John Carmack on QuakeWorld latency and business model (1996) - <AUTHOR> https://raw.githubusercontent.com/ESWAT/john-carmack-plan-archive/master/by_day/johnc_plan_19960802.txt <comment><USER2> Carmack's dotplans are always interesting history to read.

If you weren't a gamer (or alive) at the time when quakeworld came around, you might not appreciate how amazing it was for multiplayer games on the internet. On dial-up, you were lucky to have 150ms latency. Before client-side- prediction, that latency applied to every action you took in game, including player movements. Hit the up-arrow, and you wait 150-300ms before the game responds and moves your character forward. CSP really was an amazing break through, and made multiplayer action games feasible on the internet.

This is particularly relevant now, that we are entering the era of cloud-based streaming game platforms, like Stadia. The latency problems of the pre-CSP 90's will be rearing their heads again. Its going to be interesting to see how these same problems will be tackled in this new context. Internet speeds are higher now, but so are our expectations.

I doubt we'll have the nice, simple dotplan files that Carkmack left for us to read and remember, from all the SRE's at Google, sadly.

<comment><USER3> Sadly we live in a world today where some local code editors could really benefit from CSP because they add 100-200ms of latency to every character you press.

I'm not sure if it's funny or sad that there's more key press latency typing into most local Electron apps than connecting to a Quake 3 server 200 miles away back when I had 56k dial-up in 2000.

If you want to fast forward to today's internet, with an average internet connection it takes around 150ms to ping a server in the Netherlands from California. That's over 5,000 miles (8,000 kilometers). Somehow a local key press has the same latency with certain code editors. What have we gotten ourselves into.

<comment><USER4> vs code typing latency is on the order of 50ms.

its more than necessary but not as bad as you are implying

<comment><USER5> VS Code is pretty good for an Electron app

</comment></comment></comment></comment><comment><USER6> Someone correct me if I'm wrong, but I believe this was the genesis of client- side prediction for games.

If you don't know what that is, Valve has some good documentation on it (relating to Source engine, but it's the same concept).[1]

Latency was still a problem even with CSP because we didn't yet have lag compensation on the server. So although you got an authoritative server (no cheating) and instant inputs (no round-trip wait), you could still shoot someone on the client and miss them on the server. You had to shoot ahead of them, further if your latency was worse. As far as I know, Source engine was the first to add lag compensation, which has the server rewind the other players to be where you would have seen them on the client.

Since client-side prediction can be performance intensive, and lag compensation can be difficult for anything beyond simple raycast checks, many games still don't do both. Team Fortress 2 for instance does lag compensation on basic guns but not on things like the soldier's rocket or the pyro's flamethrower. Some games simply allow the client to decide who they hit, which removes the need for either solution, but totally opens things up to cheaters without some very careful server-side validation.

[1] [https://developer.valvesoftware.com/wiki/Latency_Compensatin...](https://developer.valvesoftware.com/wiki/Latency_Compensating_Methods_in_Client/Server_In- game_Protocol_Design_and_Optimization#Client_Side_Prediction)

<comment><USER7> Any idea why the would not implement lag compo for projectile-based weapons? Too much processing power required?

<comment><USER8> Projectiles are simulated on the server

<comment><USER6> All weapons are simulated on both the server and the client in the case we're talking about here. It's just that raycast weapons are rewound on the server to compensate for the client's latency, and projectiles aren't. The server has the authority on actual hits and damage done for all weapons.

</comment></comment></comment></comment><comment><USER9> Complete aside about Carmack and reducing VR latency from [https://www.gamasutra.com/view/news/226112/How_John_Carmack_...](https://www.gamasutra.com/view/news/226112/How_John_Carmack_is_bending_Samsungs_VR_strategy.php) :

"He gave the example of increasing the refresh rate on the Gear VR during development. He was working, at that time, with its Galaxy S III phone. Android triple-buffers graphics, inducing a 48 millisecond delay into the system -- making VR impossible.

Carmack pulled apart Android to hack that out. Though he'd written several emails to Samsung in attempts to convince them to give back that buffer, "It's easy to argue against an email, but it's much harder to make the argument when you can have the two things and stick them on your face and, 'Tell me this isn't better.'"

<comment><USER10> Carmack is probably the most self-consistent opinionated creator out there, given that so many years on he still sticks to one of his original quotes:

> "Focused, hard work is the real key to success. Keep your eyes on the goal, > and just keep taking the next step towards completing it. If you aren't sure > which way to do something, do it both ways and see which works better."

He'll even do Samsung's work for them to fulfill the purpose of that quote.

<comment><USER11> Carmack's brain is so much like a computer that it even does speculative execution branch prediction!

</comment></comment></comment><comment><USER12> I fondly remember the old Quake 1 days. It was pretty much the last game I played seriously. Reading Carmack .plans were a regular routine and while many of the details went over my head, it made us feel part of the whole id experience.

Finally networked Quake was an amazing experience when it came out. I had started my first job in an ASIC design company. All the computers were Solaris based Sun workstations, yet we were able to get network quake up and running on them! I just can't imagine such a thing happening today but maybe that's more to do with me being 20 years older than anything else. For sure no one is porting game engines to Solaris these days ;)

<comment><USER13> Same story, but not as glamourous, on a Windows NT4 Rollout (1997). Also recall us downloading South Park at a (then) stellar speed - only took half an hour to download a highty compressed half hour episode, a thing of sheer magic at the time :)

</comment></comment><comment><USER14> Pretty impressive when you consider this was in 1996!

I really like his ability to take out code and 'shoot it'. Back to the drawing board. It's a quality of a great engineer, to be able to reflect on what's been done and admit it's not good enough.

<comment><USER15> > "While I can remember and justify all of my decisions about networking from > DOOM through Quake, the bottom line is that I was working with the wrong > basic assumptions for doing a good internet game."

I'm not one for hero worship, but I think that's as close to engineering zen as one can get.

Aka 'I'm brilliant. I thought I was doing the smart thing. Turns out reality was otherwise. I'm changing my approach.'

<comment><USER16> What's kind of sad and funny is that these assumptions changed again and no one seemed to have noticed. We're not on PPP or SLIP connections anymore and yet game devs are still writing netcode as though we are. Client side prediction should have been a temporary hack until low latency connections were mainstream not a permanent aspect of all gaming netcode, and yet it is.

Maybe Carmack will wake everyone up again and tell them to stop copying his ancient hack two decades later.

<comment><USER17> You must be living under a very pleasant rock if you think that low latency, to the degree that client side prediction is useless, is mainstream. Not accounting for routing, drops and mux/demuxing, and assuming that the signal travels at the speed of light as the crow flies, from west coast USA to where I'm at, the latency is 29ms or roughly two frames.

This would be debilitating in an online game without CSP where even the latency introduced by screen buffering and vertical sync may make or break yor game, and in reality the latency is of course much higher, usually around 100ms or higher. Check your assumptions: [https://wondernetwork.com/pings](https://wondernetwork.com/pings)

<comment><USER18> By your numbers then the OP is right. Carmack says:

 _the bottom line is that I was working with the wrong basic assumptions for doing a good internet game. My original design was targeted at <200ms connection latencies. People that have a digital connection to the internet through a good provider get a pretty good game experience. Unfortunately, 99% of the world gets on with a slip or ppp connection over a modem, often through a crappy overcrowded ISP. This gives 300+ ms latencies, minimum._

So he designed for 200ms and then the real world was 300+ so it didn't work. Your 100ms would then work fine in that context. Maybe games have gotten more complex or our expectations higher so prediction is still worth it even on <50ms connections. But OPs point that the assumptions underlying Carmack's redesign have once again shifted seems correct, at least for that specific design.

<comment><USER17> _> By your numbers then the OP is right._

By my numbers (though as you can clearly see from the link I posted, >200ms latencies are not uncommon), and Carmack's assumptions in 1996 about what latencies would be acceptable.

