Sadly, Pandora Is Still Going Bankrupt - <AUTHOR> http://www.michaelrobertson.com/archive.php?minute_id=298 <comment><USER2> Let's get this logic straight: I promote your songs 1 billion times to people, and I'm willing to give you 25% of what I make. Yet, you want more to the point that I go out of business and you get 0% revenue and promote your songs 0 billion times.

They wonder why we pirate songs and they're losing money.

<comment><USER3> Let me get this straight: you think the terms under which I'm willing to provide a service for are egregious, and I'm unwilling to negotiate, so you're simply going to take what you want.

Your critique of the industry would be more trenchant if it wasn't tipped with rationalization. Books are pretty expensive too. Authors --- publishers, even --- make virtually no money on most titles. And yet! They won't make them available for free download! Let's take the books, too!

<comment><USER4> The music industry can stand on "principle" (that's what they call their sclerotic conception of their own self-interest) all they want. It couldn't be clearer that reality is speaking otherwise. They seem to me like an angry guy standing on a rock, shaking his fist at the tide rising around him. Pretty soon they'll be washed away. It reminds me of what Martin Amis said to Salman Rushdie after the fatwa: "It could have happened to a nicer guy."

The spectacle of the music industry portraying itself as "good" and music fans as "evil" is a great comic irony of our time.

<comment><USER3> I agree with you. But I can agree with what you're saying and still be repelled by the logic of stealing nonessential goods that are being sold on what we think are unreasonable terms.

<comment><USER5> The real losers of the battle are the artists, not the labels (they still make plenty) or the freeloaders.

<comment><USER3> That this is obviously true has, I'm sure you can see, no bearing on the original argument.

</comment></comment></comment></comment></comment></comment><comment><USER6> Well, that's what happens when you pin your business model on content you don't own.

It sucks, because labels and consequently artists will be missing out on the revenue and promotion that might come from wider web broadcasting.

<comment><USER7> Good observation. I was listening to Chris Anderson's Free on the commute home, and an interesting case he mentions is how, back in the XIX century, radios created their own label, BMI, so they didn't have to pay royalties that would render their business model completely inviable.

I think that whoever succeeds in this area will do something very similar, working with indie artists from the very beginning, maybe even producing their albums.

<comment><USER8> Lawrence Lessig also talks about that case in this great TED talk: [http://www.ted.com/talks/larry_lessig_says_the_law_is_strang...](http://www.ted.com/talks/larry_lessig_says_the_law_is_strangling_creativity.html)

</comment></comment></comment><comment><USER9> Pandora is charging $0.99 for premium accounts that let you listen to over 40 hours/month. That's $.025 per hour (less if you listen more). People pay $3 for a 10 second ring tone.

Charge more!!!!! People love and highly value your service. There are many, many people who would rather pay $5, $10, $20 or more per month to ensure that Pandora stays alive. How about limiting the number of songs you can listen to on the free iPhone client and selling a premium client for $9.99? They have 200K iPhone users.

I love Pandora, but they're not trying very hard to monetize.</comment>


How to assess a job offer from a startup - <AUTHOR> http://www.braithwaite-lee.com/weblog/2005/03/are-you-thinking-of-working-for-start.html <comment><USER2> Updated link:

Are you thinking of working for a start up?

http://weblog.raganwald.com/2005/03/are-you-thinking-of-working-for-start.html</comment>


Dropbox Pitch to Sequoia 2007 - <AUTHOR> https://relayto.com/dropbox/rBWSeSFA/slides?hub=dropbox-investor-resources-5a93c45d19eb9 <comment><USER2> Deep OS integration, visual feedback, doesn't change the way you work. As true then as it is now...

</comment><comment><USER3> It's remarkable how similar the business is 10 years later

<comment><USER4> Agreed. I think its a testimony to how well they understood the market potential.</comment></comment>


Show HN: Uilicious Snippet – Catch, replicate and share website bugs - <AUTHOR> http://snippet.uilicious.com <comment><AUTHOR> Hi Everyone, creator here.

The idea behind this, is to allow users to write clear test scripts, and bug reports that can be easily understood, repeatable, and most importantly publicly sharable!

Normally, writing bug report could be tedious or inaccurate. Sometimes the developers maybe unable to replicate the bug even with the steps provided! Now, users can simply attach the shareable link that contains the test results where the developers would be able to view it immediately. And rerun the test after fixing it.

Some notable examples,

youtube downtime - [https://snippet.uilicious.com/test/public/RuGwPjbwFX1QU5EVhv...](https://snippet.uilicious.com/test/public/RuGwPjbwFX1QU5EVhvNHZu)

product hunt title bug -[https://twitter.com/picocreator/status/1056148538411769856](https://twitter.com/picocreator/status/1056148538411769856)

Feel free to ask / clarify anything here =)</comment>


Julian Assange to run for Australian Senate - <AUTHOR> http://www.abc.net.au/news/2012-03-17/julian-assange-to-run-for-senate/3895958?WT.svl=news4

<comment><USER2> Ridiculous!! I would guess this is a PR stunt.

</comment><comment><USER3> I hope he wins giving this guy diplomatic immunity should be a fun little experiment. I want to see what the US is going to do.</comment>


Ask HN: How to describe my role in the most effective way - <AUTHOR> Today I decided to revamp a bit my Linkedin profile and I'm extremely unsure about how to describe the point where I am at in my career in a way that doesn't sound partial, silly or that just fails to convey my value as a professional.
Since there's a lot of recruiters and in general people smarter than me here, I guess I could ask for advice.
Disclaimer: I'm not actively looking for a new job... maybe open to find out what life has got for me.<p>So the key point is that I have a mixed profile. I speak 6 languages. Traveled a lot and covered several  project management-like roles during my early career. Later on I pursued my passion for tech, learned the CS basics and how to code while working 9-5 and eventually landed a job in ICT (healthcare IT). Because of my peculiar profile, I was put in the interoperability team. I started doing dev-ops and development while at the same time taking on project coordination and design tasks. Basically tech transfer. I also manage 3 devs at one of our foreign offices, write technical chapters for public tenders and do the technical feasibility and analyses for new projects.
Two years later, I am somewhere between a presales engineer and a junior architect.
How does this sound to a recruiter's ear? How would you make it concise and suitable for a CV? Thanks! <comment><USER2> If you are not actively looking for a job I would recommend identifying what kind of job you might want. Use that to inform your summary.</comment>


HTC Vive Pro - <AUTHOR> https://www.vive.com/us/product/vive-pro/ <comment><USER2> Does anyone else see a Buy Vive button that does not seem to work? I am interested in buying the wireless receiver (and possibly a vive pro). I saw it at CES2018 and it seems to use 802.11ad. I wonder if it comes with both the receiver and the packet router for the pc or if you need to buy your own wireless router. FYI I'm using firefoxDev edition, the button doesn't seem to pop up for me on chrome.

<comment><USER3> I am experiencing this. The button does not appear on Chrome.

</comment></comment><comment><USER4> This looks really interesting as it will be the first headset where you don't notice the pixels.

<comment><AUTHOR> Super exciting for sure. I wonder what the requirements will be. I kind of assume I'd need to double down on second GTX 1070 to be able to run in 60fps.

<comment><USER2> Isn't the goal to have 90fps? 60fps would probably induce nausea.

<comment><USER5> The screens used don't support variable refresh rate and double buffer everything. If you drop below 90fps you are getting a 45fps lock with Asynchronous Warp cheating Frames to remain at 90hz. If you aim for 60 you get 45. The Async Warp effect has bad side effects outside of stationary / tripod like movement. Your view shifts correctly, but everything inside your view stutters. If you imagine being in a VR Rollercoaster, your head would move and interpolate 90hz, but the rollercoaster would only update every 45hz.

VR really sucks in the sense that if you don't get the full experience, only having 80% or 90% may induce nausea or rip you out of the experience.

PC Perspective has great articles on this, going into every detail.</comment></comment></comment></comment>


Over 60% of employees are happy at startups–far outpacing FAANG and MSFT - <AUTHOR> https://angel.co/blog/over-60-of-employees-are-happy-at-startups-far-outpacing-faang-and-msft <comment><USER2> It seems the startup half of the survey was ran on Angel while the FAANG/MSFT was using a larger or more diverse data set from Blind. Unless I'm missing something this seems like a huge selection bias, since people actively focusing on startups (indicating this subgroup makes them happier) are more likely to be interested/happy with the work they find.

</comment><comment><USER3> I had the impression that Microsoft treated its employees particularly well. Maybe things have changed since the 1990s.</comment>


Nintendo Revives Game and Watch Retro Super Mario - <AUTHOR> https://www.theregister.com/2020/09/07/nintendo_gameand_watch_revival/ <comment><AUTHOR> Not available outside Japan it would seem :(</comment>


Kiddicraft, the Company Lego Ripped Off to Make Plastic Bricks (2014) - <AUTHOR> http://birthmoviesdeath.com/2014/02/06/kiddicraft-the-company-lego-ripped-off-to-make-plastic-bricks <comment><USER2> Kiddicraft was infact a variant of Minibrix[1]. None of these were "big-bang" inventions but rather a series of iterations that resulted in the bricks we have now.

[1] [http://www.powerhousemuseum.com/collection/database/?irn=108...](http://www.powerhousemuseum.com/collection/database/?irn=108980)

<comment><USER3> But without one of them hiring enough lawyers to end up looking the inventor, we'd have nothing. Right?

<comment><USER4> Thank God for patents, without them this invention clearly wouldn't have had the human willpower to do it at all.

But with patents, yay! A few aggressive apes got rich and everyone else got to play with the invention. Capitalism ROCKS.

</comment></comment></comment><comment><USER5> I wonder if the person who wrote this article understand patents, at all. I don't see any indication of that. He seems to be implying something untoward happened.

EDIT: I didn't see the comments before (they take a while to load) - the first comment on the article sums things up pretty well I think.

</comment><comment><USER6> Kiddicraft -> Lego -> Infiniminer -> Minecraft

Even if it's just in namesake, the world does have a funny way of coming full- circle.

<comment> erik-n Also, [http://www.lego.com/en-us/minecraft](http://www.lego.com/en- us/minecraft)

<comment><USER7> I'm honestly surprised there's never been any sign of a "Minecraft: Lego Edition" (rather than the physical "Lego: Minecraft Edition"), with mechanics basically identical to Minecraft now except with all the terrain in-game made out of Lego blocks.

<comment><USER8> There's was Lego universe, but they wanted dong-detection.

