Apple Avoids Amazon's Beauty Contest, Searches Secretly for New Campus - <AUTHOR> https://www.wsj.com/articles/apple-avoids-amazons-beauty-contest-searches-secretly-for-new-campus-1527067800 <comment><USER2> I'm not sure comparing a second headquarters and a tech support site is apt. I'm not sure how loud the search is matters.

WSJ is a joke. Look, I can twist words too: "While Amazon is clearer and open about employee counts and candidate locations for HQ2, Apple remains secret and opaque about any details even for small site". Abatements abound regardless, lets not treat the differences in culture between Amazon and Apple, which translate to their way of searching for places to do business, as if one is clearly superior. (I personally don't mind what Amazon is doing in the least)

<comment><USER3> Amazon's beauty contest did seem completely counterintuitive to me. People with skin in the game are always in the know of things. Even if Amazon had not massively advertised its move cities and states would have worked hard to bring them to their shores. I did not understand why ordinary public had to be drawn into it.

Your average joe is always going to oppose a disruption in his otherwise mundane and lazy life.

Apple's strategy is much smarter let the cities secretly do a peacock dance, cut some real under the table secret tax deals and move somewhere else.

<comment><USER4> I really don't understand why there's this huge presumption of ill will toward Amazon.

HQ2 is a project that will involve hundreds of thousands/millions of people when you add up the employees, contractors who will build it, local politicians/electorate, and everyone else. There's just no way to keep something that big secret. It seems easier to just come clean, announce to the world what you're doing, and be open about it.

Plus something of this magnitude is going to require political support so the proposal is as much an appeal to the local electorate as anything else.

I, for one, think it would be great if tech jobs spread out across the US.

<comment><USER5> The complaint isn't that Amazon is expanding into other locations. The complaint is that Amazon is using this to play cities off against each other. It's a race for the bottom designed to maximize gain for Amazon at the cost of the commons.

<comment><USER6> Cities can choose not to participate. Don't like it, elect new officials.

<comment><USER7> And when the secret contract is signed? Can voters reneg on the deal considering they weren't consulted nor notified.

</comment></comment></comment></comment></comment></comment><comment><USER8> It's pretty clear it hasn't done Amazon's reputation any favours. And there's no reason to think government officials won't go above and beyond in offering incentives behind closed doors.

<comment><USER9> Why do you think that? I think Amazon will get what they want - mainly a city to capitulate to their demands. I've talked to people in Pittsburgh and Atlanta and the majority wanted Amazon. I don't think most people realize outside of tech circles that Amazon will mostly bring people in rather than hiring locally and how much they have strained the infrastructure in Seattle.

<comment><USER10> > how much they have strained the infrastructure in Seattle

You could rephrase this as "How much Seattle's entrenched interests have crippled the city's growth". How many towns and cities would love to have the problem of too many jobs?

<comment><USER11> It's not "too many jobs"; it's _Washington state voters_ voting down income tax and transit initiatives that _Seattle_ sorely needs.

<comment><USER12> It's not so much that voters are voting down income tax as progressive income taxes are illegal in the state of washington[1]. Though Seattle has tried[2]. You are right though that in some cases the voters have voted down income tax initiatives [3].

[1] [https://www.washingtonpolicy.org/publications/detail/local-i...](https://www.washingtonpolicy.org/publications/detail/local- income-taxes-are-illegal-in-washington-state)

[2] [https://www.thestranger.com/slog/2017/11/22/25581262/superio...](https://www.thestranger.com/slog/2017/11/22/25581262/superior- court-judge-rules-against-seattle-income-tax-appeal-on-the-way)

[3] [http://www.theolympian.com/news/politics- government/election...](http://www.theolympian.com/news/politics- government/election/article113515583.html)

</comment></comment></comment></comment></comment><comment><USER13> A commenter on the article made a snarky reply about Apple choosing China as that's where a lot of the manufacturing is - I wonder why Apple/Amazon don't look internationally for HQ2?

Are their international offices 'big enough' for what they need?

<comment><USER14> You'd have to be insane to keep any of your sensitive IP in China, honestly. But mostly I assume they stick to the U.S. because that's where the talent is (and that's the government they need to have the closest relationship with, too)

<comment><USER15> Isn't all Apple's hardware IP "in" China?

<comment><USER16> as a simple example, not necessarily realistic, consider the circuit boards of the iphone.

yes, they've got to ship the gerber files to china so the boardhouses can fab the boards. but those are just images of the copper and mask layers. apple doesn't have to ship the electrical schematics, with tolerances and notes and explanations of why things are done the way they're done, outside of their office building in california.

same with their ASICs; the masks and such have got to go to the fabs, but not the HDL describing the logic.

so, certainly some of their IP ends up over there, but not necessarily the juiciest bits.

<comment><USER11> So, their outsource partners can't invent new things, but can clone every existing thing for a small fraction of the price? That's a good deal for them.

<comment><USER17> It doesn't really work like that either.

You can buy iPhones and take them apart, so you have the logic board. Do you know how to install Ubuntu on it?

Without the logic behind why the board was designed that way, it's going to be non-trivial to reverse engineer what's going on.

Think of it as a .exe file. Cracking software isn't a trivial task. Cracking hardware is harder.

</comment></comment></comment></comment></comment></comment><comment><USER18> Not much of a secret when it's on the front page of the WSJ. But at least they aren't doing a huge public bake off

<comment><USER19> Not just WSJ. It was in the news last week: [https://www.wral.com/north- carolina-apple-negotiating-deal-o...](https://www.wral.com/north-carolina- apple-negotiating-deal-on-triangle-campus-second-site-in-cary/17558985/)

<comment><USER20> Wow:

"We are a local media company based in Raleigh, North Carolina, USA. We have detected that you are in one of the member countries of the European Union, which is now subject to the General Data Protection Regulation.

... Until we are able to ensure our full compliance with the rigorous GDPR requirements, _we are blocking access from EU countries to our websites_ , which include wral.com, wralsportsfan.com, highschoolot.com and wraltechwire.com. We take the GDPR seriously."

<comment><USER21> On the one hand I think this is a great sign that the GDPR is being taken seriously. On the other, I see this as corporate speak for "We're not sure if ensuring compliance makes business sense for us and this notice may actually be permanent. You're from a region where anyone interested in our content is probably a long-tail outlier that won't make us much money, so ensuring access for you is not a priority."

I really hope that data privacy regulations don't have the unintended side- effect of significantly increasing the geographic balkanization of the web.

<comment><USER22> I don't blame them. I'm thinking about doing the same thing for a few of my web sites that have very local content.

The company that sells the advertising on those sites says non-US traffic dilutes the value of the ads, and I'd get 3-5% higher CPM if I filtered non-US traffic.

I've kept them open until now because I like to check on the sites when I travel, but GDPR might be the incentive I need to pull the plug.

<comment><USER23> > I'd get 3-5% higher CPM if I filtered non-US traffic.

3-5% higher CPM on how many fewer pageviews? In general, filtering out traffic should always make you less money, even as filtering to the most profitable traffic increases how much you make per page view.

If non-US traffic really were losing you money your advertising company could always drop ad requests from non-US traffic.

<comment><USER22> Non-US traffic is essentially non-revenue for many American web sites (unless you're running AdSense). Serving pages still costs money, though. So it makes more sense to block non-US traffic than to serve it ad-free.

</comment></comment></comment></comment></comment></comment></comment><comment><USER24> After hearing about Cupertino's possible plan to shakedown companies like Apple for tax money, should we be surprised at their approach to a new campus? Of course even a public search, there would be cities promising tax breaks to Apple, but their approach seems consistent with their usual levels of operational secrecy.

</comment><comment><USER25> I suspect Apple will get the same results when they finally talk to the locals about a HQ had they made a big public deal about it vs. somewhat quieter search (relative to Amazon).

</comment><comment><USER26> Just because Apple has a reputation for being secretive doesn't mean they are in this case. Most companies don't go around advertising plans to open a new office or their CEO's meeting schedule.

</comment><comment><USER27> Sounds like one is trying to make headlines with a smaller support site by punching up at the bigger HQ. Not interested.

</comment><comment><USER28> The secrecy is subpar--this was in The Washington Post a couple of days ago.

</comment><comment><USER29> But then how will apple extort cities for massive tax breaks?

</comment><comment><USER30> Can someone copy and paste the whole article into a comment?

<comment><USER31> If you're on a desktop/laptop computer and have a FB account, use the "fullwsj" hack: Edit the URL to say "fullwsj.com" instead of "wsj.com", and click on the link from Facebook.

If on a mobile device, you can do it, but have to copy the URL and then paste into a private browsing window (at least on Safari/iOS.)

<comment><USER32> Can confirm on Chrome.

There is something interesting though. I tested it after logging out of Facebook (wanted to see what would happen). Basically I wanted to see if you needed to be logged into Facebook or not to use this redirect (would it work from the logged-out Facebook page?), but got something surprising.

I performed these steps (Chrome on Desktop, from Windows):

1\. I was logged into Facebook in an incognito window. I decided to log out of it. I then removed my fast login button by clicking the X.

(Note: I didn't close that incognito window. This does mean any cookies could have been retained, I wasn't being so thorough)

2\. After logging out I returned to the main Facebook.com page (to sign in) in the same window.

3\. On the blank Facebook login screen , I then manually pasted [https://www.fullwsj.com/articles/apple-avoids-amazons- beauty...](https://www.fullwsj.com/articles/apple-avoids-amazons-beauty- contest-searches-secretly-for-new-campus-1527067800) into the URL bar in Chrome.

4\. After I pressed Enter Facebook actually put up a page "Confirm leaving Facebook" with the URL. This was under the Facebook.com URL. And then I clicked the URL on that page. I got the full article.

This is what that window looked like (I reloaded it by clicking the back button in that window, while writing this comment):

[https://imgur.com/a/X8bIGyX](https://imgur.com/a/X8bIGyX)

It doesn't do this when I put in just any other URL into the URL field.

So how did this happen technically? How did Facebook.com get the new URL I put in, and halt my navigating away manually, and instead ask if I really want to go there (but remove the "full" from where 'there' is)? I don't think Chrome gives Facebook access to URL's put into the URL bar by the user...so...?

