The Sorry State of Copy-On-Write File Systems - <AUTHOR> http://louwrentius.com/the-sorry-state-of-cow-file-systems.html <comment><USER3> Discussion from 6 months ago:

[https://news.ycombinator.com/item?id=9128404](https://news.ycombinator.com/item?id=9128404)

</comment><comment><USER4> Someone should write an article on the sorry state of file system in general. ZFS and BTRFS are improvements, though still not quite there yet. But distance between user and storage still seems vast and primitive. Perhaps Seagates Kinetic drives are the future we need? ([http://www.seagate.com/tech- insights/kinetic-vision-how-seag...](http://www.seagate.com/tech- insights/kinetic-vision-how-seagate-new-developer-tools-meets-the-needs-of- cloud-storage-platforms-master-ti/))

</comment><comment><USER5> Translation: "ZFS and btrfs are 'incomplete' because their handling of striped RAID is incomplete."

Disregarding the fact that things like mdadm still exist, and _further_ disregarding the fact that the vast majority of filesystems out there don't bother with trying to implement RAID at all (probably because - again - <USER2> are things like mdadm that do that already), RAID5/6 are generally a bad idea compared to a RAID1 or RAID10. Both RAID5 and RAID6 make multiple _very_ incorrect assumptions:

* Failure of multiple drives in a short period of time is rare (in reality, if one drive fails (excluding bathtub-curve-related infant mortality), the likelihood of subsequent drive failures increases significantly)

* The failed drive can be replaced and repopulated quickly (in reality, this is becoming less and less true as drives get bigger and bigger, thus taking more and more time to rebuild the failed array member; SSDs buy some time here, but that's not sustainable)

* Bit rot / "cosmic rays" are rare (in reality, silent data errors happen all the time, as has been demonstrated [0] as an example of why RAID5/6 is woefully insufficient for even the most basic protection against data corruption)

Basically, if you want something striping, and care _at all_ about data integrity, go with RAID10. Only use RAID5/6 if you don't care about data loss (whether due to a comprehensive backup policy or a comprehensive redundancy policy on a machine-level), though in that case you might as well just cut to the chase and use RAID0.

I really wish this article would've dug into some of the _real_ shortcomings of these filesystems; btrfs in particular would be incredibly useful compared to a more traditional LVM approach if it supported file encryption and swap subvolumes (for either of these things, LVM (+ LUKS for encryption) is necessary with or without btrfs). Instead they get criticized over not supporting things that a sane sysadmin wouldn't touch with a ten-foot pole in this day and age.

[0]: [http://www.miracleas.com/BAARF/Why_RAID5_is_bad_news.pdf](http://www.miracleas.com/BAARF/Why_RAID5_is_bad_news.pdf)

<comment><USER6> _> Basically, if you want something striping, and care at all about data integrity, go with RAID10. Only use RAID5/6 if you don't care about data loss (whether due to a comprehensive backup policy or a comprehensive redundancy policy on a machine-level), though in that case you might as well just cut to the chase and use RAID0._

Your points are valid but this doesn't follow. RAID10 is strictly worse than RAID6 for redundancy. In a four drive array any two drives can fail with RAID6 whereas with RAID10 2 drives may be enough to blow up half your data. RAID10 is actually a less redundancy but higher performance tradeoff compared to RAID6.

<comment><USER5> I should've clarified that RAID1 is the _absolute_ best if data integrity is your sole concern. Regardless...

> RAID10 is strictly worse than RAID6 for redundancy.

Only if you use two drives per mirror; RAID10's worst-case matches RAID6's when using three disks per mirror.

RAID6 also lacks a "best case" that's distinct from its worst case. You lose three disks, you're hosed, period. You lose three disks in a RAID10 (even one with two disks per mirror), it's much more probable that your data will be intact. You can mitigate this further by using a bigger array (RAID10 total failure probability is affected by array size, unlike RAID6) or by using different vendors for each disk in the mirrors (example: each mirror has one Intel and one Samsung SSD of the same capacity) - which, while having some performance and capacity implications, actually mitigates the "oh no I bought a bad batch of hard drives and now my RAID is kaput" failure case (unlike with RAID6, where mixing/matching vendors won't help you unless you mix/match them for every disk).

There are also some recoverability benefits of RAID10 v. RAID6; notably, recovering from a fault in RAID6 requires recomputing parity, while no such thing is necessary for RAID10. This mitigates the "oh no my array took too long to fix itself and now my RAID is kaput" failure case.

<comment><USER6> _> Only if you use two drives per mirror; RAID10's worst-case matches RAID6's when using three disks per mirror._

That's not a proper comparison as you are now using more disks in the RAID10 array than the RAID6 to get the same space. If you're willing to have 6 disks to get the space of 2 you could use an array with 3 parity disks (what ZFS calls Z3) and now you can fail any 3 disks just like RAID10 and you've only used 5 disks instead of 6. If you have the option for 4 parity disks (I don't think ZFS provides a Z4 level) you could fail any 4 drives of 6 and get the space of 2, so 1 better than RAID10. N-Parity setups are strictly more redundant than RAID10 for the same number of disks and required capacity.

 _> actually mitigates the "oh no I bought a bad batch of hard drives and now my RAID is kaput" failure case (unlike with RAID6, where mixing/matching vendors won't help you unless you mix/match them for every disk)._

This makes no sense to me. I mix and match vendors in RAID6 arrays just fine and it lowers the correlation of failures between disks just as well. In fact parity RAID is again strictly better at this as well. Since the redundancy is across the whole array instead of split into clusters whenever you add more drives from different manufacturers you're adding that redundancy to the whole array. With RAID10 if you have 3 drives per mirror your maximum redundancy before losing data is 3 manufacturers.

 _> There are also some recoverability benefits of RAID10 v. RAID6; notably, recovering from a fault in RAID6 requires recomputing parity, while no such thing is necessary for RAID10. This mitigates the "oh no my array took too long to fix itself and now my RAID is kaput" failure case._

Yeah, performance is the real advantage of RAID10 as I mentioned and indeed that performance can be important during rebuilds so it has some durability implications.

<comment><USER5> > That's not a proper comparison as you are now using more disks in the RAID10 > array than the RAID6 to get the same space.

You already have to use more disks for a RAID10 than in a RAID6, so I don't see why this is that big of a deal. Anything involving mirroring will involve at least a 50% cut in capacity (or more, such as with a 3-way or even 4-way mirror). RAID1 and RAID10 don't prioritize capacity; they prioritize robustness.

> N-Parity setups are strictly more redundant than RAID10 for the same number > of disks and required capacity.

But _not_ more robust against failure, as I've already described (hopefully) rather clearly. If we want to play this game, I can keep adding more disks per mirror, and now my worst-case will match that of your n-parity array while having a _vastly_ better best-case (and, additionally, dragging the probability of that worst-case happening closer and closer to zero). Remember: if you're a RAID1 or RAID10 user who cares about disk capacity, you're doing something wrong.

> I mix and match vendors in RAID6 arrays just fine and it lowers the > correlation of failures between disks just as well.

Do you mix and match all disks, though? Because if you have at least three (in the case of RAID6) disks, no matter where they are in the array, that have the same failure curve (i.e. are the same model/manufacturer), then you're gonna have a bad time when the first one of them dies.

That's my point. In order to get the same inherent benefit as RAID10 here, you'd have to have a different vendor/model for every single drive in your RAID6 array.

> whenever you add more drives from different manufacturers you're adding that > redundancy to the whole array.

Only if they're all different. You'll eventually get to the point where there aren't enough manufacturers in the world (or you'll be compromising on manufacturer diversity - which is, granted, what _most_ people do).

> With RAID10 if you have 3 drives per mirror your maximum redundancy before > losing data is 3 manufacturers.

And that's fine, because if one of those manufacturers sold me a defective batch, the problem's isolated to that side of the mirror. That's my point; with RAID10, it's no longer a game of sheer numbers of different models and manufacturers, but instead the more manageable strategy of giving each side of the mirror a different bathtub curve to ride, thus mitigating the chance of multiple hard drive batches failing at the same time.

<comment><USER6> _> You already have to use more disks for a RAID10 than in a RAID6, so I don't see why this is that big of a deal._

Not really. RAID6 and RAID10 are only directly comparable at 4 disks as they have the same capacity with the same number of disks. And in that case RAID6 is strictly better than RAID10 (any 2 disks can fail vs at best 2 disks can fail).

 _> But not more robust against failure, as I've already described (hopefully) rather clearly. If we want to play this game, I can keep adding more disks per mirror, and now my worst-case will match that of your n-parity array while having a vastly better best-case_

This is simply not true. An n-parity array will always be strictly (and I mean strictly) more redundant than the equivalent RAID array. For 6 disks this means using 4 parity disks which allows failing any 4 disks which is RAID10's best case but better than it's worst case (any 2 disks can fail). If you go for 8 disks RAID10 allows a best case where 6 disks can fail which with a 6-parity raid is your normal case, and so on. Parity is strictly better than mirroring at redundancy its just usually not worth it for performance reasons. At the file level it may make sense though (Backblaze does file level 3-parity for example) as you can choose to take the hit only on certain files. Brtfs also allows per-file raid levels so it's too bad they're not pursuing that external patch for n-parity raid levels that the original article mentions.

(skipped some parts as the core of the issue is below)

 _> And that's fine, because if one of those manufacturers sold me a defective batch, the problem's isolated to that side of the mirror. That's my point; with RAID10, it's no longer a game of sheer numbers of different models and manufacturers, but instead the more manageable strategy of giving each side of the mirror a different bathtub curve to ride, thus mitigating the chance of multiple hard drive batches failing at the same time._

This is not a RAID10 advantage it's a way to mitigate the RAID10 disadvantage compared to parity. Parity RAID with the same capacity/number of disks can survive more disk failures than RAID10 (as I explained above). In both cases you want the pool of N disks to be as diversified as possible to avoid correlation between failures. Parity exploits that lack of correlation completely (any disk failure is just like any other, it doesn't matter which disk is which) whereas RAID10 will blow up earlier if all disks in one side fail at once so you mitigate that by making the two sides different.

<comment><USER5> > RAID6 and RAID10 are only directly comparable at 4 disks

They're really not _ever_ directly comparable, because RAID10 isn't a hard- and-fast RAID level like RAID6, but rather the combination of two (really, one plus a quasi-level, but whatever). RAID10 encapulates any situation where mirrors are striped together.