[http://www.exquisitetweets.com/tweets?eids=SOlZp2L8I8.SOl4Cs...](http://www.exquisitetweets.com/tweets?eids=SOlZp2L8I8.SOl4CsO6YC.SOmhNAiuES.SOmlJ2T2Gq.SOmpjeGn1w.SOmwta15gX.SOmB4207kO.SOmJPgkOFU.SOmOl1j08a.SOmW0jPTRA.SOm72fKFfE.SOncwNl2SP.SOnlkgH05k.SOntnuAhGw.SOqg0uZR8K.SOqkXGJtbU.SOqrXBJruS)

[https://news.ycombinator.com/item?id=9639249](https://news.ycombinator.com/item?id=9639249)

<comment><USER7> > This is a roundabout way of saying "never build an online game for kids / I > have no idea how Minecraft hasn't been sued over this yet"

That's the basic problem of the MMO approach, rather than Minecraft's ad hoc and persistent private servers.

<comment><USER9> Yep that's an awesome feature. I just don't let the young ones play online, but if they want that group experience then the siblings can all play together but not with the public. Pretty cool.

</comment></comment></comment></comment></comment></comment><comment><USER10> _Over the years they refined it - the official birth of what is really the modern Lego came in 1958, when they added the hollow tubes on the underside to help with interlocking -, but the design remains taken from Kiddicraft._

Seems like a pretty key fact. The hollow tubes are what makes Lego lock together so nicely.

<comment><USER11> Even today, what makes Lego superior to their competitors (to the extent that e.g. eBay sellers take pains to guarantee their packs of random bricks contains nothing but genuine Lego...) is that the pieces are manufactured with surprising precision and have a _lot_ of little details that most people aren't even aware of.

E.g. wonder why Lego Technic sets and similar uses a mix of black and grey connecting studs instead of just sticking to one? The grey ones will rotate more easily, so depending on whether you want to lock something in place or enable it to rotate more freely (e.g. wheel, rotor) you'll use different ones. If you look at them up close, this is achieved by tiny little ridges (fractions of a mm tall and fractions of a mm wide) on the black ones. There's also a slit in he black ones, not sure what if anything that makes a difference to.

Most non-Lego bricks lack a lot of those details, and that makes them less flexible to use.

</comment></comment><comment><USER12> I thought 'no one is going to steal your idea'

[https://news.ycombinator.com/item?id=9664174](https://news.ycombinator.com/item?id=9664174)

</comment><comment><USER13> Patents are territorial. If the English guy did not bother to patent in Denmark (highly unlikely especially at that time) then Lego was perfectly free to use the design and build on it.

<comment><USER14> Both nations were signatories to Paris convention at the time, although IANAL to tell if that particular product was covered.

</comment></comment><comment><USER15> Proof that patents aren't everything.

</comment><comment><USER16> Another reason why patents are irrelevant.</comment>


Humans were eating refined starches 20k years before agriculture - <AUTHOR> http://jetlib.com/news/2010/10/18/the-stone-age-food-pyramid-included-flour-made-from-wild-grains/

<comment><USER2> I started eating paleo around 10 months ago, so I guess my opinion can be a little bit biased regarding this topic.

In any case, after reading the article, I am not sure about the conclusions done by most of the newspapers that I have read.

1\. Most of the flour that they are talking about is referred to roots, which in most cases are encouraged in the paleo diet. 2\. I miss a more detailed study about the grains that they found: amount of phytates, lectins, gluten... 3\. I am also curious about the methods that they used to cook/processing the grains to avoid poisoning. In the study they talk about the process prior to eating as: "The flour would have undergone a multistep processing involving root peeling, drying, and finally grinding using specific tools".

</comment><comment><USER3> question: is this a counterargument to the paleo/caveman diet?

<comment><AUTHOR> Yes. The paleolithic diet excludes grains for the reason that it was not included in the Stone Age human's diet.

If Stone Age humans did have refined starches in their diet, then if you wanted to follow a truly paleolithic diet you would eat flour.

Of course, I never bought the diet to begin with for totally different reasons, which is that 10,000 years is plenty of time to adapt to a new diet. I prefer the pre-industrial diet. It's obvious that fast food is bad for us, it's not obvious that pasta is generally evil.</comment></comment>


TCP Anycast – Don't Believe the FUD [pdf] - <AUTHOR> https://www.nanog.org/meetings/nanog37/presentations/matt.levine.pdf <comment><USER2> Meh, I'll bite, since it's been posted....

1) This is from a Nanog talk back in 2006. Nearly a decade later, it's appropriate to ask 'how do I properly do IPv6 TCP anycast then?', and the answer is, sorry, it's a quirk of IPv4 that anycast ever worked in the first place. The presentation mentions that the authors plan to deal with IPv6 anycast by dying before IPv6 is implemented.

2) The presentation lays out how TCP anycast works across 3 points of presence. Try anycasting a prefix out of 70 PoP's and your mileage _will_ vary. There are definitely applications where TCP anycast has the same MTBGRW (mean time before global routing weirdness) as, say, geo-aware DNS directing to regional load balancers, but with every new PoP announcing the same prefix you're taking on a non-linear (possibly exponential) decrease in MTBGRW.

3) The one bullet point that needs to be re-re-re-re-emphasized: 'Effective BGP communities from upstreams is key' [sic]. Yeah they are, and the diligence and cooperation of your upstream providers are the difference between a working anycast mesh and turning the global routing table into your own personal split brain hell.

TL,DR: Don't believe the FUD but let's not start hyping things either. I'm only aware of three ASN's announcing TCP anycast prefixes in the past decade since this presentation, and Edgecast was one of 'em. TCP anycast didn't take off, most likely because ASNs and IPv4 prefixes are way too scarce.

<comment><USER3> First of all, I don't see how any of your comments are specific to TCP. Routing is all Layer 3, if you're going to have routing weirdness, or quirks that are specific to IPv4 and you don't have good cooperation with your upstream providers it's going to make anycast an issue with any layer 4 protocol you run over it.

Secondly I don't see how anycast is an IPv4 quirk? Announcing a prefix out of multiple PoPs certainly isn't a quirk, announcing out of a PoP then routing over a dedicated WAN is in practice no different than announcing over multiple ISPs in the same datacenter. These are all normal and not quirks. So why would it be an IPv4 only quirk to terminate that connection at every PoP on a local server? I don't see how it makes any difference if your anycast network is an IPv4 /24 or an IPv6 /48 (which has the benefit of being much easier to get).

Anycast in general didn't take off because IPv4 prefixes are scarce, but the abundance of IPv6 prefixes may be a good reason to expect future expansion of anycast.

<comment><USER2> None of my comments are TCP specific, but as I said - at 3 PoPs, you won't see routing weirdness; announcing the same prefix from 70 PoPs will cause the likelihood of route instability to increase. For the case of UDP, hopefully no one will notice, as your lost packets will just go to the next available route; for TCP connections, a route withdrawal sending you to the next nearest PoP will lead to a broken connection and clients seeing badness in their browsers.

Anycast is an IPv4 quirk in that it wasn't designed; it "just works" because of the BGP route decision process. Yes, you can announce your prefix out of multiple PoPs, but how people choose to use the routes you announce is where things get "quirky".

In theory there's no difference between announcing a /24 IPv4 and asking us all to accept it, and doing the same with a /48, but in practice you'll burn an unacceptably large amount of IP space, IMHO, and if you tell ARIN that you need a second /48 block because you burned your first with less than 25% utilization, they simply won't let you have it.

Disagreed on your last point. The abundance of prefixes isn't the problem IMHO; it's the acceptance of route announcements from upstreams. If upstreams were to start accepting and passing along more granular routes, maybe we'll start seeing more anycast deployments, but I doubt it.

<comment><USER3> Agreed that if doing TCP, you either need to limit the PoPs, or be doing it with a an app that is highly resilient and capable of dealing with unexpected loss of a session and reconnections. The same is true of UDP. For stateless short burst things like DNS and NTP it's not a big deal, but it is for video conferencing and other stateful protocols built on top of UDP. It's not a layer 4 issue as much as an application issue.

As to the second point, ARIN could not possibly require 25% utilization. That's 3*10^23 addresses on a /48\. Or if they're counting utilization as the number of subnets, that 16,384 /64 networks.

Look at some sample companies, Valve has a /44 from ARIN. They're only even announcing 6 /48 prefixes right now. Netflix has a /32, they're announcing less than 20 /48 prefixes. I worked at a small MSP who provides ISP services to less than 50 clients, and they were allocated a /32 years ago and have yet to announce a single prefix.

Burning a /48 for an anycast network is not a big deal, and getting another /48 is trivial. Getting a /24 for an IPv4 anycast network is much harder. So yes, for IPv4 anycast to take off we need the ability to advertise longer prefixes, but /48's are abundant enough that one can be sacrificed.

</comment></comment></comment></comment><comment><USER4> I do it. Two data centers, east and west coast. For better or worse I peer with the same providers on each side, which doesn't do much for your traffic so much as juggling ISP maintenance that might affect you. I've not heard a single complaint due to anything relating to anycast.

Considering that you're getting a damn robust global scale load balancer for free, and it mostly maintains itself -- it's hard to argue against it,

</comment><comment><USER5> Super informative, love the detail in the slides!

Would be more impressed if the IPv6 plan wasn't:

      The plan consists of being dead by the time customers demand v6.

Why aren't these brave heroes of anycast leading the charge to ensure it works with a protocol suite that is now something like a decade old?

I don't expect the story to be:

      We are just as confident with this as what we've been running for years on IPV4.

But, maybe:

      Except for the bits that we rely on custom hardware for, it's looking really promising.

Getting IPv4 allocation from ARIN, even if it is conserved by anycast, isn't going to be possible forever. I've been meaning to get ahold of an ASN and a small block for just this reason.

Therefore, the techniques outlined here may not be usable to new companies or on new networks in a couple of years. Even if I can get IPv4 from my hosting provider, I need ARIN/RIPE/etc.. for anycast, afaik.

Still, great read! :)

<comment><USER2> It's a protocol layer thing, mostly down to "what prefix sizes can I reasonably expect other providers to accept?"

For IPv4 the answer was a /24; for IPv6 the answer seems to be a /64 at this point, and burning an entire /64 to get a couple of DNS servers (the typical use case for anycast) to resolve slightly faster is overkill. It's also probably a great way to annoy your RIR when they ask 'how the hell did you burn through your initial IPv6 delegation with only two hosts' ;)

EDIT: I meant /48, not /64! Whoops-a-doodle.

<comment><USER6> _It 's also probably a great way to annoy your RIR when they ask 'how the hell did you burn through your initial IPv6 delegation with only two hosts'_

Since /56 seems to become the "easily available standard size" for allocations, using a /64 doesn't seem like to much of an issue, especially since larger orgs should easily get /48s? (But are /64 really accepted as routes? I would have imagined that to be also limited to /56 or /60 or so)

<comment><USER2> Depends on who's doing the accepting ;) I actually meant a /48, mea culpa!

