OAuth 2.0 Security Best Current Practice - <AUTHOR> https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15 <comment><USER2> I implemented more than a dozen OAuth integrations last year with multiple American and Chinese companies and oh boy it was painful.

I do not know why so many engineers end up reading a clear specification document like RFC-6749 [1] and then ignore 80% of the instructions. I had to deal with so many weird bugs and bad OAuth server implementations, I lost count of how many emails went back and forth trying to make sense of unexpected behavior.

Even Apple engineers got it wrong. They decided to create their own thing based on OpenID Connect for "Sign In With Apple" [2]. OpenID had to write an open letter [3] explaining the repercussions of their changes and fortunately were able to convince Apple to fix the implementation [4].

OpenID was lucky though, they had some leverage, but a _no-one_ like me couldn't possibly convince a gigantic conglomerate like Tencent to fix their web API. Talking with Tencent engineers has been one of the worst experiences in my career. The company apparently has a culture of constant job rotations, engineers are assigned projects for short periods of time with bonuses for early completion which encourage them to deploy half-finished code before moving to something else.

[1] [https://tools.ietf.org/html/rfc6749](https://tools.ietf.org/html/rfc6749)

[2] [https://developer.apple.com/sign-in-with- apple/](https://developer.apple.com/sign-in-with-apple/)

[3] [https://openid.net/2019/06/27/open-letter-from-the-openid- fo...](https://openid.net/2019/06/27/open-letter-from-the-openid-foundation- to-apple-regarding-sign-in-with-apple/)

[4] [https://openid.net/2019/09/30/apple-successfully- implements-...](https://openid.net/2019/09/30/apple-successfully-implements- openid-connect-with-sign-in-with-apple/)

<comment><USER3> I always wonder why do companies have to implement oauth2/open id connect. It seems like a big waste in tech to spend so much time implementing the same things by different companies.

can you tell me if there is a good drop in component that I can add to my product and integrate easily to get oauth2/open id connect? I heard good things about identity server but would appreciate if you could share your opinion on it.

<comment><USER4> I've recently tried out Keycloak([https://www.keycloak.org/](https://www.keycloak.org/)) and have been impressed with it. Saved at least a few weeks on a personal project. It does have a learning curve though.

<comment><USER5> This, so much.

I've been tasked with implementing oauth/openid at work and in about one month in spare time i was able to read rfc 6749, install keycloak, configure it, create a client, create a very basic app (~80 lines of python and flask) and log in via oauth/openid with user information and groups pulled via LDAP.

Keycloak is really a game changer.

This presentation is very interesting: [https://www.youtube.com/watch?v=FyVHNJNriUQ](https://www.youtube.com/watch?v=FyVHNJNriUQ)

</comment></comment></comment></comment><comment><USER6> This is all good and useful, but I wish OAuth folks would fix the bugs in the spec like, e.g.

"The authorization server MAY issue a new refresh token, in which case the client MUST discard the old refresh token and replace it with the new refresh token. The authorization server MAY revoke the old refresh token after issuing a new refresh token to the client."

This sounds reasonable on the surface, and technically it might be correct (depending on your interpretation of the words). But if someone naively follows this instruction to implement the server - issue a new refresh token and revoke the old one in the same refresh request at the server, what happens is when the client doesn't receive the new refresh token due to any transient failure, the client effectively loses its authorization, since the old refresh token is revoked and they didn't get the new one. Thus the protocol becomes "leaky" \- you lose users because of transient errors.

i.e. "after issuing a new refresh token to the client" needs to be "after the new refresh token is being used at least once", or otherwise invent some other way to ensure the new refresh token is correctly received at the client before revoking the old.

<comment><USER7> "… or otherwise invent some other way to ensure the new refresh token is correctly received at the client before revoking the old."

These sorts of details will typically wind up in an implementation report document. It's rare that an IETF protocol specification document will attempt to pre-determine the solution to all such implementation details up front, and IMO, not good when they do.

In some contexts, it may be much better to require the application to re- obtain resource owner authorisation than to allow a replay of a refresh token. In others, it may be much better to avoid requiring resource owner authorisation. What you see as a bug, others would see as a critical feature.

</comment></comment><comment><USER8> To this day I have no idea how one should handle client secrets in (F)OSS applications, and I'm often wondering if I'm the only one. I guess what this text says in 4.13 is "just don't put it somewhere for anyone to see", which means that the only solution is to make the id and secret configurable and let the _user_ register the application with its OAuth provider, which of course most users wouldn't know how to do. As a result, applications like Thunderbird simply put the secret in the code with a comment above it "please don't copy these values for your own application". I really don't mean to shame Mozilla, what else are they supposed to do?

<comment><USER9> From my understanding the best practice for applications that run on clients' machines (Javascript SPA, mobile app, email client) is to not use a client secret at all. Just use a client id and assume that anyone can reuse it.

Of course that is if the OAuth provider allows it.

<comment><USER8> > Of course that is if the OAuth provider allows it.

That's the catch. Last time I checked, at least Google didn't. So how can you write a (F)OSS email application for accessing GMail via OAuth2, without putting the secrets into the code (which Google also forbids)?

<comment><USER10> In this situation, their guidance says to embed the secret, because in this context it's obviously not a secret. Here's the current page [1]; here's the earliest Archive.org snapshot of its one-earlier predecessor page from 2015 [2] -- the advice has been consistent.

[1] [https://developers.google.com/identity/protocols/oauth2/nati...](https://developers.google.com/identity/protocols/oauth2/native- app) [2] [https://web.archive.org/web/20150520223809/https://developer...](https://web.archive.org/web/20150520223809/https://developers.google.com/identity/protocols/OAuth2InstalledApp)

<comment><USER8> No, Google is not consistent in the slightest, because their terms of service directly contradict this statement:

"Developer credentials (such as passwords, keys, and client IDs) are intended to be used by you and identify your API Client. You will keep your credentials confidential and make reasonable efforts to prevent and discourage other API Clients from using your credentials. Developer credentials may not be embedded in open source projects."

From: [https://developers.google.com/terms](https://developers.google.com/terms)

</comment></comment></comment></comment></comment><comment><USER11> It is probably worth pointing out on this thread that there is a brand new draft (not yet on the working group) attempting to combine extensions and the best practices of OAuth (including these security practices) into a new "2.1" version.

[https://tools.ietf.org/html/draft-parecki- oauth-v2-1-02](https://tools.ietf.org/html/draft-parecki-oauth-v2-1-02)

</comment><comment><USER12> I need to read this draft RFC a few times before I can grasp it completely. There is an existing RFC drafted in 2013 with a focus on OAuth 2.0 threat model and security considerations [1], and it looks like this new RFC is making more specific recommendations on top of it. May be read them together.

To be honest, I was wishing for OAuth 2.5 if not OAuth 3.0 to consolidate already fragmented OAuth 2.0 spec and landscape [2]. At this stage, there are too many draft proposals and a majority of them led by vendors with some interest in standardizing their implementations.

For example, this RFC suggests restricting issued access token to one resource at a time (using audience parameter). Well with Microservices landscape this gets really challenging. Your client application may be interacting with multiple resources. Neither OpenID Connect nor OAuth 2.0 offer solutions to issue multiple access tokens (not yet). An API Gateway may be a solution but still so much ambiguity.

I think OpenID Community has done a better job to organize their specifications and working groups [3]. If you go on their specification page it tabulates really well what spec is final, currently under implementation, draft, or obsolete. Still, big vendors influence agenda and direction.

(Disclaimer: I am the founder of [https://axioms.io/](https://axioms.io/) which OAuth 2/OpenID Connect compliant identity management platform)

[1]: [https://tools.ietf.org/html/rfc6819](https://tools.ietf.org/html/rfc6819)

[2]: RFC 6749, RFC 6750, RFC 6819, RFC 7662, RFC 7009, RFC 7519, RFC 8414, RFC 7591, RFC 7592, and 20 more.

[3]: [https://openid.net/developers/specs/](https://openid.net/developers/specs/)

<comment><USER10> As posted by someone downthread [1], there's an ongoing effort to update the OAuth 2.0 spec with changes since, lessons learned, and best practices [2], in what's currently being called OAuth 2.1. Some more rationale and resources on oauth.net [3].

[1] [https://news.ycombinator.com/item?id=23083245](https://news.ycombinator.com/item?id=23083245) [2] [https://tools.ietf.org/html/draft-parecki- oauth-v2-1-02](https://tools.ietf.org/html/draft-parecki-oauth-v2-1-02) [3] [https://oauth.net/2.1/](https://oauth.net/2.1/)

<comment><USER12> Thanks for the pointer. I am not sure if OAuth 2.1 is part of working group yet. Nonetheless, a good consolidated read compared to reading 20 different RFC specs.

</comment></comment></comment><comment><USER13> > Clients MUST NOT pass access tokens in a URI query parameter

I've been wondering about this lately. This makes sense from a security perspective, but the primary alternative is setting a header like Authorization: Bearer, which makes your request subject to browser cross- origin restrictions, and all the fun that comes with CORS. In my case, the extra round-trip required for the CORS preflight in this situation is simply a non-starter for my application.

It would be nice if there was an escape hatch for developers who understand the risks. More background in this SO question I asked a couple days ago:

[https://stackoverflow.com/q/61563348/943814](https://stackoverflow.com/q/61563348/943814)

<comment><USER14> put it in a cookie (secure samesite) or in request body

<comment><USER13> Can you give more details on how you'd use a cookie here? SameSite=Strict/Lax can't be used cross domain, and none is no good for mutating requests due to CSRF.

Request body works, but it forces you to split your API if you want to be cache friendly. What I mean is ideally you want public data to be GETable and thus cacheable. In the system I'm building, any given path can change back and forth from being public vs requiring authorization, so if I use requests bodies (ie POSTs), I would need to detect whether the data is public or not before making the request and choose between GET or POST at request time. That might not actually be that bad; I'll have to think about it more.

</comment></comment></comment><comment><USER15> Worth bearing in mind:

> This Internet-Draft is submitted in full conformance with the provisions of > BCP 78 and BCP 79.

> ...

> It is inappropriate to use Internet-Drafts as reference material or to cite > them other than as "work in progress."