 _> So he designed for 200ms and then the real world was 300+ so it didn't work. Your 100ms would then work fine in that context._

He designed for _< 200ms_ which by the frame of reference he cites (T1 connection) probably was a lot lower than 200ms on average.

 _> Maybe games have gotten more complex or our expectations higher so prediction is still worth it even on <50ms connections. _

Quake was not a very complex world, but more important (to latency) is that it's a fast paced game by today's standards (IME). It seems more likely to me that perception on what an acceptable hand to eye latency is has changed, just like the perception on acceptable frame rates. To me, joining an online shooter with >100ms latency (even with prevalent client side prediction) feels debilitating, especially if other players have lower latencies.

 _> But OPs point that the assumptions underlying Carmack's redesign have once again shifted seems correct, at least for that specific design._

Yes, I agree that PPP and SLIP are not common any more. High latency unfortunately is, and client side prediction is still an effective mitigation strategy that makes a huge difference to online play. The specific design used in Quake has of course been superseded.

<comment><USER18> _> 200ms latencies are not uncommon_

Those numbers match my experience a long time ago with Quake3 based games where you'd pick servers that are local to you and get 10-40ms latencies.

 _> He designed for <200ms which by the frame of reference he cites (T1 connection) probably was a lot lower than 200ms on average._

I didn't forget the < sign. Designing for <200ms means you can handle the 200ms worst case. But maybe he meant 200ms worst case but much lower average like you are suggesting.

 _> It seems more likely to me that perception on what an acceptable hand to eye latency is has changed, just like the perception on acceptable frame rates._

Right, makes sense that the expectation today is much higher.

 _> High latency unfortunately is, and client side prediction is still an effective mitigation strategy that makes a huge difference to online play._

Just for curiosity, how low does it need to go for prediction to no longer be useful? I guess if you want to be able to have players from all over the world play each other then you have to deal with 300+ ms of latency. But if you are willing to do servers on each geography it seems 10-30 ms would be feasible. Would that be enough?

<comment><USER19> NQ (NetQuake, as the original Quake is sometimes known) 'feels off' on just 10ms. Movement becomes slightly just out of sync with your input.

10-30ms is a bit optimistic, depending on how large you define a geography. Many ADSL/VDSL connections, best case, start with 5ms of latency, and often higher (say 20ms) due to interleaving. Cable tends to be around 10ms IIRC but can suffer from significant jitter which makes things worse. So for a lot of players the servers would need to be in the same city to achieve that target.

<comment><USER16> NetQuake feels excellent at < 30ms. Even higher is easy to get used to with some practice because it's extremely predictable due to a lack of CSP. And yes, the solution is to have servers within ~500 miles of players so ~20ms avg ping is the norm. Most gamers have cable not DSL connections.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER2> What a great summation of the internet in the 90's: "Client. User's modem. ISP's modem. Server. ISP's modem. User's modem. Client. God, that sucks."

Then followed by Carmack's 90's internet experience: "Ok, I made a bad call. I have a T1 to my house, so I just wasn't familliar with PPP life. I'm adressing it now."

:p

</comment><comment><USER20> > If it looks feasable, I would like to see internet focused gaming become a > justifiable biz direction for us. Its definately cool, but it is uncertain > if people can actually make money at it.

Classic! Reminds me of the time I told my dad I wanted to make websites for a living and he replied "hey, that's pretty cool, but I don't think there's enough work available to make it a full time career". (This was circa 1996)

</comment><comment><USER16> I always preferred regular NetQuake to QuakeWorld and I played a lot of both for many years. The weird jello-jiggly behavior of client-side prediction with 400-600ms difference between players was always horrible.

With NetQuake you could learn to predict everything in your head over time, which is the primary skill competitive players use. No one has a super fast reaction time (even competitive gamers are ~200ms), the best players simply know what's going to happen next better than other players.

I did play thousands of hours of QuakeWorld (Team Fortress mostly) but it was never as fun or competitive feeling as NetQuake.

And once I got an ISDN connection it was even worse to use QuakeWorld because with a perfectly reliable (low jitter) ~50ms ping on NetQuake everything was incredibly smooth. Watching players with 150ms+ ping ("HPBs") warp around the map while you tried to shoot them was no fun.

Today far too many games rely on bad client side prediction. The last game I played seriously was PUBG and they put all of their servers in Ohio. Being on the west coast with 80ms+ ping it was just a terrible experience all the time, but they apparently (and stupidly) assumed it would work well enough due to client side prediction. PUBG could have been so much more fun with ~20ms California servers and a < 60ms ping restriction, which is how most Quake Live servers operated when I used to play that game.

The way to make online competitive games as good as possible is to embrace low latency connections now that most people have them and focus on placing servers in as many cities as possible. The speed of light can't be overcome no matter what we do, so the solution is for people to play with other people that are within ~500 miles.

I hold out hope that eventually netcode authors will realize this fact and finally re-create the incredible long-lost solidity of NetQuake. All they really have to do is stop being so damn clever!

</comment><comment><USER21> The only thing QW really added over vanilla "netquake" was client side movement prediction. Hitscan weapons (infinite velocity bullets) only let you know if you had hit or missed based on the response from the server. You had to lead your shots a certain amount based on your current latency in order to hit your target.

It was great though. It meant you could bunny hop around corners at extremely high speeds without running into walls.

<comment><USER2> You say "only", but for those of us who's ping on a good day was between 250-300ms, it was miraculous. It is interesting though, how lag compensation on one particular aspect of the game can make such a big difference, even though the lag is still there in full force in other (just as critical) aspects of the game.

<comment><USER22> Even to this day playing from Australia it's not uncommon to have a 250-300ms ping on US/EU servers (depending on the game may be the closest English servers).

</comment></comment></comment><comment><USER23> What were .plan files like? I've only ever heard of Carmack using them -- did other prominent devs also publish their .plans?

I wonder if there'd be any interest in reviving this. I think it would be cool to have something like an RSS feed of the .plan files from various developers I respect/follow. These days you have to settle for reading their Twitter+GitHub issues.

<comment><USER24> Well, Twitter, Facebook, etc. are the modern replacements for the "status updates" you used to put in your .plan file. .plan was just a simple text file you left in your home directory; it would be displayed to any user who attempted to query you with the 'finger' command. These days the 'finger' protocol is not really used anymore due to security vulnerabilities. But back then, Unix really was a social-moedia OS, and the internet was a decentralized, federated social network.

(There were actually two such files; .project was used to give a high-level summary of what you were working on, while .plan was used to talk in detail about what you were currently doing at the moment.)

</comment></comment><comment><USER25> I a developer on FortressOne - a still actively developed continuation of the original QuakeWorld Team Fortress. We have an extremely active community with games taking place nightly. It's a testament to Carmack that his code from 1996 is still widely used in 2019.

[https://www.fortressone.org](https://www.fortressone.org)

</comment><comment><USER26> It seems to be the premises of client-side prediction. I submitted a link on HN yesterday that may interest some of you guys: [https://news.ycombinator.com/item?id=19908875](https://news.ycombinator.com/item?id=19908875)

</comment><comment><USER27> Why is this article hosted on github? Obviously it wasn't created there as it was written in 1996. Are all the message boards and forums where this type of material was likely posted really defunct or unusable now? Do we now need to rely on enterprising internet historians to find gems on older platforms just to copy them to the newer platforms? Will Github be around in 20 years? Will the next historian have to unearth it from github just to copy it to the next platform?

<comment><USER28> > Are all the message boards and forums where this type of material was likely > posted really defunct or unusable now?

The original source of this material (and the other articles) was John Carmack's .plan file. See [https://en.wikipedia.org/wiki/Finger_protocol](https://en.wikipedia.org/wiki/Finger_protocol)

The .plan file is by its nature ephemeral, as the user can change it whenever. But the content was archived.

The GitHub is just the latest mirror.

> Will the next historian have to unearth it from github just to copy it to > the next platform?

Maybe!