I'll leave this here:

[https://labs.ripe.net/Members/dbayer/visibility-of-prefix- le...](https://labs.ripe.net/Members/dbayer/visibility-of-prefix-lengths)

It's from 2010-ish but still sadly relevant.

<comment><USER6> Ok, yes, "wasting" a /48 is a problem ;)</comment></comment></comment></comment></comment>


The End of History? (1989) - <AUTHOR> http://www.wesjones.com/eoh.htm#2 <comment><AUTHOR> FWIW, I feel that the first paragraph in particular is eerily applicable to the punditocracy over the past 5 years or so with regard to both Putin and ISIS, and that gives this old essay especial interest at the present moment.

</comment><comment><USER2> Fukuyama's 25-year retrospective on his essay: [http://www.wsj.com/articles/at-the-end-of-history-still- stan...](http://www.wsj.com/articles/at-the-end-of-history-still-stands- democracy-1402080661)

</comment><comment><USER3> This has always been laughable. I'm surprised it wasn't derided as a joke even back in 1989.

<comment><USER4> It was, but only by a minority.

<comment><USER5> Yes, I remember arguing about it with a fellow Pol student at the time. He was convinced the author was a brilliant parodist, I was convinced the author was an idiot.

This was way before Poe's Law had been coined, but it would have applied perfectly.

</comment></comment></comment><comment><USER6> [https://en.wikipedia.org/wiki/The_End_of_History_and_the_Las...](https://en.wikipedia.org/wiki/The_End_of_History_and_the_Last_Man)

</comment><comment><USER7> If there isn't a famous aphorism about how blithe ideological triumphalism gets proven wrong by the real world 100% of the time, there ought to be. For instance:

>The ideological challenge mounted by the other great alternative to liberalism, communism, was far more serious. Marx, speaking Hegel's language, asserted that liberal society contained a fundamental contradiction that could not be resolved within its context, that between capital and labor, and this contradiction has constituted the chief accusation against liberalism ever since. But surely, the class issue has actually been successfully resolved in the West. As Kojève (among others) noted, the egalitarianism of modern America represents the essential achievement of the classless society envisioned by Marx. This is not to say that there are not rich people and poor people in the United States, or that the gap between them has not grown in recent years. But the root causes of economic inequality do not have to do with the underlying legal and social structure of our society, which remains fundamentally egalitarian and moderately redistributionist, so much as with the cultural and social characteristics of the groups that make it up, which are in turn the historical legacy of premodern conditions. Thus black poverty in the United States is not the inherent product of liberalism, but is rather the "legacy of slavery and racism" which persisted long after the formal abolition of slavery.

This sounds blithe, silly, and downright ahistorical by today's standards. 26 years were apparently all it took for class conflict, in fact _world-wide_ class conflict, to re-emerge alongside imperial and religious conflicts, environmental challenges, and energy shortages as a chief driving factor in a conflicted, multipolar geopolitics. Meanwhile, the "democratic, egalitarian" West appears to have ended up neither democratic (in the sense that state policy reflects the will of the common people as expressed through such devices as polls, elections, and social movements) nor egalitarian (in the sense of income and wealth inequality, in the sense of social gaps between races and classes, and even in the sense of applying human-rights laws universally).

>The end of history will be a very sad time. The struggle for recognition, the willingness to risk one's life for a purely abstract goal, the worldwide ideological struggle that called forth daring, courage, imagination, and idealism, will be replaced by economic calculation, the endless solving of technical problems, environmental concerns, and the satisfaction of sophisticated consumer demands. In the post-historical period there will be neither art nor philosophy, just the perpetual caretaking of the museum of human history. I can feel in myself, and see in others around me, a powerful nostalgia for the time when history existed. Such nostalgia, in fact, will continue to fuel competition and conflict even in the post-historical world for some time to come. Even though I recognize its inevitability, I have the most ambivalent feelings for the civilization that has been created in Europe since 1945, with its north Atlantic and Asian offshoots. Perhaps this very prospect of centuries of boredom at the end of history will serve to get history started once again.

It really must be asked what Fukuyama was thinking when he actually published this nonsense.

The only possible "End of History" would be the extermination of the human race.

<comment><USER8> He was stating that history as a unique series of distinguishable events would be superseded by an interminable river of incremental activity with no real purpose;no empires being built or demolished, no great ideologies locking horns. Post-history would just be people tinkering at systems because there's nothing else to do.

</comment></comment><comment><USER9> The most laughable part is about "Western liberal democracy" being ultimate form of government. Given the following:

\- NSA surveillance in USA

\- Muslim minorities in EU

\- flood of Syrian "refugees"

\- Chinese Communist Party

\- etc.

I can then formulate hypothesis that the ultimate form of government will be:

1\. Surveillance based dictatorship in US

2\. Sharia-law based religious dictatorship in Europe and Middle East

3\. Communism-based dictatorship in Russia, China and Latin America

4\. Tribal/nationalism based dictatorship in Africa

To sum that up: DICTATORSHIP RULEZ :)

<comment><USER10> Agreed but on the communism based dictatorship point. Elites seem equally business friendly in China, Latin America, and to a lesser degree Russia. Maybe stateism would be more appropriate? >> "You are free to pursue your pig- capitalist thing as long as you fork us our due share."</comment></comment>


Show HN: Stack Match – Find engineering jobs that match your preferred stack - <AUTHOR> http://stackshare.io/match?ref=hackernews <comment><USER2> A neat followup might be to take the job-search data and then put together a list of which technologies have the highest developer interest. This could be quite useful for companies or projects trying to decide on a tech-stack or tooling.

Even better would be to compare supply vs. demand and come up with a ranking of tech combinations that people _want_ to work with but few companies are using. For example, Rust + Postgres gives _one_ result that's actually hiring. That one company could conceivably get quite a boost to their hiring efforts if there are many developers that want to work with Rust + Postgres, and other companies that pick that tech company would also get a similar boost until it gets oversaturated.

</comment><comment><USER3> Interesting way to search for jobs. I feel a bit weird though in that I'm drawn to jobs more based on the business domain and problems being solved than the particular technology used for the implementation. Getting asked 'what is your stack' always felt like a weird lead in vs. what problems you are solving day to day, but I feel mostly alone in this sentiment...

<comment><USER4> I can absolutely understand and I feel the same way. I can't understand this infatuation with stacks. They're just a tool for solving a problem. If another tool is better for solving a particular problem then you should use that. It's nothing to be obsessed with.

If you present yourself as just a bunch of TLAs you're effectively selling yourself short. Put bluntly, if you do that you're presenting yourself as a code monkey who turns other people's ideas and solutions into that nasty computer code the people who do the "real thinking" can't be bothered to deal with.

Besides, your favourite stack today might fall out of favour tomorrow. If you invested a disproportionate amount of time into learning all the intricacies of that particular stack you might have wasted a lot of time.

Being able to analyze and solve problems regardless of the toolset is a skill that likely will never fall out of favour.

<comment><USER5> But the job ads and interviews I've seen and been to are all heavily about the stack and very little about other qualities. E.g. changing language is considered making me junior from senior and halving my salary. Only exception would be a newer tech e.g. GO where perhaps getting experienced people is tough.

</comment></comment></comment><comment><USER6> Searching for F# seems to return all .NET-using companies, even if they're explicitly listing only C# or only VB.NET in their page.

Perhaps you could add a "search related tools" flag? I can imagine an experienced Java developer being OK with Kotlin and Scala jobs, but maybe a Scala fan wants to look specifically for Scala postings and avoid the majority of general JVM positions.

But in any case, sort by match % by default! I had to scroll quite a bit down to find the first actually-F# result, even though it was (correctly) matched as a 100% match and all the ones above were at 0%.

<comment><AUTHOR> Good idea! Related searches makes a lot of sense. We'll look into that. And sorting by % should already be happening, but it's clearly not. We'll fix it.

</comment></comment><comment><USER7> This is pretty cool!

Feature request: Allow me to filter by technologies that a company _doesn 't_ use.

<comment><USER8> I second this, I'd love to put e.g. -Java in a search.

<comment><USER9> Stack Overflow Jobs allows you to do this, in addition to specifying the technologies that you like to work with.

</comment></comment></comment><comment><USER10> In my case where I am stack agnostic, I actually found it better to clear out the tech stack input and see all openings in my location.

</comment><comment><USER11> Nice! This is a really interesting way to approach a job search.

I recall a few times in my career when I didn't like the technology choices being made at my current employer, which prompted me to look for new opportunities with the tools I did want to use.

There are a ton more things to consider about a new job, but the tools you will be asked to work with every day are certainly a factor.

This helps sort it out.

<comment><USER12> If company is relatively new you can still help it steer into right technologies, so not always it is a deal breaker

</comment></comment><comment><USER13> I definitely recommend using HTTPS on this site. I would rather not have all of my calls logged on a company server somewhere (especially if someone works at a company that cares about this sort of thing)

<comment><AUTHOR> Switching over is on our to-do list. Totally understand if you're not comfortable using it though. We'll have it behind HTTPS soon!

</comment></comment><comment><USER14> Well done with room for improvement. Please add a remote/onsite switch. Other useful switches would be full time/part time and employee /freelancer. I'd go for remote, part time, freelancer so I won't use a service that makes me skim through hundreds of job listings before finding the one I want to see.

</comment><comment><USER8> [http://stackshare.io/nutanix/nutanix](http://stackshare.io/nutanix/nutanix)

148 technologies in their stack, practically guaranteed to match every search. This tool will need some moderation to be of any use to developers.

<comment><AUTHOR> That count is actually inaccurate. They've added a ton of tools to be approved that are not visible (or searchable in that interface) but are included in the count. We'll fix that. It's rare that a company lists things they don't use; it's not very helpful for them.

</comment></comment><comment><USER15> I made something similar recently that only works with HN's monthly who is hiring posts. Check it out: [https://www.whoishiringpp.com](https://www.whoishiringpp.com)

</comment><comment><USER16> When I filter location to Berlin, it shows three different Berlins in the US - but after selecting the first the results appear to be in Germany (what I was looking for).

<comment><AUTHOR> Yeah, we noticed that too :( Still working on a fix. We're using Places ([https://github.com/algolia/places](https://github.com/algolia/places)) and haven't yet found a great way to improve relevance for our use case.

</comment></comment><comment><USER17> A few weeks ago at Hack the North (UWaterloo), a few friends and I built exactly this.

We literally aggregated all of our company data from StackShare, only difference was that we parsed their resumes for the preferred languages/technologies instead of having them manually enter it.

Glad to see our idea had some validity!

