't you expect that signing to be implemented straight down to a hardware level?

</comment></comment><comment><USER8> As a kid who began writing code on an Apple II I cant believe you feel that today's situation is inferior to our own. I didn't know anyone who HAD a computer let alone could program it and I sure as hell never imagined that I could actually distribute my programs anywhere. Look at what kids have today - an infinite supply of resources, an infinite audience via a multitude of channels, and even the ability to really market and sell their wares (no pun...) seems like a worthwhile trade off for being able to go native to me. And if you really care, fire up a virtual machine and go nuts.

<comment><USER9> Yeah, I remember not even having a diskette, and getting angry at my mother for turning off the computer and destroying all my work.

<comment><USER10> My brothers would just unplug it. Boy did that make me fly off the handle! I would write 50LOC programs in basic (C64), and when I was about to make my GOTO frenzy start, they would unplug it. _takes a deep breath_

</comment></comment></comment><comment><USER11> I don't think you need fear that. Unless it is made illegal you will always be able to buy a 'computer' on which you can write your own code. However, as the great mass of folks who are only _users_ of what we now call computers (web, email, twitter, what ever) move on to the appliance that replaces them, the _cost_ of a computer will go up because the volumes in which they are sold will go down.

In '78 I paid $800 for a computer _kit_ which, when assembled, was waaaaay less capable than a Raspberry Pi. But there were maybe 10,000 ever made. My prediction is that the next 'gap' will be when the big players (HP, Apple, Asus, etc) move on to selling appliances for users.

Laptops might get eaten in this gap. But there will be the equivalent of a terminal program in the appliance thing you are using so you can program over the network. If you want to run code on the machine that you are typing on, you may have to have a 'deskside' type computer, which is living off the ecosystem of server machines.

Other risks are disk drives that are too smart for their own good (built in DRM as an example). Hard to build one from scratch, but flash is ok for now.

Overall you'll experience the same sort of changes car enthusiasts did where cars became less and less a motor and a transmission and a body and more all of that and a complex proprietary feedback control system to run it. Of course many kids these days don't care that they can't put 'glass packs' on their ride, they have other things to customize.

</comment><comment><USER12> What is to prevent the browsers from also eventually becoming walled gardens, as they reach the complexity of the increasingly locked down operating systems? We already are seeing multiple threats to even the open web with things like content pay walls, cloud services, and Facebook. Sure if things got really bad, we could fork WebKit, use Linux, and run our own mail server. The problem is that the majority will use what is simple and safe - what they can understand. Whether browser, operating system, hardware, cars, or any sufficiently advanced technology, that will always end up being a walled garden of some sort.

"Once you have something that grows faster than education grows, you're always going to get a pop culture." \- Alan Kay

The problem with computing is not any particular platform or our tools. The problem is education. As tinkerers, we learned how to make computers do what we want, and eagerly raced ahead while leaving the majority of humanity in the dust. The direction computing is moving can only be attributed to our own selfishness.

We can now either accept the walled gardens as computing for the masses, or we can work to create doorways out for those trapped inside by simplifying access to computing and improving education.

Lay less bricks, build more doors.

<comment><USER13> The crucial difference is that nobody can stop you from using or building any web app you want (minus government censorship). There's no single central authority with unchallenged veto power.

Openness is about _allowing_ alternatives, not guaranteeing their success.

<comment><USER14> Your device manufacturer , OS/Browser provider or ISP can all stop you from using any web app you want.

They can either flat out block it or leave your browsing software in such a state that it would be difficult to build anything significant for it (see IE6).

<comment><USER13> In the rare cases where something like this has happened it has been met with almost instant outrage and can almost always be hacked around trivially.

On the app stores this is just business as usual and happens all the time every day.

</comment></comment></comment></comment><comment><USER15> Why not just target Linux? That's what I'm doing.

1) Linux is going to be around for a long time. However nefarious the intentions of large corporations might be, there is now too much written on top of it for it for it vanish and too many distinct users for any one to control it.

2) Making portable that runs on both walled gardens and open system still helps the wall gardens by adding to their codebase.

<comment><USER16> Things like secure boot make me worry about the future of Linux as well.