> For 6 disks this means using 4 parity disks which allows failing any 4 disks > which is RAID10's best case but better than it's worst case (any 2 disks can > fail).

You're getting caught up on redundancy for a given total number of disks, and in the process missing the point entirely. If we _really_ want to play that game, then I'll just roll a RAID1 (a.k.a. a RAID10 with only one set of mirrors) and call it a day, because with a n-disk array, a RAID1 will _always_ be at least as redundant as the equivalent parity-based RAID (really, it'll always be able to survive one more disk failure than an n-1 parity-block array; you can see this rather easily when comparing RAID5 with a three-way RAID1).

From there, my point should be more clear. Just like how you can constantly add more and more parity blocks (and disks to handle them), I can constantly widen the mirror. Eventually we'll both get to the point where we realize "what the hell are we doing; there's 100 copies of every block; we should start adding some more non-redundancy disks", at which point RAID10's advantages become more clear, since each mirror group added to the striped whole instantly bumps up capacity _and_ the best-case without compromising the worst-case. Meanwhile, you _do_ have the advantage of having more flexibility in the quantity of disks added, but doing so doesn't help your best-case unless you feel like resuming the whole "let's make every disk a parity or mirror disk" arms race.

And before you mention it: yes, I know RAID1 isn't _traditionally_ counted under RAID10, but a RAID10 with only one mirror group is possible to configure using tools like `mdadm`, and while this wouldn't _look_ different from a RAID1 at first glance, it would certainly be different as soon as more mirror groups are added.

> Parity is strictly better than mirroring at redundancy

I think this remark is the core of your misunderstanding here. Are you really trying to claim than an n-sized parity array with n-1 parity blocks is _better_ than a RAID1? You might want to clarify your position there if that's not what you meant to suggest :)

> Parity exploits that lack of correlation completely (any disk failure is > just like any other, it doesn't matter which disk is which)

Which is exactly why you're incorrect. Since any disk failure is like any other, every single disk has to be unique in order for a parity-based array to benefit from any diversity. With mirroring, you don't have to go nearly as far for that same benefit; you just need _each mirror_ to have a different bathtub curve. That's my point.

\--

This has been a fun discussion, and there is certainly lots of room for debate on the merits of mirroring v. parity, but I'm starting to think that we should just agree to disagree on this one.

<comment><USER6> _> You're getting caught up on redundancy for a given total number of disks, and in the process missing the point entirely._

That is the only point. Let me state it like this: you have N disks of which you want to get M capacity out of (M < N), what's the RAID configuration that maximizes redundancy. My assertion is that parity raid is strictly better than RAID10 at doing that, you haven't really refuted it.

 _> From there, my point should be more clear. Just like how you can constantly add more and more parity blocks (and disks to handle them), I can constantly widen the mirror. _

Of course you can, and for any given number of disks you'll always be behind on redundancy. You can of course just throw more hardware at the problem and if your choices are between RAID6 (2-parity) and RAID10 then RAID10 eventually wins because you need more parity disks than RAID6 provides to take advantage of the extra hardware. Since most block RAID implementations only do 2 or at most 3-parity, RAID10 ends up being the only practical solution for lots of disks. But for a 4 or 5 disk setup (most NAS applications for example) RAID6 or ZFS 3-parity support is a better choice if the performance tradeoff is workable (as it is in most NAS).

 _> because with a n-disk array, a RAID1 will always be at least as redundant as the equivalent parity-based RAID _

This is a red herring, yes there is the lower bound of no implementation with N disks can survive the loss of all N disks, and if you want the space of only a single disk RAID1 of N disks is the obvious choice.

 _(really, it 'll always be able to survive one more disk failure than an n-1 parity-block array; you can see this rather easily when comparing RAID5 with a three-way RAID1)._

This is again wrong. A 3 disk RAID1 has the size of 1 disk and a 3 disk RAID5 has the size of 2 disks so they're not the same. To make it comparable you need to make the array RAID6 at which point you have the same space and redundancy. You'd still do a RAID1 though as for the 1 disk size case there is no added benefit of parity.

 _> RAID10's advantages become more clear, since each mirror group added to the striped whole instantly bumps up capacity and the best-case without compromising the worst-case. Meanwhile, you do have the advantage of having more flexibility in the quantity of disks added, but doing so doesn't help your best-case unless you feel like resuming the whole "let's make every disk a parity or mirror disk" arms race._

This is missing the point entirely. The parity normal case is the same as the RAID10 best case and better than the worst case. There's no real way around that.

 _> Which is exactly why you're incorrect. Since any disk failure is like any other, every single disk has to be unique in order for a parity-based array to benefit from any diversity_

This is just not true. Having diversity means that failures become uncorrelated. Parity RAID explores that even better than RAID10. The property you keep bringing up is basically saying "since RAID10 has worse redundancy than n-parity it benefits more from uncorrelated disk failures" which is true but only by partially mitigating a problem that parity RAID doesn't have.

 _> This has been a fun discussion, and there is certainly lots of room for debate on the merits of mirroring v. parity, but I'm starting to think that we should just agree to disagree on this one._

I think that by now I've explained my point clearly enough and even repeated myself a bit so yeah, I'll drop it here.

<comment><USER5> Sorry, I promised I'd let us agree to disagree, and I will after this, but I just can't help myself on this one point:

> This is again wrong. A 3 disk RAID1 has the size of 1 disk and a 3 disk > RAID5 has the size of 2 disks so they're not the same. To make it comparable > you need to make the array RAID6 at which point you have the same space and > redundancy. You'd still do a RAID1 though as for the 1 disk size case there > is no added benefit of parity.

Pardon, but _what_?

Think about this for a second.

For one, now you're moving the goalpost by shifting gears to disk capacity alone (which, as I've mentioned repeatedly, is a non-factor if you're considering anything mirror-based). _With the same number of disks_ , mirroring always beats parity in a RAID. There's no getting around that.

Don't believe me? Take those four disks (you need four at minimum) in your RAID6. Your array can survive two disk failures. Now I build a RAID1 with four disks. Mine can survive three disk failures. Yes, there's a capacity hit, but it's been _repeatedly_ established that it's not _capacity_ that matters.

This still holds true when comparing a three-disk RAID5 and a three-disk RAID1. This still holds true when comparing _any_ n-disk n-1-parity-block array with _any_ n-disk RAID1 with the same value of n.

Your points are much more valid when they're targeted at RAID10 instead of the concept of mirroring in general.

<comment><USER6> I've explained all this so there's nothing new here at all. I'll try again if it helps.

 _> Don't believe me? Take those four disks (you need four at minimum) in your RAID6. Your array can survive two disk failures. Now I build a RAID1 with four disks. Mine can survive three disk failures._

Apples and oranges again...

 _> Yes, there's a capacity hit, but it's been repeatedly established that it's not capacity that matters._

This is not established. This is something you keep saying but makes no sense. My NAS has 4 2TB disks, I've configured it as RAID6 for 4TB of space where any two disks can fail. RAID10 is strictly inferior to that and RAID1 would only give me 2TB of space which is not enough for me. This result is generalizable. For a given number of disks and a given target array usable size the n-parity RAID configuration always has superior redundancy to the RAID10 configuration, there's no way around that.

 _> Your points are much more valid when they're targeted at RAID10 instead of the concept of mirroring in general._

My points have always been about RAID10 and not RAID1. If RAID1 is enough that's always the better option as obviously it's not possible to improve on "you have N disks and N-1 of them can fail".

Note that's also the reason RAID5 implementations are limited to 3 disks minimum and RAID6 to 4 disks minimum. In theory you could configure a RAID5 with 2 (1+1parity) and a RAID6 with 3 (1+2parity) but since it doesn't make sense to calculate parity of a single disk that just ends up meaning RAID1.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> People who use filesystems like this seem to completely misunderstand what RAID is for. They seem to care about their data somewhat, which of course means they have off-site backups.

Given that they have reliable backups, redundancy is only useful to the extent that it improves uptime. Uptime is best maintained by eliminating single points of failure. Raid is a good first step, but at some point, creating a massive disk array on a single motherboard/cpu/disk-controller is anything but that. And they don't seem to be complaining of downtime.

Given that they have already achieved data safety, and don't care about uptime, the only reasonable explanation I can surmise is that they're confused.

<comment><USER3> In your opinion, what is the best way to address the use case of spreading I/O across multiple spindles for non-uptime-related performance reasons?

<comment><USER8> Who even cares about spindles anymore?

Need fast? SSD on the PCI bus. Need lots of storage? Spinning disk where you care not about performance.

<comment><USER9> > Who even cares about spindles anymore?

Folks who have a _shitload_ of data to store, but want more perf than a single drive can give them?

</comment></comment></comment></comment><comment><USER4> Wonder if anyone has ever thought about building a SQL server directly in a hard drive?

<comment><USER10> I think more interesting question would be if anyone has build practical userland on top of SQL (or any reasonably rich database for that matter).

Here is some discussion about SQL on raw devices: [http://dba.stackexchange.com/questions/80036/is-there-a- way-...](http://dba.stackexchange.com/questions/80036/is-there-a-way-to-store- a-postgresql-database-directly-on-a-block-device-not-fi)

<comment><USER11> The Newton skipped SQL but had an object database with queries.

</comment></comment></comment><comment><USER12> Isn't COW a fundamentally hard problem? How does one expect a complete, comprehensive solution?

</comment><comment><USER13> s/tripple/triple/g</comment>


Show HN: Words for Chrome – Smarter, safer web comments - <AUTHOR> http://www.words4chrome.com/what-is-words/

<comment><USER2> Cool, I've thought about something like this for ages, but lazy always prevails. The only thing I don't really agree with is:

"Let's face it. One major problem with embedded web comments is that everyone is invited to participate. They're too open.

The WORDS community, on the other hand, is necessarily comprised of people who (a) use Chrome and (b) desire a better commenting experience. Why else would they have installed WORDS?"

That's true for now, but any system that gains any amount of steam will inevitably pick up trolls, flamers, and generally idiotic people. You can't stop it from happening. And I don't know that anyone has ever found a good solution for it. In fact, the whole 'Top Comments' and up/down-voting thing most third-party comment widgets employ is literally to combat that problem, in the hopes that garbage falls to the bottom. It obviously doesn't work perfectly and I do still agree on the whole with your assertion of it being overall detrimental to good discussion.