Link for those curious: [https://github.com/kshvmdn/find-me-a- job](https://github.com/kshvmdn/find-me-a-job).

</comment><comment><USER18> \- Being able to sort my stack would be nice. I put up my company and noticed that random small libraries I added dominated the first few positions instead of the bigger elements.

\- The scrollbars (or iframe?) and typeaheads can be pretty slow on mobile.

\- The scrollbars (or iframe?) end up with a lot of unnecessary whitespace and may be difficult to navigate.

</comment><comment><USER19> No Angular2?</comment>


Appsumo Lean Startup Challenge - <AUTHOR> http://appsumo.com/leanchallenge/

<comment><AUTHOR> It looks like Appsumo asks for an email now before letting you into the site :s (EDIT: now removed, go App Sumo)

But for those not wanting to enter one; Appsumo are running a competition to win hundreds of thousands of dollars of funding for a startup when you buy the lean startup bundle. Plus some mentoring prizes as runner up.

Pretty cool :)

<comment><USER2> Removed.

</comment></comment><comment><USER3> What investment % do you give up for those 2 "cash" awards?

<comment><USER2> That's between the companies and investors. Likely ~1% but don't hold me to that.

<comment><USER3> ok- you should probably specifically note that this is an investment that will require giving up an equity stake of some amount to be determined..........so that it doesn't look like it's just a cash prize.

<comment><USER2> Good call. Let me confirm and update accordingly.</comment></comment></comment></comment>


Just How Accurate Are Fitbits? The Jury Is Out - <AUTHOR> http://www.nytimes.com/2016/05/26/technology/personaltech/fitbit-accuracy.html <comment><USER2> So fitbit is as accurate as professional equipment on high activity?</comment>


U.S. military christens self-driving 'Sea Hunter' warship - <AUTHOR> http://www.reuters.com/article/us-usa-military-robot-ship-idUSKCN0X42I4 <comment><USER2> > The ship's projected $20 million price tag and its $15,000 to $20,000 daily > operating cost make it relatively inexpensive for the U.S. military.

$5.5-7.3 million yearly operating costs is cheap? Yikes.

<comment><USER3> 5.5 million per year would be 70 crew members wages? A small-medium organization.

Wiki -"The United States Navy has nearly 500,000 personnel"

No food costs. No one gets evacked cause their toe got infected.

No crew quarters, toilets, mess on a ship = a pretty cheap ship.

Can roll over in a storm.

No re-stocking food, although fuel needs might make that redundant.

Less time at port, perhaps, equals a bigger ROI.

I guess normal ships are not cheap.

</comment></comment><comment><USER3> Since it's unmanned could you get salvage rights on it?

<comment><USER4> Exercising those rights is probably a non-trivial implementation detail.

</comment></comment><comment><USER5> Is this the first fully autonomous military bot?

Seems like if only non-autonomous actions are attacking a target that the attack briefs are likely automated too - and makes me wonder what percent of the time the suggested course of action is not taken.

</comment><comment><USER6> It's probably going to be in the next Screamers movie. Jokes aside, a fully autonomous cruiser is a very cool weapon.

</comment><comment><USER7> Hunty McSeaface</comment>


An interesting essay on search neutrality - <AUTHOR> http://www.mattcutts.com/blog/search-neutrality/

<comment><USER2> I'd be curious what people on HN think of that essay. The direct link is [http://works.bepress.com/cgi/viewcontent.cgi?article=1034...](http://works.bepress.com/cgi/viewcontent.cgi?article=1034&context=james_grimmelmann) for the PDF or <http://james.grimmelmann.net/essays/SearchNeutrality> for the HTML version. The PDF is more in-depth, but it's a fairly long read.

<comment><USER3> I agree with the main proposition that search by its very nature is not neutral, you are searching for something specific and therefore biased towards that something.

However, I do not think he effectively argued that google does not manipulate its results by favouring itself, specifically in regards to paid results or paid ads.

These paid results are presented to the user in the same style and fashion as the organic search results, but differentiated subtly by a very light different colour background.

They are above organic results, right below the search box, making it much easier for users to click on them.

Due to their prominent placement, they attract most of the attention, although web savy users might have learned they are ads and thus have learned to ignore them.

Finally, for all practical purposes, the paid results are the first ranked, suggesting therefore that google finds them to be the most relevant.

The conclusion is clearly that you can buy your first position on google, even if it is not the most relevant.</comment></comment>


Go 1.2.1 is released - <AUTHOR> https://groups.google.com/forum/#!msg/golang-nuts/KLbkfDG5GgU/tcfb9ZYgttAJ <comment><USER2> Do _any_ teams in Google write a human readable change log?

The only one I know of that comes close is the Chrome team, which gets by with a blogspot[1] that sometimes has nice lists of the changes (sometimes in list form, sometimes in a paragraph with loads o' commas), and sometimes says stuff like:

> A partial list of changes in this build is available in the SVN revision log > [http://build.chromium.org/f/chromium/perf/dashboard/ui/chang...](http://build.chromium.org/f/chromium/perf/dashboard/ui/changelog.html?url=/branches/1750_132/src&range=253861:254028&mode=html)

And here with Go 1.2.1 we get this[2].

It's not a huge deal in this case, but if you release a version and link to it and want us to know _why_ its significant, it would be nice to find out why in English instead of SVN-ese.

Compare this to the great, readable version that Firefox offers[3]

<comment>

[1] [http://googlechromereleases.blogspot.com/](http://googlechromereleases.blogspot.com/)

[2] [https://code.google.com/p/go/source/list?name=release- branch...](https://code.google.com/p/go/source/list?name=release- branch.go1.2&r=7ada9e760ce34e78aee5b476c9621556d0fa5d31)

[3] [https://www.mozilla.org/en- US/firefox/27.0.1/releasenotes/](https://www.mozilla.org/en- US/firefox/27.0.1/releasenotes/)

<comment><AUTHOR> Hey, so this would be my job, I guess.

The reason I don't bother writing a separate change log is that I'd end up duplicating what the 5 changes on that page (above 1.2, the previous release) already say. All are subtle things that are of little meaning to most people, so I figure those that really care are going to read the changes anyway. Maybe I should revisit this next minor release.

I should note that there is WAY more in that Firefox point release than in any Go point release. We strictly include only critical fixes for issues for which there is no workaround. For Go point releases, most people should just install them and move on. For 99.9% of Go programmers there is "nothing to see here".

As has been already mentioned, we do provide a detailed change log for major releases: [http://golang.org/doc/go1.2](http://golang.org/doc/go1.2) [http://golang.org/doc/go1.1](http://golang.org/doc/go1.1)

<comment><USER2> I suppose that's a fair response, but at the risk of being rude please consider some advice from a marketing perspective.

> All are subtle things that are of little meaning to most people...

If the changes do have little to no meaning in themselves, it's important to consider: _Why did you submit it, and why does it sit at the top of HN?_

HN didn't upvote it because of the changelog itself. There's nothing there. HN upvoted it because HN wants to know more about what's going on with Go.

So what's really happened, is that HN is affording you a great opportunity here, but the contents of the post are sorta clutching defeat from the jaws of victory. I think we could both agree that Go is a great language that we want people to be excited about, and releases can make good front-of-mind advertising at the very least.

If making the release announcements is part of your job then I think you should take it on yourself to get the prospective audience excited. Tell us everything that's happened since 1.2, including reminding us of any major advances surrounding go. Here's what people want to hear:

 _The Go team is plugging along. Go is getting more dependable than ever. Here 's what we're doing with Go, by the way. Here's the latest projects. Here's the latest tools._

Don't just say the changes since 1.2, tell us _everything in your ecosystem that 's changed._

Teach us to long for the immensity of the sea, as it were[1].

[1] [https://gist.github.com/simonsarris/9318374](https://gist.github.com/simonsarris/9318374)

<comment><AUTHOR> My goal with the mailing list post and the submission was to let as many Go users as possible that a new release is out and they should upgrade. Should I use a minor release announcement as an occasion to get people more excited about Go? I'm not sure. I like the short and sweet nature of these point releases, and I'm wary of turning them into a marketing exercise.

Otherwise, I do spend a lot of time telling people what's going on with Go. For instance, my presentation on what's new in Go 1.3 was at the top of HN for a day.

Appreciate the feedback, though.

<comment><USER3> So how is this different from any other spammer? You're get paid to use Hacker News as a Go mouthpiece to promote your product every chance you can take.

The reason why you, a Google employee working on Go, shouldn't be submitting these stories is because you have a clear conflict of interest. You think that 5 changes totaling a few dozen lines of code is worth everybody's attention because you're in the thick of it.

But really, a story like this being front page I think calls into question whether there is a voting ring or voting bot; I can't imagine more than a person or two actually looked at the changes and said this is important.

<comment><AUTHOR> No need to be so cynical. You may not be interested in Go, but many programmers are, and many of them read HN (and vote). You underestimate the size and enthusiasm of the Go community.

<comment><USER4> Right, so please add some summary of changes/content to this. I don't have time to go through SVN commit logs, but I'm interested in Go and use it in some side projects. I want to quickly be able to say, "What changed? Can I apply it to my projects?" Not having that is wildly frustrating when I see these "version releases" where I have no clue what's worth my time.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> The message was posted 2 hours ago, and now I'm downloading go-1.2.1 after a simple "brew update && brew upgrade". I love living in the future.

<comment><USER6> _Meanwhile, in Ubuntu land..._

> This is to get into the next LTS version of Ubuntu,

<comment><USER7> Isn't there a PPA for this? I'm pretty sure I had one.

<comment><USER8> The PPA is no longer maintained, instead the recommend solution is to use godeb: [http://blog.labix.org/2013/06/15/in-flight-deb-packages- of-g...](http://blog.labix.org/2013/06/15/in-flight-deb-packages-of-go)

<comment><USER7> Huh, that's interesting, thanks. I don't see why they don't set up a PPA (since they already have a way to generate the debs), but I'm guessing there are some issues with that.

</comment></comment></comment></comment></comment><comment><USER9> I noticed that the minimum goroutine stack size was raised from 4KB to 8KB between 1.1 and 1.2. Anyone know why this was increased?

<comment><AUTHOR> The 8kb size was demonstrated to be optimal:

[https://codereview.appspot.com/14317043](https://codereview.appspot.com/14317043)

[http://swtch.com/~rsc/gostackamd64.html](http://swtch.com/~rsc/gostackamd64.html)

[http://swtch.com/~rsc/gostack386.html](http://swtch.com/~rsc/gostack386.html)

<comment><USER9> It is problematic if you want to have millions of tcp connections serviced from the same host.

