The Basics of Web Application Security, Part 4: Protect Data in Transit - <AUTHOR> http://martinfowler.com/articles/web-security-basics.html#ProtectDataInTransit <comment><AUTHOR> _> They might be using an internet provider that injects content such as ads into their web traffic, or they might even be in a country where the government routinely surveils its citizens._

I love those subtle hints to the NSA. (Also, here in Germany the BND isn't any different in spirit, they're just technically less capable than the NSA.)

<comment><USER2> There are plenty of countries that will do this. It is not a subtle hint about the NSA.

</comment></comment><comment><USER3> Link to the top of the article: [http://martinfowler.com/articles/web- security-basics.html](http://martinfowler.com/articles/web-security- basics.html)</comment>


Dialogflow for Web v2 now available Check it out - <AUTHOR> https://github.com/MishUshakov/dialogflow-web-v2 <comment><AUTHOR> Since Dialogflow V1 API will be deprecated soon, I have started working on a new version of my Product. It is built from scratch and based on the Dialogflow V2 API. And it offers the same great features my first iteration had, but even more new features are added and the product is now rock-solid for your Integrations. Furthermore it is built on top of custom gRPC client for Dialogflow (I call it "Dialogflow Gateway"), to make sure it works very tightly with the API and implements more platform features, that are not accessible by Web clients before (like multiple languages for Agents).

Today, I just want to notify you, that Dialogflow for Web v2 is available on GitHub. I will be happy, if you could check it out.

You can also experience a Live Demo of the product here: [https://i.ushakov.co/dialogflow-web-v2/](https://i.ushakov.co/dialogflow- web-v2/)

For any questions and doubts, leave a comment below and I will respond as quick as possible. Best wishes to you and your loved ones. Thank you.</comment>


How To Build A Startup From A Beach - <AUTHOR> http://blog.simplehoney.com/how-to-build-a-startup-from-a-beach/ <comment><USER3> I spent a lot of time this winter up in Tahoe. My days consisted of hitting the mountain for first lift, snowboarding for a few hours, back at the condo by noon and spend the rest of the day working. My productivity during these days was absolutely insane. Not being able to meet anyone for drinks, dinner, etc. just means you end up with an awesome 8-12 hour block of completely uninterrupted time to just crank through shit.

<comment><USER4> Sounds like an absolute dream. Last time I went skiing I was wondering if something like this might work, glad to hear that it did for you --- I'd love to try it in the future!

</comment></comment><comment><USER5> I was expecting some fluff piece about how to make a passive income on SEO while living a jetset life style. This was not it. The article makes surprisingly much sense actually.

<comment><USER6> My thoughts exactly. I think they're actually getting a lot of stuff right.

</comment></comment><comment><USER7> All of this advice is great except "Hawaii" which is merely good advice.

There are _much_ cheaper beach towns with unbelievable weather that aren't so isolated. Hawaii is particularly nice for US residents without a Passport, but you should get a passport!

I recently did something very similar, though I was at several beaches and in a couple mountain ranges. There is a sort of inverse relationship between adventure and monetary cost with regard to what your options are and you have a lot of choices.

Hawaii is relatively low on the adventure and high on the cost; while something like Nosara, Costa Rica is a bit more of an adventure, and a bit cheaper while things like the language barrier still won't be distracting from getting work done.

<comment><USER8> Do Americans really have such a strong aversion to getting a passport? Why is "you don't need a passport to get to X" even in the list of reasons why you should go to X? A passport is just another piece of ID. Yeah, it's a bit too bulky to carry around in your wallet, but most of the time you don't even need to carry your passport around. Is it really so difficult for Americans to get passports?

Or is passport-talk just an oblique way of saying "you don't need to worry about visas"?

<comment><USER9> It's not visas, Americans only need those for a handful of countries and an American passport is #5 for visa-free entries worldwide, ahead of even Switzerland and Canada. [1]

The problem is that getting the visa is 1) expensive ($137 when I got mine five years ago) and 2) time-consuming. Standing in the post office for hours sucks and even finding out which post office will accept your application is difficult. I had to drive to three different post offices because I got bad information over the phone. The whole process took me about two weeks. Getting my French visa, which was the purpose of my passport, took less time.

So for your average family of four, [4x$137 + time] isn't worth it just for a more interesting beach than Waikiki or Miami. Not saying I agree with that logic but I think that's how a lot of Americans view it. There's enough to see domestically that it's not worth the added expense for a lot of people.

I'm not one of them—I only started travelling internationally two years ago and I've filled five pages of my passport and will have another seven stamps and a long-stay visa in there by August. That, however, is not a normal travel pattern for most Americans.

[1] <https://www.henleyglobal.com/citizenship/visa-restrictions/>

(Whether or not Americans _know_ how few countries require visas is another issue)

</comment></comment></comment><comment><USER10> As a YC founder of a venture backed company that lives in Hawaii now... Like everything in life, it's all a balance. My quality of life in Hawaii is hard to beat. My tech scene is hard to find. Which is why I come back to SF & NYC almost monthly. The travel is a bit of a pain, but I feel like I'm living a close to perfect balance.

It helps that I'm from Hawaii, so I'm not in "vacation" mode... I'm in "home" mode. Where I feel relaxed, comfortable, inspired & supported. From that place is where I run the chaos of a startup.

<comment><USER11> You in Honolulu? If so, in the local tech scene? I'm a tech exec of a mid- sized company in Honolulu- always like to meet other local like minded folks

<comment><USER12> A great place to meet other developers in the local Hawaii tech scene is as Wetware Wedesdays. There's free appetizers and usually beer available.

<http://wetwarewednesday.eventbrite.com/>

Also you should definitely check out HI Capacity (<http://hicapacity.org>) a local makerspace/hackerspace. There is an interesting talk on Haskell coming up on May 24th: <http://www.meetup.com/dynamic/events/63061002/>

</comment></comment></comment><comment><USER13> Back when I was living in Hawaii, we had a "Castaway Hackaday". We got some waterproof pelican cases, loaded up our laptops and a few solar panels, then headed out to the mokes (<http://www.flickr.com/photos/46801360@N07/4368503769/>) - two tiny islands off the eastern coast of Oahu. We set up a cantenna from one of the houses on shore and connected some wifi out there. It was fantastic - completely free of distractions, great weather, and it kept everyone on the team pretty happy.

<comment><USER12> Wow that sounds pretty awesome. Did you kayak out to there? I guess I should make friends with someone that lives on Lanikai and try it out.

</comment></comment><comment><USER14> I can understand the upside of this, with the better routine, health, everyone living in the same house etc.

However, I think the isolation is VERY dangerous. Yes, silicon valley is a bit of an echo chamber, but at the same time, you are around some of the smartest minds in the world. Our first few VC meetings resulted in a "pivot" of sorts. Still same end goal, but different way of going about it. Being around everyone in the travel tech industry, and being able to set up meetings with them, has changed our go-to-market strategy and our priorities.