[http://www.zdnet.co.uk/news/desktop- os/2011/09/23/microsoft-...](http://www.zdnet.co.uk/news/desktop- os/2011/09/23/microsoft-explains-windows-8-boot-to-quell-linux- fears-40094017/)

<comment><USER17> If I'm not mistaken, this only applies to pre-built computers that ship with Windows. We still have hardware manufacturers that only ship Ubuntu or the like (e.g. System76) and we still have DIY computer builds (which are very easy to do nowadays).

</comment></comment></comment><comment><USER18> >What do others on HN think?

Every day I wake up this is staring me in the face. On the one hand I feel a sense of inevitability about the whole thing. On the other hand I really _really_ want to stop it but I'm not sure how. I look up from what I'm doing, ponder it for some minutes, then go back to work.

And then I do it again a few hours later. It's driving me crazy.

<comment><USER15> Well,

Whatever one may think of him, it is hard not to see Richard Stallman as prophetic in these regards (see "the right to read", etc). Gnu and the General Public License were efforts to deal with the kinds of software "unfreedoms" that have been creeping over the years (copyrights, patents, trademarks, walled gardens, controlled compiler, etc, etc).

Free software still has many warts and problems but if you are concerned with the many ways that software unfreedom is making inroads, you might consider trying to improve a free project as a way of fighting back.

<comment><USER14> As an added note: If you want to develop software for an _ideological_ goal in addition to a practical one then you really need to be using the GPL license rather than anything like the BSD license.

Otherwise your code can simply be co-opted to build platforms which are very much closed (see OSX/BSD).

In fact it should really be argued that GPL isn't good enough and you should be using AGPL which also gives rights to users who use the program on a networked basis.

<comment><USER19> Is there such a thing: an ideological vs a practical one? I understand the OP's concern as related to the freedom of software he writes. Where is here the split between ideology and practical?

The OP's question by the way, reminds me of this discussion <http://news.ycombinator.com/item?id=3802516> , in which some argue against the GPL as "unfair" and ruining their day because it prevents usage in walled gardens (<http://news.ycombinator.com/item?id=3803492>).

Would it be more pragmatic to keep the discussion on HN going instead of developing evasive concepts?

<comment><USER14> The GNU system was originally designed mostly from an ideological standpoints. Stallman and others wanted to use a UNIX system , but they wanted access to the source code.

A lot of GNU was replicating work that had been done by other Unixes but the goal was to have it available as GPL.

<comment><USER19> While obviously colored memory , the standpoint was very pragmatic: <http://oreilly.com/openbook/freedom/ch01.html>

Next to that: I would only call it ideological if it was for some higher, intangible value in a future yet to discover. But I find the purpose of the GPL from inception until now only pragmatic.

</comment></comment></comment></comment></comment></comment><comment><USER20> I find that sandboxed environments have a kind of inherent quality of liberation to them - a solution may be far slower and clunkier than the hardware would ideally allow, but when seen another way, you're really just "going back in time" to a more resource-constrained computing environment.

I've been working in Haxe for several years now, and have been targeting the Flash platform the entire time, but without really trying, the escape hatch has been built for me through the NME framework - a very close, open-source implementation of the Flash APIs for numerous client platforms(including native code). As a result I feel kind of distanced from worries about the platform; in fact, I benefit in several ways by having more platforms because they each have strengths and weaknesses w/r to iteration times, debugging, etc. I couldn't have gotten exactly this outcome if I were working in C++, because I would have been starting from too low-level a basis. Although there's a big effort afoot to get native code compiling to sandboxed platforms, my perception is that it strongly favors the platform owners.

Ultimately I think we're actually gaining by engaging in a platform arms race. We're forcing ourselves to confront some old problems with our existing technology stack by saying "rewrite in JS." We end up with another black box in the layer of native code, but our hardware already is, in practical terms, a black box, and we at least have a good groundwork of open code in browsers and operating systems.

</comment><comment><USER21> This issue is why I'm a believer in the web as a platform. It's not the right tool for every job (yet), and I still use a great many native applications myself. But the moral hazard is simply too high for us to be comfortable with vendor lock-in being the norm in computing.

For all their warts, Javascript and the web are the first truly universal computing platform, and their capabilities only continue to grow, slowly but surely. And without hating on the (highly profitable) walled gardens, the open jungle is where I prefer my energies to go.

<comment><USER22> Unless you run elinks or IE...

</comment></comment><comment><USER23> Say what you want about walled gardens, but their flowers are more beautiful and their grounds better maintained than their wild counterparts.