<comment><USER16> As a case in point: [https://tools.ietf.org/html/draft-wkumari-not-a- draft-05](https://tools.ietf.org/html/draft-wkumari-not-a-draft-05)

I think publishing an IETF RFC on security best practices is hard, but I hope these authors manage to pull through

</comment></comment><comment><USER17> If there was one perfect way to do third-party auth, we wouldn't need a standard, because all the big companies would be doing it, and the smaller companies would do it.

The problem is, there's a bunch of decisions with auth, which have to be made, but aren't really important. What should the name of the auth token header be? What should be the format of the responses? These decisions are like deciding what side of the road to drive on: it doesn't matter which side of the road you drive on, as long as everyone drives on the same side of the road. The function of a standard is to decide what side of the road everyone drives on.

OAuth isn't a standard. It's just a description of all the various homegrown third-party auth systems that anyone has implemented over HTTP, with only the absolute worst patterns weeded out. None of the shareholders wanted to re- implement their third-party auth, so they just made sure their flavor of auth made it into the standard. It's like if the Europeans and the Americans got together to standardize the side of the road that everyone drives on, and the standard they came up with is "You have two options for which side of the road to drive on, the right or the left."

Until a group of visionaries with enough clout to make the world fall in line creates an actual standard, OAuth is going to continue to be crap. And there's strong disincentive to do that: if you agree to conform to a standard that isn't exactly what you've already implemented, then that means you have to reimplement. A few years' pain conforming everyone to a standard would significantly drive humanity forward--an incomprehensible amount of developer hours have been spent writing custom OAuth integrations, and an actual standard would allow us to write libraries around it that everyone could use. But corporations don't care about pushing humanity forward when it's contrary to their bottom line.

</comment><comment><USER18> It's not structurally all that great; it opens with a long section of recommendations backed by citations to later "attack model" sections in the text, which themselves include disjoint lists of recommendations.

</comment><comment><USER19> I've been working with OAuth 2 for 7 years and I still don't really understand all the dark corners of the spec. Good to see Resource Owner grant type get called out for a "Do not use", although I dont think using it in a private, server side context is off the cards...

</comment><comment><USER20> Is it weird I like reading such specs? Many people find it dense, but I find it rewarding to read. What CS job would be more tuned to spending time doing this leisure?

<comment><USER21> Sysadmin/devops

</comment></comment><comment><USER5> Since we're talking oauth/openid: does anybody know if there's a way to get the OpenID spec in a format that is nicely formatted for printing?

(ideally, just like rfc 6749...)

</comment><comment><USER22> The road to hell is paved with best practices.</comment>


Bitcoin – Fear, Uncertainty, Doubt - <AUTHOR> http://justinvincent.com/page/2172/bitcoin-fear-uncertainty-doubt

<comment><USER2> Some Additional Ones:

 _FUD: Unless using mined bitcoin 's people will never purchase anything with BTC unless the current trading price market price is over the price they paid for it and this will make put a bitcoin based economy in peril

FUD: If the price is over the user's purchase price they will be in a constant cycle of buyers remorse or else waiting for a better price for goods because of the potential speculative return from an increase in price and this will make put a bitcoin based economy in peril_

Oh wait, both of those are true.

Bitcoin in a fantastic disrupter of the old transaction fee hungry financial systems, it will be ground zero for change.

In that it is revolutionary.

But it will will most likely fail to become a viable currency unless the volatility vanishes and it goes into a consolidatory sideways pattern. This is unfortunately not very probable either.</comment>


FDA Approves Drug with Potential to Treat 90% of Cystic Fibrosis Patients - <AUTHOR> https://cysticfibrosisnewstoday.com/2019/10/22/fda-approves-trikafta-1st-vertex-triple-combo-with-potential-to-treat-90-of-cf-patients/ <comment><USER2> _Trikafta will likely carry a list price of $311,000 when it arrives shortly on the U.S. market_

<comment><USER3> That's around $3000/month for 15 years. Not that much for miracle of curing incurable.</comment></comment>


Ask HN: Good Discussion Forums for Static Program Analysis? - <AUTHOR> I am interested in Program Analysis (or Static Code Analysis). Obviously this is a fairly specialized topic (my own level is a Bsc/Msc in CS/compilers/etc).<p>Any good forums for both research, SOTAs and libraries ? <comment><USER2> I don't know of any discussion forums, but would recommend the following resources for learning:

Accessible (at least compared to more formal texts) lecture notes: [http://www.cs.cmu.edu/~aldrich/courses/17-355-18sp/](http://www.cs.cmu.edu/~aldrich/courses/17-355-18sp/)

Free book that's more readable than "Principles of Program Analysis" by Nielson et al: [https://cs.au.dk/~amoeller/spa/](https://cs.au.dk/~amoeller/spa/)

Some practical resources for binary PA: [https://reversing.io/resources/](https://reversing.io/resources/)

</comment><comment><USER3> Which languages are you working in, friend? A prof of mine was really into static analysis for Java, and I think he was part of a few e-mail lists and newsgroups</comment>


Favtape: Full playback for your favorite Last.fm and Pandora songs - <AUTHOR> http://www.techcrunch.com/2008/07/21/favtape-full-playback-for-your-favorite-lastfm-and-pandora-songs/

<comment><USER2> It's a same they havent done too good a job at ripping off the UI of muxtape.</comment>


China Telecom and Warner Bros Hacked - <AUTHOR> http://pastebin.com/u9n2SBUX

<comment><USER2> SwaggSec, lulzsec, ... at least they are creative for choosing a team name.</comment>


Stock-trading app Robinhood was rejected by 75 investors - <AUTHOR> http://www.businessinsider.com/robinhood-crypto-stock-trading-new-funding-valuation-2018-5 <comment><USER2> They haven't "won" anything yet...a high private unicorn valuation doesn't mean success.

I would really caution connecting your bank account through Plaid on RH. It's really unclear what data they are collecting but their privacy policy suggests they are collecting your _bank account transaction history_ using Plaid's API. 100% a dealbreaker for me.

<comment><USER3> >They haven't "won" anything yet...a high private unicorn valuation doesn't mean success.

We could debate what "success" means endlessly, but if you're a VC, your job is to put money in companies with low valuations that will eventually end up with high valuations.

<comment><USER4> I think the idea is that, since RH hasn't been acquired or gone public, they haven't yet "ended up" with a high valuation. It could all go away before the investors can get liquid (e.g., Theranos for a pathological example).

<comment><USER5> There are deep secondary markets around late-stage venture-backed companies. Robinhood investors seeking to exit around this valuation have options.

<comment><USER6> Just to clarify, we're debating whether Robinhood is a success and the measure of success being used is "can early investors cash out for a gain?"

What if every company checked that box and couldn't provide lasting value beyond that? Do we still consider this a success because we're posting on a forum run by a VC?

<comment><USER7> Ignoring any one specific company for a moment, an investor consistently able to invest early and time their exits near the peak of each company's valuation would be a roaring success.

<comment><USER6> That's my point. We're saying that Robinhood is a success as a company because an early investor would have had a nice exit? Thats our "success" barometer?

I'm going to call BS on that one.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> I tried them and it is the most amateurish stock broker I have ever touched in my life. There are no metrics for any of the stocks. The graphs are not annotated, the spread seems to be inflated (as they probably make money with it).

Also as said higher in the comments, if you are not paying you are most probably the product. And I don't want my private investment informations to be sold as data to BigCo. Paying x$ per transaction is a small price to pay to not have your data all over.

They might be a good answer for newbies that want to spend 100$ on a stock for the first time, but for anything else I will stay with Ameritrade. Thanks

<comment><USER9> > the spread seems to be inflated (as they probably make money with it)

The Order Protection Rule of Regulation NMS makes this illegal (during regular trading hours).

<comment><USER10> Execution quality matters and given enough order flow a they can still match client orders to make a profit without giving a worse price than NBBO.

<comment><USER11> That's easier said than done. If you don't already have proper market making infrastructure and strategies you'll probably lose money trying to do that. Add in market makers paying per order and it doesn't make sense

</comment></comment></comment></comment><comment><USER12> The one feature that I'm really missing from Robinhood is selling based on Spec-ID instead of just FIFO. FIFO means I won't be able to tax-loss harvest making Robinhood effectively much more expensive than the alternatives (as the additional taxes are much higher than what I would save in trading fees).

<comment><USER13> Can you explain what this means?

<comment><USER14> If you've been holding stock for more than a year and then sell, it will be taxed at a lower capital gains rate. If you sell sooner, it will be taxed at an ordinary rate.

If you have stock at a brokerage and you want to sell it, FIFO is first in first out. The brokerage will sell the oldest shares you own. It sometimes makes more sense to sell a specific set of shares you bought later depending on purchase price and current price. For example a FIFO sell could generate taxes while a specific lot sell could generate no taxes (you sold at a loss).

</comment></comment></comment><comment><USER15> Is there anything like that available in Europe? In particular in Switzerland?

I checked what my bank, Postfinance, wants to charge for a brokerage account - it's in multiple hundreds of dollars.

 __EDIT: __Thanks to All for the responses! The offered options seem to be much better than my bank.

\- Interactive brokers

\- DeGiro

\- Lynx

<comment><USER16> Interactive brokers are a cheap European shop. Not free to trade but very cheap and they give you access to a lot of big markets.

<comment><USER12> IB is not European but based in the US. I would also recommend it but tax could be somewhat more complicated (W-8BEN form, etc.).

<comment><USER17> IB has US and UK accounts (and likely more). For Switzerland (and Europe) you'll get a UK account and you will not have W-8BEN problems.

<comment><USER18> They also have local resellers in many countries, but avoid them because the rates are higher.

</comment></comment></comment></comment></comment><comment><USER19> How do THEY make money? The article didn't say, or I missed it.

<comment><USER20> They sell orders/trading data of small retail investors to Big High Frequency Traders so that they can gain an edge in the zero sum game of day trading. 'Robinhood' seems like an apt name.

<comment><USER21> I have heard from the horse's mouth that small retail investors orders/trading data is used as a contrarian signal. In other words the Big Traders see what the small retail investors are doing, and do the opposite.

<comment><USER22> It's somewhat similar to that.

Assume you are a market maker - you make money off of the bid-ask spread. Specifically, you supply liquidity by issuing standing orders: To buy at the bid, and sell at the ask.

For a market maker, you typically want the price to "stable", and you set your bid/ask to reflect the current order flow supply/demand - this is the "equilibrium" price.