These smart people have a way of poking holes in your strategy. There is something to be said for talking to "normal" people, but I can say we have talked to hundreds of normal people, and the most valuable advice we got was from those VCs and angels, or travel tech people.

We possibly would have wasted months if we didn't seek out these experts and learn from their success and failure.

By moving to Hawaii you risk losing that.

The Adioso guys kind of mentioned this, that living in Melbourne they weren't around the same type of environment and PG brought them back to earth when they got back here. The ruthlessness of silicon valley has it's upside.

</comment><comment><USER15> I did this once. Instead of Hawaii though we did Palm Cove in tropical Australia. We did get away from a lot of distractions but you manage to find others. Also the work environment wasn't super comfortable being that we worked at a kitchen table in the apartment we rented and the internet was on a very low cap and frequently unavailable.

I think if you're going to do this then have a plan in advance of exactly what you want to accomplish and go there to build it. We went with a general idea and a few more and ended up trying to many things in the month we had for it to really pay off.

</comment><comment><USER16> Joyce, Eric, Wynwyn and Caleb were great to work and eat with! Loved the beach. Working in Hawaii now a days is great because of all the coworking spots like The Box Jelly and The Greenhouse. Hawaii is really taking off and will soon be the tech hub of the Pacific.

Side note about working with the SimpleHoney team - One time in the Ko 'Olina house I killed a cockaroach (follow him here - <https://twitter.com/#!/householdroach>) in the bathroom but was too scared to pick it up. Joyce "The Terminator" Kim went in there and picked it up for me LIKE A BOSS!!!! True Story!

</comment><comment><USER17> I am born and raised in a sunny southern city and always admired nordics (from canada, north europe, moscow till japan) to excel at technology. Now in nordic town of 9 months of cold, I always witnessed due to snow, cold climate, and restriction to be at home most of the time, people focus more on brain work, and in south more on outside activities(cafes, dance) etc. That said, california is against my argument, but I find it really curious to understand which climate is the best one for programming; though I bet more on stockholm than hawaii.

<comment><USER18> Only a rather small part of Japan is cold (North of Tokyo basically, in terms of population the cold part of Japan would make around 15-20%). Most of Japan is between warm and subtropical. Okinawa is tropical.

Taiwan, quite similar to Japan in many respects, is tropical (same weather as Okinawa basically, it's quite close). I've been there recently for a few weeks and temps were in the 25C-32C range most of the time. Boiling hot. Yet this is one of the places of the world where more shit gets done and invented per capita. I was in a technology park, spending a lot of time in cafes, and it felt just like Palo Alto (but more on the EE side rather than on the CS side).

Now, these people have great beaches and a weather that'd allow you to spent most of the year if not all year in the beach, but they find a balance and are every bit as industrious as any cold Nordic country if not more. Same can be said for a good part of Southern China and South Korea.

It's a matter of culture, not weather. Responsibility and hard work need to be nurtured.

</comment></comment><comment><USER19> Absolutely great story and shows off the lifestyle you can achieve outside the city.

However some drawbacks (to compliment the positives of the article):

\+ Short Term: While a retreat allows your team to focus and integrate, like all holidays - they end.

\+ Talent: You currently recruit in a tech hub city, however eventually your talent leaves and you need to find replacements in the local village. You cannot find anyone as good or as friendly (as they joined the team/party late).

\+ Too friendly: You are all new to the place, so you are a little eco system hanging out all the time. The fun will eventually wear off as internal relationships grow/breakdown.

\+ Networking: The valley offers fantastic opportunities to meet other like minded people. Opportunities are much higher to meet that next co-founder, angel or VC. What are the chances of this on an island?

So, it can work but not forever and offers startups a constructive way of building strong team dynamics and creating tight focus on building their alpha/beta product.

</comment><comment><USER20> Jameson and I spent Mochi's first summer (2005) on Maui, where we built the majority of MochiBot and MochiKit. Worked great for us, although we didn't keep California time or do any planking.

</comment><comment><USER21> I've known a number of musicians and writers who have gone on escape retreats to isolated areas in order to finish a book or an album, typically with a lot of success. Many of the most productive remote engineers I've worked with live in sparse areas where there is very little to do thats more fun than programming.

There's some merit to removing distractions when knocking out a marathon product build, but that said a good office environment can also serve the same purpose...

<comment><USER22> This reminds of Kanye West-- when he recorded his last solo album ('My Beautiful Dark Twisted Fantasy', which was unequivocally a critical and market smashing success), he rented a house in Hawaii with a studio in it, flew out all the producers/artists he needed to collaborate with, and maintained an demanding, consistent work schedule (napping in 90 minute intervals and working through the night) until he perfected the album. It's probably not sustainable, but works really well for a concerted push.

[[http://www.complex.com/music/2010/11/kanye-west-project- runa...](http://www.complex.com/music/2010/11/kanye-west-project- runaway/page/2)]

</comment></comment><comment><USER23> Please don't sell that startup from a beach dream on exoticism.

I would like to cast a diverging opinion from my personal experience. For various work-related reasons I left Europe in early 2008 to live in Martinique, in the French West Indies.

It is very close to what the article describes - tropical weather (you will never get cold - 25 C/ 77 F is what we call cold and take a jacket for - <USER2> weather station on <http://guylhem.org> \- only the webcam is down ATM), great food (french creole! do I need to say more?), beautiful wildlife (It's 9:20pm I'm listening to the various frogs and birds and stuff), healthy lifestyle (can't be helped ! even if you have bad habits it is like something from the environment you are surrounded with contaminates you and make you follow an healthy lifestyle). Same currency (euro). No need for a passport.

Also you can swim every day of the year in the caribbean. Sounds like your dream ? I went swimming on new years eve like 2 years ago. Got sunburned.

That's the honeymoon, the first few weeks/month/years. Little by little I went to the beach less and less. At the moment maybe one every couple of month, to go with the gf.

Along the way I realized something : what was initially the selling points, as good as they may sound, place you at risk of isolation. And this may not always be good, especially for a techy - there seem to be more introverts among us. I would have called myself an introvert.

You know these things you call "distraction" and the people you do not call normal? That's what I dig now, whenever I go somewhere. I'd love to have a beer and talk about technical stuff with people who will understand me (running my website on my mips dsl modem, packaging a distro). Hitting the same 3 guys you know on the island who do free software quickly loses its novelty.

So for my last few vacations, I went to Florida, Montreal twice and Paris. Basically to a conference, a LUG meeting + visiting some friends, and a technical conference. While in Florida I was a bit bored (like home, only chilly, but with techies it was fun) so I also went to see an old friend in San Diego. Since there was a HN meeting we attended. It was like being alive again, being surrounded with people who share the same interests and the same cultural references. I was quite bored for weeks when I went back to my tropical paradise - because the grass is always greener on the other side, but I don't think I had realized that yet.