[https://groups.google.com/forum/#!topic/golang- nuts/8cXGTWGU...](https://groups.google.com/forum/#!topic/golang- nuts/8cXGTWGUzWw)

<comment><USER10> If you have to handle that many connections, I would suggest looking at Erlang. Its default heap of a process is < 3K.

Usually that shouldn't matter as much as both have small process sizes compared to OS threads or processes. But at millions of connections it starts to matter. Whatsapp for example, was running on FreeBSD and Erlang with 2M+ connections.

<comment><USER11> Go needs optional arguments for goroutines and have global defaults because recompiling is ludicrous.

Erlang is an ok language with a great runtime. Elixir is much higher level language and hence more productive for teams that already know Erlang but want to write less code and build faster. Also with Erlang, static type checking not used much in Erlang and big loss unless you use dialyzer. Advantage go for compiling and running test cases laser-blindingly fast. There is a native QuickCheck framework for Erlang, and I'm sure someone wrote a go one.

<comment><AUTHOR> Have you tried recompiling Go?

This is building the tool chain and standard library on my modest machine with a cold cache:

        $ time ./make.bash
        real	0m42.763s
        user	1m11.655s
        sys	0m13.411s

Hardly a colossal burden.

<comment><USER11> I've run it a zillion times. That's not the point, and that doesn't solve the problem. The point is per goroutine configurable stack sizes.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Thank you!

I'm really glad to see the Go team sticking with the short release cycles. Very easy to follow what's changing and what to expect in the next release.

</comment><comment><USER13> This is to get into the next LTS version of Ubuntu, 1.3 is not far away either.

</comment><comment><USER14> Anyone else have the following error when trying to build stuff using the 64-bits version?

# flag C:\Go\src\pkg\flag\flag.go:87: undefined: strconv.ParseBool

</comment><comment><USER15> Wow! A point release! Can we just save "Go x.x.x is released" for major releases?

</comment><comment><USER16> very good</comment>


What are your thoughts on using Clojure for more than 2 years? - <AUTHOR> https://www.reddit.com/r/Clojure/comments/6yb1ps/used_clojure_for_more_than_2_years_what_are_your/ <comment><USER2> Personally, Given teams writing in java, python, go, or Clojure, I wouldn't join the Clojure team. It looks too painful...

[https://github.com/clojurebook/ClojureProgramming/blob/maste...](https://github.com/clojurebook/ClojureProgramming/blob/master/ch04-concurrency- webcrawler/src/com/clojurebook/concurrency/webcrawler.clj)

<comment><USER3> I don't honestly see anything out right incorrect or difficult about the code you posted other than it's clojure. Mind expanding on that?

<comment><USER4> The one roadblock I run into whenever I write functional is the ridiculous number of functions that result. Don't get me wrong, it's great that everything can be abstracted away and easily tested as pure functions, but a kitchen sink of thousands of functions is difficult to remember, let alone introduce someone else to. Namespaces help, but not everything fits into an obvious namespace.

Admittedly this is mostly a personal organization issue, but when writing object-oriented code, in my experience it encourages better encapsulation. That being said, I like functional more. :)

<comment><USER5> > but a kitchen sink of thousands of functions is difficult to remember, let > alone introduce someone else to

That's pretty much the point: You don't have to remember what the function does, just read its name (and function signature, if your language is statically typed).

This is a "best practice" in imperative land as well.

<comment><USER4> I can't remember a thousand function signatures, and pulling up the list of function names and args is a huge pain if you have to browse through it every single time to find the one function that meets your specific transform, whereas you may as well just write it yourself in half the time.

In imperative land, I find that I have to write fewer functions, for better or for worse. As a result, this is not as much of an issue.

<comment><USER5> > and pulling up the list of function names and args is a huge pain if you > have to browse through it every single time to find the one function that > meets your specific transform

Not a problem in Haskell and Idris, at least. With the :search REPL command it will give you all the functions that match the signature you give it as an argument.

And really, you can have "longer functions" in any functional language, and they're used all the time: let..in...where, piping transforms (with the |> pipe operator or the . function composition), and of course, the do-notation which resembles imperative programming while being just syntax sugar for nested monadic operations.

</comment></comment></comment></comment></comment></comment><comment><USER6> This being reddit, I expected the top voted post to be "I don't recommend using Clojure for more than 2 years, because going even a week without sleep is fatal." I was disappointed.</comment>


Nginx reverse proxies retries PUT/POST/DELETE on response timeout by default - <AUTHOR> https://trac.nginx.org/nginx/ticket/488#comment:4 <comment><AUTHOR> This essentially became the laser of death the other day and lead to cascading failure which eventually brought down our system. That's why I'm posting this.

Very few people know about this and it's really scary. I'm happy people are voting this up to increase some awareness of this.

Potential workarounds: You might think disabling `proxy_next_upstream timeout` will do, but that will also disable connection timeout retry which is not what you want!

Increasing `proxy_connect_timeout` is not an option, because then you risk filling up too many connections in the nginx instance if the upstream server swallows SYN packets or whatnot.

The real workaround: Use haproxy. Serioously.

<comment><USER2> We've hit 3 problems with nginx:

1\. Exactly this, we had mystery double trades from our clients and it took us a long time to realise it was nginx assuming we timed out and routing traffic to the next server

2\. It doesn't do health checks. When a server goes down it will send 1 out of every 8 real requests to the down server to see if it responds. Having disabled resubmitting of requests to avoid the double trade issue above this means when one of our servers is down, 1 out of every 8 requests will have an nginx proxy error which is significant when you have multiple API calls on a single page

3\. This isn't something I've personally hit so can't explain the nitty gritty but it's something one of my coworkers dealt with: outlook webmail does something weird where it opens a connection with a 1GB content size, then sends data continually through that connection, sort of like a push notification hack. Nginx, instead of passing traffic straight through, will collect all data in the response until the response reaches the content size provided in the header (or until the connection is closed). I don't know if nginx is to blame for this one or not, but I do feel that when I send data through the proxy, it should go right through to the client, not be held at the proxy until more data is sent.

HAProxy also solved our issues and is now my go-to proxy. Data goes straight through, it has separate health checks, and it better adheres to HTTP standards. It can also be used for other network protocols which is a bonus.

<comment><USER3> 3\. is the reason why NGinX is the recommended proxy in front of webapps with scarce parallelism (for example Ruby with Unicorn; see [http://unicorn.bogomips.org/PHILOSOPHY.html](http://unicorn.bogomips.org/PHILOSOPHY.html) for an explanation) when "slow clients" are to be expected. NGinX is protecting the webapp from blocked workers by slow clients and Outlook Webmail seems to behave just like one. I don't know by heart how to tune this behavior if one wants to avoid it but this property is the main reason we use NGinX.

<comment><USER4> That's… unique - and wrong - spelling of the name. (Pet peeve of mine, people spell my app's name in all sorts of bizarre ways too.)

</comment></comment></comment></comment><comment><USER5> This is unfortunate behavior on timeout, and we've shared a workaround solution available using maps. There's a configuration example in this Gist: [https://gist.github.com/thresheek/2fa6479ffb7aca710493](https://gist.github.com/thresheek/2fa6479ffb7aca710493).

We're also going to prioritize a complete fix in the product, and encourage your comments and input on this ticket: [https://trac.nginx.org/nginx/ticket/488](https://trac.nginx.org/nginx/ticket/488)

Disclaimer: I work @ NGINX. Thanks, Owen

<comment><AUTHOR> Double post. See answer here: [https://news.ycombinator.com/item?id=11221392](https://news.ycombinator.com/item?id=11221392)

</comment></comment><comment><USER6> How is one supposed to take seriously web infrastructure software that exhibits such a basic failure of understanding core web standards? From even a cursory reading of the HTTP RFCs one will understand that "POST = unsafe = don't retry after request sent = return 504 on reply timeout".

I mean, a bug's a bug; but this was known for two years!

<comment><USER7> > _How is one supposed to take seriously web infrastructure software that > exhibits such a basic failure of understanding core web standards?_

How? Probably based on the fact that otherwise it's a frigging great app that powers like 15% of the web, including some of the biggest sites out there.

<comment><USER8> Plus, it is obvious that some fanboys will promote it no matter what...

<comment><USER7> Yes, please continue calling 40+ year old developers with ancient unix experience "fanboys".

Because obviously we're all 20yo in HN...

</comment></comment></comment></comment><comment><USER9> I've been bitten more than once by this.

Example situation, you have a request to process an uploaded file which is only for admin purpose so you didn't take the time to use a queuing system to do the heavy lifting in the background. Then, your customer uploads a file that takes much longer than normal and the request times out, that file is then sent multiple times to the app server and the user sees multiple uploads..

The behavior in term of errors should definitely be different if the sending request failed (in which case resending to the next upstream is fine) and if receiving the response failed (in which case it's often not a good idea to resend)

</comment><comment><USER10> This behavior _is_ non-compliant[1] with the RFC.

Although (from the standpoint of the RFC), everything on the server side (including nginx itself) is considered the web application, nginx probably takes the implicit position that dealing with multiple requests on non- idempotent methods such as POST is really a problem that the proxied web app itself should cope with.

But then nginx puts the web app in an untenable position. Consider the example of non-idempotent POST to create a new user account. The new user account includes a username, email address, and password. Because it's proxied, nginx creates a duplicate request for this new user account in the circumstances described in this bug report.

How should the web app deal with the duplicate request?

a. Accept the first request (200 OK) and decline the second request since the account was already created (i.e., 409 Conflict), or

b. Create two duplicate user accounts (200 OK for both)

Obviously, the _ONLY_ correct response is the first one, but what happens next is really up to nginx: will the client receive the 409 Conflict (etc) or will it receive the 200?

Well, who knows?! It's completely indeterminate.

If the client gets the 200 OK, great. But what if it doesn't? These duplicate requests seem like they could lead to an nginx race condition as well. And what gets logged?

This behavior _clearly violates_ both the spirit and the letter of RFC 7231 (as well as being an obviously poor engineering decision!).

Note also the long time (years!)[2] that this has been a known, outstanding bug without any action taken. Another commenter actually said this caused cascading failure in their application that killed their app.

Bottom line... nginx is a great, fast static server, but definitely _not_ a good proxy for dynamic apps. We're trying to figure out how fast we can migrate Userify (plug: SSH key management for EC2)[3] from nginx to HA-Proxy, since we use it to front-end our REST API.

1\. [https://tools.ietf.org/html/rfc7231#page-23](https://tools.ietf.org/html/rfc7231#page-23)

2\. [https://trac.nginx.org/nginx/ticket/488#comment:3](https://trac.nginx.org/nginx/ticket/488#comment:3)

3\. [https://userify.com](https://userify.com)

<comment><USER11> By default[1], nginx only talks to backends in http/1.0, so the operative rfc is (sadly) [https://tools.ietf.org/html/rfc1945](https://tools.ietf.org/html/rfc1945). Though it did establish GET/HEAD as safe and other methods as not, the idea of idempotence itself was not yet present and it doesn't have any language I'm aware of to restrict client retries on non-safe methods.