Anyway, I'm guess I'm mostly curious if you have plans for the future of if/when the extension gets more popular and you do start finding discussions bogged down by trolls/spammers/etc and what ways you'd try and combat such things when you have 100k+ users or whatever.

<comment><AUTHOR> Thanks for the thoughtful feedback.

One of the problems with other commenting systems is what I call The Clean Slate Effect. If a troll is sucky on site A, then goes to site B, they start over with a clean slate and can continue being sucky.

Words benefits from the fact that it's web-Wide. If a user is terrible, they get silenced _everywhere_.

You're totally right (as was Paul Graham when he spoke about how Hacker News is evolving) that these sorts of systems get worse the larger they get. And that getting too big too fast is definitely a bad thing. Just look at Digg.

So I definitely anticipate badness down the road, but feel the code foundation is there to deal with it as it comes.

<comment><USER3> > these sorts of systems get worse the larger they get. And that getting too > big too fast is definitely a bad thing

I was thinking about it - why not add a view mode displaying only the comments of the early adopters? On reddit, for example, it would be interesting to see only comments of users with accounts 5+ years old.

<comment><USER4> Gawker's network effectively does that by focusing on only Featured Comments when you scroll down and making you click through to the plebs.

</comment></comment></comment></comment><comment><USER5> [http://viewsourcecode.org/why/redhanded/images/hoodblink.gif](http://viewsourcecode.org/why/redhanded/images/hoodblink.gif)

I miss _why.

<comment><USER6> for those who don't get this: hoodwink'd[0][1] was this experiment/hack/art project by _why some years ago, which allowed implementing a parallel unified commenting system for the web.

It was super cool because you'd go to, say, hackernews or slashdot and if you were part of the network you'd get access to a different set of comments, but integrated in the website rather than as an external popup (individual sets of stylesheets+js had to be written for each website of course).

For example, here you'd get the blinking hood gif, and on click you'd see new comment threads appearing with red usernames. Integration came through, iirc, a custom proxy server or a greasemonkey script.

It was super cool.

[0] [https://github.com/whymirror/hoodwinkd](https://github.com/whymirror/hoodwinkd) [1] [http://ecmanaut.blogspot.hu/2006/01/hoodwinkd.html](http://ecmanaut.blogspot.hu/2006/01/hoodwinkd.html)

<comment><USER5> Nice explanation. (:

</comment></comment></comment><comment><USER7> Consider removing the downvotes? Keep only the upvotes?

Downvoting IMO feels bad for the poster. They stop feeling like participating. They might have very good and insightful posts which might not be popular. The downvotes end up driving them away and all you're left with is an echo chamber of groupthink

<comment><USER8> As someone who's received a nontrivial amount of downvotes in this community and others, I can confidently say that I appreciate them as a mechanism. Almost every downvote that I've received was for a legitimate reason - a few were just out of disagreement, but that's the exception rather than the rule.

In a way, it does create an echo chamber: when the community consistently downvotes things that don't conform to X (in HN's case, X usually being "well- reasoned commentary relevant to the thread"), people tend to shy away from those things. One could consider the utter lack of response gifs on HN "groupthink", in the sense that everyone knows the community is unfriendly to them so they don't post them (even when they're funny).

<comment><USER9> A well-organized hate group can use downvotes to silence reasonable discourse and trumpet their ideology, so it looks like the popular opinion when it's nothing of the sort.

You see this happen on Reddit. A hate group called SRS does it. They've even been leaking onto Hacker News recently, with some of the same lines they regularly use.

<comment><USER8> Wow, that's really disheartening to hear. I've personally never seen that around here (thankfully), but now that I'm over my minor obsession with Dogecoin I don't spend much time on Reddit.

</comment></comment></comment></comment><comment><USER10> This is very sketchy. When I try to login with Facebook, it shows me chromless modal window with (what appears to be) a facebook login page. Except that I'm already currently logged in to facebook so this shouldn't be necessary. Sorry, I'm not going to hand you that info.

<comment><USER11> The Google login window seems to be safe, but I'm intrigued about the how and the why.

</comment></comment><comment><USER12> Is there way to register without Google or Facebook account?

<comment><AUTHOR> No. See my dissertation about it here:

[http://www.words4chrome.com/2014/about-words-login- options-a...](http://www.words4chrome.com/2014/about-words-login-options-and- privacy/)

<comment><USER13> That doesn't explain _why_ it doesn't have a native log-in, though ( even though the preamble says it will ), or support a general protocol such as OpenID.

<comment><AUTHOR> Here you go.

[http://www.words4chrome.com/design- choices/#nonative](http://www.words4chrome.com/design-choices/#nonative)

</comment></comment></comment></comment><comment><AUTHOR> This is my 4-year, off-and-on passion project. All suggestions and feedback are appreciated. I'd especially welcome product/feature-based ideas about how to overcome the enormous cold-start hurdle.

Note: Re-posted with permission from Dan. Last week's post got dinged by a semi-false-positive algorithmic penalty after only a few minutes.

<comment><USER14> Ok, so if I understand this correctly, in order to be certain I'm not tracked, I need to host my own back-end server? And the server stores the comments? And if I'm hosting my own server, I'm likely to end up talking mostly with those that sign up with "my" version of this? And if I want it to work in eg: Firefox I'd have to port it? Finally, wrt. tracking -- if the comments are stored on the server (and that's a REST service or something like it) -- wouldn't it be trivial to log activity at the routing level (eg: ha- proxy/nginx/other front-facing web server)?

This isn't meant as negative criticism, just trying to figure out if I've understood how it works correctly? (Note, I appreciate that the source is available, but obviously I can't know that the source you share is the source you run on your back-end. So we're back to trust, which is fine in my book).

[edit: re other clients -- the most straightforward thing to do would be to make an iframe(or js)-based proxy service (a la stumble upon) in order to enable any browser, I suppose?

I've thought about something similar, and I wonder if an XMPP back-end with one "room" pr url and the server-side log-extension might work? That should then make it trivial (unnecessary!) to enable better clients than web-only -- ie use a command line xmpp client to participate in the discussion, rather than forcing the use of the web browser. I realise many people think using the web browser is an advantage -- I generally find GUIs built on top of browsers to be slow and not very efficient. Extensions less so -- but the problem is of course that you'd have to port to Firefox, Opera, Webkit and IE (along with mobile variants) -- to achieve parity with systems like disqus etc]

<comment><USER15> The problem with XMPP rooms is that if you can connect to them with a chat client, people start using them like a chat client. Which is not necessarily what you want.

<comment><USER14> A valid point, but it's generally what _I_ want :-) Well, at least as long as I can create the right kind of echo-chamber of like-minded people... ;-)

Perhaps XMPP+Server Log extension+rate limiting?

The inability to edit messages might be a worse strike against using (a not too heavily modified) XMPP server, though.

</comment></comment></comment></comment><comment><USER16> This reminds me of a product from the 90's where it let you leave post-it style notes on any website. You could then turn the nodes on/off for any given site.

Anyway, that was a great product, so I'm glad to see that you're thinking around similar lines. A meta-commenting system that runs any site is a great idea.

</comment><comment><USER17> The Google login is a bit too disconcerting for my liking. At the very least showing the url bar would've have been less unsettling.

Only by opening the chrome inspector was I able to verify that it was indeed a valid login page and not a phising attempt as it appears to be at a cursory glance.

</comment><comment><USER18> @fiveogit: Love the idea. Need to be prettified though. How would I see comments on mobile devices or non chrome browsers? Can I inject with JS into my website? That was some of my first thoughts :)

<comment><USER19> Exactly my thoughts. I use Chrome at home while I can't get around Firefox at my workplace - is there any way to at least fetch the comments by different means?

</comment></comment><comment><USER20> From a skim of the source, this extension appears to ship every URL you visit to a third party. (It does so to fetch the comment count on the current URL.)

<comment><AUTHOR> The backend code is open source and available here:

[https://github.com/fivedogit/words- backend](https://github.com/fivedogit/words-backend)

The URL is required to retrieve the proper comment thread for that page, but is never associated with the current user.

Look for the line "else if (method.equals("getThread"))" in co.ords.w.Endpoint.java and you can follow the url variable from there.

</comment></comment><comment><USER21> I like the idea though I'm on opera.

Edit: oh and it requires google login. No thanks.

<comment><AUTHOR> Here is my answer to the Google/Facebook login question:

[http://www.words4chrome.com/2014/about-words-login- options-a...](http://www.words4chrome.com/2014/about-words-login-options-and- privacy/)

and

[http://www.words4chrome.com/design- choices/#nonative](http://www.words4chrome.com/design-choices/#nonative)

Even though there is no privacy downside, people are still afraid of Google and Facebook logins. I guess there's no way to change that perception.

Just out of curiosity, you and several others have singled out Google, not Facebook, for criticism re: the login. Why?

</comment></comment><comment><USER22> Good luck getting traction. The web is littered with the corpses of "comment on any website" apps. The problem is that there are too many websites and too many incompatible "comment on any website" standards for any one of them to emerge as a clear leader.

P.S. You list non-tracking as a differentiating feature, but how do you silence speech you don't like without tracking users?

<comment><USER23> W3C is tackling the compatibility issue.

[http://www.w3.org/2014/04/annotation/](http://www.w3.org/2014/04/annotation/)

[https://hypothes.is/blog/peer-review- annotation/](https://hypothes.is/blog/peer-review-annotation/)

<comment><USER24> Listen to Walter, you don't want to be an island of comments in this case. Following annotation standards will allow this content to be gathered and reused elsewhere, for things like fact extraction, sentiment analysis, meta- discussion, +++, it will also allow others to immortalise your content if you happen to fail.

On the other hand, maybe that's exactly what you don't want. My personal pet peeve is comments on scientific papers, where openness of this content is not only desired, it's crucial. Your situation might be different.</comment></comment></comment>


Test Driven Development (TDD): Example Walkthrough - <AUTHOR> http://technologyconversations.com/2013/12/20/test-driven-development-tdd-example-walkthrough/ <comment><USER2> As is often the case, when I read TDD walkthroughs, I see differences between the design, as implied by the tests, and implementation.

Consider requirement 2, which is "For an empty string the method will return 0"

One of the code changes was from:

        for (String number : numbersArray) {
            Integer.parseInt(number); // If it is not a number, parseInt will throw an exception
        }

to:

        for (String number : numbersArray) {
            if (!number.isEmpty()) {
                Integer.parseInt(number);
            }
        }

Oddly, the commentary doesn't even remark on this change, saying only "All there was to do to make this test pass was to change the return method from void to int and end it with returning zero." This is incorrect.