I had one of my most productive week last year when driving between Montreal and New-Bruswick - at the end of the autumn. The cold was so exotic! I loved every single minute of my vacation. I could only have loved it more if it had been snowing, but I know I'm partial with snow, so I wanted to test myself and see if even without snow I'd enjoy my vacations in the very same place, to remove a bit of exoticism. And yes I did.

Do you see how it relates to the experience mentionned in the article ? There will always be something that's attractive because it is different. Then the new become usual, and we get bored. And we leave and try something different, again and again. I think it's just human nature.

We want difference and exoticism, we want to be surrounded with people we can relate with but not too much, all these are incompatible needs. The problem is not in your work environment but in yourself. When no longer needs the exoticism to be happy, that's when the fun begins.

If you know what makes you tick, inspiration comes not only from an exotic place - like a cafe in New Brunswick can be to me - but also at the place you call home, wherever it might be.

Then it comes down to personal preferences about what weather you are more comfortable with, what kind of people you prefer having around, and your own philosophy. But not exoticism. It's a trap, a burden that can becomes non necessary. It happened just like that, someday I just started feeling that way.

At the moment, I'd say I only regret that my work will have little impact, but I've settled with the rest. 2 tech conference a year and I get the minimal contact with other techies I need to survive :-) And while some exoticism is good (I say I enjoyed my vacation) it is no longer a _need_.

<comment><USER24> That's fine and good, but writing from Berlin as it comes into springtime, I for one would much rather have my boring, isolated, day-to-day grind come without metric assloads of snow and ice on everything and relative inability to do anything outdoors for half the year.

I expect no sympathy from Californians, but for those in NYC, Boston, Chicago, Berlin, etc - upvotes to the left. :P

<comment><USER25> I've lived in Minneapolis (most extreme), Santa Fe (most sunny), Mountain View (most pleasant), Brasilia (most normal), and London (most cloudy).

I actually prefer having cold snowy winters and hot sweaty summers as it alleviates the monotony quite well. But Berlin-level snow is not enough. What's the average annual snowfall there? In Santa Fe in Christmas of 2006 we got _four feet_ (120cm) in town in one 4-day storm, now that's an assload and a half.

</comment></comment></comment><comment><USER26> As much as I love this idea, I'm skeptical it would work for everyone. Personally, I'd feel pretty antsy knowing that outside my door is a tropical paradise. It would give me too much 'perspective', and inevitably force me to close my laptop and carpe diem.

</comment><comment><USER11> As I resident of O'ahu, I'm psyched to see this. We don't have enough startup activity here.

<comment><USER12> Within the last year the tech community on Oahu has really been picking up. There's lots of awesome things going on such as the HI Capacity makerspace (<http://hicapacity.org/>) and Henk Rogers just announced a new incubator for local startups!

</comment></comment><comment><USER27> we should do an exchange program, so HI startups get a taste of ground zero in Bay Area.

</comment><comment><USER28> I bet you can get a cheaper ticket to Puerto Rico and take advantage of all the tax exceptions for startups. No passport needed if you are a US citizen.

</comment><comment><USER29> I was living in Hawaii when I finished my time as a navy officer. I realized that I would never get a post-Navy career going because every day, and I mean every day, you look out the window and think, "wow, it is much to pretty a day to be inside".

But if aren't susceptible to "Polynesian Paralysis", sure, no place better than Hawaii. I couldn't and, much to my regret, moved back to the mainland to get things moving.

</comment><comment><USER30> Your site has been hacked and is only showing the hacked pages when the request looks like its from google.

If you wget on of your blog articles you can see an example. (Registering your site with webmaster tools google would of notified you if it sees suspicious activity like this)

There will most likely be a base a base 64 encoded string at the top of your index.php file than when you decode will contain the exploit.

Keep wordpress up to date.

</comment><comment><USER31> An interesting thing about working in Hawaii is the timezone. If you have an international angle to your business, this is a great place to be. And you can surf before work. You can still get sh*t done!

Mornings: 9am HI time 12pm SF time 3pm NY time

Afternoons: 3pm HI time 10am Tokyo (tomorrow) 9am China (tomorrow)

</comment><comment><USER32> This is exactly what I've been wanting to do. Well done simplehoney; sounds like a great time.

<comment><USER33> I wonder if we could form a company of people who think this is a good idea without getting a bunch of freeloaders who want a nice vacation.

I'd definitely be into working from the beach for a month or two.

<comment><USER34> It's a good idea and I'm sure there would be a few candidates :-) Also, not exactly the same, but the folks at www.tropicalmba.com hire interns to work with/for them in Bali: <http://www.tropicalmba.com/paid-internships/>

</comment></comment></comment><comment><USER35> Less time at beach, more time focusing on uptime.

</comment><comment><USER36> Am I the only one who gets a wrong spamlike summary when trying to share this link?

Have a look [https://developers.facebook.com/tools/debug/og/object?q=http...](https://developers.facebook.com/tools/debug/og/object?q=http%3A%2F%2Fblog.simplehoney.com%2Fhow- to-build-a-startup-from-a-beach%2F)

og:title is Doxycycline mail order og:description Buy online generic no prescription Doxycycline. Get cheap low price Doxycycline without prescription. 100% Secure. Fast Delivery

But I wasn`t able to find this in the html sourcecode of the page ?

<comment><USER37> It serves spam when I request the page with curl, and goes away if I put a user agent header in there with "Firefox/12.0". Odd.

<comment><USER36> Oh thanks for the hint! I was able to reproduce it. Weird. Nice idea to hide the spam.

<comment><USER38> These guys are very smart... their hack doesn't even leave a presence in the source or cache. It's happening via JS I believe.

</comment></comment></comment></comment><comment><USER39> Our startup <a href='[http://www.gethopscotch.com>Hopscotch</a>](http://www.gethopscotch.com>Hopscotch</a>); is in the midst of something similar. We came from NY and have managed to do it very much on the cheap by staying with friends and using miles to get here. I could definitely see a tech scene blossoming here, it's a great environment for coders.

</comment><comment><USER40> This was my favorite quote, "Being in paradise lets everyone open up and share their own dreams and ideals." I've never been to paradise, but the promise of that is worth a try on my next startup.

</comment><comment><USER41> Hey - if anyone is starting a startup and wants to go to hawaii for an early code phase AND I can get a solid 1 hr surf session morning and evening in around coding....sign me up.

</comment><comment><USER42> My loose plan along these lines is to temporarily relocate my (three person) office to Kerala in India for a few weeks. Offshore development, but not as you know it.

</comment><comment><USER43> I am thinking of ways to convince my boss to do this. It might work better if I attempt to convince him in the middle of a cold Midwestern winter.

</comment><comment><USER44> The next step is to have a reality show about this. A few weeks into it they're gonna start fighting over who took who's toothbrush.....lol

</comment><comment><USER45> Well, it worked for Megadodo Publications.