There's no chance I'm misreporting what happened because there's nowhere else I could have pasted the URL other than the URL bar, since I was logged out of Facebook at the time. I'm puzzled how this happens on a technical level.

<comment><USER33> I _think_ any JS can listen for the navigate-away event or changes to the URL without doing anything special - then just grab 'window.href/window.location' or something like that

<comment><USER32> Wow, that would be super surprising. I wouldn't think I'm giving Facebook my next destination when I type it manually into the URL bar! Can someone confirm?

<comment><USER32> Update: this (what tkxxx7 suggests) is not what's happening. It's just a redirect.

</comment></comment></comment></comment></comment></comment><comment><USER34> Is Apple's spaceship campus considered in this article? I can't read anything behind the paywall, but the headline seems to suggest either Apple is frugal or Amazon is out of control.

</comment><comment><USER35> Paywall. Alternative link?

<comment><USER36> Just add "full" before wsj.com in the URL, and you'll go directly to the free article via Facebook affiliate link.

</comment></comment><comment><USER37> Can we all agree is bad form to share paywall links here? No, I don't want to resort to any hacks since it is stealing but this is literally advertising for the WSJ at this point.

<comment><USER11> Sometimes the discussion is only about the headline, as there is nothing else in the content.

<comment><USER38> "Sometimes"... the majority of HN comments are replies to a headline.

</comment></comment></comment><comment><USER39> I think the reason Amazon had to announce their search publicly is because their HQ2 project is so much bigger than Apple's or any other company's.

60,000 jobs is not something you take up lightly, especially as it relates to transit and housing. It's the equivalent of a small city, and you're going to need to be prepared for it.

<comment><USER40> Plus it's a way for cities to start a bidding war, offering the lowest tax rates and property prices. Effectively Amazon will get their new HQ for free, if not have the cities actively pay for it. Because jobs. Free market, competition, etc, yay.</comment></comment>


One third of Americans are headed for diabetes - <AUTHOR> https://www.cnbc.com/2017/08/31/type-2-diabetes-may-hit-84-million-americans-and-they-dont-know-it.html <comment><USER2> > The primary risk factor for type 2 diabetes is genetics, but excess weight, > obesity and lack of exercise also contribute to this alarming medical trend.

How does genetics compare to age as a risk factor? The article touches on age later (even saying that the risk rises exponentially after 65), but doesn't give hard numbers, and I've had a hard time finding any that seem both relevant and credible. The closest I could find was a summary of a CDC report [1] (edit: actually the source for this article; I didn't see the link before) that found 4% prevalence of diabetes in the 14-44 age group, 17% in 45-64, and 25% in 65+. If genetics is an even bigger risk factor than that, it seems like it's a _huge_ factor.

[1] [https://www.cdc.gov/media/releases/2017/p0718-diabetes- repor...](https://www.cdc.gov/media/releases/2017/p0718-diabetes-report.html)

</comment><comment><USER3> "A simple blood test can detect prediabetes, a condition marked by higher- than-normal blood sugar"

Why do you need a prescription in the US to get a blood test? I tried to get a follow up to a test that I got at a local health fair, but I couldn't do it without a prescription, even if I would pay out of pocket.

Wouldn't it be useful for people to monitor some basic numbers on a regular basis without visiting a doctor?

<comment><AUTHOR> [https://www.amazon.com/s/ref=nb_sb_noss_2?url=search- alias%3...](https://www.amazon.com/s/ref=nb_sb_noss_2?url=search- alias%3Daps&field-keywords=aic+test)

<comment><USER3> I wasn't speaking about blood glucose levels specifically. I had another number that was marked as slightly high. That's why I said blood tests.

<comment><AUTHOR> A1C is blood glucose over time, average over 3 months, this is the test that shows if you're pre-diabetic.

<comment><USER3> Once again, I am not talking about A1C, but a battery of blood tests.

</comment></comment></comment></comment></comment><comment><USER4> diabetes.... the new lung cancer</comment>


Stephen Watt discusses how he spent 2 years in prison for writing software - <AUTHOR> http://player.vimeo.com/video/66742369

<comment><AUTHOR> Sorry about that.

I was able to see it and assumed everyone else would be able to as well

[http://infiltratecon.com/watt.html](http://infiltratecon.com/watt.html)

</comment><comment><USER2> _Sorry

The creator of this video has not given you permission to embed it on this domain._</comment>


OKCupid starts accepting Bitcoin using Coinbase - <AUTHOR> http://coinbase.tumblr.com/post/48102298494/okcupid-starts-accepting-bitcoin-using-coinbase <comment><USER2> This seems like a great idea, since people who are into BitCoin are likely to use online dating services.

<comment><USER3> I thought this was funny, but downvoted because it was also rude and unproductive.

I wish we could talk about Bitcoin without saying either 1. that its expected value is negative infinity dollars and pyramid tulip 2. that its expected value is infinity dollars and oppression fiat. I think both sides are well aware of the counter arguments.

But even though that will never happen, I think we can stop short of allowing ad hominems to be acceptable posts.

<comment><USER4> Yes. You'd expect a community such as hacker news to be above the usual nerd- shaming.

<comment><USER5> It's called tongue-in-cheek self-referential humor.

Naturally, you'd expect a community such as Hacker News to be below such subtlety. :D

PS: I am a fat nerd wearing a black t-shirt, love bitcoin, and have used OKCupid to get dozens of successful dates over the last 8 years.

<comment><USER4> Fair enough. I agree it can be funny, just somewhat immature. The line between bullying and "self referential in-group humor" is pretty thin sometimes. I guess it's a bit like sexist jokes, in that some things that are meant as funny can be interpreted wrongly and hurt.

<comment><USER6> Seriously? You're getting bent out of shape over this??? Despite being very likely true, the statement was funny and targeting just the right people for it to be funny.

</comment></comment></comment></comment></comment></comment><comment><USER7> Do businesses that accept bitoins for payments typically immediately cash it out on exchanges or do they actually carry the "FX" risk?

edit: since MtGox only charges a fixed %age fee for transactions, automating a conversion into USD wouldn't cost any more than doing periodic larger transactions (other than the development and maintenance cost of such a system

<comment><USER8> _Do businesses that accept bitoins for payments typically immediately cash it out on exchanges or do they actually carry the "FX" risk?_

People in the Bitcoin community believe that these options are mutually exclusive, but _they're not_. If you're doing a dual currency transaction in a period of high volatility, _somebody_ is paying for that exchange risk. It's either the customer, the payment processor, or the merchant, or possibly two of them, but it certainly isn't no-one.

There were multiple periods _today_ in which Bitcoin fell more than 10% in 15 minutes. If I were insane enough to sell Bingo Card Creator for Bitcoin, and then gave an elementary schoolteacher a quote for 0.42785714285714285714285714285714 BTC ($29.95 at 70 to the dollar), it's entirely possible that in the five minutes of thinking it took to process everything on the screen, the 0.42785714285714285714285714285714 BTC that I received would be worth only $27.81 at market prices. Hmm, that's funny, I just paid 7.1% in transaction fees _before paying the transaction fees_. (We're obviously operating in a perverse hypothetical world where elementary schoolteachers would both understand that option, have BTC available to spend, and be happy spending them, and where I would consider actually implementing this.)

It's possible that the payment processor I was working with would absorb this risk for me, because they hope to keep my business. That would be an _extraordinary dangerous_ decision for them, because they're now running their merchant payments operation as a sideline to currency speculation. (Which I suppose makes them a perfect fit for the Bitcoin community.)

<comment><USER9> To play the devil's advocate, I'll point out that anyone selling in multiple currencies has to deal with hedging fx risk. For example, USDJPY has been pretty nuts thus far in April (not BTC nuts, but intraday swings of 1-2%).

If you were 1) very determined to sell in BTC and 2) could buy USDBTC options you could probably sell in BTC and limit your exposure to the fx risk.

<comment><USER8> _I'll point out that anyone selling in multiple currencies has to deal with hedging fx risk_

Yes, and anyone whose business involves juggling chainsaws has to pay an awful lot for workplace insurance, but Bingo Card Creator doesn't involve chainsaws. Bitcoin proponents love to say "No transaction fees! Can your credit card processor do that?" while perhaps forgetting to mention that the actual mechanism for achieving this involves you juggling chainsaws.

<comment><USER10> Transaction fees are part of the spec for bitcoin. Who says there are no transaction fees?

<comment><USER11> I'm not sure why you were downvoted. Bitcoin definitely has transaction fees which will only increase with time.

</comment></comment></comment></comment></comment></comment><comment><USER12> Until Bitcoin normalises it sadly doesn't matter who accepts it, the currency is experiencing so much instability you're better off buying a prepaid Visa debit card and using that for paying for online dating services. It;s good to see more services accepting the currency but it doesn't change the fact it's a hotbox for hacker attacks, old fashioned bank-running when the price rises and all of the investors it has attracted looking to make a quick buck.

</comment><comment><USER13> I wish there were a simple-as-Stripe way to outsource multiple payment options for customers (BTC, cards, ACH, etc.). I guess technically you could use PayPal or maybe Amazon Payments for that, but I don't think they're particularly likely to support Bitcoin anytime soon.

<comment><USER14> Spreedly comes pretty close to this actually, and they're much more likely to support working with something like CoinBase for BTC soon.

</comment></comment><comment><USER15> This is interesting but really more in the cool/cute/novel category than the practical needs one.

I'm pretty hopeful and positive about bitcoin but that's one of the things that makes me still very suspicious of it. Seems that the places adopting it are doing so for fun, ideological or theoretical reasons rather than to solve some problem they have.

I'm waiting to see online retailers requiring bitcoin payments for high risk transactions (eg sending mobile phones to nairobi). Something that demonstrates it solves a problem and (ideally) enables commerce where it wasn't possible before.

<comment><USER16> There are more large, recognized businesses coming online soon. I'm talking to a start-up right now that is fairly well-known among HNers that is working on setting up Bitcoin payment options (and have asked them if I can share their plans -- waiting for a response).