Certainly the code passes the test. But as a consequence, the input ",5" is now acceptable, and will equal 5. Since the spec doesn't define what a number is, one can argue that it's reasonable that "," means 0. I disagree with that judgement, or rather, I'll instead argue that "one,two" should give 3, since "one" is certainly a number. ;)

That's okay. Ambiguities happen all the time. Either the spec needs to change, or a test need to note that it's made an implementation-specific choice not guided by the spec.

But it still requires analysis to determine the impact on the overall goals, and that analysis is often missing from the TDD walkthroughs I've read.

The problem comes when this code is put into use. This change will also accept " 3, 1" as input, which might happen if someone used a "%3d,%5d" as a format string. Other code will start depending on this undocumented implementation- specific feature. The future developer who comes in, refactors the code, finds that it passes all the old tests, will be annoyed to find that it fails during integration or deployment.</comment>


Node.js, a popular tool for building modern internet services, has split in two - <AUTHOR> http://www.wired.com/2014/12/io-js/?hn <comment><USER2>
        >Node was created by software developer Ryan Dahl
        as a way of building and running entire online applications
        with JavaScript—the standard programming language for writing
        code that runs in your browser.

Really? I thought that they intentionally choose javascript because it doesn't have any features like threading.

       > The massively popular programming framework Ruby on Rails,
       for instance, is still sponsored by its creator, a company called Basecamp.

Basecamp isn't happy to the direction that ruby on rails is going, but they accept it. [1]

[1]: [https://www.youtube.com/watch?v=lBfVxBj61z0&feature=youtu.be...](https://www.youtube.com/watch?v=lBfVxBj61z0&feature=youtu.be&t=11m13s)

<comment><USER3> It's a widely held misconception that JS doesn't have threading. User code executes in a single thread, but asynchronous tasks are managed by a thread pool (libuv in node). Because the multi-threading is hidden with asynchronous calls, the user doesn't need to worry about it, which is why many people say JS is single-threaded. In fact worker threads execute async tasks behind the scenes; it's a very nice feature of the event-loop architecture.

<comment><USER4> You may be speaking of a particular implementation or engine. JS, the language, has no such concept of a "thread". The standard describes execution of a valid program as linear. Libraries may add functions such as event listeners or threading or sockets, but these are not part of the language.

And yes, to be pedantic, by JS I'm refering to ECMAScript, or ECMA-262. If by JS you mean JavaScript the implementation by Mozilla, then Node doesn't use that anyway :p

<comment><USER5> Well, there are Web Workers, which are basically threads. [http://www.html5rocks.com/en/tutorials/workers/basics/](http://www.html5rocks.com/en/tutorials/workers/basics/)

But it appears that it's part of the WHATWG HTML spec rather than ECMAScript, which is a bit weird.

<comment><USER6> Web Workers are closer to "processes" in the Erlang sense of the term. They're walled off fairly extensively from the rest of the JS runtime that spawned them because that is pretty much the only good way to backport threading onto a language that wasn't designed with it in mind from the beginning.

Languages like C which had them bodged on years later, well, I'd call that a _bad_ way to do it. It worked for the time but there's a reason why we are all fleeing that implementation of threading and it still stains the entire idea of "multithreading" decades later.

If JS is _ever_ going to get threading, the best case scenario is for it to look like Perl or PHP's efforts... years and _years_ of implementation work to get to something that pretty much everybody recommends you still just stay away from. And Perl and PHP were trying to integrate threading into just one runtime each, and without a browser connected at the hip with its own ideas about threading embedded into decades of code. I would not hold your breath for "true" JS threads anytime soon.

</comment></comment></comment></comment></comment><comment><USER7> I think the intersection of politics and internet is interesting. I write about it quite a bit on my blog, as well as here: [http://qbix.com/blog/index.php/2013/04/a-new-kind-of- platfor...](http://qbix.com/blog/index.php/2013/04/a-new-kind-of-platform/)

In this case, we see sort of an "arab spring" of open source projects lately. Consider MySQL after it was bought by Oracle, and then the MariaDB fork was born. Now we have Node.js and Docker being forked. Until now, most successful communities have been monarchies or oligarchies, whether it was Linux or Python. Corporate sponsorship played a big role. But if more headless or democratic communities succeed, it will be interesting to watch. PHP is an example of a more headless community, and it used to be all over the place.

There are two ways politics and internet interact. One way is how the tools we use affect our society in meatspace and the other is how we organize online in cyberspace.

<comment><USER8> This is more about how, for many companies, the OSS doctrine that they espouse doesn't really jive with their need for profitability.

In the long run, they need to make decisions for the company that are not in the best interest of the project, and either the project dies or is forked or abandoned.

Sun did really well by the OSS community for a very long time, but they had nothing to show for it and Oracle has since foisted a lot of their efforts on to the ASF. LibreOffice, hhvm, Mint, just to name a few, have all come about because the companies responsible for the stewardship of a project weren't doing their duty in the eyes of the community. I honestly think we're going to see a Firefox fork in the next 2-3 years.

It's just the nature of OSS and while it means that, long-term, fewer companies will invest in the space, the companies that do invest will do it for the right reasons.

<comment><USER9> > I honestly think we're going to see a Firefox fork in the next 2-3 years.

There are already semi-forks (downstream distributions that continue to pull from upstream and are mostly synced, but also maintain distinct and divergent feature sets) -- both GNU IceCat is an example (Debian Iceweasel I think is less so, because IIRC it is synced but for branding with upstream.)

<comment><USER10> [https://www.waterfoxproject.org/](https://www.waterfoxproject.org/) as well -- a 64 bit version.

<comment><USER11> And another, Pale Moon: [http://www.palemoon.org/](http://www.palemoon.org/)

</comment></comment></comment></comment></comment><comment><USER12> > Future of Popular Coding Tool in Doubt After It Splits in Two

Are there convincing number of examples of very popular projects being forked and both ends being discontinued, or is this just a typical example of spreading FUD?

Forking is a natural process in the open-source world.

<comment><USER13> But it's true that Node is losing traction.

<comment><USER14> I see this more as a return to reality from Node.js's astronomical levels of hype.

The use cases for a single-threaded web server are specific and limited in the real world. Node.js will continue to solve those use cases (simple web server for static content or I/O bound apps) but the resultant decline will lead some to believe that the framework is dying.

<comment><USER15> Perhaps you could name some website/app servers that aren't mostly i/o (or event-timing) bound? I wouldn't say the use cases are limited at all.

You can always run multiple process instances, and communication between processes isn't really so different in practice than inter-server communication... Which just means you are scaling horizontally by design earlier in development.

<comment><USER14> I worked on some web-based project management software which was highly CPU- bound.

A typical scenario would be the application querying a database for financial figures, doing a large amount of calculations on those figures and then generating an HTML report from them. I imagine any application with large amounts of business logic like this will be the same.

<comment><USER16> Could you describe the sorts of calculations those were? Are these regressions or similar? Do PMs really look at that sort of thing? Maybe they were basing a TSP on the latest financial figures? b^)

It seems possible that was a mostly IO-bound system, and the things which could have been conceivably CPU-bound should just have been batched and cached.

</comment></comment></comment></comment></comment></comment><comment><USER17> Ben Noordhuis, the center of the Node.js pronoun scandal [1] and one of the founders of Strongloop, has activity in IO.js more recent than his activity in Node.js.

I can't help but wonder how much of this is a power struggle between Strongloop and Joyent.

[https://www.joyent.com/blog/the-power-of-a- pronoun](https://www.joyent.com/blog/the-power-of-a-pronoun)

<comment><USER18> Off topic, I guess, but color me unimpressed by the guy claiming he would fire someone for rejecting a pull request that does nothing but advance a political agenda.

<comment><USER19> Color me impressed, because the political agenda that's being advanced is gender equality in technology, which to me seems pretty worthy.

<comment><USER20> Problem with that situation was that the Joyent guy was commenting on Noordhuis, an employee of a direct competitor to Joyent. So to many it came off as political opportunism to screw with Strongloop and not a sincere evaluation of the situation.

</comment></comment></comment></comment><comment><USER21> There is a big advantage to node.js that used to be mentioned a lot in its early days, but not much now. The advantage is still there, but it's only noticeable if a developer has experience in other server languages. The big advantage is that node.js had an asynchronous development model from the beginning. This caused all the code written since then to also be written using async. When a node.js project imports other libraries through npm, there is no need to worry about some random synchronous code blocking. All code is written using async because that's the way it was enforced from the beginning.

This is an advantage it shares with other new languages like Go that had good concurrency support from the start. Go has the same advantage with goroutines. All code written by the community since then uses goroutines.

Compare this to python and java which had better concurrency bolted on long after those languages were released. Twisted is basically node.js for python and it existed for a long time before node.js. But one of the main problems with Twisted is that all other existing python code is not written in an async way. A python dev could use Twisted, but as soon as they get some useful library form PIP, it's probably going to block and ruin the whole async.

Java has a similar issue. It was released with heavy threads as the only way to handle concurrency. There have been attempts to try to bolt on async and lightweight thread models. But there is a massive existing ecosystem of java code. None of that will work well with async and no one can rewrite all of it to use some new lightweight thread model.

This is the advantage of a fresh start like node.js or Go. Wheels will be reinvented, but it will have improvements that can't just be bolted on later.

The biggest flaw with node.js right now is that it came too early. If it came out with ES6, it would be a much better ecosystem. If generators/yield had existed from the start, all the callback mess could've been avoided. However, although the callbacks were an unavoidable mess, it did fundamentally force async on the ecosystem. NPM libraries like co show a migration path to the generators/yield future for older node.js code. The IO.js fork should use this opportunity to put something like the co library into core and push generators/yield as the way forward. If Joyent was the cause of the delayed generators/yield support, then they have done great damage to the node.js ecosystem. Node.js should've heavily promoted generator/yield use as soon as it was in V8, not hide it behind a --harmony flag for over a year.

<comment><USER22> Great comment - I do think the whole 'async by default' is a huge benefit, but I would add an asterisk and say you can technically write a module that performs synchronous I/O if you wanted to (see, for example, synchronous filesystem calls). So there's a possibility some random synchronous code blocking could happen with an untrusted module, albeit very unlikely. As far as I know the fs.*FileSync calls are the only ones.