</comment><comment><USER46> They don't seem to be productive there in Hawaii:

<http://simplehoney.com/>

"502 Bad Gateway"

</comment><comment><USER47> Less blogging about beaches, more finishing what looks like it will be an excellent service :D

</comment><comment><USER48> Nothing like a SUP session in the early AM to get the creative juices flowing.

</comment><comment><USER49> I was an intern in a startup that tried exactly this. It was a lot of fun. We got a ton of VC cash to burn and so why not do it in a nice environment? In the end, the company failed. We all got too much into a "holiday" mood. The webdesigner won a surf contest. The CEO started an affair with not one, but two of the female employes. We all got fat from eating delicious food from the 5-Star hotel and high class Restaurants near by.

Moral of the story? Stay frugal even when you dont have to. It might be better for the company.

<comment><AUTHOR> We didn't and still don't have "tons of VC cash" to burn - only our own savings accounts at that time, so no 5-star hotels or high class restaurants for us.

Also, I would not say we had a holiday mood at all during our time there. We started working the same day we arrived, but being in Hawaii had so many unexpected positive effects on productivity and product vision, we really wanted to share.

And, I could never win a surf contest.

<comment><USER21> As a travel booking startup I think Hawaii is a really clever move, you're surrounded entirely with your target customers. Very smart</comment></comment></comment>


Facebook will set indie gaming back 5 years - <AUTHOR> http://www.goplexian.com/2010/02/facebook-will-set-indie-gaming-back-5.html

<comment><USER2> My response to this sentiment is: STFU, then, and make one of these crappy games. Then you'll have millions of dollars to make whatever kind of other awesome games you'll want forever and ever.

<comment><USER3> Because I hate crappy viral games that make tones of money, I should shut up and make a crappy viral game in hopes of making tones of money?

No thanks.

If you had just said "Shut up and make your own game" I could respect that sentiment even though it is quite rude and basically shuts me down from having an opinion which (strangely) I thought was one of my rights.

But suggesting that I start making viral games for Facebook after I go through the trouble of writing an article explaining that I hate those types of games is just stupid.

<comment><USER2> It's not stupid. It's rational. You're lamenting the fact that the market is demanding games that you, as a craftsman, think are crap. Crappity crap crap.

On the other hand, if you make one of these simple, crappy games and it is successful, you will have millions of dollars that you can use to fund any type of game development you want.

I suppose you see that as compromising your principles or something. In any case, the fact that you "hate it" is an artificial barrier to your own success. If you really believe it's easy for you to make one of these games (and therefore easy to make millions of dollars), why wouldn't you?

I'm sure you'll rationalize it by saying "I don't want that kind of success" or "If I have to compromise my beliefs about game design even once to be successful, I don't want it."

Well, alright, that's fine, but you should see how you're limiting yourself strategically. The market is screaming right now, "HEY! MAKE THESE GAMES!" You're free to ignore it.

As for being rude, well, your article insulted a lot of quality game designers I know whose work, I'd wager, has touched more lives than yours ever has or will. So I'm not too worried about being rude, especially since I think your attitude is what's crappy, not these games.

</comment></comment></comment><comment><USER4> The author appears to have either a few false assumptions or simply wanted to rant against FarmVille and thought mentioning Indie games was required.

Indie games come from a few places. There are non-games industry and games industry creators. Those from the games industry obviously needed to work on some game before going Indie. They get experience, connections, and money from working on games just like farmville - without that industry start, who can say if we would have ever received World of Goo or others.

Likewise, those not from the games industry needed to know videogames exist. Maybe farmville will start a teen on the path to becoming someone on the caliber of Cactus.

What goes on in pop culture influences Indies, but it definitely doesn't control nor destroy them. Does it get more people exposed to videogames? Then I can't see it hurting the Indie scene. Note: it may "damage" mainstream games to some, but that is what you should complain about.

</comment><comment><USER5> This guy obviously has no idea how hard it is to make one of those hit games.

<comment><USER6> Explain.

<comment><USER7> Zygna (of FarmVille fame) has one of the most sophisticated testing and metrics operations on the Internet today. From externally observable evidence they're probably better at it than WoW and WoW is large enough to be its own national economy. (Zynga is a lot like IMVU or for that matter Toyota: I don't care if you have no interest in their product, their _processes_ are worthy of study.)

They aren't just throwing dung at the wall and seeing what sticks: they're very, very good at what they do. For every FarmVille there are tens of thousands of games which you have never heard of: their viral growth coefficient was .95 instead of 1.05, kaboom, that is all you need to fail. The platform is getting harder to develop for, as early entrants used techniques which were what SEOs might call "a wee bit grey" to gain traction, and these are either impossible now or will result in a new entrant getting hit with the banhammer. (For example, early social games maximized their viral coefficient by adopting a spam-early spam-often policy to user notifications, which ticked off a lot of Facebook users, causing Facebook to take a number of countermeasures. Ask somebody who builds for it to describe the specifics, but there are now throttles and some sort of system where you earn the right to use the viral channels.)

<comment><USER2> "Ask somebody who builds for it to describe the specifics, but there are now throttles and some sort of system where you earn the right to use the viral channels."

All of that is going away in five days. No more requests, no more notifications, etc.

Nobody knows what will happen! Pandemonium! Haha.

<comment><USER7> Memo to self: add "Do not build for platforms which could pull the rug from under you" to list of tips for founders with day jobs. That sort of thing would crunch my business like a tin can if it happened to me in the wrong week. (Actually, I think _all_ weeks are the wrong week for something that big.)

<comment><USER2> Facebook has done this at least three times previously. This time was better than previous because they actually laid out a roadmap with specific dates.

[http://wiki.developers.facebook.com/index.php/Developer_Road...](http://wiki.developers.facebook.com/index.php/Developer_Roadmap)

So, anyone who hasn't factored this into the development model yet is, well, dead or going to die the next time it happens. :)

</comment></comment></comment></comment></comment></comment><comment><USER7> _I want games with substance and style, richly textured and thickly layered, with real character development and breathtaking artwork. I want games which remind me of good books._

I paid $70 for this game when it was called Final Fantasy 13 and had a development budget in the upper eight figures (in dollars, not yen). If you want this from a game with a development budget in the five or lower six figures which is only paid for by 1% of all players and does not have a viral loop baked into its DNA, you apparently want to be disappointed.

<comment><USER3> "substance and style, richly textured and thickly layered, with real character development and breathtaking artwork"

...in the context of indie games. Context is important.

Maybe take a look at Braid or Machinarium.

</comment></comment><comment><USER8> Although this guy is correct in saying that FarmVille, Mafia Wars, etc are really crappy, game-play wise (but excellent slot machines), I think Facebook games hold massive promise for indie developers; they're bringing casual games to a massive new audience, and I think there's a lot of money in games that provide engaging gameplay and leverage the social aspect.