</comment><comment><USER24> You might want to look into V8 as a way to un-hook JavaScript from your browser while you are converting your apps. See: <http://code.google.com/p/v8/> I've not investigated as I've been busy writing JavaScript apps for our projects browser/web app needs. :) Luck!

</comment><comment><USER25> For what it's worth, this is exactly why Mozilla is helping to build out the missing pieces of an app ecosystem for the web. We're trying to take the good bits from other platforms and make open web alternatives.

<http://wiki.mozilla.org/Apps>

</comment><comment><USER26> Correct me if I'm wrong, but I've heard you can't install apps you made on your own iPhone without a $99 a year developer account, even if you're not going to publish anything on the appstore. That seems unnecessary. Anyone know why that's the case?

<comment><USER27> That is correct, only people with developer accounts can install apps on an iPhone. I couldn't say why this is the case.

<comment><USER28> If all you needed to install custom apps on iPhone was a toolchain, people would embed it in apps sold outside of the app store. Next thing you know theres a massive end run around the apple revenue model.

<comment><USER27> That was my thought but I couldn't articulate it as well as you did.

<comment><USER29> Off-topic: By all means, charge the $99 for distributing on the App Store, but I am not really sure why Apple doesn't allow for Apple ID level verification for personal apps. Something similar to the mobile provision they use right now, e.g. having Xcode generate a binary that is associated with the same Apple ID as on the iPhone.

<comment><USER30> I don't think that would work because setting up a shared Apple ID using a throwaway webmail account would be trivial. Each one would be good for multiple devices, and running a build script to generate multiple binaries for multiple accounts wouldn't be all that hard.

They used to ask for a credit card, but I believe that's no longer required (if it were, you could just use a prepaid gift card).

</comment></comment></comment></comment></comment></comment><comment><USER31> I never did cross platform desktop applications but from reading Python in a Nutshell, I was under the impression that it was pretty stable and should have long term support. Or maybe you are specifically talking about iPhones and Androids?

<comment><AUTHOR> It seems Windows is moving in that direction as well.

</comment></comment><comment><AUTHOR> I placed the wrong URL in the description and I did not want to edit it. Here's the correct url: <http://16s.us/sha1_pass/js>

</comment><comment><USER32> I fail to see why you chose Javascript though. Surely a C base d approach would be the most platform independent. Works out of the box on most machines and much easier to port to Java/C#.

Also you need to spend some time without the tinfoil hat. App stores have resulted in a lot more independent developers because it provides them a cheap distribution channel. Likewise vendor required development tools have always been around. There really isn't anything to be afraid of.

<comment><AUTHOR> Yes, I do C++. Perhaps you missed that bit. That's the native code I was referring to. I'm concerned that my native code will no longer be able to run in the future. I chose JavaScript because of the ECMA standard and because vendors seem to be allowing it to run in browsers unhindered for now. I'm hoping they'll leave it be, but I'm betting they won't. I continue to write native C++ code, it's just that I'm concerned that one day it won't be allowed to run.

</comment></comment><comment><USER33> "Edit: This demo only works with Chrome and FireFox."

What was it you were saying about walled gardens?

<comment><AUTHOR> That's standard JavaScript (to me at least). I don't know why it would not work with IE. I'm a systems programmer by trade. Being newish to JavaScript, perhaps I made a mistake, so let me know any ideas you have to make it work with IE, or edit it yourself. It's GPL code.

Edit: Thanks to timb it now works with IE 9. Thanks!

<comment><USER34> in the html of <http://16s.us/sha1_pass/js/> add <!doctype html> to the top. this will prevent "quirks mode" in IE and String.prototype.trim will reappear.

if you want to support IE 8 and lower you'll have to add a shim for String.prototype.trim. (see <http://kangax.github.com/es5-compat-table/> )

<comment><AUTHOR> Thank you. Adding that line made it work in IE 9.

</comment></comment></comment></comment><comment><USER35> Walled gardens, which are just another annoyance in a long line of progressive manipulation of the computer user for profit, together with an increasing lack of responsiveness (despite ridiculously powerful hardware), drove me back to UNIX, assembly, FORTH and C. In some strange way I'm thankful for the annoyances of "modern computing" because I realised there is still so much more to learn about the "old stuff". I don't consider this move back to the old school to be "tinfoil hat", although it certainly can be used for that purpose. I just like being able to understand and control the machine, and having it be consistently responsive.