When prices are volatile, your risk is greater. Typically, market makers have to maintain some position in the securities they transact in, and if they don't effectively hedge this position and the price moves against them, they could take big losses.

The optimal condition for a market maker is to have supply and demand balanced, and unchanging. Then you can simply make money off the bid-ask spread without much risk. (All else being equal, having fast access, i.e. HFT, and fast processing systems to detect upcoming likely prices changes also helps)

Market makers are worried about adverse selection; that is, if a huge buy order comes into them, they are worried that the buyer knows more about the price of the security than they do. If they sell to them, the price could subsequently increase, and they could take a loss. (The same applies for a big sell order)

That is why they would prefer not to transact on the open market - i.e. the exchange. It's difficult to tell who are the informed traders.

Instead, they would rather transact against "uninformed" traders. "Uninformed" here does not imply "stupid", but rather just implies that, on average, these traders don't possess any special information or any more information than they do.

In the optimal sense, market makers would prefer to transact against an order flow that is unbiased; one example of this would be an order flow where there are equal numbers of buy and sell orders.

This is why market making firms pay for retail order flow. Retail order flow is assumed to be uninformed, and therefore unbiased relative to the information that the market makers themselves have. Being able to transact against retail order flow thus gives them a relatively unbiased order flow from which they can profit off of the bid-ask spread with much lower risk.

</comment></comment></comment></comment><comment><USER23> With over 10 years of experience helping people acquire, recover and stay in their homes and expand/start their business. We help new entrepreneur and smart business owners to grow with adequate finance.

Ford Credit Centre offers business loans to help you grow your business. We give out all kind of loan like Educational loan, Business loan, home loan, Agricultural loan, Personal loan, auto loan and other good Reason, I also give out loans from the rang of $5,000USD- $5,000,000USD at a 3% interest rate. Duration of 1- 15 years depending on the amount you need as loan.

Get back to us for more information

WhatsApp:+1 404 400 4210 www.fordcreditcentre.com

</comment><comment><USER24> The 75 rejections number doesn't seem to mean anything without some context... Maybe the mean for companies with similar valuations over similar time frames is 300 initial rejections, and this is actually an outlier.

</comment><comment><USER25> I never "got it". It's just a brokerage like etrade? Those places charge under ten dollars per trade. What's the big draw for zero fees? It's not like you buy stocks that often.

<comment><USER5> Brokerage is a book business. Robinhood is collecting a book of young customers (whom traditional brokerages have not been successful attracting) who frequently trade and use margin (which makes them lucrative).

<comment><USER26> Can you explain what the phrase "book business" means?

<comment><USER5> > _Can you explain what the phrase "book business" means?_

You accumulate a "book" of end customers, usually from a particular demographic, for the purpose of selling to someone who doesn't have that demographic. Versus flow ( _e.g._ exchanges) or asset accumulation ( _e.g._ ETFs) businesses.

</comment></comment></comment></comment><comment><USER27> I think I see some flaws in how we automatically label a company's value based on how much an investor is willing to invest. Why isn't a startup's "value" pegged to real metrics? So in that sense, an investor is free to invest more, but they can't automatically raise the company's value simply by the fact that they were willing to invest more.

Semantically I guess it's accurate, but we really should come up with a better way, or different words, to explain what it really means. Distilling it down to "a company's value is X" is extremely misleading IMO.

</comment><comment><USER28> Rejection can also mean a sign the investors didn't understand the idea, opportunity, or the ability.</comment>


Hiring via referrals isn't great for diversity - <AUTHOR> https://www.bloomberg.com/news/articles/2016-12-23/hiring-an-employee-s-buddy-is-fueling-a-major-workplace-crisis?cmpid=BBD122316_BIZ <comment><USER2> _A McKinsey report from 2015 found that among 366 companies, those with gender diversity outperform those without it by 15 percent; those with ethnic diversity outperform those without it by 35 percent._

The problem with analyses like this is that they're observational studies rather than interventional studies. Knowing that successful companies are more likely to have gender and ethnic diversity does not necessarily indicate that increasing gender and ethnic diversity will make companies more successful.

There are many things which we consider to be inherently Good Things but are completely disregarded by most of the world's population, simply because they can't afford to be concerned about such things; in a sense, being concerned with diversity is a sign of privilege, and in some cases is a even used as a economic signalling mechanism. If your company is only barely staying afloat, you're far less likely to spend time and money promoting diversity.

Differences in priorities extend all the way down the socioeconomic ladder. In many of the world's slums, an asbestos roof is a sign of success and something which people work hard towards obtaining. Don't they know that asbestos can kill them? Of course they do -- but having an asbestos roof makes their home quieter when it rains, cooler when it's sunny, and they'd have to be extremely lucky to live long enough to get lung cancer from it anyway. In the Western world of course the notion of people willingly exposing themselves to asbestos is horrifying; but it makes sense in their context.

I hope we can all strive to remember that people may have different priorities based on their backgrounds, and especially their socioeconomic backgrounds. Coming from my privileged position, I think diversity is great; but if a small business in rural Wyoming ends up hiring 100% white heterosexual males because those are the people the business owner knows and he can't afford to spend time looking beyond his circle of acquaintances... well, it's unfortunate, but it doesn't make him racist, sexist, or homophobic.

</comment><comment><USER3> Is it possible that successful companies devote more resources to increase diversity? Implying that companies are more diverse because they are successful. What tests have been done to tease out which is the causal factor?

<comment><USER4> I think ou are onto something - business is difficult and even simply surviving is a challenge facing most enterprises. Thinking about diversity seems like a first-world problem and only really on the radar of companies who have a strong foothols in the market already.

</comment></comment><comment><USER5> TL;DR: People tend to refer buddies from the same gender/race. To alleviate this problem instead of ditching referrals altogether add a referral cash bonus (only?) for diversity referrals.

<comment><USER6> Thanks, that was a good summary.

If you're someone of a less represented class, and you tend to refer your buddies from the same gender/race, you're going to get better bonuses than your overly represented peers. Does this constitute reverse discrimination?

<comment><USER7> Discriminating based on race is racist. End of story. This would never make it past your legal department.

<comment><USER8> You say it like it's a bad thing.

[http://lesswrong.com/lw/e95/the_noncentral_fallacy_the_worst...](http://lesswrong.com/lw/e95/the_noncentral_fallacy_the_worst_argument_in_the/)

<comment><USER9> Legal risk sounds like a bad thing. That being said, it doesn't put discrimination in the hiring process per se, only the referral process, which may not be protected by federal law. I am not a lawyer.

</comment></comment></comment></comment></comment><comment><USER10> I thought I remembered a similar phenomenon where you tend to hire or refer people that don't represent a strong competitive threat to your career. That is, hiring people that you think are smart, but not quite as smart as yourself. Can't find a good reference to any actual study or data though.

<comment><USER11> That's the "A's hire A's, B's hire C's" concept. A sign of a bad manager is that they never recruit people that they feel are equal to or greater than themselves in any way. The outcome is that that manager holds back the entire organization to secure their own power, and dilutes the talent of the group for personal gain.

Sadly, the President-Elect appears to share this philosophy:

[http://townhall.com/tipsheet/guybenson/2016/04/21/life- lesso...](http://townhall.com/tipsheet/guybenson/2016/04/21/life-lessons-with- donald-never-hire-people-who-are-smarter-than-you-n2151620)

</comment></comment><comment><USER12> Whenever I am involved in hiring, I look at boring stuff, such as ability to do the job at hand, team fit, alignment of ideas, etc. I look for the best possible person for the job and enterprise at that specific moment in time. I don't look at or consider gender, race, religion, or anything else.

Diversity in the workplace is not my problem. Finding the right person for the job is. I have hired people of all genders, sexualities, races, as well as physical abilities. These things just shouldn't feature in a hiring process either way. I will hire the best candidate for the job, every time.</comment>


HIPAA Grouse - <AUTHOR> https://siderea.dreamwidth.org/1639993.html <comment><USER2> If you're having fun now, wait until you get to PCI for payments.</comment>


The Brain's "Inner GPS" Creates Conceptual Spaces in the Mind - <AUTHOR> http://nautil.us/blog/new-evidence-for-the-geometry-of-thought <comment><USER2> The honeycomb lattice mentioned in the article resonated with me.

I'll go out on a limb and share a personal anecdote: In high school I took magic mushrooms with my friends, and at one point in the experience the world disappeared and I saw an undulating fabric in a honeycomb pattern. In the center of each "hole" in the fabric was a link to a memory, a time and a place.

It was one of those images that was hard to forget - I can still recall it many, many years later.

In "Dragons of Eden" Carl Sagan muses that drugs might work in an analogous way to how night time brings out the stars. The stars are always there, but daylight masks them.

In a similar way I've often wondered if there was something to that geometry I saw.

Or perhaps it's just my brain trying too hard to be poetic :P

<comment><USER3> I've always been under the impression that consciousness is actually a bunch of brain activity competing for attention and that one thing at a time is selected/blessed to be the highlight of one's attention.

The addition of drugs sort of pulls back the curtain on what other things may be just under the mark, lurking beneath your "default" consciousness.

<comment><USER4> >I've always been under the impression that consciousness is actually a bunch of brain activity competing for attention

This reminds me of one my favorite quotes from Westworld (HBO, 2017)

"There is no threshold that makes us greater than the sum of our parts, no inflection point at which we become fully alive. We can't define consciousness because consciousness does not exist. Humans fancy that there's something special about the way we perceive the world and yet, we live in loops as tight and as closed as the [robots] do, seldom questioning our choices - content, for the most part, to be told what to do next." \- Dr. Ford (character)

One of the things I really love about marijuana is that while it mentally alters your state, it leaves you completely coherent, where you can still be perceptive and reflective. For me it's like a deep, consistent meditation if I relax and really focus on how I'm "thinking." Perceptually, at least personally, it really feels like there are mental facilities that suddenly become "communicative", a higher (no pun intended) mental state. If I dose right I often use marijuana to reflect about how I'm living my life, a social situation that needs attention, a hard problem at work, or sometimes I just really really love listening to music. And I have to say, if you've never listened to music while high, you truly are missing out on an experience.

All this is basically to say I totally agree with your statement about "pulling back the curtain." I personally consider it useful, it's often nice to have a different perspective on a problem. It's helped me out a lot, I think.