</comment><comment><USER9> _"Facebook is going to set indie gaming back 5 years, developers must follow the money, and nobody can deny that there is sick cash to be had playing the viral lottery on Facebook"_

I can cite many examples of people who have abandoned PC gaming for XBLA, PSN, Wiiware, Flash gaming, Unity web gaming, or the iPhone, I don't know of a single guy who has jumped onto Facebook. So the fundamental thesis of hardcore indie developers being tempted by the lucrative cash piles to be had in Facebook apps seems pretty dubious.

The other contrarian point I'd like to make is that Facebook has actually been really kind to indie developers. Facebook Pages are huge for self promotion: Facebook is consistently a top referrer for our game, even though it is a traditional, PC/Mac/Linux downloadable game (that's not even released yet).

<comment><USER10> Slightly off-topic: your upcoming game seems pretty cool; especially the setting. I've had the comic in my RSS feed since months and I was really thrilled to see it come alive the past few weeks.

<comment><USER9> Thanks! We are about to release a pretty sweet update to the comic in the next couple days.

</comment></comment></comment><comment><USER11> That is like saying "Pong set back gaming because it is not as complex or in- depth as D&D".

</comment><comment><USER12> I think the author is upset because developers are slowly learning there is this giant demographic of people who like playing games, who aren't 16-30 year old males, and these people have no problem paying for games. I think he's upset because games used to be made with only his demographic in mind, and now his group is being shifted back in how many games are developed for them.

</comment><comment><USER13> This guy is obviously not familiar with the indie communities and offerings on XBLA, Steam and WiiWare.

</comment><comment><USER14> This guy probably plays farmville and loves it.</comment>


Ask HN: How do you engage kids - <AUTHOR> I see that most kids in my family and neighbor hood spends most of the time on phone or tab watching garbage video like Ryan's channel or some other toy review channel. How do you engage kids creatively to limit the media and technology time <comment><USER2> If it's your own kid set hard limits. (30 mins per day or 2 hours per week only weekends) There's a huge industry in capturing your child's attention, and they don't own the downside.</comment>


The Tesla Cheerleader - <AUTHOR> http://www.nytimes.com/2015/08/29/opinion/joe-nocera-the-tesla-cheerleader.html

<comment><AUTHOR> Is Nocera trying to skew Jonas or Tesla or both? Or is he implying that stock analysts who make these price targets are really in bed with the underwriters?</comment>


Ask HN: Any Swift web frameworks ready to become as strong as Rails/Django? - <AUTHOR> Are we likely to see a viable Rails/Django type framework for Swift, now its been made available for Linux? <comment><USER2> There are a few Swift web frameworks:

[https://github.com/PerfectlySoft/Perfect](https://github.com/PerfectlySoft/Perfect)

[https://github.com/glock45/swifter](https://github.com/glock45/swifter)

[https://github.com/izqui/Taylor](https://github.com/izqui/Taylor)

[https://github.com/brownleej/tailor](https://github.com/brownleej/tailor)

</comment><comment><USER3> I dont believe that this would be possible even if Apple was backing such a framework, which officially is not.

You rarely see a situation where a newcomer can take from day one on any well established player, on any sector.

I still remember the buzz when Toyota was to join F1. "Experts" where predicting a championship in 3 years time, because of bigger pockets compared to others teams. Well, never happened.

</comment><comment><USER4> Swift is really not the right language for web development IMO. Doing this would be foolish.

<comment><USER5> Why?</comment></comment>


Ask HN: Where do you host your startup web services? - <AUTHOR>

Where do you host your startup?
I am looking for a solution that is cost-effective. I want to keep costs very low to start, but I can pay-as-I-grow for increased resources.
Imagine a URL shortening/redirecting service (e.g., bit.ly) That's not what my startup is about, but I will have that kind of traffic. I need to handle lots of hits to my web site, but each requires minimal processing and bandwidth. Top requirements are 99.9% uptime and low latency (< 20 ms).
A typical cheap/shared hosting service is not acceptable, even when just getting started, because they all suffer from downtime or "brownouts", where response latencies get slow if there's a traffic spike, of is some random user on the shared service is doing lots of database queries.
My application is currently built using Apache, MySQL, PHP, and C. I also need SSH access.
To process each "hit" to my web site, I have rather minimal requirements for CPU time, memory, database size, and data-transfer per hit.
What really seems to be the challenge (when just starting) is getting a guaranteed 99.9% uptime and low latency without paying a lot per month for dedicated hosting.
(I confess that I don't have any experience with Amazon EC2, so I don't know if that would be appropriate.  If you have any practical experience with the time/cost to get up and running on "the cloud", I'd love to hear from you.)
Any recommendations, suggestions, comments, or advice would be much appreciated.
You can reply here, or by email.
Thanks in advance,
David Jones, PhD, Pairwise Affinity
email@example.com,  http://dxjones.com
firstname.lastname@example.com,  http://pairwiseaffinity.com <comment><USER2> I will recommend Linode, for me it has been working great, no downtimes, good support ,etc.

I also having a good experience with GoDaddy, but it seems that I am an exception and not the rule, since everyone complains about it.

Good luck!

<comment><USER3> There's an excellent comparison of all the big virtual server services, with Linode recommended as a clear winner on almost all of the benchmarks (as always, YMMV).

<http://journal.uggedal.com/vps-performance-comparison>

The one thing I really dislike about Linode is they don't offer automated backups.

I don't have any experience with them as a customer.

<comment><USER4> Good link, thanks! I am researching a VPS for a change...

</comment></comment></comment><comment><USER5> You'll probably still get periods when your service is slower than other times, because you're sharing the network either way.

Anyway, I recommend Softlayer. A bit more expensive than Linode but at least you aren't sharing the server with other virtualized users. And besides, if your business isn't worth $200/mo in fixed costs for this important part of your infrastructure, why bother investing your valuable time anyway?

<comment><AUTHOR> Has anyone had experience to be able to comment on the pros and cons of: Slicehost or Rackspace?

</comment></comment><comment><USER6> I have the same question, but what if the uptime requirement is only something like 97%? Backups is a requirement though.</comment>


Ask HN:Mixcloud API - Peer Review - <AUTHOR>

We are slowly opening up our new api, and before full public release, we are putting the api and documentation through peer review. Essentially we would love to know your thoughts as fellow hackers on what you like and hate about the api structure. We accept it isn't perfect, but we can't see our own mistakes as well as others.
If you have a moment please check it out, and any feedback would be greatly appreciated.
http://api.mixcloud.com
[Edit] For those interested, Mixcloud is an online audio hosting platform, focusing on long form audio. This initial launch covers basic site interaction (favorite/follow) and all our meta data. The API authenticated is OAuth2 and JSON(P)/XML endpoints are provided. <comment><USER2> Haven't had a chance to have more than a very brief look so far; and I don't have any apps in mind just yet. But:

1) massive thumbs up for good use of HATEOS :-) Too many people miss it, and it makes writing clients much easier in my experience (also makes your job much easier in maintaining the API)

2) there's a couple of namespace conflicts which make me itch, but I don't know how important they are in practice. In particular:

<http://api.mixcloud.com/spartacus/>

<http://api.mixcloud.com/popular/> <http://api.mixcloud.com/new/> <http://api.mixcloud.com/me/>

at first glance, I would think that the latter URLS refer to users whose usernames are "popular", "new", and "me". If the endpoints look exactly the same, that's probably ok, but it's still a bit odd. If I'm writing an app which says "enter a username here", I have to remember that these are not valid usernames; and I can imagine similar sort of special-casing might have to be put in elsewhere.