I can definitely sympathise with the OP. But I have little motivation to learn Javascript. It is a workaround to get a little control through the browser, but it is still browser-centric and has so little power relative to lower level languages. It is not a long-term solution to the problem the OP describes.

</comment><comment><USER36> Have you tried monodevelop? Mono is a free open source version of c# and it works very well on windows, mac, and linux.

<comment><USER32> If the poster is paranoid about the future then Mono isn't a good choice. Microsoft could easily revoke their license agreements and sue everyone for patent infringement.

<comment><USER37> That could happen with any language, as Oracle's (mostly failed, I might add) suit against Google over Java proves. Even for languages that were completely and fully OSS-developed, there's a near certainty their implementations are violating some patent or other that someone could come out of the woodwork and start suing over.

The Mono situation is actually pretty ideal practically, because much of what would be patented is known and not submarine patents, and it would be far harder than you suggest for Microsoft to start suing over that stuff after issuing their legally binding patent promise.

<comment><USER38> The probability of it happening with C# is much, much higher.

It's a given that Objective-C is entirely within Apple's domain and C# is within Microsoft's just as Java is now Oracle's. These languages are not independent of the organizations involved.

Other more standard-based languages, which has traditionally included things like C, C++, JavaScript and now Ruby are less likely to be disrupted because of shared ownership.

I'm worried about all the people chugging C# Kool-Aid when Microsoft wasn't the least bit concerned about taking SilverLight back out behind the barn...

<comment><USER39> I don't really think there's too much risk of Microsoft taking C#/CLI (particularly non-classic Asp* stuff) behind the barn and killing it. It's both a bad move considering how many of the successful cornerstones of their business run on it or use it extensively (SharePoint, Reporting Services, BizTalk, OWA, Powershell etc), and would be breaking from a tradition of supporting existing versions of everything for far longer than is useful.

Silverlight could only be killed like it was because it's on the client. Classic ASP, a 15 year old technology, still runs easily on IIS 8 / Windows 8. Yes, Microsoft could kill CLI on the desktop and stop distributing .net frameworks (or by removing the desktop mode from Windows 9 and removing .NET support from metro etc), but it's almost as safe a bet as there is that you'll be able to use it on the server for at least the next decade.</comment></comment></comment></comment></comment>


The imprinted brain theory - <AUTHOR> http://www.edge.org/3rd_culture/badcock08/badcock08_index.html <comment><USER2> _"However, the very same excellence in mentalism would make such psychotic savants much less noticeable than their autistic counterparts, whose deficits immediately identify them as odd, socially-isolated, and eccentric. Psychotic savants, by contrast, can be expected to be deeply embedded in successful social networks, and found at the centre of excellence in such things as religious and ideological evangelism; literary and theatrical culture; litigation and the law; hypnosis, faith-healing, and psychotherapy; fashion and advertising; politics, public-relations and the media; commerce, confidence-trickery, and fraud of all kinds."_

This is scary.

</comment><comment><USER3> This theory of a binary opposition between autism and schizophrenia, explained as a tug-of-war between maternal and paternal genes, strikes me as grossly simplistic. Notice how, in the second-last paragraph, the author evades the question of how then a single person can have both disorders. He also glosses over the well-known fact that schizophrenia (as well as autism) is more common in men.

The theory is surprisingly reminiscent of older models about schizophrenia that traced its cause to mothers. Nowadays, I suppose, we reimagine the family drama in genes and call it "symbolic".

The theory does have the property of being perfectly suitable for science journalism, no doubt a significant advantage for a meme.

<comment><AUTHOR> I posted this because the theory has been making the rounds among neuroscientists. It came up in one of our lab meetings. And the context was provocative - brain activation patterns in neuroimaging studies of the two reflecting mirror images.

Still, I agree it's simplistic. Problem is, in order to be comprehensible to mere humans, theories can only be a tad complicated. Take two main effects with an interaction. That's hard enough. A three-way interaction is near impossible to talk about.

<comment><USER3> I didn't think you were endorsing the theory, and it was certainly worth posting. But the more I think about it the cruder it seems.