<comment> saiya-jin Can attest to those experiences too. Most of my biggest decisions in life were started as a seed thought in Inception style while high. For this to happen though, I had to be alone with my thoughts, otherwise others presence would take all the focus. And they were really good life changing decisions.

What basically happens (among other things) the feed from my subconsciousness that sometimes suggest ideas out of blue or solves problems becomes much, much stronger. Sometimes I can't even manage to type all of those ideas/todos into phone, they come so fast. The only issue is, short term memory impairment also makes them fade away pretty quickly, so sometime it looks like a race to record it all.

</comment></comment></comment></comment><comment><USER5> As it happens, the representations (aka embeddings) learned by deep neural nets also organize objects geometrically in tensor or vector spaces, such that similar objects end up near each other in a high-dimensional system of coordinates. AI researchers nowadays routinely use generative models like, say, Glow[a] to identify geometric directions in the coordinates of a representation space that correspond with concepts such as "smiling vs not smiling," "male vs female," etc.

[a] [https://blog.openai.com/glow/](https://blog.openai.com/glow/)

<comment><USER6> I find myself reading the news backwards; rather than "the brain uses space- orientation to map other things", it's like "it's interesting how many things can be represented in a space-like manner that we may not have otherwise thought they could be".

I think the difference is that rather than "the brain is sort of performing a hack and reusing something it doesn't seem to have any driving need to re- use", the news is that many things turn out to fit into that model despite our intuition that they should have no particular spatialness to them. Metrics are more fundamental than we may have thought and it's actually neither a surprise nor a "hack" that the brain exploits this characteristic.

An interesting question comes to mind; do some brains have more dimensionality than others? Are some people literally one-dimensional thinkers, pervasively? Could we produce a test to distinguish between 2.1- and 2.5-dimensional thinkers? Can an increase in dimensionality be trained, or a natural talent fail to flourish without proper stimulation?

<comment><USER7> > I find myself reading the news backwards; rather than "the brain uses space- > orientation to map other things", it's like "it's interesting how many > things can be represented in a space-like manner that we may not have > otherwise thought they could be".

It could actually be spatially related in the brain too. Neurons are situated spatially and spatial constraints, ie. they have a limited number of connections, and the closer two neurons are spatially, the faster they can signal each other. The neuronal connections also rewire each other based on reinforcement, which could very well consistent of moving related concepts closer in your physical brain (at least important ones).

</comment></comment></comment><comment><USER8> I worked on this with Peter Gardenfors in my PhD thesis. If someone is interested in a mathematical model of conceptual spaces which is not machine- learning oriented, you can check this out: [https://arxiv.org/abs/1608.01402](https://arxiv.org/abs/1608.01402)

<comment><USER9> Thanks for adding this.

</comment></comment><comment><USER10> just a quick knee jerk example here, it seems the visual cortex has an intrinsic noise that is normally filtered out but is shunted through when psychedelics are in the mix.

[https://en.wikipedia.org/wiki/Form_constant](https://en.wikipedia.org/wiki/Form_constant)

>" Many observers see geometric visual hallucinations after taking hallucinogens such as LSD, cannabis, mescaline or psilocybin; on viewing bright ickering lights; on waking up or falling asleep; in "near-death" experiences; and in many other syndromes. Kl ¨ uver organized the images into four groups called form constants: (I) tunnels and funnels, (II) spirals, (III) lattices, including honeycombs and triangles, and (IV) cobwebs. "<

[http://psychedelic-information-theory.com/geometric- hallucin...](http://psychedelic-information-theory.com/geometric- hallucinations)

<comment><USER11> I used to see geometric shapes upon waking up if I woke up abruptly in the middle of a very visual dream, but only if the first thing I saw was a sudden bright light (as in having my sleep mask abruptly removed). Hasn't happened to me in a while, but usually the bright light of the real world looks "pixelated" in very weird geometric patterns that for me were morphing, chromatically abberated and animated. These flashes of shapes only lasted 1 second at most but were very trippy to experience.

</comment></comment><comment><USER12> >"Cognitive spaces are a way of thinking about how our brain might organize our knowledge of the world," Bellmund said. It's an approach that concerns not only geographical data, but also relationships between objects and experience. "We were intrigued by evidence from many different groups that suggested that the principles of spatial coding in the hippocampus seem to be relevant beyond the realms of just spatial navigation," Bellmund said. The hippocampus' place and grid cells, in other words, map not only physical space but conceptual space. It appears that our representation of objects and concepts is very tightly linked with our representation of space.

That is certainly how I think I think ... I think :) As an experiment two years ago, I bootstrapped an IDE from an html file with just textarea that could overwrite it's own source on a webserver (it would restart the server if the server code was changed) in the browser. Eventually I got it to the point that it laid out the editors for individual files in an infinite plane of 2d space (akin to something like placing editor windows in a google maps like scrollable ui) and saved their locations between refreshes.

I still really miss the spatial sense that the file that controls the editors is up over there, and the file browser code is right over at that location, (and they slightly overlap their tests and other supporting files).

I had this vision of this sort of becoming a system wherein everyone could choose to see all the files in the system being edited in a shared global space (or perhaps space of workspaces). So if you wanted to see what so and so was working on you'd just navigate over to area where the files they are working on are located. By default if you were editing a file in this system in a public repo, since it was browser based it would be publicly viewable.

Juggling editor tabs and re-opening and reorganizing windows, and not being able to create workspaces of editor layouts since then has kind of sucked. It's like having this glimpse of a system that was from some future time but then having to abandon it.

<comment><USER13> Something similar to this is discussed and championed in The Humane Interface:

[https://www.amazon.com/Humane-Interface-Directions- Designing...](https://www.amazon.com/Humane-Interface-Directions-Designing- Interactive/dp/0201379376/ref=sr_1_fkmr0_1?ie=UTF8&qid=1549949192&sr=8-1-fkmr0&keywords=jeff+raskin+interface)

</comment></comment><comment><USER14> > _"we have reported an unusually precise hexagonal modulation of the fMRI > signal during nonspatial cognition."_

The article has an illustration of a hexagonal lattice but makes zero explanation of what that means in practice, and the sentence above is the only actual reference.

Can anyone here explain what hexagonal modulation means, and what it means in the context of an fMRI signal?

<comment><USER15> Honeycomb structure is the optimal way to cover a region with shapes of the same area while minimizing the boundary.

You get honeycomb lattices naturally when you try to pack things efficiently into a surface. For example the same sized soap bubbles on the water surface.

The grid cells are tightly packed to equidistance to each other just like the bubbles.

</comment></comment><comment><USER16> I wonder if this explains why the "Method of Loci" or the "Memory Palace" technique of memorizing and recalling facts work so well.

<comment><USER17> I also wonder what it means for people who have very poor spatial reasoning. If you have poor navigation skills are you also likely to be bad at memorisation and recall?

<comment><USER18> I can navigate quite well, but I need to go to where I must make a choice of path. I have a hard time visualizing the map, or the overview, so to speak. I find that I organize my code much the same way. I build patterns that I recognize and can choose the right way (to modify or use) when I get there. I guess it must be the same for everyone, but at different levels of scale.

</comment></comment></comment><comment><USER19> For whoever's interested, there's a Peter Gärdenfors lecture on youtube:

[https://m.youtube.com/watch?v=L0X9mEe9aY0](https://m.youtube.com/watch?v=L0X9mEe9aY0)

</comment><comment><USER20> _In Krakow, Gärdenfors pushed against that prejudice. In his talk, "The Geometry of Thinking," he suggested that humans are able to do things that today's powerful computers can't do—like learn language quickly and generalize from particulars with ease (to see, in other words, without much training, that lions and tigers are four-legged felines)—because we, unlike our computers, represent information in geometrical space._

On the contrary, it's pretty common to represent information on computers in geometrical space. This is what the whole concept of embeddings is, and it works really well!

</comment><comment><USER21> We perceive the world through or conceptual models of it.

So the fact that our analyze of the world is similar to our analyze of our other conceptual models seams very rational.</comment>


Microsoft Bing Controls 30% Of Search Market, Google Slowly Sinking  - <AUTHOR> http://mashable.com/2011/04/11/bing-google-stats/

<comment><USER2> I feel a major contributor to this might be the fact that IE uses Bing as the default search engine, even if it annoyingly prompts you to change it on initial install. Admittedly, that's not what drives the choices of this corner of the web, but it might affect the web as a whole, where IE is still (by far) the dominant browser.

Of those IE users, there's likely a set of people who don't even know there is something called "Bing" -- they just type into the search field and click on the results when they come up. They might even think they are "googling" their search, and as Bing and Google look essentially the same, they won't notice a difference.

<comment><USER3> It's called leveraging your monopoly. 9 out 10 desktops still run Windows. That's a lot of control. As a company, Microsoft should leverage this right up to the point where they might run afoul of the EU or US govt. That's just good business.

<comment><USER4> Good business would be to build something people would actively seek out, in my mind. Anything else seems to diminish the brand -- or maybe the point is to diminish the value of search and the competitor's brand?

</comment></comment></comment><comment><USER5> This is not entirely surprising. If you take Yahoo's share of the market and add Microsoft's own pre-existing share with Bing, you get to about 30%. The question is whether or not their share increases any further. My guess is probably not. It's not that Bing is any less useful than Google - it's just that it's not really more useful. As such, there isn't much impetus to switch over.

<comment><USER6> I'm a happy Google user, but it's nice to have some choices. Nonetheless, I agree that Google will probably dominate until something game-changing comes along.

</comment></comment><comment><USER7> Google is loosing market share: This is wonderful news, I only hope the data is correct.

For clarification I love Google. I use 20% of all products they ever made (which is a lot). I wish them nothing but success. BUT as much as I like Google, I fear monopolis much more.

I must credit Google for being able to keep their product at such a high quality level, for such a long time, without any real competition forcing them to. I don't think there are many other companies in the world who could do the same.

I just rather don't relay on the goodwill and effectiveness of one single company for an essential commodity. (Yes I consider online search a commodity).

I truly hope the article about the impending fail of Bing is an inaccurate description. Source: <http://news.ycombinator.com/item?id=2423054>

</comment><comment><USER8> Note: the US search market only. Bing's share is much lower worldwide (partly because it's not fully launched in most countries)

</comment><comment><USER9> I like Bing and I want to use it more often, but I just keep using Google out of habit. This, no doubt, is the biggest challenge that Bing faces.