3) I still hate OAuth - it's probably still the best of a bad bunch, though! Nice overview of how to use it in practice.

4) minor issue - for exceeding rate limits, I'd use a 403 code not a 503. 5xx limits boil down to "it's the server's fault". 4xx are "it's your fault" and in this case I think the semantics are more user error than server error.

<comment><AUTHOR> Thanks, for checking it out.

1) Cheers 2) Yeah we know, its a tricky one. We use those urls on the main site, and can't really change those now. The point of the api is to allow any developer to take a url on the site and be able to just swap out the www for api, to get a machine readable version. There are certainly some clashes, the current design decision was it is probably worth it. But we are still gathering responses and this can easily be changed.

3) OAuth1.0 and 1.0a I'd be with you all the way, but become quite a fan of 2.0 its easy to use and to implement, as all the crypto is SSL based.

4) Fair enough, over sight on our point, double checking the meaning and will get it swapped over

<comment><USER3> re 2) - you already have /artists/blah and /tag/blah so why not /users/blah ?

<comment><AUTHOR> Turns out our users really like vanity urls :) from an api perspective this makes sense except that it no longer mirrors the main site.

</comment></comment></comment></comment><comment><USER4> Took a quick look: 1) How do you plan on supporting Versioning in the API? 2) You need to clarify the GET/POST semantics: something like Supported request methods: GET would be helpful 3)As another user pointed out the /me /new etc are a conflict with the existing user namespace

<comment><USER5> +1 for versioning. Without it you are pretty much locked in to what you have now, unless you're willing to flip the switch and break all existing clients.

</comment></comment><comment><USER6> Great looking site! (listening to mixes as I write this)

So, this is the first time I've heard of you guys. MixCloud is basically a mugasha.com for everyone else, is that correct? Some of my DJ friends were recently looking for something like this. I'll definitely have to pass this along.

I'm still poking around in the API documentation. I'm trying to think of something to make to test it out. What are some example ideas you guys have thought of? I'm sure you guys have thought of some cool ways you'd like to see the API used.

<comment><AUTHOR> Cheers,

We have been around for a while, but tend only to shout in music circles, HN isn't really the right place! We have absolutely no idea what people are going to make on this. We have seen a lot of screen scrapping of our main site, and had loads of emails requesting api access. So figured it was about time we opened it up!

So far have seen guys build last.fm scrobblers, cue timestampers, an android app, and charts, so keen to see what people come up with! We will be setting it in stone for the upcoming Music Hack Day, and sure some interesting stuff will come out of this. <http://london.musichackday.org/2010/>

Mat

</comment></comment><comment><USER7> The API looks good to me. Nicely documented. Only found one thing that seems wrong.

You have: <http://api.mixcloud.com/popular/> <http://api.mixcloud.com/popular/hot/> <http://api.mixcloud.com/new/>

<http://api.mixcloud.com/popular/hot/> seems like it should be <http://api.mixcloud.com/hot/> to be consistent.

</comment><comment><USER8> Wouldn't you be better off exposing internal IDs? As it currently stands your keys and hence URIs are immutable, which could be a problem if somebody wanted to rename things after creating them.

edit: like the way you've emulated Facebook's Graph API wrt metadata - why not go all the way and drop XML support?

<comment><AUTHOR> Potentially, we debated using internal id's. The issue then becomes we dont have a globally unique id currently, so would need to code/make one. We also fix the url's in our system when they are first set and they become immutable.

XML, easy enough for us to do, so why not support it :) we just run it through a different serializer before outputting it. Seemed like a minor addition to keep the XML users happy...

<comment><USER8> Just because it's easy, doesn't mean you should include it ;) For one thing it makes the docs longer.

Will be interesting to see how many people use XML.

</comment></comment></comment><comment><USER9> clicky <http://api.mixcloud.com></comment>


Protecting your startups server from attacks - <AUTHOR> http://blog.jitbit.com/2011/03/protecting-your-startups-server-from.html

<comment><USER2> The solution to the password/username problems in the Unix-like world would be to use SSH with password login disabled, just using keys. Attackers can still brute force a key, but it's a pretty unlikely scenario. If you've got SSH, then you won't need FTP or any other admin ports open. Even more secure would be to VPN directly into the data center and access your servers over the internal network only - though that's probably overkill for most purposes.

I wouldn't put too much trust into obfuscation techniques such as using non- standard portnames and URLs.

Backups are of course deadly important. There are a million things that can kill or corrupt your servers. Most of the time, you don't really need to use an online service for that. Another machine somewhere in the world capable of cron, SSH and rsync will almost always do the trick.

It is also a good idea to establish mechanisms that enable the servers to alert you of strange things going on. For example, you can set up the system to message you every time a remote login takes place. If it's you, you can discard the notification. If it's not you, you know instantly that you've got a problem.

</comment><comment><USER3> I think point 7 needs a slight bit of expansion. -> Don't allow anything sensitive to be accessed from the outside world.

Creating a vpn takes seconds and provides a very strong wall between everybody who isn't you and your vulnerable services (ie. sql server/etc.)</comment>


If you could rebuild a city from scratch - <AUTHOR> http://www.elevatedgardencity.com/

<comment><USER2> This is a rather poor proposal. I mean it doesn't even attempt a modicum of non-bias as it doesn't even include a "disadvantages" section, which most notably holds: any leak in the membrane between soil and concrete can significantly reduce the longevity of the roofing structure, meaning property managers will inevitably be facing leakages below the top level - thus meaning the property managers would face significant problems attracting doctors offices, medical clinics and even food services places as any serious leak would be cause for closure and could incur serious expense for the property owner when they'll inevitably have to pay for lost income.

While I think this is a great idea, I'm doubtful that the advantages significantly outweigh the disadvantages.

Another notable disadvantage is that if you plan on growing anything more than grass and flowers AKA a tree, you're going to need significant soil depth in areas. This means that the building is going to have to cope with not only soil weight but of the soil becoming super-saturated with water. The drainage of the soil so as to avert too much water sitting in the soil. So on and so forth. Adding hundreds of tons of soil and water onto the roof of your building is going to put excessive demands in place and sky-rocket construction costs in your urban core. Given that many cities have a problem keeping businesses in their urban core, I don't see how making it more expensive for them would be beneficial.