</comment></comment><comment><USER23> If Node forks, does this mean one of the projects will block?

<comment><USER24> No, node.js is event-driven and non-blocking.

<comment><USER25> But there is only a single thread, so io.js will probably hog all the time and effectively block everybody else.

</comment></comment></comment><comment><USER23> How can Node fork? I thought it ran everything in the event loop...

<comment><USER26> I see your bad joke and raise you an example :)

[http://nodejs.org/api/child_process.html#child_process_child...](http://nodejs.org/api/child_process.html#child_process_child_process_fork_modulepath_args_options)

<comment><USER23> Haha! Oh man...

</comment></comment></comment><comment><USER27> The new repository: [https://github.com/iojs/io.js/](https://github.com/iojs/io.js/)

The new contributors: [https://github.com/iojs/io.js/graphs/contributors](https://github.com/iojs/io.js/graphs/contributors)

Joyent really fucked up.

<comment><USER28> The "new contributors" link you provided uses commits from before the fork, so it doesn't really have any information.

<comment><USER29> Do you know who the 4 developers mentioned are? isaacs probably is the NPM one.

</comment></comment></comment><comment><USER30> I think it's great news. Node development has been glacial for a while now. There's an issue where people are sharing logos, [https://github.com/iojs/io.js/issues/37](https://github.com/iojs/io.js/issues/37), highly recommend.

<comment><USER31> Better visualization: [http://tableflip.io:1234/](http://tableflip.io:1234/)

<comment><USER30> Nice link! Check this one instead of mine if you haven't done so.

</comment></comment></comment><comment><USER8> > actually set up this foundation because they're still hoping that Joyent > will let them to use the Node.js trademark.

Is that naivete on the side of Io.js here, or is there more to the story?

<comment><USER32> I'm not sure what you're asking, you left out the key part of the quote:

> the team hasn't actually set up this foundation because they're still hoping > that Joyent will let them to use the Node.js trademark.

Frankly, I kinda like the name Io.js better than Node.js

<comment><USER9> > Frankly, I kinda like the name Io.js better than Node.js

Well, if it was for a project that was implementing Io [0] on top of JavaScript, sure. For a server-side JS stack based on V8, I don't really like the name at all.

[0] [http://iolanguage.org/](http://iolanguage.org/)

</comment></comment></comment><comment><USER33> Here's a take from one of my friends who is a pretty heavy Node developer:

[http://compositecode.com/2014/12/05/im-so-mad-my-response- to...](http://compositecode.com/2014/12/05/im-so-mad-my-response-to-the-fork- of-node-js-to-io-js/)

I'm pretty sure he's right, nothing to freak out about.

</comment><comment><USER10> I believe given the nature of those that forked it, we'll be replacing Node.JS with IO.JS (that is awkward to write) soon in [http://Clara.io](http://Clara.io).

I think that the confusion around Node.JS versus IO.JS will persist for some time though. If I wasn't a regular HN reader, I would have missed this completely.

<comment><USER3> You're not the only one. iojs is already pulling ahead in momentum, fixes, features. Not to mention it has a bazillion logos to choose from haha

<comment><USER34> I must be missing something. What features has io.js added?

</comment></comment></comment><comment><USER35> The community has created a lot of rad logos you can find here: [http://tableflip.io:1234/](http://tableflip.io:1234/)

</comment><comment><USER36> Well now there's a missing consonant in the MEAI stack. Add golang for the IMAGE stack?

<comment><USER37> AIME? ;)

<comment><USER38> Oh I like that- drop the 'E' for express since it's a little redundant and you get "AIM"

<comment><USER39> Hey, that's even in front-to-backend order.

</comment></comment></comment></comment><comment><USER40> Here's your Friday entertainment...

</comment><comment><USER41> The guy squatting on the js.io domain (Michael Carter from Claremont) just bought a yacht.

<comment><USER42> That's ok since internet has been squatting on Javascript for years.</comment></comment>


Scala on LLVM - <AUTHOR> http://greedy.github.io/scala-llvm/

<comment><USER2> Scala can also host the JVM (well, a subset of it, enough to run itself): [https://github.com/lihaoyi/Metascala](https://github.com/lihaoyi/Metascala)

</comment><comment><USER3> [http://www.dzone.com/links/videopresentation_compiling_scala...](http://www.dzone.com/links/videopresentation_compiling_scala_to_llvm_geoffre.html) for a video on the project, explaining the rationale etc by the author.

<comment> iso-8859-1 Not working. This one is, though: [http://www.infoq.com/presentations/Scala- LLVM](http://www.infoq.com/presentations/Scala-LLVM)

</comment></comment><comment><USER4> "This is the paper presented at the Second Scala Workshop to be held at Stanford on June 2nd 2011."

Not a good sign.

</comment><comment><AUTHOR> Note: It seems the author hasn't had time working on this project for the last couple of months. Still, I think it might be interesting for others to know about this project, maybe someone wants to play around with this.

<comment><USER5> Do you know how complete this is at the moment?

<comment><AUTHOR> I haven't tried it myself yet, but I really wish that somebody would continue working on this as I think it is an awesome project. My CS knowledge is not deep enough to work on this myself, I fear. The author wrote this about the project in February (on the mailing list):

"So, it's not dead but there's (currently) noone working on it besides me and my time for it is very limited (to barely more than zero over the last year). I'm hopeful that I'll be able to find more time, hopefully around summer. That said, if anyone is interested in working on it, I'm more than happy to have the help. I do promise to make some time to work with potential contributors, but as you can see my latency can be pretty bad at times. "

And last year in June he wrote this: "Also, most any normal scala program will not work since many parts of the standard library are not compatible yet with LLVM (because of java library dependencies)."

Which probably still stands as there's no way to easily convert the java library to Scala and then to llvm.

<comment><USER6> There is a way to convert Java straight to LLVM. I would guess the developer is already aware of that though

[https://llvm.org/svn/llvm-project/java/trunk/docs/java- front...](https://llvm.org/svn/llvm-project/java/trunk/docs/java-frontend.txt)

<comment><USER7> The LLVM FAQ states, however:

> There is an incomplete version of a Java front end available in the java > module. There is no documentation on this yet so you'll need to download the > code, compile it, and try it.

</comment></comment></comment></comment></comment><comment><USER8> This project is so cool, only Elixir on Xen could be just as cool.

<comment><USER9> There's OCaml on Xen ([http://www.xenproject.org/developers/teams/mirage- os.html](http://www.xenproject.org/developers/teams/mirage-os.html)).

<comment><USER8> Holycrap, exokernel is the most brilliant idea I've heard today. I don't have to mess with sk_buffer anymore!

<comment><USER9> Years ago there was lots of excitement about exokernels coming out of MIT. They haven't gotten anywhere much, yet.

<comment><USER10> Sure they have, you'd just have to look deep inside google to see their influence, probably.

</comment></comment></comment></comment></comment><comment><USER11> Am I missing something about the terminology? This claims to be an "LLVM backend for Scala" which sounds wrong. Perhaps you want a backend that compiles LLVM AST to JVM bytecode. Or perhaps you want a Scala _frontend_ that compiles Scala to LLVM AST.

Unless they really intend to compile LLVM AST into Scala ... and then what?

<comment><USER12> "LLVM backend for the Scala compiler". There ya go, no ambiguity.</comment></comment>


Testing AngularJS with Protractor and Karma – Part 2 - <AUTHOR> http://mherman.org/blog/2015/04/26/testing-angularjs-with-protractor-and-karma-part-2#.VTz7uOYnvPV.hackernews <comment> frido-van-driem I think you wil like this overview as well: [https://angularjs.zeef.com/krishna.srinivasan](https://angularjs.zeef.com/krishna.srinivasan)

<comment><AUTHOR> nice. thanks!</comment></comment>


Should Writing Be an Art or a Career? - <AUTHOR> https://newrepublic.com/article/124463/writing-art-career <comment><USER2> The word "should" shouldn't be applied to the question. Writing words is like writing code: some people are paid to do it, and some do it for fun. Both professionals and hobbyists can create good or bad writing, and they have to be judged case by case.

Like math or woodcarving, writing is a skill which on the most basic level accomplishes a workaday task, and with more sophistication may produce beauty. Maybe all arts are on that spectrum, which starts with necessity and ends with aesthetics.

On the professional side: Writing is commercialized for various purposes. Journalists are paid to convey facts; columnists perform acts of middle-brow cleverness; and novelists arrange words to produce emotions.

All of those products are substitutable goods. Radio, TV and the Internet have left the industries of the written word in ruins. Newspapers, publishing, you name it -- there are no barriers to entry any more. Writing has been largely commodified.

This has a lot of consequences. One is a decline in marketing budgets for new books. Unless a novel is sure to sell, and even then, a publishing house will offload the task of promoting the book to the writer. So half a writer's life will be spent barnstorming from one book-signing to the next.

This is compounded by the networking they must do to land a book deal in the first place. Like startup founders, authors need to make something that people want, and then find a way to distribute it. Networking is all about solving the distribution problem, getting noticed. Nobody else will do it for you...

<comment><USER3> >>> ...then find a way to distribute it. Networking is all about solving the distribution problem, getting noticed.

I'll distribute it. Anyone with an internet connection can put a novel in front of millions rather easily. The problem isn't one of distribution but monetization. Book publishers, like movie studios, know there are only so many dollars to be spent each year on books. So whether a particular book is marketable has as much to do with what else is happening in that market.

Markets can only absorb so many spy thrillers or romantic romps in a given timeframe. Quality is now arguably secondary. If you accept that, then it is not difficult to understand that publishers do not always go with the best book. Instead they turn to reliable sources, especially friends and previous authors. Networking and name recognition become the entire game --> the rise of ghostwriting.

<comment><USER2> It's one thing to publish writing online. It's another to get attention for it. Distribution means getting in front of your audience. Posting on a blog doesn't inherently solve that.

</comment></comment></comment><comment><USER3> >> Novelists have a choice: stay in and write or get out and promote.

Ya um, the term "writing" is broader than writing books. Writing is a career for many, including myself. That doesn't mean we sit in NY brownstones creating an "atmosphere of gloom and misanthropy."

So ... misleading title. Writing is a skill that is an essential part of many careers. It therefore should not be approach as anything less. Writing novels is an art, something that a precious few are good enough to turn into a career but should be approached first as art.