</comment></comment><comment><USER17> Wait, since when did OKCupid start charging? They were free when I was on there (before the match.com takeover)

<comment><USER18> It was after their acquisition by IAC in 2011. Match.com is owned by IAC, so technically it was taken over by IAC. The CEO said multiple times they'd never charge, but plans tend to change after you get acquired.

<comment><USER19> Paying (for A-List) is entirely optional and gets you extra, nonessential features (like no ads and extra search parameters). It's been around since 2009, long before IAC bought us. Using OkCupid is still, and will stay, free.

<comment><USER18> My mistake. I originally prefaced my comment with "I think" and should have left that in there, because I didn't know for sure. I misread a Mashable article that said OkCupid would never charge in 2011.

</comment></comment></comment></comment><comment><USER20> The entire blog seems to be 404ing now.

</comment><comment><USER21> This is interesting, I'm all for bitcoin, but I think if I am meeting someone over the internet, I'd like at least some part of the process to not be anonymous.

I know that doesn't necessarily make me safe, but it is one more step.

</comment><comment><USER22> Same question as always. Money transmission license?

</comment><comment><USER23> Fedoras, everywhere</comment>


Ask HN: Best Password Manager? - <AUTHOR>

Hello all! What with the recent Gawker slip up, it seems as if password related security is on all of our minds. I feel like I am finally being prompted to step up my game and use a real password manager with strong, random passwords for each site that I visit. I know I should have been doing this all along, but what can I say?
Features that I am interested in:
* Android/iOS app so I can access my sites on-the-go.
* OSX/Linux/Windows support.
* Preferably Free and Open Source, if possible.
1password? KeePass? LastPass? What do you use? <comment><USER2> I use One Password and love it.

There is an iOS version. Android in beta. OSX and Windows versions and the windows version can be used via Wine on Linux but has no browser integration there.

</comment><comment><USER3> Lastpass serves me well. I've started using the password generator after the gawker incident.

</comment><comment><USER4> Password Gorilla (<https://github.com/zdia/gorilla/wiki>). It runs on OSX/Linux/Windows, the password database is compatible across OSX/Linux/Windows, it is open source and free software.

All that is missing is Android/iOS support, but if a Tcl environment were to be brought up on either, the Password Gorilla should work there just as well.

</comment><comment><USER5> 1password. I use it on my mac, iPad, and iPhone. Incredible product.

<comment><USER6> I've been using 1password on my mac, but I'm not using it's full capabilities yet. To use it with the iPhone do you sync your passwords using Dropbox or anything?</comment></comment>


Hackers hide credit card stealing script in favicon metadata - <AUTHOR> https://www.bleepingcomputer.com/news/security/hackers-hide-credit-card-stealing-scripts-in-favicon-exif-data/ <comment><USER2> I'm not sure about others, but to me this is quite fascinating and clever. I'm a decent engineer who can build and maintain codebases, but I've never been well versed in the depths of knowledge needed to do things like this.

In a hypothetical scenario, what would I need to learn to be able to pull something like this off, from conceiving of it to actually executing it?

<comment><USER3> IANA expert, but...

As far as conceiving the attack, you would just need to "think outside the box", as much as I hate that expression. These attacks are derived from someone thinking "Huh, I wonder if this would work" about some crazy idea, and then trying it out.

As far as execution, if I were running this attack I would probably set up a site like [1] (No endorsement, this is just the first thing that popped up in a search). I would take peoples pictures, spit out their favicon, along with the JS embedded in the exif data. They would then put it on their site, and wind up serving it to their customers.

[1] [https://www.favicon-generator.org/](https://www.favicon-generator.org/)

edit: forgot to actually link the site.

<comment><USER2> Appreciate it. You're quite right about thinking outside of the box. I guess I need a better baseline of understanding to be able to do that better in this case.

The entry point of the attack vector is interesting though. I wouldn't have considered a third-party service "innocuously" causing the problem as I was trying to think of a sexier direct exploit into the website's system.

<comment><USER3> Glad to be of service. If you want to learn more about security hacking, check out hackthissite.org , and I would be happy to recommend some more things to check out if you're interested.

Indeed. Honestly, I only realized it because I saw that site when I looked up favicon. Otherwise, I would have been doing the same thing.

<comment><USER2> Appreciate it. Will take all the resources you got.

<comment><USER3> Sorry, I just saw this.

Disclaimer: I'm not particularly good at this, so whatever comments I make are well intentioned but may be of varying accuracy.

...

Online sources: * OWASP.org is a good place to find info. If you look something up, there's a good chance you will find it here.

* [https://owasp.org/www-project-web-security-testing-guide/](https://owasp.org/www-project-web-security-testing-guide/) Thanks to redis_mic for this one, I didn't know it existed until today.

* overthewire.org Similar to HTS, but you don't need an account. The subject matter covered is also slightly different.

* [https://0x00sec.org/](https://0x00sec.org/) A forum dedicated to security. There's a lot of script kiddies, but also some gold.

* [https://www.hackerone.com/](https://www.hackerone.com/) What better way to learn then practice on live targets? That being said, I would do some of the others first.

...

I do a lot of learning through reading, so books:

* Network Security Assessment by Chris McNab. I have second edition, which is a good and instructive read, but quite outdated.

* Real-World Bug Hunting by Peter Yaworski. Web security 101. Good read, and fairly useful.

* Advanced Penetration Testing by Wil Allsop. Outdated, but interesting. You will never use flash again after reading this.

* Social Engineering, The Science of Human Hacking by Christopher Hadnagy. This is a very interesting read. Also, one of the few that can't go out of date.

...

This should be enough to get you started. There's a couple more books I can think of, but they tend to be more specialized into certain fields of security and less approachable/generally applicable. If you want these recommendations as well, feel free to email me, my email's in my bio.

<comment><USER2> Thank you so much!</comment></comment></comment></comment></comment></comment></comment>


Doodle for Google - <AUTHOR> https://doodles.google.com/d4g/ <comment><USER2> This is a ripe opportunity for a good parody contest!</comment>


Show HN: vcspull – Manage your commonly used repos via YAML file - git-pull http://vcspull.git-pull.com <comment><AUTHOR> Similar tools:

[http://myrepos.branchable.com/](http://myrepos.branchable.com/) [https://code.google.com/p/git-repo/](https://code.google.com/p/git-repo/)</comment>


Uber sells food delivery business in India to Zomato - <AUTHOR> https://techcrunch.com/2020/01/20/uber-sells-food-delivery-business-in-india-to-zomato/ <comment><USER2> Ubereats user from India here. Just opened the Ubereats app and it says "your account is now set up on Zomato" and directing to Zomato app. Looks like they completely shut down the app and moved their operations to the Zomato app.

<comment><USER3> Why is that surprising?

<comment><USER4> I assumed this was simply relating what is happening from a users perspective.

</comment></comment></comment><comment><USER5> I think Uber is getting a good deal out of all these exits

10% in Zomato

27% in Grab

15% in Didi

x% in Yandex

<comment><USER6> Yea that's certainly one way of looking at it.

The other is "we burned billions trying to win those markets and lost every one of them to a local competitor"

<comment><USER7> Many companies are facing winner takes all, so if your failures result in getting a significant stake in your competitions businesses, you're doing pretty well IMO.

As much as I'd like that not to be the case for Uber.

<comment><USER8> But Taxis are not a winner-takes-all business. They may be on a city-by-city basis, but not nationally.

</comment></comment></comment></comment><comment><USER6> Uber will end up being an American(-only) business like Lyft. It's inevitable.

<comment><USER7> Australia is dominated by Uber unfortunately, I'd hazard a guess they've done similarly well for other countries where the competition is weak.

The only competition they faced on entry was Taxis, which is to say, no competition.

<comment><USER9> The only competition they faced when entering Portugal was taxis, too. Now there are two competitors more.

</comment></comment></comment><comment><USER10> While speculations and early reports of possible sale of Uber Eats were coming, as a user one could see hefty discounts of upto 50% capped at over Rs.200 in the last 3-4 months.

</comment><comment><USER11> Seems like Travis knew just when to get out. Sinking ship?

<comment><USER3> Uh he sold all his shares below $30. It's at $35 now.

<comment><USER12> Yes, Travis sold a little too early!

<comment><USER3> $37!

<comment><USER11> We'll see.

<comment><USER3> I've been holding since $25

</comment></comment></comment></comment></comment></comment><comment><USER13> Zomato is raising close to half a billion dollars. I am extremely curious to see how their financial expenditures are.

It's just an app. Does the money go to acquiring new customers via ads? Subsidizing food? Customer service? Running servers?

<comment><USER14> I doubt they spend a lot on customer service. The automatic conversation you are bombarded with has taken care of every issue I have ever had...all just results in refund or feedback to some unknown place. Swiggy has more human interaction but yeah, I think it's better to refund, save money on customer service and ban account after a certain threshold of profit you can get out of a person for a high growth unicorn.

<comment><USER15> Swiggy is a scam! They stole 200 bucks from me (as food wastage charges) because I didn't look at my phone for 15 minutes after I placed an order with a full address that I had already fully paid for.</comment></comment></comment>


Jon Hendren – DevOps Thought Lord - <AUTHOR> http://jonhendren.com/

<comment><USER2> oh hell yea baby..

</comment><comment><USER3> I need help writing a data bean agnostic protocol.

</comment><comment><USER4> Jon took my business to the next level.

The level of success and mad profits for me and my distinguished staff.

You have to touch him to know what he can truly do for you. Wi</comment>


If Google and Amazon won't innovate, the rest of us must - <AUTHOR> http://www.guardian.co.uk/technology/2009/aug/12/victor-keegan-internet-innovation

<comment><USER2> Solution: More Startups!</comment>


Show HN: GroupMe bot to render LaTeX equations and send them as images - <AUTHOR> https://github.com/jstrieb/groupme-latex <comment><AUTHOR> I made this very quickly in an evening as a proof-of-concept for a more advanced version to be integrated into Slack.

I am a member of several group chats in which math is commonly discussed, but it is sometimes difficult without notation. This bot is designed to augment such group chats with LaTeX typesetting ability!