</comment><comment><USER10> It's interesting that the article looks at click-through rates for Google and Bing, and then concludes that Google's lower click-through rate means that people aren't finding what they're looking for.

Except that for many searches, Google just tells you the result right there (so you don't even need to click on anything to find it), while Bing does not. As a quick example, googling "10 meters to feet" tells you, above the results, that 10 meters = 32.8 feet, while Bing just returns a bunch of sites with conversion tables.

Which query will have better click-through rates? Which query better helps you find what you're interested in?

<comment><USER11> <http://www.bing.com/search?q=10+meters+to+feet>

Bing does a very good job on such queries.

</comment></comment><comment><USER12> I don't know if I buy this. Yahoo and Bing account for less than 8% of my sites' search engine traffic. Anyone know how hitwise collects their stats?

<comment><USER13> I looked at your products and they're not the Bing demo. Can someone get Wikipedia data? That I think would be more representative?</comment></comment>


Gfycat stops Archive.org volunteers from archiving content - <AUTHOR> https://twitter.com/textfiles/status/1192518085997137920 <comment><USER2> Looks less menacing than it sounds. [https://mobile.twitter.com/mceleney/status/11925194405181071...](https://mobile.twitter.com/mceleney/status/1192519440518107141)

<comment><USER3> The tone of the people who replied...

Gfycat should just delete the data and be done with it. Trying to play the helpless victim while slinging that ridiculous "holier-than-thou" "for the public good" attitude.. for trying to "preserve" a bunch of images that were probably never meant to be shared with more than one person.

I'm reading more of the tweets, some cringey vague threats about Verge wanting a story. I'm guessing the reason that doesn't go anywhere is because Verge wasn't impressed once they had the whole story that the Archive Team was taking down someone's API with bulk downloads of unwanted images.

Followed by some ham-fisted insult about deepfakes? Thank god I don't have to work or even interact with people like this on a daily basis.

<comment><USER4> That's Jason Scott for you. He does great work, but he's an awful, awful person to work or generally communicate with.

<comment><USER5> I can't fault Jason Scott for his attitude considering how passionate he is about his work. With enough age and time in tech, your tolerance for bullshit of any kind rapidly falls to zero. Agree he does great work.

It's ArchiveTeam's fault a company that took $10 million in VC funding to provide GIFs to the internet couldn't properly implement a publicly exposed API (including rate limits)? Hardly. Gfycat should be appreciative that there will be a Wayback archive of the site after it goes bust (who pays for GIFs?).

EDIT: Disclaimer: ArchiveTeam participant, full supporter of their activities to preserve digital culture.

<comment><USER3> >your tolerance for bullshit of any kind rapidly falls to zero

I've seen this sentiment and I don't get it.

I've worked with older people in tech who had plenty of tolerance for "bullshit" like showing a modicum of cordiality in a situation like this, on a public forum especially.

To me this mentality just sounds like... inverse ageism? I mean, most people I know would not want to work with someone who acts like this.

The brilliant but abrasive people are usually the ones we hear about the most, but are plenty of brilliant people who aren't proudly proclaiming "Problematic Guy" in their twitter profile.

So if you convince yourself it's ok to act like this because you've just dealt with so much "bullshit" over the course of your career, and you've been doing it so long, are you just saying you don't want to be hired because of how old you are (or how long you've been in tech) unless people are ok with a toxic work partner, in a round about way? It sure sounds like that to me.

I'd rather work with someone 8 tenths brilliant and _not_ problematic, than someone 10 tenths brilliant and problematic, and in my experience, the team with the 8 tenths guy will be a more fulfilling environment to contribute to.

<comment><USER5> You might get it eventually, you might not. Everyone's life experiences will be different. It's not a problem if you work someplace where they care about the skill more than your bedside manner (which is a lot of places!). If you're brilliant and abrasive, you're still brilliant. If you're kind but not so skilled, you're still not so skilled. Enough employers to go around for those who want to work with cordial people, brilliant people, or cordial brilliant people (if you can find them).

People with dark histories of abusing their coworkers get hired into positions of power because they deliver results (not good of course). It should be no surprise that someone who is only abrasive will always be able to find work if they are a domain expert. If you generate revenue (or in a non-revenue role, are a subject matter expert), and can pass a background check (and sometimes even not!), _someone_ will hire you.

Disclaimer: None of this comment is about an individual, only workplace logistics in general and my opinion on the topic. If a mod ventures into the thread, consider detaching this entire subthread as it's off topic.

<comment><USER3> The problem is:

a) A lot of kind people are skilled people. There are so few roles where the pool of skilled people is so small you just _have_ to settle for someone abrasive, yet there are so many people using the excuse of "I'm old so I get to be abrasive", or "they're old so they get to be abrasive".

b) Abrasive people take away from everyone else. More time will be spent building up "thick skin" against each other than needed and at the end of the day it's easy to drain any additional benefit of this "10x guru who doesn't know how to interact with people"

So much of value generation at a workplace is in "meatspace". Having the most technically brilliant product ever isn't enough to make it work. If the "genius" behind all of it is so abrasive your ability to react to needs is being cut down, you don't necessarily have a stronger _product_ just because you have a domain expert and stronger _tech_.

-

> People with dark histories of abusing their coworkers get hired into > positions of power because they deliver results. It should be no surprise > that someone who is abrasive will always be able to find work if they are a > domain expert.

I have optimism that this is changing. More and more companies are putting a stronger emphasis on their core values and actually defending them. And I'm not naive enough to think it's just out of the goodness of their hearts or a suddenly growing of a conscious.

It's because more and more companies are figuring out these people are not generating as much value as they appear to be. Spiking turnover, being difficult to integrate into teams, giving workplaces a bad name, even the compensation they receive combined with these other factors, the numbers just don't add up. They make very impressive and flashy output, but then take away from the ability of the company to turn that output into a strong product.

The realization being made is a team that meshes well can execute better than a "cult of domain knowledge", even if the team that meshes well is not as technically strong. The same way the realization is coming about CEOs who work based on a "cult of personality".

Similarly between CEOs and engineers, some of the most well known players end up being those that lead a cult of personality, so outsiders start to assume that's what works, even though it only works when the stars align and is a serious detriment when it doesn't...

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> It's ArchiveTeam not Archive.org which got blocked.

</comment><comment><USER7> [https://gfycat.com/robots.txt](https://gfycat.com/robots.txt)

not

</comment><comment><USER8> > Gfycat stops Archive.org volunteers from archiving content

No

Why do we keep creating bullshit internet drama. I guess cause it's fun. But I suspect we all might lose in the end.

[https://mobile.twitter.com/mceleney/status/11925194405181071...](https://mobile.twitter.com/mceleney/status/1192519440518107141)

"As mentioned, we had offered to work with any group that wished to save the content. I even offered to delay this, but this group continued to takedown our service. We will work with any group that is willing to work with us using legal and reasonable means."</comment>


Druid 0.9.0 Released - <AUTHOR> https://groups.google.com/forum/#!topic/druid-user/nqqb5RIdBbs <comment><USER2> I've been using Druid in production for our analytics platform for quite some time now. This is excellent news! For an easy entry in to Druid, check out [http://imply.io/](http://imply.io/) :) Congrats to devs and contributors! I owe you all a pallet of beer. <3 you guys!</comment>


Ask HN: What is some piece of code that you're proud of - <AUTHOR> <comment><USER2> <SLIGHTLY_UNCOMFORTABLE_BRAG> I completely reverse-engineered a popular online task management system, but made it an application that runs locally on my laptop. Now I control all the functionality, and most importantly, the data. Also, I can add things that maybe wouldn't be interesting for the many, but are very useful to me (e.g. when I enter a URL as a task, it fetches the title and sets that as the task name; e.g. it auto-summarizes arxiv postings as discrete tasks and takes a crack at prioritizing them for me; e.g. all my email gets auto-funneled into separate tasks, so I'm always at "Inbox zero").

I would say it has improved my productivity and focus a lot. </SLIGHTLY_UNCOMFORTABLE_BRAG>

How about you, @kureikain?</comment>


11 Search Trends That May Disrupt Google - <AUTHOR> http://www.readwriteweb.com/archives/11_search_trends.php <comment><USER2> Unexpectedly, this trend article is actually intelligent. I love how it dismisses natural language and image search right away. Search Monkey is an interesting idea, but trivial for Google to clone. Faroo, even more interesting, wonder what it'll take to fly. A quick search turned up two open source distributed search engines: Grub <http://grub.org/> and YaCy <http://yacy.net/> .

</comment><comment><USER3> Hmm he disses video-search because it is expensive and that tagging is "just good enough".

Here is a really coll video-search-company: <http://viewdle.com/>

I dont know about the revenue-possibilities and costs but if online-video continues to grow more detailed queries than what tags allow must be desired no?

</comment><comment><USER4> I think the author is wrong to dismiss both image and video search as complicated and expensive. All either of them needs is the right algorithm, which can come as a "stroke of genius" and land someone a lot of cash, real easy.</comment>


Ask HN: Do you stalk Facebook profiles? - <AUTHOR> Hello everyone
Do you stalk your friends profiles ? I am asking because i am building an app which let you know whenever your friend changes their profile photo ( or upload an album)
It will be a great help if you give me some feedback about it
Thanks <comment><USER2> Similar to: [http://bioischanged.com/privacy](http://bioischanged.com/privacy) but for Facebook :)

Slightly tangential, but what's to stop me flipping one bit in a JPEG and uploading it again. JPEGs are renowned for being fault tolerant to even the most aggressive mangling of the file structure, as long as the header is intact it will preserve some integrity

</comment><comment><USER3> You can favourite your friends on Facebook, and get notifications whenever they post or change their profile picture.

<comment><AUTHOR> Sorry I missed one thing you can get notification of profile pic update of any one be it your friend or not

</comment></comment><comment><USER4> Isn't that called the Feed in the world of Facebook ?

<comment><AUTHOR> No no you got it little different, you can get notification of profile pic of anyone ( you have choose ) be it your friend or not

<comment><USER4> Then that's called "following" somebody. You can do that without their consent, but of course you only have access to updates that you'd be able to see as a non-friend.