</comment><comment><USER4> "Craft." My favorite word that blows up the art<->career dichotomy.

<comment><USER5> There's a pretty strong tradition of an arts vs. crafts dichotomy though.

Edit: If anything, aren't the traditional dichotomies art vs. craft and career vs. hobby? Typically speaking, it's widely acknowledged that artists have careers.

</comment></comment><comment><USER6> Sir Walter Scott, I believe, said that literature was a good staff but a bad crutch.

<comment><USER2> speaking of whom... have you read this? [http://harpers.org/blog/2007/07/how- walter-scott-started-the...](http://harpers.org/blog/2007/07/how-walter-scott- started-the-american-civil-war/)

<comment><USER7> I doubt it. Read _Albion's Seed_, or _Bound Away: Virginia and the Westward Movement_. The South originates with Virginia, with Jamestown in particular, and thus with the west country of England; it always was a very quasi- medieval, quasi-feudal, aristocratic society. Southerners embraced Scott because they saw their values in him; they didn't change their values because they liked his books.

(One surprising but evidently true thesis of _Albion's Seed_ and _Bound Away_: slavery came first, economic uses for slavery came later. In the Southern aristocrat's estimation, you couldn't be a gentleman without having peasants to tug their forelocks to you -- and free indentured servants proved impossible to keep on the plantation.)

</comment></comment></comment><comment><USER8> Does there have to be a distinction? Why can't it be like Programming, which is regarded as an Art[0], Career and Science.

[0]: [http://www.paulgraham.com/knuth.html](http://www.paulgraham.com/knuth.html)

</comment><comment><USER9> The quality of information you are conveying is often more important than the quality of writing. If you don't have anything to write about, then it doesn't matter how good of a writer you are.

<comment><USER10> Bingo - one of the great insights I had while struggling to become a 'writer' \- and after my mentor / editor continually slashed up my writings. George Orwell, in "Politics and the English Language" even mentions this briefly.

 _What is above all needed is to let the meaning choose the word, and not the other way around. In prose, the worst thing one can do with words is surrender to them. When you think of a concrete object, you think wordlessly, and then, if you want to describe the thing you have been visualising you probably hunt about until you find the exact words that seem to fit it. When you think of something abstract you are more inclined to use words from the start, and unless you make a conscious effort to prevent it, the existing dialect will come rushing in and do the job for you, at the expense of blurring or even changing your meaning. Probably it is better to put off using words as long as possible and get one 's meaning as clear as one can through pictures and sensations. Afterward one can choose — not simply accept — the phrases that will best cover the meaning, and then switch round and decide what impressions one's words are likely to make on another person._ [1]

[1] [http://www.orwell.ru/library/essays/politics/english/e_polit...](http://www.orwell.ru/library/essays/politics/english/e_polit/)

</comment></comment><comment><USER11> While I can't find the video at the moment, one of my favorite writers, Christopher Hitchen's, put it this way, speaking about having been asked the same thing: (and I'm paraphrasing) "A real writer finds that they have no option, that indeed, they _must_ write." or something to that effect. The point being that writing is more of a passion that can turn into art and/or career.

<comment><USER12> I really miss that guy. He was honest in his writing, and in his personal life.

<comment><USER11> Me too. His abrasive style was one of very few writers who inspired me on my Descartes like journey into the rabbit-hole and back out, and I regret not having read his works sooner. The world truly has not yet seen his equal, and suffers for it.

One thing in particular he said that struck me was that one should write as if they were already dead. That is to pull no punches. A great but hard to attain goal.

</comment></comment></comment><comment><USER13> The Internet is wonderful! It democratized publishing - now anyone can put out whatever they want to, and damn the editors! It's wonderful!

Until you realize that you are one of a teeming multitude of people doing the same thing. You can't just post something and have it instantly lauded. Oh, no. You've got to build an audience. You've got to make something interesting enough that your fans tell their friends about it, and some of them become new fans who do the same.

And if you've become your own publisher? Well, you get to learn that there's a lot more to publishing than just putting your stuff in a form people can physically read(/watch/play/etc). There's designing an appealing package for your work. There's distributing your physical product, if you have one.

And there's promotion. Yep. There sure is promotion. Did you know that it often even costs _money?_

You want to get to the point where you can do it as a living? Better learn something about promotion. Nope, it's not what you signed on for. Nope, it's not what you passionately want to be good at. Yeah, it takes time away from improving your craft, and as soon as you can afford it maybe you'll want to find some way to pay someone else to do it so you can get back to making the work. But first you need the money to pay someone to do it for you.

Otherwise? Well, you can live off of someone else's money and wait to be "discovered". Good luck with that.

</comment><comment><USER14> _Novelists have a choice: stay in and write or get out and promote._

Or, with the internets, they can spend a bit of their spare time between deadline crunches and occasional promo trips blogging, tweeting, and answering fan email and blog comments. Or even podcasting or commenting on HN (cstross, e.g.).

</comment><comment><USER15> The implication is that art and career are mutually exclusive, meaning once you become professional, you can't do art anymore. This assumption is not necessarily true.

</comment><comment><USER16> Answer: yes.</comment>


Are thoughts some kind of stochastic process - <AUTHOR>

I personally feel thoughts are some kind of stochastic process but my friend thinks we don't yet have models that can predict our thoughts, seemed a lot more unpredictable before our models got as good as they are today. His claim is given, we know about every atom in our brain, and had a powerful enough computer, we could simulate the actions of every atom. My argument is at atomic level, Heisenberg principle comes into picture and somehow stochastic nature is inbuilt into it. Any thoughts will be very helpful :-) <comment><USER2> _My argument is at atomic level, Heisenberg principle comes into picture and somehow stochastic nature is inbuilt into it._

Your argument applies more to CPUs than brains.

Like with neurons, transistors in a modern CPU signal each other with pulses of charged particles. In both cases, the motion of those messenger particles is stochastic; it is primarily determined by diffusion due to concentration gradients (with transistors, the E-field as _as_ important, but not more). Thermal electrons move a lot faster than small organic molecules, though, so there is correspondingly more quantum uncertainty about their position.

So assuming neurons are what we think with, human thoughts are at least as deterministic as computer calculations.

</comment><comment><USER3> I don't think we know enough about quantum mechanics. My understanding is that right now we model it as random behavior, but we have no real reason to believe its random rather than subject to some other factors that we can't/don't yet measure. (Someone correct me if I'm wrong).

</comment><comment><USER4> That's what the Blue Brain project is currently doing. They are very convinced it's possible, but they are working on a molecular, not atomic level.</comment>


Unpatched US government website gets pwned by pro-Iran script kiddie - <AUTHOR> https://arstechnica.com/information-technology/2020/01/unpatched-us-government-website-gets-pwned-by-pro-iran-script-kiddie/ <comment><USER2> the title made me feel like I was back in 2011</comment>


Ask HN: What's the best programming language for a "business guy" to learn? - <AUTHOR>

<comment><USER2> Java - that way you can write mobile, web and desktop software.

</comment><comment><USER3> What do you want to make?

<comment><USER4> I agree with machrider that it depends on what you want to do with the language. Since you're browsing HN, I assume that the most likely scenario is to create either a website or IOS/Android app.

Website: I would recommend Ruby or Python and the use of <http://learncodethehardway.org/>. Both languages provide low-friction introductions to programming, and have large communities focused on web development.

IOS App: Objective-C is the smoothest choice at the moment, but it (and IOS development in general) have steep learning curves.

Android: Java is the language for you, and there are tons of introductory materials for learning it. But the learning curve here will be fairly steep as well.

Best of luck on your journey!

</comment></comment><comment><USER5> COBOL

</comment><comment><USER6> SQL</comment>


Who rooted kernel.org servers two years ago? - <AUTHOR> http://arstechnica.com/security/2013/09/who-rooted-kernel-org-servers-two-years-ago-how-did-it-happen-and-why/

<comment><USER2> From the 2011 kernel summit, "The attack turns out to have been part of a widespread credential-stealing network that has been operating for some years now; it is clear that the site had been owned by this network for some time before it was discovered. What also seems to be clear is that this was not a targeted attack; kernel.org was just another on a long list of broken machines."

\- Jon Corbet reporting on a talk by H. Peter Anvin, [https://lwn.net/Articles/464233/](https://lwn.net/Articles/464233/)

</comment><comment><USER3> So let's speculate about what the article almost-but-doesn't-quite propose:

The NSA, or related parties, was responsible for the breach. There was an investigation and postmortem, but because of an NSL or other gag-type order, they couldn't accurately publish what they discovered. So they figured that not releasing a report was better than releasing a report that either intentionally misled or pretended not to have figured out what happened.

I know, this is a pretty big leap. But regardless -- what does it mean? What are the ramifications if this _is_ what happened?

<comment><USER4> _What are the ramifications if this is what happened?_

I strongly suspect they were able to get a copy of the kernel source code... They could be doing anything with it.. Porting it to a new platform.. Compiling it with unsafe GCC flags.. Or worse..

<comment><USER5> There was a discussion about this recently saying that it was highly unlikely. All the source was in Git and every git commit references the previous commit, making it highly challenging to modify an old commit without also modifying the commit id. More details: [http://archive.is/Khq7R](http://archive.is/Khq7R)

<comment><USER4> Yes, it's unlikely they modified the source in git.. But it's possible they were able to download a copy and modify it locally... Possibly adding comments to document certain blocks of code.. Or adding unofficial patches for zfs support... Or worse..

<comment><USER6> Isn't that against the Geneva Convention?

</comment></comment></comment></comment></comment><comment><USER7> A feature of civilian security is that "It was restored from Git" is doesn't immediately spark a concern that Git could be compromised.

I'm not saying that it is, but compromising Git is certainly the sort of thing which would occur to a state sponsored espionage agency. And if one were seeking to compromise the Linux toolchain, it would certainly be a very attractive link. So attractive that not including it in a multi-vector attack might be considered grossly unprofessional.

<comment><USER8> Version control systems are a bad target. They are too simple _, too deterministic, and too networked. You can steal their data, but if you insert something, you will get caught.

_ Yeah, there are exceptions, all of them proprietrary. There is no reason to trust GIT less just because some companies can make even version control hard.

<comment><USER7> Even assuming that Git is unassailable with a billion dollar budget:

How long has the Linux kernel been under development?

How long has it been version controlled using Git?

How long has it been a potential target of state sponsored espionage agencies?