Additional discussion here: [https://www.reddit.com/r/math/comments/d5hw66/groupme_bot_to...](https://www.reddit.com/r/math/comments/d5hw66/groupme_bot_to_render_latex_equations_and_send/)</comment>


A Lover and a Fighter - the-enemy https://literaryreview.co.uk/a-lover-and-a-fighter <comment><AUTHOR> A fascinating character. Stephen Pressfield wrote an entertaining novel about him: [https://en.m.wikipedia.org/wiki/Tides_of_War](https://en.m.wikipedia.org/wiki/Tides_of_War)</comment>


They Build Spacecraft and Fight Epidemics; Shutdown May Scare Them Away - <AUTHOR> https://www.nytimes.com/2019/01/24/us/civil-servants-government-work.html <comment><USER2> Since there has been a couple of comment already about how the people in the pictures are clearly not PhDs but cleaners (because they're not caucasian, I suppose), I took 15 seconds to look up "NASA Gustavo Costa", first name mentioned in the article: [https://www.researchgate.net/profile/Gustavo_Costa16](https://www.researchgate.net/profile/Gustavo_Costa16)

<comment><USER3> Which is really quite a baffling perspective. A stereotype/joke I was told while young: if you see a scruffy, probably homeless, person near a good university you should first check to see if they are part of the Math faculty before making any further assumptions.

It is not possible to gauge intelligence or academic credential by visual inspection, unless someone is wearing an academic gown. Some very accomplished people positively seem to enjoy looking disheveled.

<comment><USER4> It's one of the remaining interesting parts of "signaling theory" that the super-elite now commonly uses shabby looks to prove that they have nothing left to prove. Only mediocrity needs a suit to be taken seriously.

<comment><USER5> Suits are basically uniforms. Sometimes literally.

Having a strict dress code isn't a sign of status in my book.

<comment><USER6> One data point: it makes me think first of all about salespeople.

</comment></comment></comment></comment></comment><comment><USER7> > NASA, a government agency as well-known as Coca-Cola back in his little > Brazilian hometown.

I've noticed this when I travel--all over the world, I see people wearing NASA t-shirts, everywhere I've been: Europe, Asia, South America. It seems like the NASA meatball is globally popular.

Whatever the Americans are paying for NASA, it must be an absolute bargain in terms of the good press and soft power it wins them worldwide. Can you imagine any other foreign government agency that people would be eager to have on their shirt? Was Roscosmos similarly popular during the Space Race?

<comment><USER8> >I see people wearing NASA t-shirts, everywhere I've been: Europe, Asia, South America.

I for one have never seen anyone in Europe wearing a NASA t-shirt, and that includes American tourists.

<comment><USER9> You're not looking hard enough. I see NASA shirts at least once a week here in Germany

<comment> saiya-jin Well I haven't noticed any of those either, ever. Its true I didn't look for it specifically, but anywhere outside US this would stick out at least a bit, especially for a space nut like me. And I also include all the travelling I ever done, on 6 continents, sometimes for months in a row when you mean tons of folks including US citizens.

Neither I ever saw it in Geneva in Switzerland where I live, which is home to CERN folks, many UN/NGO folks, banker folks, or generally quite international folks. Maybe you keep seeing 2-3 people in your vicinity over and over?

</comment></comment></comment></comment><comment><USER10> Could a supporter of 'the wall' explain to me (after first taking a deep breath) why it is a reasonable or even effective solution for illegal immigration? To me, shutting down the government for this wall is a dangerous and destructive temper-tantrum. Why are all other proposals being rejected?

<comment><USER11> This isn't about a wall or illegal immigration. This is about politics and both sides using a government shutdown as a way of swinging popular opinion in order to gain an edge for 2020 elections.

Historically, government shutdowns have been a very effective way of swinging popular opinion against the party that is viewed as causing the shutdown.

The key, and what both parties are working really hard at, is to paint the _other_ party as the "guilty" party for causing or not resolving the shutdown.

<comment><USER12> Historically shutdowns don't meaningfully affect public opinion in the long- term: [https://news.gallup.com/poll/164714/history-suggests- shutdow...](https://news.gallup.com/poll/164714/history-suggests-shutdown- stakes-may-not-high.aspx)

</comment></comment></comment><comment><USER13> This is how my SO and I ended up in Canada.

The 2013 shutdown happened smack in the middle of our post-PhD job hunt. The shutdown itself 'only' lasted a few weeks and directly slowed down interviews at federal labs. However, the overall environment of uncertainty affected hiring well before—-and well afterward. It also spread beyond actual federal jobs to those that somehow interact with the government (contractors, companies with federal contracts, labs that get federal grants). Nobody wants to hire a new person just to lay them off a few months later, nor do people (especially those making academic salaries) want to jump into such a precarious situation.

So....I listened pretty carefully when someone from Canada made me an offer. The salary was maybe a touch low by US standards, but it was available _right now_ and likely to stick around. As a result, We have spent the past five years training Canadian students, building up Canadian labs, and so on.

We think about coming home: we miss our friends and families, it does get _cold_ up here, and living abroad can be strange. At the same time though, we do need steady jobs for ourselves and our research.

FWIW, I don't think we're particularly special in this regard. Only two people from my PhD cohort are still doing research in the US (1 academic, 1 industry). The rest have gone abroad or left research, in part due to the crazy career uncertainty.

</comment><comment><USER14> The point of the article is that the US Government employs people who do good things (science, medicine, etc.) and that capricious management(for example, government shutdowns or arbitrary censorship of research results) encourages them to leave government service and work elsewhere. This is not a new phenomenon but it is much more common under the Trump administration.

</comment><comment><USER15> It's understandable that there is a lot of attention on those affected by the shutdown, but what about all those who have lost their livelihoods due to illegal immigration? These are American citizens who rightly expect that their government that they pay taxes to will protect them. I keep hearing about "jobs Americans don't want to do", but I know several people who were driven from their trades due to this.

<comment><USER16> I agree that if illegal immigration is causing job loss to americans it is a problem that should be addressed; I admit I don't have much education on the subject. Do you know any studies to give hard(or even a range of) numbers of the effect of illegal immigration on american job loss?

<comment><USER17> Question: are you looking for facts to support your opinion, or are you looking for enough facts to determine what's happening with respect to illegal immigration & jobs in the U.S.? Because the story is complicated.

<comment><USER16> The latter. My opinion on the subject can be summarized as 'I dont know enough to opine, but if you have an opinion I'd like to see what you're basing that opinion on'.

</comment></comment></comment></comment><comment><USER18> Govvies do not build spacecraft, contractors do.

Oh, and the article even starts out that way: "and it keeps him in steady demand as a contractor at NASA's John H. Glenn Research Center"... and then immediately commits some slight-of-hand to start talking about the "civil service", i.e. govvies.

Is learning to be purposefully misleading a whole class in journalism school, or does it just come naturally?

<comment><USER19> I gotta ask: what the hell are you talking about? Can you demonstrate how this is misleading?

<comment><USER13> The argument may be that contractors aren't _technically_ government employees. As part of the shrink-the-government-privatize-everything mania, a lot of positions are now filled by contractors from Booz Allen, Kelly Services, and a million other firms, large and small. These people work in government facilities, often side-by-side with "real" government employees whose paychecks come straight from Uncle Sam.

However, this argument totally misses the point. Some of these contractors aren't getting paid either—and I'm not sure if contractors always get back pay. They are also limited in what they can—-and are allowed— to do without their government counterparts. Finally, the bigger picture is that these folks, along with federal employees, are part of a broader R&D ecosystem. Like a real ecosystem, if you keep destabilizing it, it'll eventually fall apart.

</comment></comment></comment><comment><USER20> Spacex has proven NASA's only purpose is military industrial. It is a money pit with poor results per dollar spent. National security has been made the only excuse for the SLS.

<comment><USER7> NASA has successfully landed eight spacecraft on the surface of Mars, millions of kilometers away.

Nobody else (not the Soviets, not the ESA, certainly not SpaceX) has done it even once.

[https://en.wikipedia.org/wiki/List_of_landings_on_extraterre...](https://en.wikipedia.org/wiki/List_of_landings_on_extraterrestrial_bodies#Mars)

<comment> saiya-jin true... and their budget for all this? timeframes?</comment></comment></comment>


Netflix functions without client-side React, and it's a good thing - <AUTHOR> https://jakearchibald.com/2017/netflix-and-react/ <comment><USER2> React is already championing this - React 16 has the new hydration function specially designed for exactly this kind of scenario. There is now complete and official support for the following paradigm:

* Write your app as React views

* As much as possible, render either the app skeleton or the full view on server

* Serve rendered HTML with async/deferred JS tags [https://reactjs.org/docs/react-dom-server.html](https://reactjs.org/docs/react-dom-server.html)

* Optionally hydrate the HTML with React whenever the JS is done loading. [https://reactjs.org/docs/react-dom.html#hydrate](https://reactjs.org/docs/react-dom.html#hydrate)

* If the current page is a static page and doesn't need JS, don't even bother loading any JS. Just use [https://reactjs.org/docs/react-dom-server.html#rendertostati...](https://reactjs.org/docs/react-dom-server.html#rendertostaticmarkup) to begin with.

</comment><comment><USER3> So Netflix homepage, not signed in, has no React. It is the page that doesn't even need React.

If you are signed in, then you will not see Netflix landing page and go straight to their app which has React.

I feel people are misunderstanding what Netflix meant in their tweet.

<comment><USER4> Reading the post helps address a misunderstanding about misunderstandings:

>> Netflix uses React on the client and server, but they identified that the client-side portion wasn't needed for the first interaction, so they leaned on what the browser can already do, and deferred client-side React. The story isn't that they're abandoning React, it's that they're able to defer it on the client until it's was needed. React folks should be championing this as a feature.

<comment><USER5> What they've done makes complete sense, and is probably the way more developers should start looking at SPAs.

The initial page load doesn't use React. It doesn't need it. Its a pretty simple page with a bunch of links and a couple of signup/signin buttons. Once you click one of these links, the subsequent pages load React in order to handle the richer client-side interactions on those pages.