I'm not sure what you mean by "mere humans", but unless it's "journalists and most of their readers", then I have to disagree. Theories are welcome to be quite a bit more complicated than this _if they work_. Take Maxwell's equations. Though "complicated" isn't the right word for something so elegant, they certainly encapsulate more than two or three "main effects".

<comment><AUTHOR> Bah, the limits of language. I should have said "mere neuroscientists". Maxwell had a Silver Hammer.

Seriously, I agree with your criticism and your hopeful view of science. But even as Hodgkin-Huxley is elegant it's a long way from explaining how human thought and behavior arise from our wetware. We're likely to get many muddled theories in the near future. The best we can do is test them.

<comment><USER3> I think science is an art and not a science :)

</comment></comment></comment></comment></comment><comment><USER4> Animals in general always tend towards two binary opposite behaviours, each of which is more successful in certain enviroments. It's a sort of hedging of the bets, in case unexpected situations spring up. As such, there will always be extremes of both behaviours - the bird that takes more risk to get the worm, and the other bird that takes less risk. Depending on the external situation, one of the two types will always dominate.

It's my belief that the concentration of genetic tendencies is what is causing the increase - people from universities tend to marry people from universities, and so there is a similarity in tendency among people who are reproducing, and so there is a larger tendencies for the extremes to manifest themselves.

It's like the sickle cell gene - when the population is diverse, this gene hardly shows up as a disease, but when the community is closed, the disease comes up very often.</comment>


Role Playing Game for Your Career - <AUTHOR> http://signup.welcometoindo.com/

<comment><USER2> I am currently in a big slump and totally lack motivation. I decided to try this out. Am I mistaken or is the sign-up sheet the only thing up currently?

If so, I would recommend you include a message in your automated reply saying that we would receive an invite soon or something on those lines. Currently, I got

> Thank you for signing up for in.do!

which seems to indicate that I am successfully enrolled in the service. However, the main page prompts me to share this with others. While I would definitely share this with others if I find it useful, why would I share something that is for now just a sign-up sheet?

</comment><comment><USER3> Yargh... yet another launchrock signup page without any information.

</comment><comment><USER4> >This is my first startup! If you think this is cool, spread the word!

This seems more like a personal project than a startup, but nonetheless I wish you luck.

</comment><comment><AUTHOR> Thanks scriptdevil for pointing this out, I will update the text. It is for now, an email signup.

<comment><USER5> Are you missing the reply link underneath comments? Sometimes I'm missing the reply link on messages but that can usually be solved by going to the permalink of the comment and replying from there.

I think most users of HN find comment threading useful.

</comment></comment><comment><USER6> That sounds pretty cool actually. What sort of skills, tasks will we need to level or do?

</comment><comment><AUTHOR> xaviel, an example quest would be to create a mobile app UI on behance and get 5 likes and 20 views. This would then reward you experience points in UI design.

</comment><comment><AUTHOR> th0br0, thanks for the feedback! Trying to write as little as possible while giving enough information. Refer to my reply to xaviel.

</comment><comment><USER7> Sounds like the SIMs. Pretty cool!

</comment><comment><USER8> signup before you enter! :(

</comment><comment><USER9> Cool</comment>


Looking goofy in the TV Hat - <AUTHOR> http://www.theglobeandmail.com/news/technology/gadgets-and-gear/gadgets/review-looking-goofy-in-the-tv-hat/article1895174/?cmpid%3Drss1&ved=0CBgQFjAB&usg=AFQjCNEZ0Tovz-rcqgx1O2qAfwqO8iW1RQ

<comment><USER2> That's awesome; I built my own stand so I could lay in bed and watch with out my arms/hands getting tired. I used the original box to get a perfect pit molding that I could attach to a broken arm lamp desk (used by architects).

I wager this would put some strain on your neck, but still.</comment>


Nero files Anti-Trust suit againts MPEG-LA - <AUTHOR> http://www.courthousenews.com/2010/05/17/Antitrust.pdf

<comment><USER2> But is this from January? [http://dockets.justia.com/docket/court- cacdce/case_no-2:2010...](http://dockets.justia.com/docket/court- cacdce/case_no-2:2010cv00382/case_id-463131/)

</comment><comment><USER3> ~Go Nero

Stop this madness

[http://www.facebook.com/album.php?aid=33723&id=142983457...](http://www.facebook.com/album.php?aid=33723&id=1429834573&l=0b2e084518)</comment>