</comment></comment><comment><USER29> > In a clean sheet of paper redesign, I would try to correct more of the > discrepencies

Sounds like that is what he did with Quake 3 (don't know about Quake 2). At least in Quake 3, the whole game logic is running in a so-called 'Quake Virtual Machine' file (.qvm) that is exactly the same on server and client (even cross-platform compatible). That way he doesn't just predict the client movements but the whole game world.

</comment><comment><USER30> It seems like almost every time something about Carmack is posted, people point to the book "Masters of Doom", about the development of id games (Wolf3d, doom, commander keen). It's pretty interesting read imo: [https://www.goodreads.com/book/show/222146.Masters_of_Doom](https://www.goodreads.com/book/show/222146.Masters_of_Doom)

<comment><USER31> I recently read the book and it blows my mind how Carmack was able to program so relentlessly. Always moving on to the next thing and doing the impossible. He's definitely on a whole other level.

</comment></comment><comment><USER32> "I have a T1 to my house..."

<comment><USER33> In 1996, one would have been lucky to be able to have ISDN, so having a T1 was more like 'money is no object' territory.

<comment><USER34> In the late 90s a T1 cost about US$1,500/month. It came with a bunch of service guarantees and the like because it was aimed squarely at businesses. A T1 is only 1.5mbps too, fast for the time but in absolute terms not that great. The only other options were 56k modem (48kbps on a good day) and frame relay or ISDN, which was a solid 64kbps and lower latency than a modem but also far more expensive than it should have been (US$200-300/month).

<comment><USER35> ISDN ("It Still Does Nothing" to give its facetious full name from the time) lines were often bonded, usually to give 128kpbs though faster configurations were possible, though of course there was an increased cost for this.

</comment></comment></comment></comment><comment><USER36> Link to the origin repo if you'd like to read the entire .plan archive: [https://github.com/ESWAT/john-carmack-plan- archive](https://github.com/ESWAT/john-carmack-plan-archive)

</comment><comment><USER37> Maybe FRP (functional reactive programming) can give more abilities to reason when designing networked shooters and internal simulation in games. Just like React had revolutionized GUIs (it's not FRP library, but has ideas from it). With FRP, it's even possible to build "tickless" game logic. However, for now it has limited practicability and I never seen something complete that was built with FRP.

</comment><comment><USER38> Is he happy with his Oculus job after the FB deal or will he leave after the Quest comes out?

<comment><USER39> I always wondered about how he felt about that role. I feel like Carmack could still run one of the best software shops on earth, even if he had to start from scratch. The man invented the concept of "it will be ready when it's done", and has an incredibly positive attitude towards handling difficult (challenging) problems.

If the stars aligned and Carmack decided to get back into making new software- based gaming experiences (especially around the DTX/ATX area), I would be incredibly tempted to investigate opportunities.

</comment></comment><comment><USER40> Good times. If I remember correctly, it was possible to drop everyone from a quake server (especially team fortress, when your team was about to lose) by spamming chat messages in the console

</comment><comment><USER41> > I would like to see internet focused gaming become a justifiable biz > direction for us.

> Its definately cool, but it is uncertain if people can actually make money > at it.

</comment><comment><USER42> It is interesting to see so many grammar and spelling errors in this short article. Almost sounds like he didn't write this himself.

</comment><comment><USER43> Was the dot plan written to himself or for his teammates ?

</comment><comment><USER44> >There are all sorts of other cool stats that we could mine out of the data: greatest frags/minute, longest uninterrupted quake game, cruelest to newbies, etc, etc.

I agree with his use of a double etc there.

</comment><comment><USER45> pushlatency -120

</comment><comment><USER46> play'd all the doom/quake... was a pleasure reading this...

</comment><comment><USER47> I see everyone in this thread reference CSP [0] and I keep thinking they're all talking about the foundations of core.async or Golang.

[0] [https://www.reaktor.com/blog/why-csp-matters-i-keeping- thing...](https://www.reaktor.com/blog/why-csp-matters-i-keeping-things-in- sync/)

</comment><comment><USER48> Presumably by HN readers, saved to archive already 7 times today!

[https://web.archive.org/web/*/https://raw.githubusercontent....](https://web.archive.org/web/*/https://raw.githubusercontent.com/ESWAT/john- carmack-plan-archive/master/by_day/johnc_plan_19960802.txt)

<comment><USER49> Is there a good browser extension for archiving pages in one click? Firefox.

<comment><USER50> I do not know about submitting to archive.org, but i use Save Page WE for Firefox to make full local copies of sites (it essentially takes the current DOM state and inlines all external files/dependencies to a single HTML file and then prompts you to save that file which can be opened later):

[https://addons.mozilla.org/en-US/firefox/addon/save-page- we/](https://addons.mozilla.org/en-US/firefox/addon/save-page-we/)

<comment><USER49> Thanks for the suggestion. You might be interested in Zotero [0] for a more general solution. It supports saving to HTML, saving to PDF, etc. and allows you to organize everything with tags.

[0] [https://www.zotero.org/](https://www.zotero.org/)</comment></comment></comment></comment>


Marc Benioff of Salesforce: 'Are We Not All Connected?' - <AUTHOR> https://www.nytimes.com/2018/06/15/business/marc-benioff-salesforce-corner-office.html <comment><USER2> > Then Larry [Ellison, Oracle's co-founder] took notice of me, and I started > working directly for him.

Wow, so much to potentially unpack here! Career advice-wise, I'd love to read the details of how one joins a company (presumably as a rank and file contributor) and all of a sudden the CEO "takes notice" of them and they are working directly for the CEO! How big was Oracle at the time? I can count on one hand how many companies I worked for where I even once met the CEO, and they were all very small indeed.

<comment><USER3> Maybe I'm reading it wrong, but it appears he was in sales there? If you're a high performer in sales you get access to people because your activities directly impact the balance sheet

</comment></comment><comment><USER4> "We have a plan to get every homeless family off the streets within five years. We've already moved hundreds of families back into society and into homes." Wow.

<comment><USER5> You have to start somewhere. A local, wealthy entrepreneur has the same goal, and after about a decade of work coordinating public and private orgs and developing a unified case management system, our city of ~140k has functionally zero homeless because they are all getting help. Replication of this model is underway in other cities. The hard work of scheduling meetings and getting multi-org agreement "scales" if it's being effectively managed by locals in each city, and of course the software is easily distributed.

<comment><USER6> Any more info you can share on this?

Very curious what the difference is compared to the usual approach, see how it could apply in different places (here in NL).

<comment><USER5> Sure, here's a very recent article (but the effects of this approach have been accumulating for awhile.) [http://www.rrstar.com/news/20180608/rockford-gets- attention-...](http://www.rrstar.com/news/20180608/rockford-gets-attention- for-efforts-to-reduce-homelessness)

Here's the software referenced: [https://www.mpowr.com/focus- areas/community](https://www.mpowr.com/focus-areas/community)

It's a SaaS, but as you can see, the hard part isn't the app development; it's getting all the government departments and charities talking and agreeing to automatically coordinate via software.

Our city is bad at a lot of things, so I'm a bit proud we've actually accomplished something good that we are able to export. :)

The usual approach is to start a new case at each org which duplicates the same kind of assistance, leaving less for others and making it harder to steadily advance someone towards receiving the treatment or rehabilitation they need since they'll bounce from place to place. When communication between agencies does happen, it generates too much paperwork and decision-making is inconsistent, time-consuming and less effective because the staff might not be up to date on the solutions or money available to treat an individual's specific problems. Software, along with a more collaborative mindset, helps all of this.

</comment></comment></comment></comment><comment><USER7> Benioff is one of my inspirations and one of the technology CEOs I most look up to.

<comment><USER8> Why is that? As someone that has only been exposed to him via headlines and articles like this he has come off as someone that states populist politically correct statements for the purpose of gaining attention and not seeming like a "typical" billionaire.

<comment><USER9> One of my mentors, who worked with Benioff directly for years at Oracle, says he's legit - one of the kindest and most generous people he's known.

<comment><USER8> Ok, I'm probably looking at him in the worst possible light then.