</comment><comment><USER3> Speaking of earthquakes... How would an entire city react when it's tied together like on giant building? My guess is the legal aspects alone of determining cause of damage would prevent this type of city-wide design.</comment>


Twitch is reportedly blocked in China - <AUTHOR> https://www.engadget.com/2018/09/20/twitch-blocked-china/ <comment><USER2> Why are these digital service blocks seen as anything but tariffs by the US government? They cost American companies billions of dollars and help enrich Chinese companies.

Yes, maybe censoring is the purpose, but the financial effect is the same.

I'm not opposed to foreign countries fighting against tech monopolization either, it makes sense from their perspective.

I'm just wondering why the US government doesn't seem to see it as a hostile act and respond likewise. Do they just not understand the effect it has on American companies? That senator asking Zuckerberg how Facebook can offer a free service comes to mind...

<comment><USER3> _Cyber Security Law of the People 's Republic of China_[0] give it a read. On the surface, it's _like_ GDPR or other similar data regulation, but focus on different purpose.

The law basically gives the China government a legal foundation to block any service that does not comply with it, and most foreign service does not.

If you DO completely obey the law however, then you can operate in China. Amazon.com for example, can be accessed directly in China. But the law was very restrict and tricky, for most companies (Twitch for example) it's not worth the trouble.

(Maybe you don't know, China's game streaming service are heavily controlled: you could only stream few games that are selected by the platform. Streaming _illegal_ game that is not approved by the authority (Battlefield for example) is not allowed and likely results a ban)

BTW: Do we have any international treaty that can prevent political censorship?

[0] [https://en.wikipedia.org/wiki/China_Internet_Security_Law](https://en.wikipedia.org/wiki/China_Internet_Security_Law)

<comment><USER2> Thanks for the info.

Yes, I read about a Chinese gaming company that was affected by these restrictions, so it could be that censorship is the end game.

It's hard to ignore that US companies have lost hundreds of billions of dollars because they cannot operate in China, though.

</comment></comment></comment><comment><USER4> Should link to the original article, which is either of: [https://www.theverge.com/2018/9/20/17883736/twitch-china- blo...](https://www.theverge.com/2018/9/20/17883736/twitch-china-block-app- store) [https://www.abacusnews.com/digital-life/twitch-vanishes- chin...](https://www.abacusnews.com/digital-life/twitch-vanishes-china-weeks- after-spike-popularity/article/2165056)

<comment><USER5> Thank you. The main link only shows a blank page.

</comment></comment><comment><USER6> I wonder how this is going to work for say, The International 9, which is going to be in China. Is the government really going to block streaming of an event that so many of their citizens will have national pride riding on. Just hosting the event is something I expected the government to be proud of given Dota's profile in China.

Edit: Actually they're probably going to have it on national TV, that will allow them to have a layer of control over the broadcast.

<comment><USER7> One of China's larger tech companies also owns a competing streaming service with casting in Chinese, so most Chinese viewers generally don't use Twitch.

</comment></comment><comment><USER8> Wouldn't surprise me. Last trip to mainland China and nothing worked online. Apps like Instagram, sites like Google, etc. except Bing and WeChat. Perfect WiFi yet everything filtered.

<comment><USER9> To any one coming to China, get a shadowsocks server ready first! Or let me know if need help.

<comment><USER10> To be even more prepared: spin up two Digital Ocean Shadowsocks servers in case one gets throttled down (which happens after extensive usage). I often combine this with ExpressVPN as well, which still works in China (although many are sceptical of how ExpressVPN has managed to do so over the years, so expect there to be logging).

I wonder how long it'll take before Steam going offline as well, now that they are both thinking about implementing streaming and the fact that gaming is seen as unharmonious these days (e.g. refer to Tencent's recent stock drop). Steam is currently handled by Perfect World Games as the Chinese partner, so I'm curious to see what will happen.

<comment><USER9> vultr works even better

<comment><USER11> I wonder if it is because so many are using vultr for this purpose now they started to accept WePay.

</comment></comment></comment></comment></comment><comment><USER12> in other news Tencent, Baidu and Alibaba's video streaming services, VERY successful after "unfortunate" youtube ban, move into the new game streaming market.

</comment><comment><USER13> The Chinese Internet already blocks nearly all western social media sites. Twitch is a form of social media. Secondly, in June this year, China blocked livestreaming even on domestic sites. So it should come as no surprise that Twitch would be blocked under these rules.

</comment><comment><USER14> Can confirm. Wasn't blocked yesterday but is not reachable right now.

</comment><comment><USER15> I've been to China and before entering the country I was hugely critical of all the things we read on our mainstream media. However, after spending time travelling through large parts of China I'm on the opposite side now. People in China are so calm, so polite and helpful. Their streets are extremely quiet because there is not a single motorized two wheel vehicle. Even though it is a 1.4 billion nation, the largest on the planet, people live comfortable lives, they have space and time to recreate together (you literally see people exercise before and after work everywhere) and most importantly the nation is not divided. Yes, they have problems and not everything is perfect, but heck, they are 1.4 billion people and their president is not Trump, they don't hate each other and nobody shoots children in schools, people don't spend all day on Twitter to kill each other and nobody gets publicly shamed for a small mistake. Their problems in relation to their size are literally peanuts. Maybe democracy and freedom the way we know in the Western world is not that great for everyone after all. They are in a unique position and China is doing pretty well, so whatever they do which makes you think is bad, it seems to work for them better than for the US.

On one hand we read how foreign nations manipulate and taint the minds of our people through social media and that we drown in fake news, biased one sided reporting and an agressive ad driven consumerism which makes us vulnerable, but on the other hand we are critical of a nation which basically says no to this through censorship. Maybe the only way to keep 1.4 billion people at peace is through censorship, who knows? We only have one country to measure this experiment and they seem to be doing fine, right?

EDIT:

Lol, lots of people saying I was in China only for a day or what not and pointing out all the problems the country had to justify their criticism. I don't say they don't have problems, I'm saying their problems in relation to their unique size are actually not that big. The US has also lotsbof big problems, 100s of years of slavery, Vietnam war, Iraq war, killing lots of innocent people for no reason, Guantanamo bay, torture, etc

Yes, China is not a role model in human rights when you look at their history, but please save your poor criticism if you can't honestly compare two things without national pride and bias.

<comment><USER16> This is an idiotic comment made by an obvious fly-by tourist that hasn't lived in China for more than a few days.

If you actually lived in the country you would be infuriated by

\- toxic milk powder. Which the government has done very little to punish the offenders. The offenders got rich and fled. Oh yeah, if you complain in we chat, you get censored

\- disgusting air in Beijing and elsewhere.