Seems reasonable. React allows for a better User Experience than static pages, but at the cost of additional load time. So don't load it on the first page, when your users are most likely to bail, and then load it once you need it.

Maybe we're starting to see the pendulum swing back the other way. 3 or 4 years ago, we seemed to go from 'SPA Nowhere' to 'SPA Everywhere,' and now maybe we're settling on 'SPA Where We Need It'

<comment><USER6> Call me cynical, but I've a feeling that "SPA Where We Need It" would creep into being the static pages plus more and more snippets of jQuery scattered around as time went on, to "just make it do this....". Projects go that way. In other words, back to the bad old days with swathes of unstructured frontend spaghetti. Walked into a lot of those codebases on contracts.

</comment></comment></comment></comment><comment><USER7> With the risk of being downvoted, I would like to share my thoughts.

IMHO I find that many people on HN continuously seek for an excuse to not ship that product or that particular feature that caused them so many hours of frustration. I know the feeling. I have this feeling constantly because making software is hard! Some of our internal modules took me months to develop and get them right. Regardless of the language, regardless of the platform there always will be tradeoffs.

Let's not panic when companies like Netflix decide to remove React from their landing page. They have their own problems and they are certainly not my problems. Frankly, I consume Netflix on my TV so I do not care how their web page loads.

In terms of React, it has been a godsend for my business and if I have to I will pay for it. React is not the kind of thing you want to put in a simple application or to build a simple widget. React is useful when you build complex, state-aware applications in web technologies or mobile. Although I will choose to use React if I need to build the UI of Netflix, it is true that given that the UI is rather simplistic, it can be done better in a bit of javascript and CSS.

I have also looked into other technologies that are advertised as React alternatives such as Vue.js. My personal experience is that they do not even come close. They may have similar features but there are certain things in React and JSX that are just better and straightforward. Some of the applications we are currently working on (not public yet) are so complex internally that I cannot even begin to contemplate re-implementing them in anything else. The productivity gain will be negative in my opinion. We are constantly looking for alternatives but React for me is the best that fits my problem domain.

I hope this comment is helpful.

</comment><comment><USER8> TLDR: Clickbait

Let me fix the title for you:

"Netflix renders their landing page on the server. Preloads other code while you're signing in."

Revolutionary.

> A few days ago Netflix tweeted that they'd removed client-side React.js from > their landing page and they saw a 50% performance improvement.

Are you telling me that serving a small, cached HTML page takes less time than downloading and running a full-fledged SPA? Gee whiz mister!

> It caused a bit of a stir.

Nope, but it gave people a good laugh.

> the headline boils down to: less code was executed and stuff got faster.

You bet.

</comment><comment><USER9> Cant't wait for 2020: Did you know about this new cool thing? Render websites in back-end and cache them. It's super fast and non-taxing on the browser. It's clearly the future fo web-development!

<comment><USER10> At this point I fear it would take a strong carbon tax to achieve that.

Building inefficient systems is attractive when you externalize all that inefficiency onto other people.

</comment></comment><comment><USER11> Taken from this talk:

[https://www.youtube.com/watch?v=V8oTJ8OZ5S0](https://www.youtube.com/watch?v=V8oTJ8OZ5S0)</comment>


Simple solution to card fraud part 2: A primer on public-key cryptography - <AUTHOR> http://blog.rongarret.info/2013/02/a-simple-solution-to-credit-card-fraud_24.html

<comment><USER2> If the solution is so simple why is it so difficult to explain? Would it be too much to ask for OP to simply describe the solution? OP can, for example, assume we know what encryption is.

<comment><AUTHOR> > If the solution is so simple why is it so difficult to explain?

Many things which are conceptually simple are nonetheless difficult to explain, particularly to a skeptical audience. Relativity, for example, is conceptually very simple, but nonetheless hard to explain.

> Would it be too much to ask for OP to simply describe the solution?

Did you even bother to read the post you're commenting on? That is exactly what it is about.

> OP can, for example, assume we know what encryption is.

No, I can't. My blog has many non-technical readers. (And, BTW, knowing what encryption is and knowing what public key encryption is are two very different matters.)</comment></comment>


Ask HN: Find lawyer to review founder agreement? - <AUTHOR>

I'm starting a project with a partner as a co-founder. He is providing our seed money. We are putting together an agreement (compensation, equity, etc.).
The agreement appears to be written as I expected, but what should I do to ensure I am protected from getting screwed in the future?
Any ideas for finding a lawyer that specializes in these items and would be able to provide me with feedback? <comment><USER2> I don't know anyone better than George Grellas: [http://www.grellas.com/](http://www.grellas.com/)</comment>


Wikileaks data dump - <AUTHOR> https://file.wikileaks.org/file/ <comment><USER2> Is this related to Assange's announcement of (automatic) retaliation for disconnecting his internet?

<comment><USER3> No this has always been there IIRC, and they never release (proper) timestamps for their files so you can't know if something has changed unless you diff it.

They have released a few more emails from the DNC leak earlier today, but nothing major or new.

This is just the standard file dump where you can either download everything or torrent it.

There are tons of files there that are not even leak related like various Wikileaks promotions and "educational" material, as well as quite a bit of nonsense. It's simply a file mirror of the entire content of the wikileaks site excluding the serverside stuff.

</comment></comment><comment><USER3> What exactly is new here?

</comment><comment><USER4> 01-Jan-1984 01:01?

<comment><USER3> That's the usual time stamp for all their files.

</comment></comment><comment><USER5> That's going to take a while to download...</comment>


How a robot pharmacist wound up giving an overdose - <AUTHOR> https://medium.com/backchannel/beware-of-the-robot-pharmacist-4015ebf13f6f <comment><USER2> I work developing an internal company app that's already a little trigger- happy on the e-mail alerts (which are not at all life-and-death) and a lot of it boils down to an organizational/political malaise.

The most common problem is when the people _setting_ alert policies are divorced from the people _receiving_ them. The managers have no direct incentive to keep the alerts sane or moderated. On an individual basis, every alert that exists _shifts potential blame_ from the manager to the employee. ("It's all the employee's fault for not following the alerts.")

In this way, _over-_ alerting is often "automated micromanagement", but without even the feedback-loop and mutual-accountability of actual micromanagement. Until the people _acting_ on alerts have some feedback into the alert-configuring process, the problem will continue.

Another dysfunction is when people ask for alerts _purely for an independent paper trail_ , either because they're paranoid about assigning blame, or because they want to use their e-mail client as a half-assed searchable database.

P.S.: We've already had managers asking us if we could have e-mail alerts that users must confirm receipt of by visiting the website... and for the site to continuously e-mail followups until they do. Meanwhile, the IT staff have their own horror-stories of ancient inboxes grown too large to reliably read data from.

<comment><USER3> This is exactly it--nurses are usually not empowered to set alarm thresholds or delays, but physicians are. So, docs ask for the most sensitive settings they can (because they want that intimacy of care), but they're gone 15 minutes later and the rest of the unit has to deal with the fallout for the rest of the day.

<comment><USER4> Not sure what "intimacy of care" means, but most docs, like me, are frustrated and annoyed by the barrage of wolf-crying that comes out of these systems, of which Epic is one of the best and best-designed. (So far, all the others I've seen are FAR worse.) I WANT to see the meaningful alerts, but it's difficult to do with a sea of identical-appearing utter BS. Besides alert fatigue, there's a related problem with cognitive load. For this patient, I want to order A, B, C, and D. Now erect roadblocks in front of A, B, and C, and quite often D will fall by the wayside. By the way, I've never been able to set or even influence the alert policy. This was mandated by corporate risk management, whose policy appears always to be more alerts = safer.

<comment><USER3> We've seen alarm policies range from "Dr. X wants this to be the threshold on the patient" to "Unit policy is X, change during a PDSA cycle someday" to "Eh, this seems alright for this patient" to "silence as many alarms as reasonable".

I'm sympathetic to "it's corporate's fault", but instead of fixing _that_ problem I see a lot of folks lobbying for shiny new toys, meetings to stroke egos, and basically spending their political capital on being prima donnas instead of making their lives easier from an operations standpoint--and for the rest of the docs such as yourself this obviously is a problem. :(

The roadblocks bit is what it is--if doctors were better at prescribing medications and hadn't cowed their colleagues and nurses into a culture of "oh, well, I shouldn't say anything" then automated systems wouldn't be so compelling from a safety standpoint. As it is, they are undermined continually (as explained in this article) by the humans who have to work with them and who--as you've exemplified--don't trust them.

Let's face it: in the next 30 years, most physicians who are basically knowledge workers are going to be doing work very differently than they are today, most of it with heavy computerized assistance. You can choose which side of history you want to be on.

</comment></comment></comment></comment><comment><USER5> UX design, especially for medical software, is incredibly important and yet is rarely done by people who actually understand how to do it.

I remember when my mom had radiation treatments for brain cancer, which were so awful they killed her quicker than the disease would have (by a few weeks). A few months later I read about how terrible the design for calibrating these machines was leading to a large number of mis-treatments, my sister and I wondered what dose she actually received.

During the Vietnam war pilots turned off all the alarms in some of their planes due to constant alarms that always happened during intense combat situations leading to an inability of focus on what mattered.

UX design is not easy but has to be treated as more important than just making it pretty. Understanding how real people use these things is incredibly important and not just a last minute bullet check.

<comment><USER6> Sorry to hear about your mom. Do you have any references for the calibration design article? Also do you know the linear accelerator that was used?

<comment><USER5> No, it's been a few years.

</comment></comment></comment><comment><USER7> There are least two comments here already ascribing the error to incompetence; I expect more will come.

In my opinion, this is a _dangerous_ misperception. Hindsight is 20/20\. You saw one screenshot displaying the incorrect dosage; the doctors see "scores" each day, day in, day out. The brain is hardwired to ignore repetitive stimuli. Humans are smarter than computers overall but have a much higher error rate; "competence" can decrease that rate, but not to zero. There is _always_ a chance of a mistake.