</comment></comment></comment></comment><comment><USER10> Bit of a puff piece. For a contrasting view, Dan Lyons (Fake Steve Jobs) has some choice quotes on Benioff excerpted here [http://www.platformonomics.com/2016/09/the-spectacle-that- is...](http://www.platformonomics.com/2016/09/the-spectacle-that-is- dreamforce/) "There's an art to this kind of horseshit, and Benioff is its Michelangelo."

</comment><comment><USER11> This was an interesting article.

Changes my impression of SFDC.

<comment><USER12> Curious why impression would be different? Benioff has been outspoken like this for at least a decade (two?). And Salesforce is well-known to be very charitable.

<comment><USER13> > And Salesforce is well-known to be very charitable.

When I interviewed there, every single person who spoke to me talked about their 1-1-1 thing. Might be interview training though.

<comment><USER14> Yes, it's their main sales tool for recruiting and public relations efforts. Everyone gets two weeks training in part on 1-1-1 when they join, and employees involved in recruitment get a lot of training on how to present it and respond to questions, and exposed to ongoing marketing on it.

<comment><USER15> Is it possible to work there (or any socially invested company) and just do your job and go home?

I do certain charitable things but I don't discuss it except with a few people who also participate.

I interviewed with a company here in Austin early this year and one of the things that bugged me was how they'd turned their charitable work into a marketing tool with slick brochures. I actually felt bad about being more interested in the actual business work than the charity work.

<comment><USER16> Yes, it's possible.

You have the option of using up to 7 days per year (56hours) to volunteer and you're being paid normally for this time.

You are encouraged to volunteer and there are events setup regularly in which you can take part if you want.

If you have something you personally care about you can volunteer there.

That being said nobody is forcing you to volunteer.

</comment></comment></comment></comment></comment></comment><comment><USER17> If you're remembered primarily for doing great philanthropic things in a few decades I'll buy it. Til then you're just a billionaire who went to India and likes to say stuff, in my books.

</comment><comment><USER18> Cool guy. The core software is pretty dated though (it is 2000 era) and in need of a major refresh which seems like it may never happen. So there are some long-term risks with Salesforce because of that.

<comment><USER19> You're right. Salesforce is a big, complicated, multi-tenant, CRUD application coupled to an Oracle database. Multi tenant architectures themselves aren't an issue, but Salesforce implemented it well before the days of containers. All the Apex code has to be "bulkified" which means writing almost everything for multiple records in an execution context. This adds to the mental effort and reduces readability. A major concern when not all consultants do it well.

They've been trying for years to replace the Oracle database with Postgres, but it's not easy in such a large, heavily used enterprise application.

For many situations I recommend integrating with a messaging system and using the REST apis from something like Ruby.

Lightning is not bad, but it's slow compared to the front end framework competition. It is pretty fast to develop with though.

</comment></comment><comment><USER20> He seems like he wants to be a better CEO and have employees volunteer but I wonder if this type of business leader ever actually wants to empower their employees by unionizing them? Or giving them the day off to vote? Encouraging regulation on their own industries? Not financing lobbyists?

Not to say he's a horrible person, just the corporate system we have seems destined to take more and more power away from the avgerage joe.

<comment><USER21> Good grief. Salesforce people are well paid. They can take a personal day to vote. For many people, working at Salesforce is a dream job.

<comment><USER22> Also, people shouldn't really need a day off to vote unless they are working an insane schedule. Polls are usually open 12+ hours. You should have time to vote before or after the workday.</comment></comment></comment>


Top improvements for PHP developers - <AUTHOR> http://www.jeremyhutchings.com/2010/11/top-10-improvements-for-php-developers.html

<comment><USER2> I like the points about using php for logic instead of mysql, I've been doing that for years because I prefer to always do the heavy lifting in php which I know better than SQL.

I always felt it was against best practices though, but now I won't worry about it so much.

<comment><AUTHOR> One of the PHP devs who is also at Facebook suggested I do it that way, so I don't worry too much either!

</comment></comment><comment><USER3> While interesting, if you haven't read the original article, most of the points lose their meaning.

[http://blogs.sitepoint.com/2010/11/19/mysql-mistakes-php- dev...](http://blogs.sitepoint.com/2010/11/19/mysql-mistakes-php-developers/)

Also, aren't most PHPers using frameworks (like CakePHP or Symphony) now instead of raw-coding PHP? I can imagine this being useful for dealing with small or legacy systems, but I haven't had to write a raw SQL statement in almost a year now.

<comment><AUTHOR> Indeed, most of the time I use codeigniter, though I was focusing on "where" you do the logic, opposed to just how.</comment></comment>


A surprising opinion on the 'Bing is copying Google' controversy - <AUTHOR> http://fury.com/2011/02/a-surprising-opinion-on-the-bing-is-copying-google-controversy/

<comment><USER2> "Bing isn't mining the first pages on Google search result pages as Google claims; they're mining the pages that users click on the most."

Hasn't this been at the core of the controversy all along?

Counterargument:

It's user action on a page created by google. Say I had nothing but this user data - and say I had enough of a sample. I could build a pretty damn good search engine out of that. But I know nothing about how to provide search results. I haven't even got a crawler. Yet here I am with a search engine.

edit (to finish the follow through):

If I can with this method build something about which I have no actual knowledge - then it proves the method is piggy backing on someone else's hard work. And THAT is what matters. It doesn't matter if it is only one of many signals - it doesn't matter if it's not copying Google's algo directly. What matters is that it is still relying on someone else's knowledge to improve Bing's product. That's shitty.

This argument clinches it for me.

The fact that Bing can't even acknowledge the opposing side - given that at the very least intuitions are going both ways here - is a clear sign of bad faith to me.

<comment><USER3> Oh, come on! The whole idea of search engines is to rely on someone else's knowledge to make a product, isn't it? Isn't this how Google makes, like, all its money?

What's skeevy in the MS case is that the relied-upon-knowledge and the product are so similar...but still, Google's uber-umbrage strikes me as odd and tone- deaf, especially given its dominant position in the market.

<comment><USER4> Re: using someone elses's knowledge - Google honors robots.txt, so, if you don't want them to use your link knowledge, you can tell them not to.

I'm not sure there is any way for Google to Tell MSFT to not use their search results in the Bing search engine.

If Microsoft had just been a bit more upfront with the fact that they were using IE user's google clicking behavior to improve their search engine, I suspect there would have been much less furor.

<comment><USER3> I don't know, doesn't Google harvest the content of anything I send to an @gmail.com address? Or how about the massive scanning of books over the objections of book publishers a while back (though I think this ultimately got resolved)? My general impression of Google, and part of why I find their crying foul so jarring, is that they will harvest as much information as they possibly can, to whatever end, until restrained by public outcry. (Which, BTW, I'm fine with!)

But it seems very hypocritical to get butt-hurt on behalf of Bing toolbar users who are having their movements tracked.

(BTW, I don't find Google's observance of robots.txt to be particularly compelling or telling, because they've never been in a position where ignoring it would be significantly beneficial to them, as far as I know.)

<comment><USER4> Google was pretty clear that they would be harvesting the content of your gmail to target ads. The different here, is that MSFT did this "Google-search- Click-Tracking" thing on the down low.

I agree with you though, if I, as an IE9 user wish to submit my click track results to MSFT for analysis so they can improve search results - that's fair game.

But, It's not clear to me that MSFT should be able to review what the user was searching on before they clicked on that data. Now they are actually using Google's search Data + the user's click traffic. I think they cross a line there, particularly if they aren't willing to come clean and admit that's what they are doing, and make it clear that they are sending your Google Search queries + your click traffic back to Redmond.

How many people on HN were aware that Microsoft was doing that with IE? Click Traffic, sure - But I didn't know they were sending my Google Search queries back to HQ.

</comment></comment></comment></comment></comment><comment><USER5> The fact that Microsoft is able to take only the relevant results from Google doesn't change the fact that the results are coming from Google. The problem is that if search engines start using the technique that Microsoft is using then there is substantially less value to Google, Microsoft and other search engines for innovating on rare search term relevancy since the other search engines get the benefits for free.