</comment></comment></comment><comment><USER5> Facebook will shut you down if you become popular.</comment>


Using relativistic effects for laser fusion: A new approach for clean power - <AUTHOR> https://phys.org/news/2020-01-relativistic-effects-laser-fusion-approach.html <comment><USER2> This bit is wrong: "The fuel for this method, which is usually a mix of the hydrogen isotopes deuterium and tritium, is easier to obtain than uranium"

Uranium is relatively common and widely distributed, compared to oil.

It is possible to build a reactor that uses natural uranium

[https://en.wikipedia.org/wiki/CANDU_reactor](https://en.wikipedia.org/wiki/CANDU_reactor)

however the common LWR reactor uses mildly enriched uranium.

1 in about 6420 hydrogen atoms on Earth are deuterium, compare that to about 1 in 140 U atoms being the U235 which is used by current fission reactors.

So producing D requires isotope enrichment of an isotope which is much more rare than U235, however, the enrichment is relatively easy to do because of the huge mass difference between protium and deuterium.

Tritium has a half-life of 12 years, so like Plutonium 239 (half life 24,000 years) it doesn't exist in commercial quality in nature.

Like a fast breeder fuel cycle where neutrons are used to make Pu239 from U238, a D-T fission reactor would need to breed T from lithium 6, then fabricate it into targets with D.

Tritium is highly radioactive (short half life) and is hard to handle (it is an isotope of hydrogen, hydrogen likes to go in between the atoms of metals, and once tritium gets oxidized into water, you are not going to separate it, the way you can remove many isotopes from Fukushima waste water.)

So it is not so clear that fussion is an environmental or safety win over fission, particularly a fission fuel cycle that breeds Pu from U or U233 from Th.</comment>


Ask HN: Do you work on interesting problems? - <AUTHOR> <comment><USER2> For work, my team has been moving legacy architecture to a new stateless model while continuing to support billions of events going through our system. Our software runs on thousands of machines. It is very much switching out parts on a moving vehicle. High scale, high availability, updating arch, etc. I think it is interesting. You can't just start a green field thing and move over wholesale. You have to move over parts and for subsets of users. You have to incorporate years of bug fixes and learnings in the legacy stack to the new stack, and the new stack has new and different scaling challenges.

</comment><comment><USER3> You shouldn't have to work on interesting problems at work because Life is the most interesting problem. You should have as much time and mental resources as possible to handle that problem/puzzle.

<comment><USER4> Everytime I discover the meaning of Life, they change it. My point is, Life isn't a well-defined problem, and it shouldn't be, so it is more like a never- ending puzzle that you are free to go as deep as you want.

But there are parallels, and for example, multiple solutions can apply for the same issues, with plenty of different outcomes, positive or not.

Work, usually, comes with well-defined requirements which require specific solutions. Working on well-defined problems, and solving them, gives you knowledge and experience, which you can often apply to solving Life problems as well, but in a more systematic way than you did before.

It's an exercise for the mind which generalizes, the mind can then reuse those new skills out in the real world. Even more, solving difficult problems in a team environment, requires certain levels of communication, coordination and accommodation, which are also very important, if not the most important skills you can reuse to understanding and solving the puzzle of Life.

<comment><USER3> That is a very inspiring perspective on how work aids in dealing with life. I hope you do find work that provides challenging and meaningful problems for you to solve. You deserve it.

</comment></comment></comment><comment><USER5> At work I work on problems that are interesting to other people, but not to me. At home I work on problems that are interesting to me, but not other people (or so I assume).

Feels like a healthy enough balance.

</comment><comment><USER6> They may not be technically difficult, but they sure are challenging in other ways, and that makes them interesting to me!

</comment><comment><USER7> At work, no. But I have side projects.

</comment><comment><USER8> sure, to keep my bills payed on time is the most interesting problem ever... :)</comment>


Seldon Release Open Source General Prediction Endpoint - <AUTHOR> http://www.seldon.io/2015/06/03/seldon-release-general-prediction/

<comment><USER2> Hi, I'm a developer on this project so I can answer any technical questions you may have.

<comment><USER3> No offense intended, but my eyes can't handle a body text color of #666 this early in the morning.

<comment><USER4> Why do you let his website set that colour on your screen?

<comment><USER3> I didn't. I just hit the back button.

This is technically known as "blaming the victim", by the way.

I made a polite suggestion to change something that many, many people find annoying, and you're making it out like it's my fault that I don't run some script or whatever to keep it from happening. Whatever, dude.

<comment><USER4> Interesting way to interpret my comment. Personally, I am in control of my computer and I find it sad when I found out other people aren't in control of theirs. Sorry if I implied it was your fault.

<comment><USER3> There's no reason to feel "sad" because others choose to not spend their time on manually micromanaging every aspect of third-party web sites. If you find doing that a productive use of your time, I'm happy for you.

<comment><USER4> I perform no micromanagement of third-party websites, it was a one-time setting of my web browser preferences.</comment></comment></comment></comment></comment></comment></comment>


Concrete Semantics - <AUTHOR> http://www.concrete-semantics.org/ <comment><AUTHOR> The literature on formal methods has evolved a lot. In particular there is some great broad introductory material using either Coq or Isabelle:

* [https://softwarefoundations.cis.upenn.edu/](https://softwarefoundations.cis.upenn.edu/)

* [http://www.concrete-semantics.org/](http://www.concrete-semantics.org/)

* [http://adam.chlipala.net/frap/](http://adam.chlipala.net/frap/)

Even the Little series covers types and proofs now:

* [https://mitpress.mit.edu/books/little-typer](https://mitpress.mit.edu/books/little-typer)

* [https://mitpress.mit.edu/books/little-prover](https://mitpress.mit.edu/books/little-prover)

Plus some topic-specific classics:

* [https://mitpress.mit.edu/books/principles-model-checking](https://mitpress.mit.edu/books/principles-model-checking)

* [https://www.springer.com/gp/book/9783540654100](https://www.springer.com/gp/book/9783540654100)

* [https://www.cis.upenn.edu/~bcpierce/tapl/](https://www.cis.upenn.edu/~bcpierce/tapl/)

And some constructive foundations:

* [https://www.cambridge.org/core/books/conceptual-mathematics/...](https://www.cambridge.org/core/books/conceptual-mathematics/00772F4CC3D4268200C5EC86B39D415A)

* [https://www.cambridge.org/core/books/sets-for-mathematics/E8...](https://www.cambridge.org/core/books/sets-for-mathematics/E899F592AD8FBA9A550B1ED3E1E61EC3)

* [https://www.paultaylor.eu/~pt/prafm/](https://www.paultaylor.eu/~pt/prafm/)

* [https://www.cs.cmu.edu/~rwh/pfpl/](https://www.cs.cmu.edu/~rwh/pfpl/)

<comment><USER2> I highly recommend people interested in Coq start with Pierce's Logical Foundations. It is by far the most accessible introduction to Coq I've found. I'm working through Chlipala's books next. CPDT is a great deep-dive into more advanced use cases of Coq as well as its theoretical underpinnings. I'll be taking a class this semester based on FRAP, my understanding is it hits those formal methods and language topics without specifically emphasizing Coq, except for the exercises.

As an aside, since Coq is the only theorem proving language I know well, I am curious what the pros/cons are as compared to Isabelle/HOL, F*, Lean, etc. Coq has been around for a while, but I keep seeing new theorem provers pop up. What are the alleged weaknesses of Coq that other languages are trying to fix?

<comment><USER3>
       pros/cons

The main issue is proof automation. Curry-Howard based provers (Coq, Agda, Lean etc) are nice for teaching but if you want to get work done (e.g. you want to verify an OS kernel), you need to automate as much as possible. Isabelle/HOL currently has by far the most powerful automation. This is partly because, like Coq, it is an old system (unlike Lean and Agda) and lots of automation has been built in the past, but _also_ because a lot of automation is much easier to adapt to provers based on classical logic (as opposed to the constructive logics that Curry-Howard needs (yes, I know that classical reasoning can be done within constructive logic)). Adapting proof automation that has been available for a while for Isabelle/HOL to Curry-Howard is at least in parts an open research problem. Lean has been created in parts because of the urgency of given Curry-Howard systems much better proof automation.

There is an additional dimension which is strength of the logic at hand. The logics Coq, Lean et al are based on are more expressive in various dimensions. Whether that's relevant to your use case depends on what kind of maths you are trying to formalise. If it is higher category theory, it matters a great deal, for program verification it tends not to be important b/c most program verification can be done in rather weak logics.

<comment><USER4> How does being classical help with automation? I'm more familiar with ACL2, which seems to gain a lot more on the automation front from being first-order than from anything else (though it has sort of a weird take on the excluded middle).

<comment><USER3> That's a subtle and deep question. One example are nominal techniques. Consider Nominal Isabelle. It is known that nominal techniques _are_ contructive. However, when adding nominal techniques to a classical logic, it is natural to express some of this using double negation, leading to only a small blowup in formula size. Existing proof automation can easily handle this blowuip. Doing the same in a _simple minded_ constructive way, leads to a massive formula size increase, defeating (at the time) existing proof automation.

This was a while back, maybe the problem has been solved now, I have not followed this field. But as far as I'm aware, the 'hammering' approach to proof automation that has been working well with Isabelle/HOL has been successfully ported to Coq/Agda etc.

</comment></comment></comment></comment></comment><comment><USER5> Came here expecting an obscure dictionary of aggregate and cements.

<comment><USER6> Or a "pattern language" for concrete structures, parametric generative Brutalist architecture?</comment></comment>


Coolest Cooler, $13M-funded Kickstarter project, needs another $15M - <AUTHOR> http://www.oregonlive.com/window-shop/index.ssf/2016/03/coolest_cooler_15_million.html <comment><USER2> Ultimately the problem with most crowdfunded hardware products can be summed up here:

>> Coolest wasn't able to manufacture the exact cooler in the promo videos.

>> "The Coolest Cooler in that video was a one-of a kind prototype," Grepper said. "Ultimately it's not a scalable design – it's an industrial design."

>> The proof-of-concept prototype cost him $15,000 to make, he said.

>> Grepper had no idea how much each cooler would cost to manufacture.

>> "At the early stages, you simply can't get that information," he said.

A model != a DFMA'd product.

There's tooling costs (I suspect the Coolest Cooler has several hundreds of thousands of dollars in tooling needs), there's supply chain, etc.