That said, I don't know if nginx does any better if you set it to http/1.1 mode on this issue. I assume not, to be honest.

[1] [http://nginx.org/en/docs/http/ngx_http_proxy_module.html#pro...](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_http_version)

<comment><USER12> > By default[1], nginx only talks to backends in http/1.0, so the operative > rfc is (sadly) > [https://tools.ietf.org/html/rfc1945](https://tools.ietf.org/html/rfc1945). > Though it did establish POST/PUT/etc. as 'safe'

No, only GET and HEAD are safe in RFC 1945.

> the idea of idempotence itself was not yet present and it doesn't have any > language I'm aware of to restrict client retries on non-safe methods.

That actually doesn't really change the situation that much: without an idempotence guarantee, there is no protocol-level basis for a proxy (reverse or otherwise) to assume that a non-safe method is repeatable. Under HTTP 1.0, by the RFC alone, there's no justification for treating anything other than GET or HEAD as reliably repeatable. (Except perhaps that the operations described by PUT and DELETE are at least arguably, as specified, idempotent, even though the term is not invoked and the guarantee is not made express.)

<comment><USER11> > No, only GET and HEAD are safe in RFC 1945.

Brainfart typo, corrected.

</comment></comment></comment></comment><comment><USER13> We had this same problem some time ago in our company. That's why we came up with this.

[https://github.com/xetorthio/nginx-upstream- idempotent](https://github.com/xetorthio/nginx-upstream-idempotent)

<comment><AUTHOR> Cool. Did you ever consider patching nginx upstream instead?

<comment><USER14> Yes. Before implementing this module we contacted nginx developers and they didn't think it is a problem. This is why we had to create our own module.

<comment><USER15> Did they explain why they don't think it's a problem?

</comment></comment></comment></comment><comment><USER8> This almost seems non-compliant w/ the action HTTP spec.

<comment><USER16> Per my other comment [1], it's only noncompliant for POST; for PUT (and DELETE) it's _more_ compliant than people want or expect!

[1] [https://news.ycombinator.com/item?id=11217686](https://news.ycombinator.com/item?id=11217686)

</comment></comment><comment><USER17> Yeah, tripped over this beauty a few years ago... Took days to figure out what was going on :( Was using nginx as internal load balancer across a RESTful services layer.

</comment><comment><USER18> Forgive me for not fully understanding this. If I'm just using proxy_pass to a single server (vs using proxy_pass with round robin or using proxy_next_upstream for failover) would this still affect me? In my experience with proxy_pass, a timeout on upstream was reported to the client and the POST was not retried.

<comment><AUTHOR> No, then you are safe.

</comment></comment><comment><USER19> Some APIs are not designed very well in the face of the possibility of a time- out on a POST, because the client can't be sure if the request was successful or not.

[http://blog.hackensplat.com/2014/07/is-your-api- broken.html](http://blog.hackensplat.com/2014/07/is-your-api-broken.html)

</comment><comment><USER20> Am I the only Chrome on Android user whom received a PKCS#12 access request for trac.nginx.org? I have honestly never seen that before.

<comment><AUTHOR> Yeah, I got it, too. That was a first-timer...

</comment></comment><comment><USER21> I can't reproduce it. I have nginx proxy_pass'ing to two upstreams and configured with proxy_next_upstream timeout;

One of the upstreams is running iptables -A OUTPUT -p tcp --sport 8080 --tcp- flags PSH PSH -j DROP

CURLing the nginx location configured for proxy_pass'ing returns 504 GATEWAY_TIMEOUT on half of the requests, as expected.

</comment><comment><USER22> This is why idempotence is so important.

<comment><USER16> But it's only the POST that this is a problem for, right? PUT and DELETE are supposed to be idempotent so retries are okay, yes?

<comment><USER23> Sure, but the point is you should design your POSTs to be idempotent as well.

<comment><USER24> Well, they are defined as non-idempotent, so there's no reason why you 'should' design this way. You can't make every request idempotent.

It's best to design so that duplicate POSTs are handled sensibly (e.g. you don't make a user pay for the same product twice), but the response to the second POST is unlikely to be the same as the first one, so they aren't idempotent.

More difficult cases are where an action could legitimately be performed twice, e.g. adding an item to a shopping cart. You must differentiate between a wrongly-duplicated request, and a real request to add the second item. One way to do this is to add parameters to the POST so that it can be identified as a duplicate. But it can be tricky to do this without holding a lot of extra state in the server application, and there are all sorts of concurrency problems when you have a cluster of servers.

<comment><USER25> I think the most of these cases can be handled via PUT i.e. update a cart so it contains these items. That way you keep all the state on the client.

<comment><USER26> That's great unless people want to shop in multiple browser tabs or anything like that. The real solution here is to use the fact that we have POST which is specced as non-idempotent and not depend on the very small set of technologies that purposefully disobeys the spec.

</comment></comment></comment></comment></comment></comment><comment><USER27> This applies to uWSGI (uwsgi_pass) as well, right?

<comment><USER28> I'm wondering about this myself. I'm looking into alternatives to Apache with mod_wsgi.

<comment><USER27> Seems that it does. And I would have a solution if only nginx had $request_uri_without_args...

The trick for uWSGI is to have `uwsgi_param PATH_INFO` not $document_uri (it won't work due to `rewrite ^ @nonidem last;`) but an originally requested URI. $request_uri _almost_ does it, but fails when URI has query arguments.

On nginx mailing lists there is a suggestion to strip it myself, with Lua[1], but I'm surely not going to throw in Lua just for this.

[1] [https://forum.nginx.org/read.php?2,215192,215195#msg-215195](https://forum.nginx.org/read.php?2,215192,215195#msg-215195)

</comment></comment></comment><comment><USER29> That's why I use openresty. I can use balancer_by_lua to customize my upstream selection/retry strategy.</comment>


Ask HN: How do you organize libs and repos you like? - <AUTHOR>

I've now starred 148 repos on Github, which is probably nothing compared to some people but it's still a lot to hunt through when I am looking for something.<p>Anyone have a good way to re-find utilities or libraries when you need them later? <comment><USER2> I have a personal wiki that's powered by Org mode. My wiki has more than 2,000 documents, including many lists of development tools. Before I created a wiki, I had notes in various file formats and more than 10,000 bookmarks in Firefox.

One of my greatest regrets in life is not using Org mode sooner for notetaking. (My life has been uneventful.)

</comment><comment><USER3> I use Google Bookmarks. Any online bookmarking service would probably work, though.

Just make sure adding items is as seamless as possible (I use a bookmarklet). If there's too much friction adding items, you're less likely to do it.

Also, I'll sometimes add certain keywords/phrases in the "notes" field that match how I anticipate I'll try finding it again.

For example, if a Django app uses redis but only for optional features, I'll still add "redis" to the "notes" field. In six months when I'm trying to remember the project, the only thing I may remember is it featured redis in some capacity. From there, it's pretty easy to find.

</comment><comment><USER4> Kippt imports Github starred projects and makes them searchable. [https://kippt.com](https://kippt.com)

</comment><comment><USER5> Here's a really bad, but feasible idea: create a git repo with a folder for each category, and make each starred repo a submodule under a given folder.</comment>


Meet the Economist Behind the One Percent's Stealth Takeover of America - <AUTHOR> https://www.ineteconomics.org/perspectives/blog/meet-the-economist-behind-the-one-percents-stealth-takeover-of-america <comment><USER2> Conspiracy theory? Check.

Very few sources, and none of them independently confirmed? Check.

Call to action with a sense of urgency? Check.

The only thing that this article inspires is a rolling of the eyes.

I'm very much a liberal and it would be easy for me to accept some of the things described here, but it just trips way too many red flags as far as empirical reporting is concerned.

<comment><USER3> The article is very Marxist, using popular terms that attempt to stoke a recollection of occupy wall street and similar movements failed movements.

If a true oligarchy were to come into power it would be likely to be overthrown in the west now more than ever. I posit that the best interest of the 1% is not to position itself in this manner. If the 1% truly is based in the objectivist-selfish philosophy then this would be very obvious. Without a middle class, the upper class has no buffer between itself and the poorest class. I think history states that this would be a society primed for revolution.

<comment><USER4> I disagree about the swift overthrow; it's easy to say that when you go from pure democracy to pure oligarchy with no transition, but by boiling the frog, and one day the change could seem natural or even welcome. It's not easy to see the pieces of the puzzle for what it is until it's fully assembled.

Your argument re middle class disappearing is addressed in the write up; the argue by strengthening law enforcement and government that they can hold the populace at bay by force. There are many past and present examples of authoritarians retaining control by force, but it's not as elegant a solution as convincing people it's what they wanted all along imo.

</comment></comment></comment><comment><USER5> > "Each person seeks mastery over a world of slaves," he wrote in his 1975 > book, The Limits of Liberty.

> Does that sound like your kindergarten teacher? It did to Buchanan.

My primary recollection of K-6 was teachers shrieking "Just Say No!" Or policing what we said, what we did off school time, what we wore, implementing zero tolerance policies that punished victims, etc. Teachers don't have much power over adults, so it's easy to forget, but its a field that attracts power tripping authoritarians and conformists.

<comment><USER6> > "Each person seeks mastery over a world of slaves," he wrote in his 1975 > book, The Limits of Liberty.

"The rich rule over the poor, and the borrower is slave to the lender." \- Proverbs 22:7

You look at society today and various debt levels across the board...there's a lot of truth to it. The requirement to continue making payments on various debts is one of the biggest factors that forces people into jobs that they may not want.

Lots of wisdom there.

<comment><USER4> Debt is by no means a clear cut evil; it's referenced in the article at the federal level as a good, which allows governments to meet the civic needs of the people in times of hardship. At the individual level, it allows people to have what they want when they want it; you needn't save 3 years to purchase a car, buy it now and save over the next 3 years. Or 30 years for a house. Debt is a tool - it's good or bad depending on how it's used. The temptation is that people often want to live beyond their means, and it's that instinct that drives many negative outcomes, but also it's tempered at least in the US by bankruptcy laws.