<comment><USER6> Meta search depending entirely on other search engines' output has been around in the form of Dogpile since the days Google was a student project.

During that time Google has managed to innovate fast enough and implement well enough to grow into a multi-billion dollar corporation.

</comment></comment><comment><USER7> Monitoring users clicks over the web is not the same as monitoring users clicks on a competitors web site (google search results).

The whole point of generating 100 unlikely search terms is the fact that these wouldn't be items that exist in any web page on the web. Hence if one searches for them it should not return any results!

How is monitoring people's clicks on google's search results not copying ?

On a different note, I am of the opinion that this practice is acceptable, only as long as one acknowledges it. The fact that M$ is not, to me is appalling.

</comment><comment><USER8> > This morning I had a different thought though, one that's completely > reversed my thinking on the issue: People aren't robots, and they don't > always click on the first result.

But people do have a bias to click on the first result _because_ it's the first result. From <http://www.useit.com/alertbox/defaults.html> :

> 42% of users clicked the top search hit, and 8% of users clicked the second > hit. ...

> [When the researchers] swapped the order of the top two search hits ... > users still clicked on the top entry 34% of the time and on the second hit > 12% of the time.

</comment><comment><USER9> "If Bing is using the techniques descriped in this Microsoft technical paper then they should stop. Full stop." <http://aclweb.org/anthology/P/P10/P10-1028.pdf>

I didn't read the paper (just read the abstract, I know..), could anyone explain what are they doing so bad in that? Thanks.

</comment><comment><USER10> The whole point of crawling and indexing websites to begin with is to simulate what users can and do click on. The fact that it is now technologically possible to actually track users navigation of the web doesn't change the intent of the robots.txt convention in controlling and limiting the way that search engines collect data from a site.

Bing/MS can choose to dishonor that convention, either directly or indirectly as they are now with the Bing toolbar, but I think that's a mistake on their part. Google (and Bing.com for that matter) has used the most widely accepted mechanism, robots.txt, for ensuring that content it does not believe should be indexed is not. It abides by that convention with other sites and expects other search engines to abide by that convention with respect to google.com in return.

From here the following things can happen:

1\. Microsoft agrees that robots.txt should govern clickstream data from the Bing toolbar. The world returns to sanity once again.

2\. The search engine community (MS, Google, etc.) agree on a new standard similar to robots.txt specifically for governing the use of clickstream data, sites are updated with new directives allowing/disallowing such use and the world returns to sanity.

3\. Microsoft specifically denies that they should be limited in using clickstream data from _any_ source, through convention or through any means. Search companies and other sites are forced to fall back on other means to achieve the same results and things get messy (for example, google blocks all users who have the Bing toolbar installed, they prevent the Bing toolbar from being installed in Chrome, MS retaliates, etc.)

For the life of me I cannot think of a sane reason why MS would choose option number 3 other than that they are insane, horribly myopic, or just plain dumb.

<comment><USER11> I was always under the impression that robots.txt was intended not to control search results, but to help prevent overzealous crawlers from taking down your website.

If you want to control what a search engine does with a page, you should use <meta name="ROBOTS"> and rel=nofollow, neither of which Google includes in its results pages. It would be reasonable for Bing to look for and honor these directives when collecting their clickstream data, and Google isn't availing itself of the option.

<comment><USER12> It's for controlling search results; blocking overzealous crawlers is a convenient side-effect.

robots.txt also blocks indexing of non-html files.

</comment></comment></comment><comment><USER13> Kevin Fox, the author, makes the interesting point that what Microsoft is mining via clicks isn't directly Google's results, but the users' estimation of those results, when they choose which ones to visit. This data is to some extent a new creation, although definitely derived from the Google results. Custom analysis of such user activity doesn't necessarily just port over results, but could also result in an even better ranking than the original Google presentation.

Fox also suggests there could be a robots.txt-like standard where sites declare they want to opt their users' activity out of any such analysis. That strikes me as a bad idea: users ought to own their own interaction trails.</comment>


Ask HN: Transpiling a dynamically typed language to a statically typed language - <AUTHOR> Hi, I have been pondering what I want to do for my master thesis (2+ years away) and I have an idea. I am writing to ask if the question has a known answer or is even theoretically possible to conduct.<p>My idea is to write a source-to-source compiler from a Lisp_2 to Rust, but I do not know if it is possible to transpile from a dynamic language to a statically typed language. Is it? <comment><USER2> It is possible. Some scheme compilers use C as their intermediate language. Scheme to C to binary. (Gambit/Chicken/Stalin etc.). I have a project [1][2] that compiles a subset of Clojure to C++11 that is written using literate programming [3]. It thoroughly documented and should give you an idea on how to build your own.

[1] [http://dropbox.nakkaya.com/builds/ferret- manual.html](http://dropbox.nakkaya.com/builds/ferret-manual.html) [2] [http://nakkaya.com/2011/06/29/ferret-an-experimental- clojure...](http://nakkaya.com/2011/06/29/ferret-an-experimental-clojure- compiler/) (Old version for more documentation on the idea.) [3] [https://en.wikipedia.org/wiki/Literate_programming](https://en.wikipedia.org/wiki/Literate_programming)

</comment><comment><USER3> In one of the later chapters, the book Lisp in Small Pieces (great book), shows you how to write a a Scheme compiler to C. The general idea is you create a structure that contains a union type of all types in the dynamic language, and also a tag that tells you which type it is.

</comment><comment><USER4> That doesn't sound hard to me - you just use a high level type that implements the coercion/conversion rules of the dynamic lang types.

GC lang to non-GC lang is a more interesting challenge. If anyone has transpiled a gc lang to C++ I'd love to know how they did it.

</comment><comment><USER5> [https://en.wikipedia.org/wiki/HipHop_for_PHP](https://en.wikipedia.org/wiki/HipHop_for_PHP) [https://www.call-cc.org](https://www.call-cc.org)

</comment><comment><USER6> My honest opinion is that unless you've written C, or assembly, I don't consider you a real programmer.

<comment><AUTHOR> What does this have to do, at all, with the question?</comment></comment>


"This is Broken" (Seth Godin) - <AUTHOR> http://www.ted.com/talks/seth_godin_this_is_broken_1.html

<comment><AUTHOR> From the video, in case you're a TL;DR kind of person...

Reasons why something is broken (not a transcript, my interpretation in parts, FWIW)

Not my job - Instead of addressing the problem, this is a poor band-aid by someone who is lazy. Someone needs to take responsibility. e.g. Signs on killer gates

Selfish jerks - People who do something selfish in the short run hurt their image in the long term. e.g. "Organic cigarettes", email spam, tricky contracts

The world changed - Trying to make something "better than the original", "Vote for Pedro" shirt from Napolean Dynamite: official one isn't like the ones in the movie!

I didn't know - internal contradictions, subtle oxymoronic things, e.g. "Professional Gum", wine lists on a Windows ME tablet

I'm not a fish - The designer is out of touch with the end user, e.g. bad (empty) signs, poor dashboard design to chill coffee

Contradictions - e.g. "water salad in a jar", "pocari sweat drink"

Broken on purpose - things that are broken intentionally, like mismatched socks sold that way</comment>


Do certain venture capitalist invest based on the school of founder? - <AUTHOR> https://www.facebook.com/photo.php?fbid=10151999772795450&set=a.432190050449.225968.582270449&type=1&theater

<comment><USER2> I made the post on Facebook and am somewhat confused why it has appeared on HN.

This is _extremely_ unscientific, so I would not recommend making any conclusions based on it.

...but if there's interest, I'll improve the data and write up a blog post.

<comment><AUTHOR> Yes this data analyisis is worth sharing so shared it on HN. By d way how did you found it out ?