This takes time, testing, dozens of iterations, etc.

He sold a product he didn't understand the real cost of. Not maliciously but because he was naive and didn't understand the process.

Knowing what your true landed BOM costs are can take over a year of modeling, making production samples, negotiating with manufacturers and suppliers, etc. Even then you wont really know the cost until you enter volume manufacturing since there's scrap rate and QA issues you run into.

<comment><USER3> This VC firm does a great job breaking down a lot of the mistakes that this guy made and provides a set of frameworks startups can use to avoid this fate: [https://medium.com/@BoltVC](https://medium.com/@BoltVC)

</comment></comment><comment><USER4> A big problem with crowdfunding is that many backers don't seem to understand the risk they are taking on. It is distressing to see pages and pages of comments complaining about a project's failure, but in the same vein, I've never seen a gambler bang on a slot machine because it didn't payout this time. Is this due to a lack of basic business knowledge among the public?

I think a big reason I've never contributed to a campaign is because there's a greater than 50% chance my money will evaporate.

<comment><USER5> > A big problem with crowdfunding is that many backers don't seem to > understand the risk they are taking on.

The bigger problem is that the people starting crowdfunding initiatives have no idea about what it takes to bring a new product to market, if they're not outright scams.

<comment><USER6> Related: [http://www.iflscience.com/technology/artificial-gills- underw...](http://www.iflscience.com/technology/artificial-gills-underwater- breathing-device-has-820000-funding-despite-being)

And yes, indegogo, but its basically the same platform as kickstarter.

<comment><USER7> It looks like I just got burned on an Indiegogo project myself ([https://www.indiegogo.com/projects/zaptip-the-world-s- first-...](https://www.indiegogo.com/projects/zaptip-the-world-s-first- magnetic-super-charger/x/7261196#/story)) - I was aware of the risks, but the product was "just" a cable, so I considered it low risk. I had previously participated in a couple of other Indiegogo projects worked out wonderfully.

The worst thing about my IndieGogo Zaptip failure is that there are now tons of ZapTip knockoffs already available through Amazon, eBay and other channels, and at lower price than what I paid to fund the Indiegogo project.

</comment></comment></comment></comment><comment><USER8> Coolest Cooler always reminds me of the "I can't believe they invented it" on the simpsons and the "S.S. Microwave".

[https://frinkiac.com/caption/S04E21/90156](https://frinkiac.com/caption/S04E21/90156)

or another quote from that episode "people are afraid of new things, you should have taken an existing product and added a clock".

</comment><comment><USER9> I am amazed that the founder didn't plan the exact cost of each unit during the kickstarter phase and I'm even more amazed that people are so careless to put money in projects with no clear plan and cost figured out.

Please send me some money now for my virtual cat project. I just need to raise $100MM. I promise it will deliver!!! =<O.0>=

<comment><USER10> I have a family member who knows the founders and apparently they're completely nontechnical "idea guys" who have a trail of shitty projects like this and have already moved on to other projects. So it's not that surprising to me.

<comment><USER11> This isn't an "everyday joe" who loved camping and hit upon a neat cooler design...

He had been working to perfect his pitch on all sorts of novelty items. Washington Post had an article on prior failures ([https://www.washingtonpost.com/news/the- intersect/wp/2014/08...](https://www.washingtonpost.com/news/the- intersect/wp/2014/08/28/ryan-grepper-inventor-of-the-coolest-cooler-failed- many-times-before-raising-11-million-on-kickstarter/)).

Professional crowd funder looks like his only skill.

</comment></comment></comment><comment><USER12> Timely, since I had the chance to use this on the beach this week. My friend ordered one after me - he got his 3 months ago. It looks like I'm going to get diddly-squat. Having said that...it's a kick ass product. Kept beer cold on our porch over 20 hours (probably would have been longer, we drank the contents in that time). The blender churned out 3 full pitchers of margaritas + halfway through another - as we hung out on the beach. Was very easy to roll on the sand. I'm more pissed the attitude this guy has had all along - "whoa, it's hard to find reliable providers in China." "Shipping is hard!". I would have paid more to cover the costs if they had just priced it out right. Now I hope he ends up getting tied up in legal challenges - maybe that'll knock the It's-Not-My-Fault attitude down a peg or two.

<comment><USER13> Has there been an explanation as to why later backers received theirs before early backers?

<comment><AUTHOR> I'm not sure about later backers, but as money ran out, they gave priority to Amazon customers because it was priced at $499 on Amazon, not the $199 that backers paid. The logic was that the retail purchases would subsidize the early backers.

<comment><USER14> If you don't fulfill Amazon, you get kicked off Amazon, plus that's bringing in about $450 per sale (after Amazon fees) as opposed to $0 for a Kickstarter fulfillment.

</comment></comment></comment></comment><comment><USER15> Crowdfunding hardware is often a dangerous mix of "get this amazing unsustainable discount over our future retail price" at a time when the per- unit costs are highest and the up-front engineering costs are still unpaid (and likely to grow from anyone's best estimates). This is an obvious recipe for trouble.

That doesn't mean it isn't worth trying. But it does mean that project creators should build in sufficient margins to absorb all of that, and project backers should understand that asking a creator to deliver a not-yet- production-ready product with near-zero margins is likely to end in a total loss of their backing funds. It's possible that if you had paid more, you might be likely to lose less.

</comment><comment><USER16> ""The Coolest Cooler in that video was a one-of a kind prototype," Grepper said. "Ultimately it's not a scalable design – it's an industrial design."

The proof-of-concept prototype cost him $15,000 to make, he said."

"[After Amazon approached us] we recognized that every Coolest cost more than each backer had given us for the manufacturing process,"

Incredible.

</comment><comment><USER17> Am I reading this right, that it's just the swiss-army- knife of coolers? I'd ask why anyone would want this but the mob has clearly spoken. That being said, why didn't he just take an existing cooler that's already available in large quantities and figure out a clever way to enhance it with all these capabilities? Maybe just swap out the cover?

<comment><USER18> I daresay plastics are the cost issue here so I'm not sure swapping out the cover would help. Personally, I'd have done this as some sort of cooler add-on kit in a custom cloth case of some sort and pitched it as letting you use your existing cooler or pick the cooler that meets your needs. But then, as I said elsewhere, I'm not the audience and don't see the attraction :-)

</comment></comment><comment><USER19> "Ultimately it's not a scalable design – it's an industrial design."

So which one of us doesn't understand what "industrial design" means? Because my understanding says his statement is a contradiction. I thought part of "industrial design" was to design things for mass production, not one-offs.

<comment><USER20> Actually industrial design doesn't mean the design will work for mass production. Usually they should think about the manufacturing part as well. That step is called Design for Manufacturing (DFM). Usually the mechanical engineer works on the DFM part.

</comment></comment><comment><USER21> \----Round 1---- $13m raised 20k units shipped ~$650 per unit

\----Round 2---- $15m needed 36k units remaining ~$420 per unit

Obviously I'm not factoring in initial manufacturing costs.

Having 13 million to invest in manufacturing at scale, brought costs per unit sold down 35%, which is good. But I don't know many people that would buy a cooler for $500.

<comment><USER22> The Kickstarter charged $165 or $185 per cooler.

What I don't understand is why this was so exciting in the first place. It looks like a normal cooler with a few cheap accessories (ice crusher, blender, light, usb charger, bluetooth speaker) and it's not even very big. Why were people so damn excited about it that they were willing to put up $165 for this Sharper Image wannabe.

Their website doesn't even talk about how good it is at being a cooler. How long does ice stay frozen in the hot sun? Can you keep your meat from going back over a long weekend at the campsite? Not that there is enough room in this thing for a camping trip. It's apparently focused on the beers on the beach crowd. How the hell did this shatter Kickstarter funding records?

<comment><USER18> Yeah, I'm apparently not the audience. Yeti seems to be doing well selling what are, to me, somewhat ridiculously expensive coolers but at least those are optimized for actually keeping stuff cold. The accessories on this thing are either gimmicks that I can see using once or twice because they're coo1-- Make a frozen margarita at the beach!--or they're easily replicated with an inexpensive standalone speaker or whatever. (Indeed, there are also hand- cranked and battery-powered blenders for camping.)

ADDED: >Sharper Image wannabe

I had to laugh. This is EXACTLY the sort of thing that one would expect to see in a Sharper Image catalog.

<comment><USER23> Yeah, it is ridiculous. Even if the CC sold for exactly as advertised, and did exactly as advertised... it still isn't a good buy.

So you use the blender for a while... and then it breaks (through no fault of the cooler itself, say the dog chewed on it).

Now what? Send the whole thing back? Ditto for all the other crap tacked onto it. After a couple things break on it, then it turns into a large piece of junk.

And these things never work as well as dedicated devices.

<comment><USER18> Furthermore, there's a lot to be said for a cooler that can get wet or covered in sand, be hosed off, etc. while electronics are kept protected. If I really wanted something like this for the beach, tailgating, or a boat, I'd just buy whatever size/price point cooler met my needs (assuming I didn't already own one), pick up an appropriate waterproof/water resistant bag, and fill it with a battery-powered blender and whatever other accessories and eating/drinking implements I wanted.

</comment></comment></comment></comment></comment><comment><USER24> The product design section of Kickstarter is basically the new "as seen on TV." Except half the time they can't even deliver the product they're pitching.

Kickstarter does a lot of great things, but it seems that the highest profile projects never live up to their expectations, even when they are able to deliver.

</comment><comment><USER25> The issue is he will only ship the existing orders if he gets $15M in investment but a large part of that investment is to fund operations after shipment of the existing coolers. Hmm....

Where has this money gone? I'd love if Kickstarters that failed had to get audited and get those results posted publicly.

</comment><comment><USER26> I remember looking at the original campaign with fascination. The inventor had already attempted a kickstarter campaign and failed. He came back with an improved design but it was obvious that he did not increase his price sufficiently to make up for the additional considerations in regards to injection molds, tooling, BOM etc... Must admit I was super jealous when he raised that record amount (I was running an unsuccessful kickstarter at the same time which actually had realistic goals and costs) but the end result is not a surprise.

I think he knew the cost was not realistic and chose to sell it anyways, hoping to raise additional funds after the fact. Same thing happened with Broken Age and you can bet it will happen again (people are very optimistic for cool sounding products).