The potential adversaries have been taking cryptography and security seriously since long before the Linux community. They have larger budgets and significant expertise backed by patriotism and economic rewards.

Compared to pulling a nuclear submarine wreck from the depths of the Pacific, Git might not appear so difficult.

</comment></comment></comment><comment><USER9> It's a shame this article doesn't have anything new to add, although I'm glad someone is reminding the world we still don't know what happened. Before the Snowden revelations this summer I'd assume it was a simple drive-by, incompetence. Now it's hard to see this as anything other than a deliberate attack by an Advanced Persistent Threat.

</comment><comment><USER10> Weird parallel between the NSA revelations and the Global Warming movement, every odd weather event is attributed to global warming, every odd security event it attributed to the NSA.

That said, as I recall the "hack" was a lot less impressive than it seemed (some folks in Google's Linux team were administrators of kernel.org). I do wonder about the lack of a definitive online after action report though. Seems someone dropped the ball on that one.

<comment><USER11> Could you stop lying about Climate Science please?

<comment><USER12> I think that he (she?) was comparing some extra-alarmists' (Al Gore-type) tendencies to attribute every abnormal weather pattern to global warming. We should all agree that crying wolf weakens legitimate claims about climate change and ocean acidification.

</comment></comment></comment><comment><USER13> OFF-TOPIC why is that when I hit back in Ars it creates about 10 pages in my history (didn't click anything in the page itself) this is an UX nightmare and the 3-4 articles I've looked in the past week made me cringe when trying to leave the page.

<comment><USER14> Do you have an extension blocking ads? I found the same problem and disabling the extension, stopped the problem occurring.

</comment></comment><comment><USER15> Until there is a post-mortem, we have to assume the simplest explanation: gross facepalm, like leaving something 777 open to the world.

<comment><USER16> Possible. But even then it would be good to know as much as possible on who actually broke in and what they did.

</comment></comment><comment><USER17> It's worth noting than back in 2003 an attempt was made to introduce a backdoor into the (CVS mirror of) the Linux kernel[1].

It's never been clear who was behind that attack, either.

[1] [http://lwn.net/Articles/57135/](http://lwn.net/Articles/57135/)

</comment><comment><USER18> Promises on important matters are made every day and subsequently broken. Any reason why Ars is bringing this up now?

<comment><USER19> Because this was a high profile breach and in light of the recent NSA revelations the reader is expected to connect the dots. Just my take on it.

</comment></comment><comment><USER20> > While there's no evidence that backdoors or other malicious code were > surreptitiously inserted

And it's difficult to imagine how changes would have gone unnoticed.</comment>


Show HN: We built a Continuous Delivery platform just for mobile developers - <AUTHOR> http://www.cisimple.com

<comment><AUTHOR> Continuous Delivery is a process that automates builds, testing and deployment for software. This saves developers a lot of time and helps improve the quality of their app because tests are run so frequently. While there are a lot of great solutions for web applications, there is really nothing that works well for mobile.

We think there's a lot of value in building a service specifically focused on solving problems for mobile developers. That's why we decided to build cisimple. Please let us know what you think about the idea and if you want immediate access to our beta email me at kevin [at] cisimple dot com.

Check out our recent article on TechCrunch <http://tcrn.ch/QnQbJJ>

Also, here's a post on why Continuous Delivery for mobile is different: [http://cisimple.wordpress.com/2012/11/24/what-makes- continuo...](http://cisimple.wordpress.com/2012/11/24/what-makes-continuous- delivery-for-mobile-different/)

<comment><USER2> site looks good looks like its still going through some polishing. FYI for the Flash screencasts, if you're going to support mobile devices(with responsive twitter bootstrap) then you might want to consider using html5 video too otherwise you might miss converting visitors to customers.</comment></comment>


Ask HN: A good and not-so-shady alternative to Google Analytics - <AUTHOR> I am looking to replace the visitor tracker and analytics on some of my sites.<p>I am currently using Google Analytics. Is there any other alternative? I can use less complexity and features! <comment><USER2> A little late to the party but I'm the developer of Simple Analytics. Servers in Iceland, not selling YOUR data and have it in a simple and clean interface.

</comment><comment><USER3> Matomo seems to be a good solution (called Piwik in earlier times)</comment>


How to correctly cast a pointer to int in a 64-bit application? - <AUTHOR> http://www.viva64.com/en/k/0005/

<comment><USER2> It might not work with an int, but I'm virtually certain it works with a long int. I say that because I had to research whether I could use a long value as both a reference count when a struct was in use, and a free list pointer when a struct was not in use. I didn't want to declare the field as a clunky union, but as simply "long".

I researched the issue in the C Language Reference Manual, document 007-0701-150, available on the web as a PDF. Here are my notes:

"In the value structure, the reference count N is a long int, which guarantees that it can also be used as a pointer to link unused values on the free list, without my having to use a cumbersome union type.

The standard says:

      long ints are large enough to hold pointers in -n32 and -o32 mode.  Both are
      32 bits wide.

      long ints are large enough to hold pointers in -64 mode.  Both are 64 bits
      wide.

(C Language Reference Manual, document 007-0701-150, Appendix A, Section F.3.7 "Arrays and Pointers")

Assuming there are no other modes, I conclude that long ints are large enough to hold pointers, period.

As further evidence, the section titled "Integer and Floating Point Types" has a table of Storage Class Sizes which lists the size in bits for the various types in all three modes -o32, -n32, and -64. In all modes the size of a long equals the size of a pointer."</comment>


CSS at Scale: LinkedIn's New Open Source Projects Take on Stylesheet Performance - <AUTHOR> https://engineering.linkedin.com/blog/2018/04/css-at-scale--linkedins-new-open-source-projects-take-on-stylesh <comment><USER2> One thing looking at this (and other solutions like CSS modules etc.) is how to automate E2E testing when you don't have predictable CSS names.

Seems like the discussions some communities (like with Cypress) where dedicated unchanging test attributes should be used, which makes sense to decouple visual selectors from test based selectors.</comment>


Deep-Murasaki: Deep Learning to Play Chess Without Knowing the Rules - <AUTHOR> https://github.com/lazydroid/deep-murasaki <comment><USER2> So, on the order of about one minute per training epoch, for 500 epochs gives you a trained program in about 500 minutes?

So, how well does it play? Does it make any illegal moves?</comment>


The sorry state of Avira anti-virus heuristics - <AUTHOR> http://grack.com/blog/2010/03/17/the-sorry-state-of-avira-anti-virus-heuristics/

<comment><USER2> Avira is well-known in A/V for producing higher false positives than most other competing products.

That said, it also (as of late last year) had the highest actual detection rate (at 74% of 20,000+ tested bits of malware).

It also won AV Comparative's "gold" award for 2008, there's still a free version available for personal use, and it offers one of the lowest impacts on system performance of any antivirus product.

So, although I agree with the author that the heuristics in this case aren't optimal, Avira is still a very good product overall.

</comment><comment><USER3> Great example of why signature based detection for anti-virus is just a stopgap measure. You can be sure the anti-virus of the future (if there is one) will make limited to no use of malware signatures. I suppose it probably feels weird to most people to find out the AV product they pay a lot of money for is just a sophisticated version of grep.

<comment><USER4> I'm pretty sure the future of anti-viruses will involve signature matching one way or another, because there's no way around that.

Viruses are pretty similar to their biological counterparts ... they are pretty useless by themselves, but once they infect a host, they can use its mechanisms to multiply.

Antibiotics are targeting bacterial infections successfully because bacterial cells can be recognized (have their own specific shell, and aren't relying on a host for survival). That's why antibiotics work, because while different, all bacterial cells are alike. And antibiotics only attack bacterias, not normal cells.

With viruses it's different ... you can't attack viruses with a generic mechanism.

The only hope you have to treat a virus / stop it's reproduction is to identify a signature in its proteins, and target that. Vaccines are the most efficient because they give your immune system a heads-up, but once you caught it the only hope you have is for your immune system to fight back.

Computer viruses are pretty much alike ... you can't have a generic method for fighting back. You can only develop a specific treatment for a specific virus, otherwise you'll be in the same league as cancer treatment ... targeting cancerous cells efficiently, but doing enough of a damage in normal cells that your internal organs start failing (with a direct analogy being the loss of data).

Personally I never install anti-viruses. I'm just cautious about the sources of the materials I have to work with, and whenever I suspect my computer got infected (happens once in 2 years) I just save my data somewhere and do a fresh reinstall.

<comment><USER3> Analogies between computer viruses and biological viruses are strained, overused, and abused. I'll just point out that our innate immune system doesn't use signature based detection, it uses a whitelist and behavioral/heuristic based detection. Where do you think transplant rejection comes from? It's not because the immune system has a virus signature that matches the foreign organ.

 _I'm pretty sure the future of anti-viruses will involve signature matching one way or another, because there's no way around that._

There are numerous ways around it. A whitelist is the simplest way. We have the technology to systematically verify the integrity of each piece of software on a computer (barring physical access) [1]. The current implementations of TPM have the potential for massive privacy violations and abuse, but I'm hopeful that projects like OpenCore will eventually lead to open source TPM designs. In any case, in such a system anti-virus is not even necessary.

More complex but less restrictive methods include:

(1) Building machine learning algorithms around a set of data that measures the normal operation of the machine. Because 99.9999999999% of the time Grandma's computer shouldn't be acting as a server.

(2) A feedback system built into your antivirsus where users report applications that don't work or have malicious behavior. Then Grandma can look up the greeting card creator she wants to install and see that 100 users have given the application 5/5 stars over a period of 6 months. Bonus points for open source applications where people will take the time to audit them for free.

There's tons of research in this area and I don't have time to reproduce a complete summery here. The point is that signature based detection is a method that is not sustainable in the long term because the number of unique malware variants is something that is growing exponentially. Most people don't even have anti-virus installed, and those that do have to deal with the fact that the AV slows the machine to a crawl.

Signature based AV is just a stopgap measure until we can properly implement our operating systems and detection methods. In the future we will have operating systems with trusted computing bases and detection methods based on behavior and crowd sourcing.

[1] <http://en.wikipedia.org/wiki/Trusted_Platform_Module>

<comment><USER5> Your immune system uses a wide range of methods to find and fight infection. However, while identification is based on finding things outside of the "Normal" range, fighting it is all about signatures.