P.S I follow you on facebook. Your each and every data analysis are awesome. I even tried to add you on facebook so that i could learn something from you, but seems like you do not add strangers.</comment></comment>


[Ask HN]: Really testing out my website.. - <AUTHOR>

MacBook OS X 10.6, 8gb RAM, 750gb SATA, took out my SuperDrive and put in a second 750GB.
I have an HTML5 video streaming site I have been working on, about 300gb and I develop it fully on my MacBook.
I want to get a sense how well the site runs in terms of resources for each connection or get an idea of the coding changes I make if they are increasing resources needed or decreasing...Get an idea of when someone just lands on the site, how much did that cost in terms of resources? if I make JavaScript changes are they saving or costing?
Get what I am saying? I am having a hard time phrasing it in the manner I want.
Tools that I can use to decide if the changes I am making are good or bad, ways for me to see what parts of my site are using the most resources...
A long time ago I remember Rational had a testing suite, but I am poor and would like OSS or low cost..
Thinking more out loud with an example. Say I measure my current site and then I rewrite using the HTML5 boilerplate template and see how that stacks up before I deploy everything to production..or maybe after than I optimizing my JS better, what does the site now cost per session... <comment><USER2> You could try searching for software like this:

Load testing software -- can do things like download many video streams at once, to show you how well your server handles it. An open source example is Apache JMeter at <http://jakarta.apache.org/jmeter/>

Split testing software -- can compare and contrast different approaches to a web site, typically by creating two versions of a resource like web page A and web page B, then tracking which is most successful by whatever metric you want. Look at Bingo Card Creator by HackerNews user "paraschopra" at <http://www.bingocardcreator.com/abingo/resources>

System monitoring software -- can do things like graph your RAM and CPU over time, as well as let you script more sophisticated tracking like average CPU spike per connection. An open source example is Nagios at <http://nagios.org/>

Browser simulation testing -- can do automate click testing on your site, for example to create a test that pretends to be a user clicking on your links which run your javascript changes. An open source example is Selenium at <http://seleniumhq.org/></comment>


RockMelt browser goes beta - <AUTHOR> http://www.pcmag.com/article2/0,2817,2372080,00.asp

<comment><USER2> I like John Gruber's comment on this: "They solved the problem of Chrome having a nice, simple, minimalist interface."</comment>


C++ vs Java vs Python vs Ruby : a first impression (w/side-by-side comparison) - <AUTHOR> http://www.dmh2000.com/cjpr/

<comment><USER2> " I came up with a vague impression that Ruby is more pure and is set to win in the long run, but that Python is currently more practical for now"

I'm curious as to the reasoning behind both these assertions.</comment>


88% increase in application library vulnerabilities over two years - <AUTHOR> https://snyk.io/blog/88-increase-in-application-library-vulnerabilities-over-two-years/ <comment><USER2> > _In 2018 vulnerabilities disclosed […]_

More like 88% increase in _"disclosed"_ vulnerabilities.

The title of the post makes it sound like the vulnerabilities were introduced and discovered in the last two years, but it is more likely that an increase in interest in web and software security during the last two years allowed people to discover more bugs than before. In other words, if I have a database with 100 vulnerabilities in 2016, then I update the database with 100 more vulnerabilities in 2018, that doesn't mean that there was an increase in vulnerabilities between those two years, it just means that my vulnerability scanner got updated to track vulnerabilities that were already in the wild, but it was not aware of until the update.

<comment><USER3> Very possible, but the act of the vulnerabilities being disclosed makes them more vulnerable unless it was disclosed responsibly and the responsible party has already issued a fix. Even then, devs using the affected version now have a known vulnerability out in the wild, which will be incorporated into vulnerability scanners and scripted exploits and kits.

So whether it's due to an increase in interest or not, it is something that needs to be taken seriously.

</comment></comment><comment><USER4> I see that Snyk is still trying to claim credit for "discovering" zip directory traversal vulns.</comment>


Is It Wrong to Outsource Your Own Job? - <AUTHOR> http://techonomy.com/2013/01/is-it-wrong-to-outsource-your-own-job/

<comment><USER2> What a lad.</comment>


An FPGA Implementation of a Distributed Virtual Machine [pdf] - <AUTHOR> https://www.cs.unm.edu/~williams/fpga-ucnc18.pdf <comment><USER2> GALS style has been around for a while, but I'm interested in the application. Is the code up somewhere?

<comment><AUTHOR> I have no idea.</comment></comment>


Ask HN: How are you combatting computer elbow? - <AUTHOR> Apart from stretching, resting, and arranging an ergonomic setup (e.g. arms at 90 degrees, etc.), are you employing any coping strategies for computer elbow, or that dull ache in an elbow's tendons from computer overuse? If the pain I've been experiencing over the past year or so gets any worse, which it plausibly will without intervention, I can't imagine spending the rest of my life in any industry that requires sitting in front of a computer for a large chunk of the day.<p>Any tips? <comment><USER2> I'm not sure what you mean by "computer elbow", but one thing that was giving _me_ discomfort somewhere in forearms or wrists (don't remember details anymore) was using mouse.

Basically, laying my hand flat on the mouse forced me to either rotate the forearm in some weird manner or spread the elbows unnaturally far from the body. The latter, I think, might be the reason behind your issues.

I solved this by switching to a trackball with angled top (Microsoft Trackball Optical 1.0) so that my palm doesn't need to lie horizontally anymore. So called "vertical mice" push this idea even further (never tried one).

And as for the keyboard, consider learning to touch type effortlessly. With some hunt-and-peckers I get the feeling that they apply all kinds of weird tensions to their hands, especially under stress, which hardly is good for longterm comfort.

</comment><comment><USER3> I try to move a lot during the day. Part of repetitive stress injury is that everything stays within a pretty small range of motion for long periods. So, moving mouse pads, keyboard back or forth, adjusting where I sit in the chair, all change the angles of attack (if that makes sense) of my arms/hands.

But as well is that I'm up and away from my desk for at least a few minutes every hour, and I try to take a couple walks outside of lunch.

I'd have a hard time saying what helped more.

</comment><comment><USER4> Am I the 9l one who has more of a _shoulder_ (impingement? ) issue than elbow or other joints*? This is specific to notebook use, where the pointing device is fixed relative to the screen.

It helps a bit to stand to the left of the screen, opening the shoulder angle... but I guess I should try an external mouse.

<comment><USER5> I've never had an issue with my shoulder while using a laptop, computer, or tablet. But if you are forced to hold your shoulder in a certain way with how you are using the device, it certainly could happen.

</comment></comment><comment><USER6> What have the doctors and ergonomists told you?

</comment><comment><USER7> This is what I use and refer my patients to buy: www.thelonniebrace.com. It is an alternative to surgery and my patients love it.</comment>


RIP Likealittle? - <AUTHOR> http://siteanalytics.compete.com/likealittle.com/

<comment><USER2> Didn't they switch to <http://lal.com>?

<comment><AUTHOR> good point, but that doesn't actually look any better: <http://siteanalytics.compete.com/lal.com/></comment></comment>


A resumé platform that lets you use photos and videos - <AUTHOR> https://dextercv.com/tYa5GmNumJ <comment><AUTHOR> Hi there.We used an Elon musk demo(who doesn't love this guy) to showcase what it means to use photos and videos on your resumé.Let us know what you think.</comment>


The IE6 Equation - <AUTHOR> http://24ways.org/2008/the-ie6-equation <comment><USER2> Why I love my Mac, hate web development, and learned to loathe IE6 <http://tinyurl.com/5skq8x> (screenshots of our website)

I am an entrepreneur and a bit of a python hacker but am new to web development as a craft. It was a skill developed from the necessity of a self- funded startup I co-founded.

Wasn't the web supposed to be accessible to all? WTF was Microsoft thinking when they came out with that stinking piece of turd called IE6 and why haven't they killed the beast by now? Instead of killing a plague like IE6 they are killing a solid operating system called Windows XP to be replaced by another Windows Vista ME (at least that's what it feels like).

Sorry for the rant but it's late and I don't like web browsers anymore.