</comment><comment><USER27> When I saw the cooler I thought it was great and I would own it. But when I finally saw the price tag on Amazon, I just couldn't justify the purchase. I can't say the speaker is necessary and I wonder how much cheaper the cooler would be if I could just remove that feature.

<comment><USER28> I don't know why or how on earth this costs so much to make.

* Speaker? $5 for something decent enough to work. Find AmazonBasics supplier, crank that up to $10.

* Blender? I can buy a "good" blender from Hamilton Beach for $20.

* Plastic parts? I don't know. Can't be that much, can it?

* Power? $20 will get you a really nice battery. Just put in a power brick battery thingy.

* Bottle opener? $4 will get you the nicest one from China, and it's probably coated in diamonds.

<comment><USER29> what confuses me is it costs so much, but they want to make the cooler _look_ like any other $30 cooler? are people throwing money at this just because it has some gimmick features?

<comment><USER28> Where's Elon when you need him?

</comment></comment></comment></comment><comment><USER30> I can imagine a conversation like this:

CC: I just raise 13M, I am hiring you as our lawyer.

Lawyer: Confirmed

CC: How much can I legally pay myself as CEO?

Lawyer: Literally all the money.

CC: Here is your check for $350k.

Lawyer: Always satisfying to do a good job for a client.

(CC has already left, moments later you see the CEO drive by the window in a huge boat)</comment>


Boeing didn't conduct end-to-end tests on Starliner before its failed flight - <AUTHOR> https://www.engadget.com/2020/02/29/boeing-starliner-failed-first-flight-report/ <comment><USER2> I don't actually have any fully pure unit tests in my codebase at the moment. The exception is some algorithmic stuff which has a bunch of tests. In practice, I've almost never caught a bug because of a unit test except in an algorithm - but integration tests involving 3-4 small components are great.

</comment><comment><USER3> _I really don 't want anyone to have the impression that this team tried to take shortcuts_

\- man who let his team take shortcuts

 _NASA is still thinking whether to allow Boeing to proceed with its first manned flight to prevent delays or to require the company to successfully complete an unmanned flight first._

Yeah, it's probably fine now. I mean, ugh, look at all these passing tests!

It's staggering to me that _Boeing_ is confident enough to not want another unmanned fight. After all this, you really want to roll the dice again?

</comment><comment><USER4> How does one do an end-to-end test on a system that ends up in space?

</comment><comment><USER5> Unit tests do not negate the need for Integration Tests and they do not negate the need for manual tests. You can get overlapping coverage and slack in certain areas in some cases... medical equipment and aerospace are not areas you can come up short with some of the longer testing cycles.</comment>


Ask HN: How do I conquer professional web dev? - <AUTHOR>

Currently I work in web development on CRM Systems and front and backend web with around 1 years' experience, but I'm looking to further my skill set (MVC, OOPHP, CodeIgniter, MySQL, Linux to name but a few). I would appreciate any guidance relating to suggested courses or resources with particular focus on industry practices/relevance.
As a starting point I was thinking along the lines of design pattern books or particular courses that strengthen core web development skills used in industry with examples.
Thank you in advance for your assistance. <comment><USER2> If you do more PHP projects, stay the hell away from CodeIgniter, Zend, Symfony, and Cake. Slim is ok. Laravel is really heavy and opinionated, and it does a lot of things in a "non-PHP" way (using strings to configure behaviors, for example). It may seem easy to build projects like that, but it's really hard to follow them once they're written.

PHP is at a point where you should really just be using a microframework or a series of libraries. With Composer and PSR standards, you don't need frameworks anymore.

All that said, don't stick with PHP. Definitely learn Python and one of the next-gen languages (Go, Rust, Elixir, etc).

The best way to learn is to think of a project you want to complete, choose a stack, and then Google your way through it. Seriously. There isn't a ton of great, formal learning in web development.</comment>


Could Anything Make You Use IE9? - <AUTHOR> http://briancrescimanno.com/2010/03/05/could-anything-make-you-use-ie9/ <comment><USER2> This seems silly. If the browser was better, I'd use it. And I'd be very happy that the future of the web looked so bright.

That said, I don't think it's likely that IE9 will even catch up to today's Chrome, let alone pass it.

<comment><USER3> Agreed. Neglecting issues of open vs. closed source (for whom that matters), the question boils down to "would you refuse to use an arbitrary program because it's named IE". Of course not.

</comment></comment><comment><USER4> I guess if they ported it over to Linux? Otherwise I physically cant :(

<comment><USER5> Yup, won't run on my machine either. Though to be honest, I wouldn't run it even if it would.

</comment></comment><comment><USER6> Two parts to this really - will it be better and would you use it if it was? By the look of the current alpha/beta stuff, it's just barely competitive now, on very selective benchmarks. When it comes out it will be competing with Chrome 6 and Firefox 4, probably. It'll be good by Microsoft's previous browser's standards, but not good compared to the competition, I imagine. Will I use it, if it is competitive? Would I use it if it was actually the best browser available? As a Linux user, unlikely. As a web developer, yes, but only in a VM; I hope it runs on a nice lightweight Windows XP VM, although I doubt it will, somehow.

</comment><comment><USER7> Could anything lead me to not install Chrome on my parent's computers but instead leave IE the default?

IE8 does that already. It's good enough. Not worth going through the trouble of getting an alternative for my parents.

<comment><USER8> But, the question wasn't "would you want your mom to use it." It was "would _you_ use it?" I definitely understand the desire to keep things simple on a system you have to support but don't get to use.

<comment><USER7> I know, I can read :)

I just wanted to suggest that there are ways for IE to "succeed" that have nothing to do with convincing the Hacker News demographic of its superiority.

</comment></comment></comment><comment><USER9> I stick with browsers (software in general) until I have a bad experience which prompts me to explore other options. I don't recall what version of IE that was for me (probably 5?) for FireFox it was the dreadful early 2.x releases. Safari hasn't pissed me off yet so I'll probably stick with it. I've been using Chrome, in conjunction with Safari, for the silly reason that I like having two logical groups of web pages under different Dock icons.

</comment><comment><USER10> If it worked on the Mac and on Linux, and it was better than Firefox, sure. I adopted Chrome on those platforms because it's better than the alternatives.

<comment><USER11> I wouldn't want to miss all those Firefox extensions. Especially AdblockPlus and EasyPrivacy. As far as I know Chrome only blocks displaying of ads but not the download. I.e. it cannot support EasyPrivacy at the moment.

</comment></comment><comment><USER12> No. I run Linux, you insensitive clod! ;)

I am still pumped for better standards support, though. Makes everybody's life better. Now if we can only get them to abandon the rendering mode insanity: [http://ieblog.members.winisp.net/images/MarcSil_IE8_Document...](http://ieblog.members.winisp.net/images/MarcSil_IE8_Document_Mode_2.png)

</comment><comment><USER13> I find this silly and hyperbolic. I _will_ use IE 9 because a significant portion of people using web sites I design will use it. I doubt it'll replace Chrome as my preferred browser, but it's not going to hurt me to use.

</comment><comment><USER14> Problem is for a lot of power users and developers, the people that will be the hardest to convert to using IE, the existing addons for firefox and now chrome would mean that they probably wouldn't bother.

</comment><comment><USER15> If they get on board with HTML5 (including goodies like canvas and WebSockets), we'll talk. In the meantime, I'll stick with future-facing browsers, as a user and as a dev.

</comment><comment><USER16> Only a forced upgrade from Windows Update or the next version of Windows that I have to get would make me have IE9 installed. I still wouldn't use it though.

<comment><USER17> As a developer, I'd still be forced to use it for QA. :(

</comment></comment><comment><USER18> How could I speculate about using a browser no one outside of Redmond knows very little about just yet?

</comment><comment><USER19> I would do it for a Klondike bar.

</comment><comment><USER20> WebKit and Mac support.

EDIT: Wait, what? Why was my personal opinion voted down?

</comment><comment><USER21> No, because it won't run on Linux.

</comment><comment><USER17> Answer: Microsoft.

</comment><comment><USER22> Any of the following:

a) be superior to chrome and firefox

b) be the only browser I could run

c) Drugged, hypnotized, bribed, etc

<comment><USER22> P.S. Microsoft, Chrome is your target now. Not Firefox.

And get rid of the flashiness, make it plain... _PLEASE_

<comment><USER23> ++ re: plain. I still think ie5 was the greatest browser Microsoft made, because it was the basic browser that, although it had no bells or whistles, worked on almost EVERY page. If I couldn't see something in Opera or, later, Firefox, I just threw it at ie5 and it worked.

<comment><USER24> Funny story for you; I have found pages that do not render properly in IE6 that render fine in IE5.5.

I wish I could explain it but..

<comment><USER23> Exactly. Standard IE is no longer the throw-anything-at-it (and pretty fast as well) browser, unfortunately.

</comment></comment></comment></comment></comment><comment><USER25> 1) Would need to run on a Mac

2) Would need to out-perform Chrome, Safari, and Firefox in that order.

3) Would need to have 100% ECMAScript 5 support, 100% CSS3 support, and 100% html5 support.

Yeah, these are pretty high standards. I hold my browsers to a higher standard than my women.</comment>


Show HN: repeat functionality without a loop or variable assignation - <AUTHOR> http://yugioh.wikia.com/wiki/Template:Repeat

<comment><AUTHOR> Disclaimer: I'm not the one who came up with the concept in this particular case, though I did refine the idea.</comment>


Ask HN: Was the U.S. election hacked? - <AUTHOR> I haven't seen any discussion on this at all. <comment><USER2> Nothing unexpected enough happened that people suggested this. The results weren't far from polls.

</comment><comment><USER3> I am wondering the same thing. Either "all the polls were wrong" or the election was hacked. Polling has been conducted for decades. It seems highly unlikely that all of the institutions involved suddenly forgot how to do it properly this year.

<comment><USER4> Did you do any research at all on this? The polls were within a few points of the popular vote, and state polls were well within typical polling errors consistent with ... the entire history of polling.

</comment></comment><comment><USER5> No.

</comment><comment><USER4> No.

<comment><USER3> That was a really thoughtful answer. It had almost as much depth as the thought process of the average American voter.

<comment><USER4> OP wonders if the most heavily scrutinized democratic election in the world was overthrown, based solely on the fact that nobody has suggested it was. What do you think?</comment></comment></comment>