The software could have been designed to make the probability of requesting a 38.5x overdose from the robot pharmacist _negligible_ , by reserving a special warning for extreme circumstances. This requires the programmers to do a non- shit (shall I say "competent"?) job once, but not constant vigilance by the doctor, who I'm sure can use the saved mental cycles to check for many other potential errors the machine can't handle _completely trivially_.

I expect a more thorough design overhaul would cause a non-negligible reduction in the occurrence of a wide variety of mistakes, dangerous and not.

<comment><USER8> There was a remark made by one of those involved, in the article, that EPICs alerting didn't differentiate between a 'trivial' alert, say "Dose is 1.02x maximum recommended dosage" and a much more critical "Dose is 38.5x..."

<comment><USER9> A scale would be useful:

         Recommended dosage
            |
        ----|-x</comment></comment></comment><comment></comment><comment>

vs

        ----|</comment><comment></comment><comment>x-

Also for mg vs mg/kg, that's a harder problem - off the top my head, get rid of the modes, and show both mg/kg and mg textboxes, with a radio button to select the one you want to edit. Edit it, and the non-selected text box is grayed-out and uneditable, and shows you the corresponding calculation (enter in mg/kg, and it shows you the mg amount of medicine; enter in mg, and it shows you the mg/kg ratio).

<comment><USER4> As a sanity check, what about showing the ordering physician a picture of 38.5 tablets? "Is this correct?" I think that would grab my attention.

</comment></comment><comment><USER10> FTA: "There is no difference between a minuscule overdose — going 0.1 milligram over a recommended dose — and this very large overdose. They all look exactly the same."

That here is the problem, right here. If we can have self-driving cars (which can look ahead and figure out the result of their actions), so can a system like EPIC. Why can't it calculate the probability of a Bad Thing(tm) happening, and suitable tag the alerts?

<comment><USER11> Maybe this is just a case of comparing a tech demo (the car) against a deployed system. Presumably hospital software will gradually improve in the future.

</comment></comment><comment><USER12> Confused about one thing, did the robot put 38.5 pills in a bottle, or did it formulate a pill containing 38.5 pills worth of meds into one pill, which the resident gave to the patient? I'm thinking sitting there and giving the patient 38.5 pills for the patient to swallow would have been considered unusual?

<comment><USER8> It attached them in 39 little bags to a loop of plastic. You can see the picture near the bottom. If I see 39 individual pills in 39 individual bags like that and am being told that I am to administer them, at once, to a patient, alarm bells in my head are ringing, as a paramedic. Swallowing 39 tablets like that is not fun for anyone, even aside from risks of OD.

<comment><USER9> I'm wondering about this too. I guess we'll have to wait until Part 3.

One other thing that went wrong here - through no fault of her own, the mom was in a different room with the brother. She knows what the patient normally takes, and would likely have started asking questions when she saw her son taking way more than what he usually took.

</comment></comment></comment><comment><USER3> A few different observations:

First, Epic does a lot of custom work--as noted in the article, each installation is "customized" to only have particular alerts. This makes it hard to count on a standard system behavior, _because there isn 't one_. This continued coddling of clients makes it very hard to introduce new software into the market, because you can't do it without deep pockets and sloooooow sales cycles.

Second, the physicians are very much overloaded with alarms and alerts--and instead of saying "Hey, let's figure out why we keep ending up with so many alarms" they instead do the short-term thing and just ignore or turn them off. The entire profession is rooted in split-second decisionmaking, for reasons I cannot fathom. They really, really, really want to be the heros that come in and save the day, and systematic approaches to operations optimization just aren't a priority.

Third, the data coming off of these things (and at work we've seen this) usually indicates large operational deficiencies. Unfortunately, you can't just tell the clients "Hey, you all are doing things wrong, and here's the proof", because they either won't care, or they will fire you and bring in somebody who keeps them happy, or they'll care but be unable to make changes because that introduces uncertainty into their line of work and that could hurt someone--nevermind all the existing casualties.

<comment><USER13> _The entire profession is rooted in split-second decisionmaking, for reasons I cannot fathom_

Because insurance companies, Medicare, and Medicaid reimbursements barely cover costs, so to be profitable they have to make it up on volume.

<comment><USER3> It's more fundamental than that, I think. It's core to the entire mindset of the profession.

If you compare the operators of decades ago with the sysadmins of the 90s and the devops folks of today you can see a rough path of evolution that hopefully medicine will follow: a last-minute heroic effort to save a system is a failure, not a victory.

</comment></comment></comment><comment><USER14> > (The computer symbol for swearing, #$@&%*!, was chosen because it's the > output when you're trying to type numbers but you've inadvertently engaged > the caps lock key.)

Did this used to be true? I have never encountered this. Holding down Shift, perhaps, but not caps lock...

<comment><USER15> Symbol swearing goes to at least 1900: [http://languagelog.ldc.upenn.edu/nll/?p=2483](http://languagelog.ldc.upenn.edu/nll/?p=2483)

Not sure about the Caps Lock thing though.

</comment></comment><comment><USER16> > Like many other physicians, pharmacists, and nurses, Jenny Lucca found > alerts to be a constant nuisance. Even giving Tylenol to a feverish child > every four hours triggered an alert that the dose was approaching the > maximum allowed.

You know, given what we know about the liver toxicity of acetaminophen/paracetamol at this point, not sure this is the best example of a spurious alert. There's a good argument that this is one of the more dangerous drugs OTC, in part due to the widespread impression that it's not very dangerous.

It is interesting looking at the story in general as an example of alert fatigue, though, and the need to differentiate different types of alerts.

Unlike some of the other comments I see here, I don't think this points to incompetence so much as human nature. It takes a fair amount of cognitive power to overcome the natural tendency to assume that when the alert was spurious yesterday, it's not spurious today.

That power would be better spent elsewhere, and points to a failure of automation to truly lighten the load.

<comment><USER17> Not "exceeding the maximum dose" just "approaching the maximum dose".

"Hey, you're almost taking _exactly_ the amount of this thing we say you can take. Watch out!" is pretty much the definition of a spurious alert to me. It's telling you that what you expect to happen is happening.

<comment><USER16> Well, yeah, except pills up the amount in steps--it's not like turning a dial. So you'd want to warn before they can give another dose of medication that would take you over the line. Really depends on how far off the line the warning is.

But either way, in this case I'm pretty sure Tylenol was stressed in the article because it was an example of an innocuous medication, which it really kind of isn't.

</comment></comment></comment><comment><USER18> Serious cliff hanger on this article, with the second part of how it actually made the mistake held off until tomorrow. Reminds me of one of those old tv shows...

</comment><comment><USER19> > Computer experts call this type of problem — when the same action can result > in two very different results — a "mode error," and it is especially > problematic when the user is not focused on the mode (in this case, mg > versus mg/kg)

Terrifying example of one way AI or computer-augmented decisions can go horribly wrong. A "Mode error" is at the core of the difference between intelligence and common sense.

</comment><comment><USER20> I'm torn on this. On one hand: we can see the process, and clearly identify a number of mistakes in the software that led to this problem. Serious mistakes, that need to get fixed. And on the other: while this was an error that wouldn't happen without computers and robots, it's clear that this process will _reduce_ the number of overall errors, saving peoples lives. But it's a different set of people.

This is similar to the "Trolley Problem" ethical thought experiment—we have a computerized system, that will save a lot of peoples' lives—at the cost of others, who wouldn't have otherwise died. It's a hard problem, with no easy solution. See: [http://en.wikipedia.org/wiki/Trolley_problem](http://en.wikipedia.org/wiki/Trolley_problem)

</comment><comment><USER21> While I absolutely agree computers, UIs, and systems in general can stand between a patient and an error, can we just stop and acknowledge how incompetent the doctor was for prescribing 38 instead of 1 double strong dose?

The UI screenshot in the article makes that mistake VERY clear, and their "are you 100% sure" question is obviously intended to illicit a particular response (who is ever really 100% sure of anything?).

I know this article is about how systems can be altered to protect patients, but much like with the NTSB's findings, sometimes it legitimately is pilot error (or doctor error in this case).

Can things be better? Yes. Absolutely. But so can doctors. These types of systems are stop-gaps, without them this doctor could have calculated the wrong dose by hand and made just of large of a mistake.

<comment><USER22> Yes, the doctor and pharmacist and administering nurse failed here. But that is not useful. The useful bit is why they failed, and that seems to be a mix of "busy" with "software sucks".

The doctor didn't order 38.5 tablets -- at least she didn't think she was. She thought she was ordering a dose per kg, not a quantity of tablets.

You say the screen is very clear. It's clear enough when I read it. I had a good night's sleep and I am alert and awake. I've been primed by the article to look for the error. I imagine I would easily miss the mistake if I've been working hospital wards for the last 10 hours on a rolling nightshift, looking after some very ill patients.

The fact that it's possible to use two entirely different dosing systems to order medication and have the screen not clearly indicate[1] which is being used is so obviously sub-optimal I'm kind of surprised to see anyone saying that it's "just pilot error".

<comment><USER23> > She thought she was ordering a dose per kg, not a quantity of tablets.

Actually, she thought she was ordering a single dose at 160mg, and accidentally ordered dose per kg. 160 was the size of the dose, so the patient's weight became the number of pills.

</comment></comment></comment><comment><USER24> Pharmacists shouldn't be "clicking through" alerts. They should have a separate, joystick style device with an actual trigger (bright red). That trigger, and that trigger alone, can dismiss an alert.

Seriously, what would that cost, like $20? (Obviously there are a lot more things wrong with this system than just using a mouse for too much, but this would help). We should be willing to invest more in our machines: [http://www.loper-os.org/?p=861](http://www.loper-os.org/?p=861)

<comment><USER25> And if they are beset with hundreds of mostly innocuous alerts a day, the low signal/noise ratio of the alerts and their sheer quantity will train the pharmacists to press that button just a bit more blithely each time. That leads one the believe the correct course of action is to reduce the number of alerts but then that was at least part of the cause of the incident related in the article.