<comment><USER3> I don't want to interrupt the cliche fanboy hatefest, but when IE6 came out way back in 2001, it was by far the most standards compliant browser out there, and much better than the dying outdated Netscape in terms of feature- completeness. They did not update it for several years while there was little competition. Many of the features taken for granted in modern web development are proprietary Microsoft extensions - InnerHTML and Ajax both come to mind.

It's funny you criticise Vista when the reason that you still have to develop for IE6 is because of the huge unprecedented success of XP. IE6 has been the XP browser since it came out. The fact is that if Vista had been a bigger success, an OS that ships with IE7, IE6 would be less of an issue. The "plague" was actually caused by what you praise in the next sentence. They're unlikely to stop supporting IE6 until they stop supporting updates to XP since it's XP's default browser.

</comment></comment><comment><USER4> > Fingers are crossed, prayers are muttered, but alas, to no avail. The > nemesis browser invariably screws something up.

I must be doing something right, because while there's usually something to fix, it seldom takes more than a few minutes (in my experience building templates over the past few years). Recently, the nastiest bugs I find are in IE7. They defy classification...there's some weird voodoo going on in that browser.

<comment><USER5> Same here, IE6 debugging only takes a few minutes. The PNG transparency issue being the most annoying (but a simple fix)

I think most of the IE6 hate articles out there are from new web developers or from coders who rely too heavily on complicated CSS which makes debugging utter hell.

<comment><USER4> Yep. See, I'm from the days when IE6 was just fine, and we all loathed IE5.5/Mac (and weird proprietary Netscape stuff). My first HTML and CSS books listed compatibility issues for every browser for every technique. This was expected knowledge.

For me, as a designer, the lack of alpha transparency support is annoying indeed, but it's pretty rare that a design absolutely requires true alpha transparency. Usually you can ape it during slicing, unless the "below" elements move, in which case I'll look to SuperSleight and what not.

</comment></comment></comment><comment><USER6> I think the big question is whether or not Windows 7 will be any good. XP is still very popular which means a large percentage are using the stock IE. If the next release gets widespread adoption (or fuels the Apple fire) then hopefully IE6 will be on its way out.

Has any tried using that JS file in production? Recommended?

<comment><USER7> I think that XP will be supported for a very long time. A lot of people, including myself, have jumped onto the Apple bandwagon and only use XP for those few programs, including IE6 and various arrays of games, via Boot Camp or some sort of virtualization. Unless Microsoft will actually let me dumb down Windows 7 for the bare minimum for even lower levels of boot time, memory usage, etc, I probably will stick with XP for my dual boot.

But the problem at hand isn't people using IE6 at home, there's a lot of companies that will not allow upgrades to even IE7. Somebody, either Mozilla, Google, whatever, needs to implement the features enterprise values most, and then advertise the hell out of it.

There's a business idea for somebody willing to take it: Enterprise Browsers. They pay you for support, updates, and insurance that their legacy apps still work. If, for any reason at all, many PHBs see free as 'cheap, inefficient, and worthless'.

<comment><USER8> Those Enterprise intranet apps are very often dependent on IE6 bugs. Yes, some admins are also concerned about ease of SMS or WUS deployment, or central control over preferences such as proxy settings and the home page, but bug- compatibility with MSIE6 is probably more important and certainly (much) harder to implement.

I think the cheapest way to run an IE6 application will be to keep using IE6, for as long as Microsoft is willing to collect the license revenue on WinXP or whatever.

<comment><USER9> I can't believe there are still people (not necessarily you, arebop) who think pushing _proxy settings_ to clients is somehow good from a security standpoint. If you really want to control or log what people are doing through your network, you have to FORCE them to go through a proxy, and the only way to do that is with a firewall and with a transparent proxy, not by putting configuration on a piece of hardware that someone else, the user, has physical access to and uses day in and day out.

</comment></comment></comment></comment><comment><USER10> This guy obviously is a designer and doesn't do math for a living... Why is the equation built like that? Why is it logarithmic? What are "large" values of P.

The idea is good but the implementation is terrible.</comment>


An Alternative to Convertible Debt in Emerging Markets - <AUTHOR> http://techcrunch.com/2015/05/08/an-alternative-to-convertible-debt-in-emerging-markets/

<comment><USER2> I think there's a lot of wishful thinking here. Pretty much nobody would recommend putting a sizeable share of your personal wealth into a single investment of any kind, whether that's a single S&P 500 stock or a loan to a small business collateralized by an ownership stake in that business.

Also, the default case sounds like a real loser for the investor, the chef in the story. If the owner defaults, there's a good chance that the business is not performing to plan, so the chef gets a share in something that's not worth as much. Also, the chef now owns part of a company with an owner who is not planning to sell the business, and who has complete control over how it's operated -- he's now got to try to sell that 15% on the secondary market, where it will probably go for pennies on the dollar. If he holds onto it, the founder has no obligation to share profits with him, so there's no ongoing revenue, and he has no long-term assurance of it ever becoming liquid.

What a mess!

<comment><AUTHOR> author here: the Interest Investment is for specific startups that are cash- flow positive (and deemed by an investor to be very likely to re-pay & that would be a valuable asset regardless). I spend most of the year in Colombia, and the challenge I've seen in LATAM is that there many profitable startups that don't necessarily fit the VC model (Ex: they likely won't become $100M companies, but they will be profitable). However, many of these companies do need capital to grow quickly & yet they don't have the credit to do so via traditional banks. The idea for is that investors interested in being involved with the tech scene can invest and receive more predictable returns (that they are used to, most emerging market investors aren't familiar at all with tech investments) and cash-flow startups can find a new avenue to grow.

<comment><USER2> It's a worthy problem to solve. I wonder if you could just attack it with peer-to-peer unsecured loans, like what Lending Club does for consumers? In that model, many different lenders fund each loan, and conversely lenders can diversify over many borrowers. There's a similar service, I forget the name, where lenders bid on the interest rate they are willing to offer.

My big concern is that "15% stake in a proprietor-owned business that has no intention of going public and pays no dividends" is hardly better than no collateral whatsoever. The time horizon to get one's money back is darned near infinite, and there's no market for unloading it.

Another potential solution might be to offer up something more fungible as collateral, like vehicles, factory equipment, accounts receivable or intellectual property.

<comment><AUTHOR> A solution like you mentioned would help (I believe there are some things similar in LATAM today, but there needs to be more).

The thought with the Interest Investment is there exists a large market of investors in LATAM (and emerging markets), however they avoid startups because of a lack of traditional yearly returns, it's more unpredictable, there are unfamiliar terms, etc. Many people have tried to solve this problem by educating investors (to create new angel investors), but the success of this has been questionable. I felt this new idea could bridge this very large gap.

About the 15% stake, you are right that it's not a very liquid market at all. The thought was, if a person invested in a cash-flow profitable startup with good growth rates, there is some value in that asset (this type of investment wouldn't work for an unprofitable startup or a company with zero cash flow). There is a smaller market for private companies, but an investor should put money into an entrepreneur with a good reputation who stays true to his or her word (just like they would with convertible debt).</comment></comment></comment></comment>


Animal rights group PETA to launch pornography website - <AUTHOR> http://www.telegraph.co.uk/news/newstopics/howaboutthat/8772592/Animal-rights-group-PETA-to-launch-pornography-website.html

<comment><USER2> "PETA is extremely disingenuous," said Jennifer Pozner, executive director of the New York-based advocacy group Women In Media & News. "They have consistently used active sexism as their marketing strategy to garner attention. Their use of sexism has gotten more extreme and more degrading."

Playing on sex have proved ingenious for PETA. They've attracted loads of attention. The message they are trying to communicate have, however, to some degree drowned in meta discussions on _how_ they try to do it. But there's no doubt they've gotten a lot of attention, so I don't think disingenuous is the right word here.

Doesn't necessarily make it less controversial or 'wrong' for some people, though.