Vaccination works by preparing the body to fight something that looks like X by dumping millions of copy of something that looks like X into your body. At which point your immune system feels it needs to really fight X with everything it has so it develops a specific response. aka _Adaptive immunity is triggered in vertebrates when a pathogen evades the innate immune system and generates a threshold level of antigen._ SEE: <http://en.wikipedia.org/wiki/Adaptive_immune_system>

This is also why you can have auto immune diseases, if you trip the "fight" response to something that should be left along you get a world of problems. You immune system is more than willing to kill cancer, or even normal cells, and inflammation can be vary harmful.

<comment><USER3> It's not all about the signatures. Vaccination would be just as ineffective as anti-virus if biological viruses were anything like computer viruses. Imagine billions of biological viruses that are _instantly transmitted upon infection to anywhere in the world_ , _have an immediate impact on the host_ , and can _evolve and adapt with human-like intelligence_. Good luck fighting that with vaccines.

Because computers are not human beings, if we can do detection well, than the problem of fighting an infection is already solved. Just run your server on a virtual machine verified by a trusted boot module. When an infection is detected, just roll back to a trusted snapshot or roll back to a clean install.

<comment><USER5> Remember less than 1/2 the cells in your body actually contain your DNA. Yet signatures still work. Biological viruses are light years ahead of computer viruses. Picture a world where there where more computer virus strains than computers, they mutated millions of times a second, ignored firewalls and could attack computers though the electrical system. Further 1/4th of every nations GDP went to anti virus systems and had been for the last billion years.

PS: Virus writers have become far more tame but old school virus's would rewrite your BIOS.

</comment></comment></comment></comment></comment></comment><comment><USER6> I once had a totally benign website that triggered an anti-virus alert in Clam AV. There was an specific sequence of characters in the HTML that caused it.

One of the weirder bugs I've encountered.</comment>


If Libya Shuts Down the Internet, What Happens To .ly Domains? - <AUTHOR> http://www.centernetworks.com/libya-shuts-down-the-internet-domains

<comment><USER2> Probably nothing will happen. Nameservers for .ly are dns.lttnet.NET, dns1.lttnet.NET, ns-ly.ripe.NET, auth02.ns.uu.NET, phloem.uoregon.edu. Of these only dns.lttnet.net and dns1.lttnet.net are hosted in Libya. If the dictator will have the local internet shutdown, he probably will not go to the lengths of also clearing all foreign DNS caches listed above.

Nonetheless I would be more careful in selecting a ccTLD to base my business on. Read, for example, about Gaddafi's dealings with Switzerland and you know which laws Libya follows at the moment.

<comment><USER3> As of right now, dns and dns1.lttnet.net (in-country) are unreachable, but the out-of-country nameservers are responding with what I presume was their last zone transfer. bit.ly still works, for example, but because of the outage, nic.ly is dead.

</comment></comment><comment><USER4> Hopefully? Stop abusing country code TLDs already...

<comment><USER5> What do you suggest? Getting a .com domain? Have you tried to do that recently? All dictionary words and most two-word combinations are taken by squatters. I searched for a domain name for a new web app the other day and wanted a .com name, it was almost impossible to find _anything_. I spent two days searching until I found something.

.net and .org are better, but users always expect (and type in) .com.

<comment><USER6> It's not actually _that_ bad. I recently wrote a script that sends me daily emails of all .com domains that are expiring that day, sorted by length, and by a measure of how "English-like" they are (just using a frequency table for pairs of letters). I was surprised by how much good stuff is available.

<comment><USER7> Please publish this script! Or, throw up a site and let us add our email to a newsletter list :)

</comment></comment></comment></comment><comment><USER8> I apologize if I missed something, but I think it's shamefully insensitive of the editors of that site to not even acknowledge that this issue is proportionally _irrelevant_ in light of the fact that peaceful protesters are getting _shot to death_ TO-DAY in Libya.

[http://www.thisislondon.co.uk/standard/article-23924674-liby...](http://www.thisislondon.co.uk/standard/article-23924674-libya- troops-shoot-24-dead-as-protesters-march-in-five-cities.do)

Let's do a thought experiment for a moment and pretend there are some things more significant than web development and e-commerce, shall we?

yes I cross-posted.

EDIT: the author/editor there (Allen Stern) was gracious and considerate in his response to my complaint, and committed to trying to find a way to put the .ly domain issue in perspective in the article. Kudos centernetworks!

</comment><comment><USER9> I do not believe that would affect DNS since it is distributed. The root zone file has five servers listed as authoritative for .ly

      LY. NS AUTH02.NS.UU.NET.
      LY. NS PHLOEM.UOREGON.EDU.
      LY. NS DNS.LTTNET.NET.
      LY. NS DNS1.LTTNET.NET.
      LY. NS NS-LY.RIPE.NET.

I'm sure at least the uu.net and uoregon.edu servers are located in the US. Besides, your ISP DNS caches will stay warm for several days.

</comment><comment><USER10> Why do people use .ly anyway? It's not like there aren't other two-letter domains out there.

<comment><USER4> It's some dumb marketing gimmick. The idea basically seems to boil down to _"only old foggies use the major gTLDs these days, lets be hip and make our company name an adjective that is also our URL"_.

<comment><USER7> It's more than a gimmick. A recognizable and memorable URL has proven to be extremely beneficial to new startups. Memorable .com addresses are becoming endangered, or very very expensive.

<comment><USER4> To this day I have to doublecheck myself on where the '.'s are places in _"del.icio.us"_ (in fact, it abandoning this URL some time ago). Now, "amazon.com"? Absolutely no worries there.

</comment></comment></comment></comment><comment><USER11> The same thing that happens when tuvala sinks beneath the waves - nothing.

It's more likely that the US gov might decide that Libya is a terrorist nation and shut down all the .ly addresses for you.

</comment><comment><USER12> The same question showed up on Quora ... no reponse: [http://www.quora.com/What-will-happen-to-http-bit-ly- links-w...](http://www.quora.com/What-will-happen-to-http-bit-ly-links-when- Gaddafi-shuts-down-the-Internet-in-Libya-due-to- protests?q=If+Libya+Shuts+Down+the+Internehat+Happens+To+.ly+Domains%3F)

</comment><comment><USER13> Pro: People stop abusing and overusing ccTLDs. (maybe not?)

Con: Many major services go done, which causes a lot of unhappiness and headaches. (does it?)

<comment><USER14> Don't know about the headaches - more like: okay bit.ly seems to be down, lets use something else.

</comment></comment><comment><USER15> Has anybody asked what happens to .com when the USA turns off their Internet? Having a .com address could be a huge risk to companies in other, more stable countries.

</comment><comment><USER16> they go away.

<comment><USER12> well-summarized :-)

</comment></comment><comment><USER17> By the same logic .com domains aren't _safe_ either given the recent ICE shutdowns.

</comment><comment><USER18> The schadenfreude is strong in this thread.

<comment><USER19> Why do people keep using that word - schadenfreude, when peinlich would be more suitable?

<comment><USER20> peinlich is more suitable but alas it's taken by a squatter who wants $50k for it ;)

</comment></comment></comment><comment><USER21> This is total.ly missing the point.

</comment><comment><USER22> this article simply poses the question, and does not answer it. waste of 5 minutes. for that, I will not upvote it.</comment>


A Typeface Just for Dyslexics? — The Book Designer - <AUTHOR> http://thebookdesigner.com/2012/10/a-typeface-just-for-dyslexics/ <comment><USER2> Even though I don't consider myself dyslexic, I am intrigued enough to have installed the font on my OS X and set it as the default face in Emacs.

ADDED. It would make a better Emacs font if it were fixed width.

</comment><comment><USER3> [http://www.hnsearch.com/search#request/submissions&q=dys...](http://www.hnsearch.com/search#request/submissions&q=dyslexic&start=0)

Few discussions on this already.</comment>


Cigar Smoking World Championship - <AUTHOR> https://www.nytimes.com/2019/10/29/sports/cigar-smoking-world-championship.html <comment><USER2> So the goal is to smoke one cigar as slowly as possible, without relighting. I imagined it'd be like an eating contest, where you have 10 minutes to smoke as many as possible.

Their way sounds a bit less unhealthy.

<comment><USER3> I wonder what the second-hand smoke risk is like.

Even though they're not inhaling their own cigar, there are about 15 other competitors in the enclosed room.

<comment><USER4> I'm always curious about how incidental exposure like this affects the biology of the body. It seems like there are many cases where mild exposures to things like pathogens, allergens, toxins, etc build up resistance in the body and gird it for future exposure.

I wonder if there is any mechanism where this could be true for second hand smoke. There clearly are some folks that have a better resistance to lung cancer than others...my father in law smokes 3-5 packs a day for 50 years, no emphysema, no lung cancer, wtf. He did have polio when he was a kid, maybe that helped.

</comment></comment></comment><comment><USER5> I have some friends who are into slow pipe smoking, it's really hard for them to organize competitions because smoking indoors is banned.

</comment><comment><USER6> How about a cigarette smoking competition to see who can smoke the most cigarettes in 10 minutes?

</comment><comment><USER7> I find this as meaningful as any sportball contest.

<comment><USER8> Ok, but please don't post unsubstantive comments to Hacker News.</comment></comment>


Valve Index review: $999 buys you the best VR experience yet – when it works - T-A https://www.polygon.com/reviews/2019/6/28/18758877/valve-index-review-steam-vr-headset-virtual-reality-pc <comment> T-A The mysterious malfunction thing does not seem to be an isolated case:

[https://www.tomshardware.com/reviews/valve-index-vr- headset-...](https://www.tomshardware.com/reviews/valve-index-vr-headset- controllers,6205.html)</comment>


Critical RCE vulnerabilities patched in Git, SVN and Mercurial - <AUTHOR> http://marc.info/?l=git&m=150238802328673&w=2 <comment><AUTHOR> _" PSA: Update your version control system client NOW."_ [https://twitter.com/adambroach/status/895729717415890944](https://twitter.com/adambroach/status/895729717415890944)

Direct links to the related Subversion and Mercurial announcements:

* hg: [https://www.mercurial-scm.org/pipermail/mercurial/2017-Augus...](https://www.mercurial-scm.org/pipermail/mercurial/2017-August/050522.html)

* svn: [http://mail-archives.apache.org/mod_mbox/subversion-announce...](http://mail-archives.apache.org/mod_mbox/subversion-announce/201708.mbox/browser)</comment>