My wife is a Pharm.D. at a hospital (that coincidentally is currently installing Epic). I know she worries (obsesses even) over the possibility of making an error that hurts or kills someone. I'd like to think other people doing that work feel the same way. Even if she can get three or four nines worth of confidence in every decision she makes however, that leads to some unfortunate probabilities when multiplied out by a career's worth of decisions. We can improve the technology to reduce the chances of significantly negative outcomes but they will always be non-zero.

I don't envy her or the programmers working on systems like Epic. It's messy work with serious consequences.

<comment><USER24> Reducing alerts is way more important than my idea, I totally agree with that.

</comment></comment></comment><comment><USER4> My proposal: usability experts should identify an acceptable range of alerts on a per-order, per-encounter basis. End-users of all disciplines should have the opportunity to provide feedback in real-time, in the live environment. Just like Amazon reviews, "Was this alert helpful?" If you always vote "no", your feedback will be down-weighted. With a few exceptions, like wrong patient or 10x overdose, all the other alerts will be ranked in order of utility and only the top x% will be shown.

</comment><comment><USER26> I wonder if somebody could build a bayesian filter for Epic alerts.

If we can filter out the Nigerian prince scams from your email, why not apply that to save lives?

<comment><USER27> I suspect a great deal of lurking complexity and privacy concerns there. What's spurious in one case is critical in another, and the difference lies in HIPAA-sensitive data.

</comment></comment><comment><USER6> This is why you must always always be at your kids beside and if you are in the hospital, always have a friend with you (if you are in the hospital and otherwise not capable), who can double check and ask questions on your behalf every time.

</comment><comment><USER28> The title of this is basically false. The humans gave the overdose, the robot merely processed the order.

</comment><comment><USER29> Give me a break. The system has alerts and it spells out the exact dosage in tablets in a dozen places, which is then apparently seen by at least three people.

If these people in the course of their work choose to ignore alerts, are distracted and not actually doing what they were hired to do (hint: theres a reason there were three humans in the chain here), the fault lies on them, not on the software.

You obviously can't have it both ways. We call it automation because things will happen automatically. At the end of the day, this system probably causes significantly less problems than the _old_ way of trying to read some doctors handwriting only to pick up the wrong medicine regardless.

<comment><USER30> Really, you think the UX of those screens is in anyway clear or that the alerts shouldn't be color coded or differentiated by thresholds from "hey this looks like it might be an error" to "this is out of the realm of possibility, do not pass go, do not collect 200, correct this immediately"

<comment><USER29> All I'm seeing is that the salient information is on the UI in at least three places. It spells out the freaking calculation.

So clearly, these people simply didn't look. Not once. In their perpetual multitasking frenzy that any hospital staff seems to be in, they didn't do the actual task. I'm reasonably sure that you can color code or flash whatever yo u want and they would still miss it if that's the way they work.

<comment><USER31> A graphical representation of the dose relative to the patient weight or the dose prescribed relative to the recommended dose would be a great way to help users from accidentally making this mode error.</comment></comment></comment></comment>


Are Google employees more productive because of company perks? - <AUTHOR> https://www.quora.com/Are-Google-employees-more-productive-because-of-company-perks?share=1 <comment><USER3> Xoogler here; this information is circa 2015.

The infamous perks are low-order bits for personal productivity. For example, on-site food is nice, but making it free actually hurts productivity: larger crowds so you spend more time waiting, you are more likely to travel between different cafes just to sample things, etc.

However company-wide these are much more valuable because they improve recruiting and especially retention. Nothing hurts productivity like employee turnover! This is why they are a smart investment for the company.

As for personal productivity, these were the biggest perks:

1\. The shuttle. This gave me effectively two additional hours working instead of driving.

2\. Fast hardware. I had a 64 GB Mac Pro, plus laptops and dev servers. Sweet!

But there were also "anti-perks" that hurt my productivity:

1\. Cramped and ghastly loud open office (building 40). It was difficult to focus.

2\. Insufficient physical space. My job required wiring up a lot of PCBs and prototype hardware, but I had the same desk as someone just writing code. I had to "swap" my physical setups.

3\. Highly distributed team. Having key team members in Asia meant ~16 hour cycle time for questions, code review, etc. (Plus expect to spend a portion of each meeting fighting with VC.)

However if we take productivity as literally "producing valuable things" and not false metrics like LOC or bug fix count, then IMO these were the highest company-wide productivity killers:

1\. Leadership churn, leading to project churn and cancellation. Not the healthy reevaluation of underperforming projects, but rather arbitrary "make a mark" changes associated with new directors/VPs.

2\. Performance review over-weighting "creating something new" leading to unnecessary duplication. A Googler who creates a (say) new build system excels the one who adapts an existing build system. This is visible all the way to the product level, e.g. their many chat apps.

<comment><USER4> I've had offsite food before and onsite food. Yes onsite food comes with queues, but meet up while working + queue + eat still beats the hell out of travel + meet up while waiting + travel + queue + eat + travel.

In my experience, onsite food (free or cheap) is often 30 to 45 minutes. Offsite food starts at 45 minutes and can be occasionally up to two hours and this is mostly out of your control.

I imagine this is pretty dependent on the exact area you work in though.

</comment></comment><comment><USER5> I don't work at Google, but I think their productivity comes from not wasting time. I had some interactions over the years so here is what I have noticed (might not be true, might not be all, might depend on the teams I interacted with).

There seems to be a lot of effort to remove day to day time wasters in small things.

Then, if you think about it, having subpar teammates is also a waste of time. They are not only wasting their own time but also everybody elses. So making sure you don't let people with IQ less than certain threshold is also important for everybodys productivity.

Solving a problem once is extremely important. Instead of reinventing infrastructure for each and every project at the company as many companies do (mine, one of the largest banks in the world, in my team there are still people who are devoted to maintaining a handful of servers running Windows -- including completely custom everything from project structure, to build, to configuration mechanisms, everything reinvented for the project). Solving a problem once also means you can focus on a single problem because you are solving this problem for an entire company.

If you do Agile right you get to the part at the core of the process where you mercilessly optimize your process. I think most companies talk about Agile where Google is one of the very few that actually do it.

<comment><USER6> I was surprised at how much time _is_ wasted. Lunch is free of cost, but because there are long lines at times it can take easily 15 minutes of wait time, and that doesn't even count time spent going to a cafe in a farther building, rounding up coworkers to go with, etc.

<comment><USER5> Time is wasted when a team works for years on something that ultimately is not bringing value to the company because the vision was not clear or execution was pitiful. Time is wasted when everybody repeats same thing without enough benefit. Time is wasted when you are working on a project while you could do something else with better return for the company.

That 15 minutes in line? Well, you probably had to stand up and socialize anyway...

</comment></comment></comment><comment><USER7> Some of the comments here suggest that the Google's perks are bad because they corrode work/life balance and encourage employees to stay longer.

Having worked at some of the FANGs, I can say that this effect of these perks on work/life decisions is very very small. Most people enjoy the perks and do what they were going to do anyway. Most of my teammates won't stay for free dinner because they'd rather spend time with their friends and families. Most people work from home all the ~once/week.

When work/life balance is bad, it's because of a desire to perform or managerial pressure; not because you get free food and an on-site dentist. Generally the perks are conveniences and genuinely nice to have, and if they are part of a sinister plot to exploit workers, they are pretty bad at it.

</comment><comment><USER8> Does anyone else thinks this question is not well defined? Because, 1\. How do you define employee productivity? 2\. How do you know that Google employees have more productivity as opposed to other companies?

The analysis becomes even more convoluted when "employees" encompasses everyone from engineer to janitor to executive.

<comment><USER9> Also, one possible answer is that the perks don't make the employees more productive, but they attract more productive employees.

</comment></comment><comment><USER10> What evidence points towards higher productivity at Google? In my opinion, this is largely a myth.

When Google acquired Motorola, snotty Googlers paraded around claiming to be at least 2X smarter than the average Motorola employee. They publicly proclaimed to turn around a sinking ship and produce iPhone killers, emphasis on plural, within a few quarters.

But none of that famed productivity or genius amounted to measurable results.

An objective analysis will reveal that Google's main business - <USER2> advertising- has been so damn profitable for them that they've absorbed hundreds, if not thousands of failed projects burning billions. One might argue that any other company with the ability to subsidize this this kind of failure will churn out scores of projects with little chance of success, projecting an image of productivity.

Ponder on this for a moment, if everyone outside core advertising, AI, YouTube and Android are fired from Google tomorrow, their revenue and profit will barely budge. What % of Google do to think work on those products? So how productive do you deem the average Googler is?

</comment><comment><USER11> I'm guessing that, even if it wasn't more productive, the perks help keep Google employees at Google and not, say, at a competitor.

</comment><comment><USER12> A lot of the answers say yes, but I would say no. One of the answers touches on what I think might be the real cause for high productivity:

> The problems you work on are new and interesting

> The people you work with are smart and helpful

I would add the great infrastructure, which is probably the main reason.

But none of these are perks that folks usually think of when they think of Google perks.

</comment><comment><USER13> I feel as I would hate to work there.

They are creating all these things to make it a 2nd home for people. They want people to be there a LONG time.

I'm happy with 40hrs with some days remote and I don't think I could switch to googles approach.

<comment><USER14> But you have no idea that you wouldn't be able to continue with your 40hrs and some days remote if you had a job at Google. There are lots of people who have a positive work/life balance at Google. Some take advantage of some perks, some others, and some don't use very many at all, but the fact is that there are many perks available catering to a huge spectrum of desires, whether that means fitness, food, social, cultural, technology, or financial.

Just because Google offers onsite laundry and serves three meals a day doesn't mean employees _have_ to participate. But having them makes it a more appealing place to a broader range of potential candidates, and a friendlier place for employees, too.

<comment><USER15> Do people who work 40 hours a week get promoted?

<comment><USER16> Working long hours has zero to do with getting promoted.

</comment></comment></comment></comment><comment><USER17> Not covered in first answer: you could leave at 6, but if you stay till 7 there's a roast dinner. I suspect people who still work at Google are sometimes a little blind to their own behaviour.

<comment><USER18> Young, brilliant programmers but still totally dependent on the approval of their peers - to the degree that they not only work very late to get food, they stay even longer to avoid someone judging them.