</comment><comment><USER3> Doesn't the saying go: "If it exists, there's porn for it on the internet."</comment>


LastPass - LinkedIn Password Checker - <AUTHOR> https://lastpass.com/linkedin/

<comment><USER2> I wrote a FB-note for my buddies regarding these tools and the leak. I see a lot of bad advice on HN as well, so I should probably paste how I see it here as well:

1\. DO NOT check whether or not your password was compromised via services like leakedin.org. If you've used LinkedIn, it was stolen. They only RELEASED around 6 million passwords, though LinkedIn has 161 million users. Odds are, your password is not found from the publicized list. There's very little reason to assume, that those password-hashes were the only ones out there...

By using such services, you just guarantee that your password-hash ends up in a web-server log to be stolen or outright to a hash-dictionary. Especially since most of us are stupid and recycle passwords from other services, you'll just intentionally leak your weak password to a 3rd party.

(Besides, leakedin.org DOES leak that information to a third party. They use an analytic tool, getclicky.com, which commits your search parameters back home every time you do a page reload/search.)

2\. As far as we know, LinkedIn HAS NOT DISCOVERED HOW THE ATTACK WAS MADE NOR BLOCKED THE VULNERABILITY. So even though we've all been clever and changed our passwords before any damages were done, the new one might as well have been leaked already. This is especially bad, if the new password is a recycled password as well. So if you lost your LinkedIn & Gmail -password before and replaced it with your FB-password... Congratulations! Odds are that you lost your FB-password as well.

Also, change your password again once LinkedIn has given a statement of fixing the vulnerability. If they don't... Well, sell your NYSE:LNKD.

3\. For every leak we know of, there's dozens of leaks we don't. Assume that your password gets stolen. Don't recycle them. Use a Password Manager (I use 1Password, there are others, cheaper and free ones, though. Don't know how good they are.) and/or a system such as passphrases or [http://safeandsavvy.f-secure.com/2010/03/15/how-to-create- an...](http://safeandsavvy.f-secure.com/2010/03/15/how-to-create-and-remember- strong-passwords/) .

4\. People can do pretty evil things with your data and by being able to impersonate you. Your account can be used to scam people (you might not want legal trouble), to blackmail you, to spy on you and your neighbors or even for performing crimes. E.g. Money laundering.

([https://www.facebook.com/notes/eetu-korhonen/about-the- linke...](https://www.facebook.com/notes/eetu-korhonen/about-the-linkedin- thing/10150925856481878))

<comment><USER3> Playing Devil's advocate (as in, I agree with you, site A should never under any conditions ask people to enter their password for site B):

Lastpass does encourage visitors to that page to change their LNKD pw on LNKD and anywhere else it might be reused. The checker form is placed below that recommendation.

Anyone inclined to enter their (old?) LNKD pw on the Lastpass page would probably enter it on some other "leakedin" password checker page that's less secure. At least Lastpass tries to be trustworthy.

Regarding your point (2), I don't think it matters if the LNKD vulnerability has not been patched. Everyone should still change their LNKD pw, because the compromise _might_ have been temporary. I agree that Lastpass and everyone else encouraging a LNKD password change should emphasize not to reuse passwords, but universally, and not specific to LNKD.

<comment><USER2> Yes. I agree that LastPass is probably a lot better than alternatives. They kind of have their balls on the line if things go wrong.

That said, I have not dwelled to details of how LastPass handles the site design to avoid unintended leaks, (I believe the issues with leakedin are simply unintended mistakes rather than attempted malice) but I sure as hell would avoid using or recommending their services should I find mishandlings of the data within such trivial applications.

About (2), It matters in the sense, that we have to assume that all of the sensitive data which has been leaked before will continue leaking until they have identified the vuln. The worst thing a user can do, is to insert a recycled password and consider the situation resolved.

Should the hacker still have the backdoor open, he'll just steal the new keys as well. Salting helps a bit, but it's far from solving the problem.

What I'm proposing is that people should change the pw twice. First instantly (and not recycling) and then when LNKD has confirmed that this individual attack vector has been closed.

</comment></comment></comment><comment><USER4> I think LinkedIn handled this very badly: [http://blog.jgc.org/2012/06/dont- be-reckless-with-other-peop...](http://blog.jgc.org/2012/06/dont-be-reckless- with-other-peoples.html)

</comment><comment><USER5> This is great fun to play with.. Some of the most amazing stupid passwords you can imagine are in here. Including things like qazwsx or 1q2w3e4r etc. Lot's of "keyboard patterns" etc.

Maybe major sites should use these sorts of lists as black lists for passwords?

Of course the sad thing is then someone gets pissed while registering and will just click away because the first 20 passwords they thought up are already in there. :)

It's a fine balance and one that's not going to die anytime soon.

<comment><USER5> Has anyone thought of doing a keyboard heatmap for this list? It seems to me there are a lot of these "muscle memory" like passwords in here where people use the keyboard pattern as the password basically.

</comment></comment><comment><USER6> I can't understand the rationale behind tricking people into thinking this is secure.

\- A list of (partial) hashes was released

\- People start setting up websites where you can compute your hash, this is already a bit dubious

\- Now people start setting up websitse where you can check if your password was stolen, effectively sending them a copy of your hash to make sure they got it...

It would not surprise me if one of those tools turn out to also send your unhashed password along.

<comment><USER7> More than that it "educates" people that entering their password into some web form other than the original login page is ok. Because the site says so.

<comment><USER6> Indeed, also a very good point.

</comment></comment></comment><comment><USER8> LastPass is an excellent service to manage your passwords. Their Firefox add- on is amazing. If you are not the paranoid-type (i.e. not scared to put your passwords in a 3rd party cloud) then I strongly recommend LastPass. Their browser add-ons are free and their mobile apps a mere 1$.

<comment><USER9> LastPass don't store your passwords per se. Your passwords are SHA256 hashed locally.

I love their system, but I think LastPass don't do a good enough job of explaining the security behind the system to those who are a bit more skeptical.

</comment></comment><comment><USER10> Same functionality as <http://leakedin.org/> ?

<http://news.ycombinator.com/item?id=4075347>

<comment><USER11> For starters, lastpass is using https, which is definitely better

<comment><USER12> https, we're not using 'GET' parameters for the hash (which is almost certainly ending up in log files on leakedin's site). We also just came out with a version for eHarmony's breach: <https://lastpass.com/eharmony/>

<comment><USER13> Completely off-topic but am I the only one that has been having problems viewing secure notes on FF 13? I can view them once every time I start Firefox but after that they just don't pop-up.

<comment><USER12> Try the prebuild: <https://lastpass.com/dlpre>

</comment></comment></comment></comment></comment><comment><USER14> I think the story here is: company that offers a password vault product thinks it's a good idea to encourage users to enter their passwords in third-party websites.

</comment><comment><USER15> I've been using LastPass for years and their service is great, so I decided to trust this service too. Apparently (if the published list is complete) my (old) password hash was not hacked :-)

</comment><comment><USER16> What's interesting is that virtually every single number spelled out from "eleven" to "onehundred" is used as a password.

I've also noticed celebrities are really common, such as "parishilton", "michaeljackson", or "jamescameron".

</comment><comment><USER17> This is useless. How do you know they released the full dump? The best "password checker" is the one that says you to change your password.

</comment><comment><USER18> There are some hilarious passwords listed, just keep entering combinations of profanity to see. f __*you is there etc.

<comment><USER19> At least they let you.

My LinkedIn password was also used for a rather old, unimportant POP account. So I went into Viginmedia account settings to change it.

Not only does Virgin enforce a maximum password length of 10 (what?!) this fact also lead me to discover that the company has a profanity filter on its passwords. (Double what!?)

<comment><USER20> What a clbuttic mistake.

</comment></comment></comment><comment><USER21> Why nobody mentions that the hackers probably have also your username, which on LinkedIn is a valid e-mail address ?

</comment><comment><USER22> That was somewhat amusing. Somebody had "dingleberry" as their password :)

</comment><comment><USER23> Other one is prettier.

<comment><USER24> But I'm more inclined to send last pass my old password to be honest.</comment></comment>