<comment><USER7> Except the government massively expands it's own debt ... constantly. I mean, here is an article with a lot of figures:

[https://www.thebalance.com/us-debt-by-president-by-dollar- an...](https://www.thebalance.com/us-debt-by-president-by-dollar-and- percent-3306296)

Good times or bad, times of plenty, times of hardship, war or peace, ... government goes deeper in debt. When there is a tiny bit of debt relief, it's ... essentially accidental ... (nevertheless great respect for Bill Clinton, who proposed the budget made it happen, however it was not his intention. He could have spent the money though, and he didn't. Which is more than can be said of many others. On net however, Bill Clinton was like every other president: the government spent way more than it brought in)

<comment><USER4> Thing is it seems like it doesn't matter. The government isn't required to balance is checkbooks at the end of the year and is in control of the money supply. Government debt isn't really slavery as they have many more options. The US has actually defaulted on its debt obligations 6 times [1,2,3,4] so far, most recently in 1979 [1]. Seems like so long as it doesn't happen too often, it might be a non-issue, I'm not sure what to make of it personally.

[1] [https://www.theatlantic.com/amp/article/267205/](https://www.theatlantic.com/amp/article/267205/)

[2] [https://www.google.com/amp/s/www.cnbc.com/amp/id/43140915](https://www.google.com/amp/s/www.cnbc.com/amp/id/43140915)

[3] [https://mises.org/library/short-history-us-credit- defaults](https://mises.org/library/short-history-us-credit-defaults)

[4] [https://en.m.wikipedia.org/wiki/List_of_sovereign_debt_crise...](https://en.m.wikipedia.org/wiki/List_of_sovereign_debt_crises)

</comment></comment></comment></comment></comment><comment><USER3> I tend to disagree when someone speaks of the 1% as being money driven. After a certain point, you can buy basically anything and more money won't change that. Influence may be the next level for these people.

The article mentions Scott Walker(I'm from Wisconsin. My grandfather was a union worker, I am not). I am largely against anyone bank rolling a political candidate. By eliminating the collective bargaining rights, Wisconsin became a prime competitor for manufacturing in the midwest. Free market competition allows for greater which in where one works. In the same way that we saw ping pong tables at software companies, we are seeing more attractive manufacturers pull ahead based on higher salaries that collective bargaining attempted to offer.

The class-ist mindset of this article is not a good thing for anyone. Elevating the 1% to the status of enemy will only sew further instability in an already precarious time.

<comment><USER4> You're conflating two things that just happened to occur at the same time: elimination of unions and tightening of the labor market. Unions provide consistency for when the market sours, and I guarantee you those salaries and perks are going away as soon as the market for labor sours. Unions are the only way labor can push back against capital. It may not seem that way because times are good but they won't aways be especially because:

Either way wanting humans involved in the manufacturing chain is backwards and inefficient, and flies in the face of the inevitable automated future of manufacture. We desperately need to stop trying to recreate the jobs of 50 years ago and retrain people for the jobs we want moving forward. Manufacturing jobs just aren't good jobs. If we can get people elsewhere to do them, my god, what an opportunity to get ahead for everyone here.

</comment></comment><comment><USER8> I don't think they were ever not in control? Maybe this guy just helped them get more control???? I am sorry but american society has been money driven since inception. I don't even want to click this link because by the title it is clearly jailbait.

<comment><USER9> Right? Very weird framing. You used to have to own land to even vote in this country.

<comment><USER3> The idea was that you had a literal financial stake in the country. A "producer".

<comment><USER9> Who's more of a "producer," the person who owns the land or the person who works the land?

</comment></comment></comment></comment><comment><USER10> _One remembers, for example, the trial, condemnation and execution of Prof. Dr. Scott Nearing at the University of Pennsylvania, a seminary that is highly typical, both in its staff and in its control. Nearing, I have no doubt, was wrong in his notions--honestly, perhaps, but still wrong. In so far as I heard them stated at the time, they seemed to me to be hollow and of no validity. He has since discharged them from the chautauquan stump, and at the usual hinds. They have been chiefly accepted and celebrated by men I regard as asses. But Nearing was not thrown out of the University of Pennsylvania, angrily and ignominiously, because he was honestly wrong, or because his errors made him incompetent to prepare sophomores for their examinations; he was thrown out because his efforts to get at the truth disturbed the security and equanimity of the rich ignoranti who happened to control the university, and because the academic slaves and satellites of these shopmen were restive under his competition for the attention of the student body. In three words, he was thrown out because he was not safe and sane and orthodox. Had his aberration gone in the other direction, had he defended child labor as ardently as he denounced it and denounced the minimum wage as ardently as he defended it, then he would have been quite secure in his post, for all of his cavorting in the newspapers, as Chancellor Day was at Syracuse.

Now consider the case of the professors of economics, near and far, who have not been thrown out. Who will say that the lesson of the Nearing debacle has been lost upon them? Who will say that the potency of the wealthy men who command our universities--or most of them--has not stuck in their minds? And who will say that, with this sticking remembered, their arguments against Nearing's so-called ideas are as worthy of confidence and respect as they would be if they were quite free to go over to Nearing's side without damage? Who, indeed, will give them full credit, even when they are right, so long as they are hamstrung, nose-ringed, and tied up in gilded pens?

It seems to me that these considerations are enough to cast a glow of suspicion over the whole of American political economy, at least in so far as it comes from college economists. And, in the main, it has that source, for, barring a few brilliant journalists, all our economists of any repute are professors. Many of them are able men, and most of them are undoubtedly honest men, as honesty goes in the world, but over practically every one of them there stands a board of trustees with its legs in the stock-market and its eyes on the established order, and that board is ever alert for heresy in the science of its being, and has ready means of punishing it, and a hearty enthusiasm for the business. Not every professor, perhaps, may be sent straight to the block, as Nearing was, but there are plenty of pillories and guardhouses on the way, and every last pedagogue must be well aware of it._

From H.L. Mencken's 1922 essay, " _The Dismal Science_ " in "Prejudices, Third Series."

</comment><comment><USER11> Mirror? Site is down for me

<comment><USER12> [https://web.archive.org/web/20180602065458/https://www.inete...](https://web.archive.org/web/20180602065458/https://www.ineteconomics.org/perspectives/blog/meet- the-economist-behind-the-one-percents-stealth-takeover-of-america)</comment></comment>


Apple quietly announces new Mac Pros - <AUTHOR> http://www.apple.com/macpro/index.html

<comment><USER2> I suspect the reason that they did this quietly was that these are not new Mac Pros at all. Rather, they are same as the "Mid 2010" models they replaced, with minor bumps to the CPUs and memory. They continue to use the same generation CPUs that were available in 2010 (and same chipset, I presume), despite the fact that newer generation Sandy Bridge CPUs have been available for months now.

IMHO, the RAM bump wasn't even that good -- the base config now includes only 6GB, which is still laughable for a professional machine costing $2500.

Pretty pathetic if you ask me.

<comment><USER3> The CPU offered in the lowest Mac Pro today is the W3565, a "Bloomfield" model, based on Nehalim-B. For the record, that is now three generations behind, being behind the W36XX "Westmere"/Nehalim-C Xeon chips, the Sandy Bridge Xeon E3/E5, and the Ivy Bridge Xeon E3. A quick Googling cannot give me when the Ivy Bridge E5s are due out, but probably not soon.

EDIT: Apple does offer "Westmere" Xeons, but only as 6-core CPUs, which when looking at the website, is all but the cheapest option.

<comment><USER2> That is all true! Thanks for the clarification.

I believe the Ivy Bridge E5s aren't due until early 2013 at the earliest.

</comment></comment></comment><comment><USER4> Looks like time for a Hackintosh. I wonder what the best platform for an E5-based hackintosh would be. Like, pretend you want more than 16GB (or 32GB maybe) of RAM, in something vaguely current, and ideally with ECC.

<comment><USER2> Here's a forum thread posted by someone who's using a Supermicro Intel C606-based board with dual xeon E5s and 128GB of memory:

[http://tonymacx86.com/viewtopic.php?f=169&t=55963](http://tonymacx86.com/viewtopic.php?f=169&t=55963)

Looks like they had trouble getting the network functional, but everything else worked fine.

32GB of ECC ram compatible with a motherboard like that would only run you $300:

[http://www.newegg.com/Product/Product.aspx?Item=N82E16820161...](http://www.newegg.com/Product/Product.aspx?Item=N82E16820161561)

Apple charges $975 for an _upgrade_ from 6GB to 32GB. Highway robbery.

</comment></comment><comment><USER5> And a new Airport Express that no longer plugs directly into the wall. <https://www.apple.com/wifi/>

<comment><USER6> ...that has dual wired ports. This is a good thing.

<comment><USER7> Though I agree that it's good (awesome, even), it should be noted that only one of those ports is a LAN port. The other is WAN only.

<comment><USER6> That's pretty typical for Apple stuff, though. Although, if I remember right, you can set Apple stuff up as just bridged. I also find it interesting that there's now an iOS app for setting up their APs. That fixes a big gap for some people. I'm just hoping that IPv6 support comes back soon...

<comment><USER8> You can still use IPv6 when you install the old Airport utility.

</comment></comment></comment></comment></comment><comment><USER9> I was hoping for new Mac Pro's this WWDC. These look to simply get a processor upgrade. No Thunderbolt.

<comment><USER10> Also no USB 3, and no Bluetooth 4.0, which means, they didn't design a new motherboard.

Which, in turn, says rather loudly to me that the Mac Pro is not a high priority for Apple right now.

</comment></comment><comment><USER11> According to David Pogue Apple will have a new Mac Pro, possibly in 2013: [http://pogue.blogs.nytimes.com/2012/06/11/an-explanation- of-...](http://pogue.blogs.nytimes.com/2012/06/11/an-explanation-of-the-news- from-apple/)

</comment><comment><USER12> Their laptop line has been competitive enough in pricing that I'm willing to spend for the ergonomics - I don't expect a powerhouse machine as a portable. (My last 3 laptops have been either MB Pro or MB Air)

But where's the benefit - and who's the customer - for a desktop machine at these prices? Unless you absolutely _need_ OS X with a higher powered machine, why not just use Ubuntu in that desktop / server application?

</comment><comment><USER13> Again, no Nvidia CUDA support for scientific computing. Not even faster ATI cards... I think my next workstation is going to be Linux on Dell or HP.

<comment><USER14> They have been heavily involved in OpenCL for a while though, which is not tied to any specific graphics card manufacturer, or graphics cards specifically. There are some pretty nice OpenCL tutorials here btw: <http://www.macresearch.org/opencl>

<comment><USER13> True, but they don't offer a machine that can run OpenCL well. On my current Mac Pro (6-Core Xeon 3.33Ghz) the CPU runs most of my codes at the same speed as the ATI Radeon 5870. An ATI 7970 would have been a nice (minimal) addition but I really want support for an NVidia Tesla c2070 so I can develop CUDA codes to run on Amazon EC2.

</comment></comment></comment><comment><USER15> I haven't been able to determine - did their iMac line get _anything_? They all seem the same...