I bet they even make excuses before leaving at 8 pm... Its really very sad that smart human beings act like that due purely to social pressure.

<comment><USER19> So is this something you've experienced personally, or is it just speculation?

</comment></comment></comment><comment><USER20> Quora sure does take in a lot of data.

<comment><USER21> What's this comment getting at? I don't follow.

<comment><USER20> Quora compels users to hand over sensitive personal data, combines that with any other data it can, makes mental health diagnoses on its users, and generally offers creepy content.

</comment></comment></comment><comment><USER22> Journalism/editing tip: Never start a headline with a question. And definitely never start a headline with a question that can be answered: "No" by a reasonable guestimation.

<comment><USER23> How did that come to be a best practice? I like titles with questions because they can frame the scope and objective of the article really well.

<comment><USER24> In journalism, the argument is as follows: If the answer to the question is "yes," it is a stronger/more authoritative headline to simply assert instead of pose a question.

Therefore, any headline that poses a question will result in the answer being "no."

It doesn't apply in this case because it's a Quora question and not an editorialized piece of journalism.

[https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headline...](https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headlines)

<comment><USER23> Interesting, thanks</comment></comment></comment></comment>


I woke up in the morning and decided to quit my job... - <AUTHOR> http://www.bahadir.io

<comment><USER2> A good read. So you used to work in the US, but you were born in Turkey and now live/work in the Netherlands? You sure do move about ;-) How do you like working in Amsterdam vs the US?

<comment><AUTHOR> I've never worked in the US.

<comment><USER2> Ah, I just assumed you quit your US job and talked with a US immigration lawyer about a US entrepreneurship visa.

<comment><AUTHOR> I would definitely not return back from US to Netherlands to start a company :)

</comment></comment></comment></comment><comment><USER3> Wow.. quote of the day!! "Happiness is not external. Happiness is a perception. Happiness is within. It's up to you. You either choose to be happy or not. Yes, that simple."

<comment><AUTHOR> Glad you liked it.

</comment></comment><comment><USER4> I noticed in the blog post you started with RoR but now you're looking for Python/Tornado devs? What happened there to make you switch?

<comment><AUTHOR> Btw, we did not started Followords with RoR. Started with Python/Tornado from scratch

<comment><USER4> Oh. I assumed you started with RoR since that's what you mentioned in the post. How would you compare development between RoR and Tornado?

<comment><AUTHOR> I mentioned RoR, because that was what I've used in my previous project.

RoR's learning curve is much more higher than Tornado. I don't even think that is fair to compare those two. IMHO, RoR is more suitable for apps that requires lots of objects, views, etc.. E.g: A business app or a website.

In our case, we don't have that many tables, but lots of code around it and our app also runs on top of a single page. All the rest is taken care via AJAX.

One more factor in our decision was simplicity. You can easily dive into Tornado's code ( web.py ) and understand, whereas in RoR you need to read a lot of code, and Ruby is also making it harder to find out the flow of the code with its advanced concepts ( was called extends I believe )

And I am not a big fan of Active Record as well. We use PyMongo to communicate directly with MongoDb.

Tornado's Asynchronous abilities also an advantage.

Also I did not have that much of experience to use RoR in full scale, and if I got stuck on something, I need to read a lot and I don't like that.

<comment><USER4> Interesting. Those are all reasons I've stuck with Python frameworks over RoR as well, although I haven't used Tornado. Thanks for the opinions.

</comment></comment></comment></comment></comment><comment><USER5> I see that you have more opportunities in Netherlands than Turkey for a startup.

</comment><comment><USER6> broken image on your site - <http://followords.com/static/img/followords_on_ipad.png>

<comment><AUTHOR> thanks zoidb

</comment></comment><comment><USER7> Good post, encouraging

<comment><AUTHOR> thanks ozuolmez</comment></comment>


OFFER HN: Rooms in ... - <AUTHOR>

Let's make a collection of rooms available in various cities for easier browsing. <comment><AUTHOR> To start off: I'm offering a room in Sarajevo. Feel free to mail me at email@example.com

<comment><USER2> Wow, really cool. I am very interested in the history of that part of the world. Looks like a lovely place to visit.

</comment></comment><comment><USER3> This looks like a freeairbnb.com in the making.</comment>


Echo: A fast HTTP router and micro framework in Go - <AUTHOR> https://github.com/labstack/echo <comment><USER2> I don't understand why people keep reinventing routers even though routing doesn't take much time anyways, especially in a compiled language like Go.

Most APIs seems to respond within 20 to 200ms. Even if you take 1ms to route stuff, what's the point in spending so much time in trying to optimize routing instead of SQL queries, cache layers or developer productivity with a nice ORM ? Trying to squeeze nanoseconds out seems pointless to me at the moment, especially since newcomers to Go end up seeing 20 different routers and might not know where to start.

I'm genuinely wondering.

<comment><USER3> It's particularly jarring for me given that whenever there's a post about someone moving away from Amazon and seeing significant performance and/or cost benefits the HN zeitgeist tends to be rubbishing it as too much work for the benefit, but endlessly re-solving the same problems over and over in software for much smaller gains tends to be wildly applauded.

<comment><USER4> If 80% of posters on a thread about diets say vegetarian is healthier, and 80% of posters on a thread about fun recommend riding a motorcycle, it doesn't follow that there is a single HN zeitgeist saying both things. A simpler explanation is that there are two groups which speak up in different situations. Those groups don't necessarily overlap much.

</comment></comment></comment><comment><USER5> I didn't want to release this today... but there we go. Gin will also be a zero allocation http router.

[https://github.com/gin-gonic/gin/issues/249](https://github.com/gin- gonic/gin/issues/249)

<comment><USER6> Awesome! Gin is really the best go webframework at the moment. Fast, easy to use and is being maintained and improved upon!

</comment></comment><comment><USER7> Interesting approach. I guess there are use cases where the small number of allocs of some of the other routers is enough to cause problems.

I'll definitely stick to httprouter as my default starting point, though. The params interface is much nicer, and it's pretty damn good with performance and allocation count: [https://github.com/julienschmidt/httprouter](https://github.com/julienschmidt/httprouter)

<comment><USER8> We're also using httprouter and so far have been pretty happy with it. The lack of middleware isn't really an issue, you can inline the key stuff (Gzip, logging) yourself from other sources.

<comment><USER9> It isn't too difficult to add basic middleware support. We actually wrote a tiny framework[0] around httprouter for that to use on our API servers. It works pretty well.

[0] [https://github.com/VividCortex/siesta](https://github.com/VividCortex/siesta)

</comment></comment></comment><comment><USER10> It is interesting and surprising how many allocations per request other frameworks do, from 100s to 10000s.

They're sort of cheating by having a pool, and sort of punting with things like "// MaxParam sets the maximum allowed path parameters. Default is 5..."

<comment><USER11> How is that cheating? That's just how you program without allocations.

<comment><USER10> Pool allocations are still allocations. If you look at the implementation for Pool.get, it works a lot like malloc:

[http://golang.org/src/sync/pool.go](http://golang.org/src/sync/pool.go)

I've programmed without pools or allocations, where everything had statically allocated storage. Both for microcontroller firmware, and telephony software. It's noticeably harder.

</comment></comment></comment><comment><USER12> I'm curious what they did different than httprouter to remove the allocations, or if they trick the benchmark tool by reusing memory with a pool.

<comment><USER13> Looks like its using a `sync.Pool` to amortize allocations.

[https://github.com/labstack/echo/blob/master/echo.go#L17](https://github.com/labstack/echo/blob/master/echo.go#L17)

<comment><USER12> I noticed that, I didn't verify where it was used. It's smart, although it cheats the benchmark... kind of. =P

I'm always suspicious of usages of `sync.Pool`, it's easy to reuse things that aren't reset properly and end up with subtle coupling between requests.

</comment></comment></comment><comment><USER14> It would have been nice if the library conformed to http.Handler. That has nothing to do with routing yet whenever a new router comes out, it's non- idiomatic. I'll take free performance anyday but not if I have to rewrite code.

</comment><comment><USER15> I'm curious as to why they chose to use a separate echo.Context. Why not create a type with an embedded io.ReaderCloser and a map[string]interface{}. Then replace the req.Body (it's a io.ReaderCloser) with the custom type. You could then write methods that take a http.Request to add/delete/modify the piggy backing context field. No need to have a Context type in your handlers.

</comment><comment><USER16> It appears to be storing routes in a tree structure allocated via struct literals in router setup. I'm imagining that if performance is relying on them always being on the stack, that would be an implementation detail of the Go runtime and may change.

Looks like a decent implementation, but aesthetically I dislike monolithic "frameworks" (eg: "echo.New()"). The "Go way" is to write small composable libraries, not opaque frameworks. Gorilla would have been a good model to draw inspiration from.

<comment><USER17> > I'm imagining that if performance is relying on them always being on the > stack

In which case can it make a performance difference if memory is on the stack or somewhere else in memory?

</comment></comment><comment><USER18> What do you mean by zero memory allocation? The title seems contradictory. You have to allocate at least some memory for a program to run.

Do you mean it doesn't allocate any memory per request, it just uses pre allocated memory?

<comment><USER19> Yeah, seems like a sensationalist title tbh. The project README doesn't giving any info to support that claim as well.

It doesn't make any sense.

<comment><USER20> The benchmark section in the README clearly shows the echo router to be the only one of all benchmarked routers that has exactly 0 allocations per request.</comment></comment></comment>


Live Chat with Amazon Support - <AUTHOR> http://i.imgur.com/IDFkz82.png

<comment><USER2> Very good :-)

Similar to this one: "Sainsbury's in hilarious pun-filled Twitter chat"

[http://www.mirror.co.uk/news/weird-news/sainsburys- twitter-f...](http://www.mirror.co.uk/news/weird-news/sainsburys-twitter-fish- puns-hilarious-3010949)

</comment><comment><USER3> Excellent support, hope more store have that kind of attention

</comment><comment><USER4> Nice, but why are Norse gods speaking in Old English?

</comment><comment><USER5> we reddit yet</comment>