<http://www.apple.com/imac/specs.html> [http://web.archive.org/web/20110719193344/http://www.apple.c...](http://web.archive.org/web/20110719193344/http://www.apple.com/imac/specs.html)

<comment><USER16> Everything that was refreshed is tagged "new" on the main store page at <http://store.apple.com/us> . So no :)

</comment></comment><comment><USER17> According to arstechnica, there's a more serious update that's being worked on by Apple: [http://arstechnica.com/apple/2012/06/mac-pro-gets-minor- upda...](http://arstechnica.com/apple/2012/06/mac-pro-gets-minor-update-with- standard-12-core-option-no-xeon-e5/)

</comment><comment><USER18> I'm pretty sure I was able to get one of these yesterday. Or did they just rev the specs?

</comment><comment><USER19> For anyone who's interested I will be purchasing $1500 worth of hardware from newegg, assembling PC's, and selling them for only a 100% markup. And oh yeah, they'll be more powerful than this load of crap they want to sell you.

</comment><comment><USER20> quietly? how's that quiet if they sold out 8000 tickets for their "quiet announcement" and it was covered by the tech blogs and their uncles?

<comment><USER21> It's quiet because the Mac Pro upgrade was not announced in their big announcement, but only with a little "New" sign on their webstore after the show.</comment></comment>


Forget Oracle's Latest Java Patch  - <AUTHOR> http://www.forbes.com/sites/andygreenberg/2013/01/13/forget-oracles-latest-java-patch-just-kill-the-program-in-your-browser-for-good/

<comment><USER2> Out of curiosity, could anybody tell me more about Python's vulnerabilities? Python runs on bytecodes too, is multi-platform, so why aren't there just as many exploits since Python is older than Java?

Edit: Google shows 2.51M results for "Java security exploit" versus 5.03M for "Python security exploit".</comment>


Geeks are the New Guardians of Our Civil Liberties - <AUTHOR> http://www.technologyreview.com/news/510641/geeks-are-the-new-guardians-of-our-civil-liberties/ <comment><USER2> Bring back the librarians!

</comment><comment><USER3> Well duh.

Nobody else seems to care, or do anything about anything.

</comment><comment><USER4> Instinctive reaction to headline: "What do you mean, new?"

</comment><comment><USER5> Risible, self-indulgent, self-serving, myopic handjob.

<comment><USER6> Wow, you really have an impressive history of useless comments.

<comment><USER5> Nonsense, they're quite functional for all involved. You get to bristle at the presence of an id in a den of egos, I get to be right in the most obnoxious way possible, and everyone has a lovely time.

<comment><USER7> How did I end up at Reddit again...</comment></comment></comment></comment>


Reel - a jQuery plugin that provides a 360° views - <AUTHOR> http://jquery.vostrel.cz/reel

<comment><USER2> I am using this plugin inside an iPad app doing panoramic interior shots. Took some playing around to get it a little bit smoother. Didn't have much time to do it natively for the initial version but it works well, I've left it in.

</comment><comment><USER3> This looks awesome! I hope it works as well on mobile devices as it does in the browser.</comment>


Show HN: I built Milliner, a visual email building tool, now in public beta - <AUTHOR> https://www.milliner.app/ <comment><USER2> Really nice work.</comment>


5 months into a running a startup, the little things I learned - <AUTHOR> http://www.cucumbertown.com/craft/5-months-into-a-running-a-startup-the-little-things-i-learned/

<comment><USER2> Might I suggest a new home page for cucumbertown? It's extremely well done - very pretty, a lot of fun things happening.

It's also far too busy. I couldn't tell what I was supposed to see. Too many things moving and drawing my eyes away from actually reading. Too much scrolling. I closed it without trying to "come on in" even though I am likely in your target market.

It's a cool showcase of what you can do with HTML. Not so good for marketing a product.

<comment><USER3> Thanks for the feedback. We are on our way to fixing this.

</comment></comment><comment><USER4> GNUcash though ? I used that for a while and it was just so frustrating to work with. Even creating a custom invoice was a hassle. That application needs to be replaced by a cloud hosted app for simple invoicing.

<comment><USER5> Well, we are not using it for any invoicing but just maintaining our records. The year end reporting to the CPA was a cakewalk this time compared to all the head breaking we went through pouring over Excel entries, bank account statements etc last year. There are other alternatives but GNUCash works well for our needs.

<comment><USER6> Do you ever see yourself transitioning to a closed-source or SaaS accounting package, like Wave Accounting or QuickBooks Online? If so, why? If not, why not?

<comment><USER5> Of course we would grow out of GNUCash some day. I have not explored yet on what solutions we may end up looking at though. Since we are not an e-commerce outfit, we can live for some more time with basic tools just recording our expenses. The day when we start issuing invoices (or if we had to procure inventory to convert to saleable goods), we would need something other than GNUCash.

</comment></comment></comment></comment><comment><USER7> Say you have a financial controller (which looks at both accounting and financial performance) in front of you, what kind of questions would you like to ask? What kind of training would you like to get?

<comment><USER5> I think most important things would be: 1\. Understanding double-entry accounting 2\. Passing entries for liabilities and later squaring off them against payment from bank (e.g. credit card, deferred taxes) 3\. Managing all the hosting services and other SaaS tools monthly payments as an expense item 4\. Understanding how to account for equity</comment></comment>


Scaling lessons from the CEO of Zenefits - <AUTHOR> https://medium.com/@charlierguo/scaling-lessons-from-the-fastest-growing-saas-company-ever-a6e077653d21

<comment><USER2> Zenefits is pretty awful. A startup I was advising was using them and they were ridiculously slow to respond, failed to make sure payments were processed appropriately causing their insurance to lapse, screwed up payroll taxes, continued paying someone who had quit, and basically failed at every task they were supposed to be helping with. Further they had no personal accountability and did everything they could to shuffle blame rather than just trying to resolve the issues.

</comment><comment><USER3> "At the time, we were actually racing another company in our Y Combinator batch. It was called Simply Insured. Originally it was fairly different from us, but about halfway through YC the founders decided that they wanted to do what we were doing, and the company pivoted into our market."

One of the more interesting parts of the article. Not sure how you prevent or discourage that.

<comment><USER4> VCs typically don't want to have two companies in the same space in their portfolio due to conflict of interest. I wonder if YC has an analogous desire.

<comment><USER5> Paul Graham once responded to me asking a similar question.

[https://news.ycombinator.com/item?id=7180744](https://news.ycombinator.com/item?id=7180744)</comment></comment></comment>


Devastating tornado hits Moore, OK - <AUTHOR>

Live feed here: http://kfor.com/on-air/live-streaming/ <comment><AUTHOR> This is a serious, developing disaster. Best wishes to anyone with family or friends in the area.</comment>


Ask HN: Why is there seemingly such little research on (real) trees? - <AUTHOR> Also such little research on Tree Networks <comment><USER2> Your question is incomprehensible. Please clarify.</comment>


WP7 App 6 months worth of Sales and Downloads stats - <AUTHOR> http://lukencode.com/2011/05/07/windows-phone-7-app-phonealyticssales-and-download-numbers/

<comment><USER2> My first thought when looking at your graph was "why lower price to 33% for the same growth rate". Glad to see you were on the same track.

Hike it to $1.99 and double your income.</comment>


Show HN: Declutter your inbox by combining your newsletters into ONE email - <AUTHOR> https://subscriptionzero.com/?ref=hackernews <comment><USER2> Looks interesting. Is this open source? How can we contact you?

<comment><AUTHOR> It's not open source for now. You can contact me on Twitter @jevinsew</comment></comment>


Google's self-driving car is the victim in a serious crash - <AUTHOR> https://www.engadget.com/2016/09/24/googles-self-driving-car-is-the-victim-in-a-serious-crash/ <comment><USER2> I think nobody questions the need for fully autonomous cars. I do think there is still a lot of discussion needed in terms of autonomous car policy.

What insurance requirements must be in place for a manufacturer, such as Tesla, when their drivers are routinely taking their eyes off the road?

What insurance must be carried by the _manufacturer_ of the autonomous driving equipment? What effect does this have on the insurance carried by the "human in command"? (I was going to say "driver" but that didn't seem quite right.)

What additional legal protections must be in place for the _inevitable_ day when software chooses to kill a human?

What additional legal protections must be in place for the day when, because of software, a human's life was saved -- will society even know? Should Tesla produce a monthly statistic of the estimated total number of trips driven by their cars where an intoxicated "human in command" was able to get home? (Because then anyone can compare to how successful humans were before an autonomous system was available.)

What legal protections must be in place before Google is allowed to provide autonomous driving service "in the cloud"? If the cell connection suddenly drops at just the wrong moment, should Google pay the costs of the ensuing accident? (Ok, ok, maybe Google isn't planning on putting the driving software "in the cloud." I'm just saying...it's not like the owner of the vehicle will be any wiser. Then they'll be dead.)

<comment><USER3> The NHTSB laid down policy on this last week. Level 1 and 2, it's the driver's fault. Levels 3-5, the driver can sit back and relax and it's the car manufacturer's fault.

The Tesla fatal crashes (Tesla is Level 2) have produced lawsuits, but no decisions yet.

<comment><USER2> Thanks, and I agree on your quick analysis: no decisions yet. The NHTSB's policy will almost undoubtedly also need to be tested in court, as it appears on the surface that it over-simplifies some critical things.

</comment></comment></comment><comment><USER4> "Google also stressed that red light violations are the "leading cause" of car crashes in US cities, and that 94 percent of those are due to human mistakes."

Last I heard the speed trap towns and insurance companies were justifying their agenda by saying speed was dangerous. Before that it was the prohibitionists (MADD) and universities using drunk driving to push their agenda.

I'd wager that tailgating and distracted driving causes a lot more car crashes (they're far more common behavior even if the average instance is less risky), barring some absurd definition of car crashes that rules out most rear endings. IIRC other articles have mentioned Google has complaining about distracted drivers. Why the sudden change of priorities? Is a company Google owns trying to win speed camera contract or something?

</comment><comment><USER5> I don't know if I necessarily agree with the article's conclusion that self- driving needs to become the rule. Sure, if all cars were self-driving, this accident would not have happened, and that's the dream. But if the Google car was not self-driving, i.e., it was just me or you in the car, I doubt I would have been able to avoid this crash. If automatic sensors can't see a car speeding through a red light, there's no way I will.

<comment><USER4> Do we know if the van was traveling cross ways or was sitting at a red arrow?

Not many people will run a red 6sec after it's red. Many more people will floor it right as the light changes to cut off opposing traffic and take a left turn on a red left arrow

edit: nevermind, robocar got hit on the left.</comment></comment>