\- tons of ponzu schemes that go unpunished. And hey if you protest, you get jailed and your sesame score goes way down

Etc etc etc

<comment><USER17> to say nothing of the people-eating escalators.</comment></comment></comment>


Interactive map of Cohen's testimony to congress - <AUTHOR> https://www.plectica.com/maps/TMLNTAJB0 <comment><AUTHOR> Flat image is here as well: [https://imgur.com/RpXQRBp.jpg](https://imgur.com/RpXQRBp.jpg)</comment>


'Sudden' cardiac arrests often aren't so sudden - <AUTHOR> https://www.nytimes.com/2020/09/01/well/live/sudden-cardiac-arrests-often-arent-so-sudden.html <comment><USER2> The presentation they're referring to is at [1]. I wasn't able to find a transcript or a video, perhaps it's necessary to become a member.

What I'd be interested in is how they deal possible confounding. Eg, that sick people tend to visit doctors more and sick people tend to have more health problems. Or, that people who have cardiac arrests tend to have other health issues. Is anyone with access able to help?

[1] [https://programme.escardio.org/ESC2020/Abstracts/220608-cont...](https://programme.escardio.org/ESC2020/Abstracts/220608-contacts- to-the-healthcare-system-prior-to-out-of-hospital-cardiac-arrests)</comment>


High-Speed Trading Firm Deleted Some Code by Accident - <AUTHOR> http://www.bloombergview.com/articles/2015-09-30/high-speed-trading-firm-deleted-some-code-by-accident <comment><USER2> In finance you'll find low accountability for developers. Basically finance is where great developers go to get paid a lot to become horrible developers. Very few companies in finance are pushing the bar on quality code since they culturally cannot accept the cost of that. It doesn't make sense until it is too late and by then their code base is too entrenched.

I've seen this at countless finance companies, and from interviewing people across the entire spectrum of finance. It is a rare corner of the industry where you'll find quality engineering. Usually everyone in a finance company thinks they are amazing engineers, and are just plain wrong.

My advice: work smarter, not harder.

<comment><USER3> I can confirm this. I just wish I had known about it before I accepted my current contract...

<comment><USER2> Get out while you can.

</comment></comment></comment><comment><USER4> The best part of this article is the feature graphic, that of a castle with the caption:

THIS IS A TOWER. PHOTOGRAPHER: DAMIEN MEYER/AFP/GETTY IMAGES

The article mentions "Tower Research".

Is the image/caption a joke, auto-generated by content, or just plain laziness?

<comment><USER5> It's a joke, consistent with Matt Levine's writing style. See for example the image and caption for his article on Panda Express: [http://www.bloombergview.com/articles/2015-09-24/panda- expre...](http://www.bloombergview.com/articles/2015-09-24/panda-express-s- life-coach-might-have-overshared-a-bit)

</comment></comment><comment><USER6> Every time I read stories about high speed trading, I have to wonder what is actually the point of high speed trading to the society. The point of a free and fast stock market is to provide monetary liquidity and stabilize the economy by shortening the feedback loop. But something tells me that our society and economy derives zero benefit from nanosecond resolution trading vs. trading with say 1 minute resolution. Meanwhile, the market is exposed to wild swings which might be smoothed over or even prevented if markets worked a little slower.

<comment><USER7> Faster trading allows market makers to operate with smaller capital investments. This lowers the barrier to entry in the market making business, creating more competition. More competition reduces the costs of trading. (And not just in theory. Market making used to be exclusively the domain of a few big players. It's not anymore.) Reduced cost of trading matters to almost everyone who's involved in the markets. Passive index funds, for example, have to trade to reinvest profits and to rebalance their composition. That's why Vanguard -- the most evangelical of the passive fund managers -- firmly defends HFT.

You may ask, well, why do we need market makers at all? Well, you don't have to use them. You have other options for trading. Call up your broker and ask. What you'll discover is that these other options have far larger transaction costs.

A lot of the complaints about HFT I've seen on Hacker News seem to think that no one should get paid for market making. I don't think that's possible. (And if it is, I'd love to know how.) Transaction costs are an inescapable part of trading; ultimately, you're faced with the choice between tilting your hand to other traders or paying some intermediary to take on risk for you. Generally, it costs less to choose the second option.

<comment><USER6> How does HFT help market making? Would a market that operates with a 1 second resolution be inherently unable to provide the same levels of liquidity that we enjoy today?

You argument is that Vanguard is a market maker, Vanguard likes HFT, thus HFT must be good. That doesn't really follow at all. Vanguard could be arguing in favor of HFT for all kinds of reasons, one of them could be that they have the money to rent server space right next to the main exchanges, and pay for the ludicrously low latency connections to the exchanges, so they benefit from HFT by being able to be quicker than others, and they don't want to loose there edge.

<comment><USER8> No. Vanguard is a large participant in the markets because it manages funds for long-term investors. Markets have bid and offer prices where you can instantaneously sell or buy shares, and these bids and offers are often provided by professional market-makers. Before automation, these were humans on an exchange floor. They could only trade a single stock at a time, hence the name "specialist", since they specialized in that issue. Volumes were also lower. To make enough to earn a living, that human on the exchange floor had to charge a big spread between buy and sell prices. For a long-term investor, this spread is an additional friction cost that drags on their returns when rebalancing portfolios.

Now a small team of researchers can make markets on many securities at once. They don't have to make as much money on each, so the spreads get smaller. Additionally, instead of a monopolistic specialist, these professional traders compete to win transactions by making better prices (higher bids and lower offers) than others. Many market makers try to keep a neutral "book" of positions, so if they sell some GS they may bid higher in other bank stocks to reduce their exposure to market risk. The faster a market maker can update his quotes or hedge when conditions change, the less spread he needs to charge.

[http://meanderful.blogspot.com.au/2013/01/hfts-dirty- little-...](http://meanderful.blogspot.com.au/2013/01/hfts-dirty-little- secret-where-money.html)

</comment></comment></comment></comment><comment><USER9> Doesn't matter how much money is involved or the quality of a team, someone somewhere will always do an oopsie. Maybe that particular 'code' should have had a little comment such as // used by ISO stuff do not delete

Commenting tricky / non-obvious code is well recommended.

<comment><USER10> Some unit tests would be nice. Maybe even a special folder full of tests that know when laws have been broken.

<comment><USER11> Probably exists now, and not before.

Writing this software would be very scary for me -- I'm confident in my work for the most part but I'm only human. To then let a "for-loop" go wild making thousands of trades per second on the entire market with real money against other high frequency traders no less.. man... you gotta be really really really really sure of your code!

<comment><USER2> It is not about confidence. It is about ownership and being a good engineer. A good engineer would have cared about the code base and ensured that a test would fail, a use case would be linked to that failure, and someone would see that they have now violated a regulation.

Then if the regulation changed, someone would grep through the use cases, and see what behavior is occuring/ how to modify the code base to cope with the change in regulations (this occurs a lot). Of course most finance firms don't do this and actually violate regulations all the time. There is literally a gold mine for the SEC/FINRA to go after, but the government is fairly incompetent at mining through the data and holding companies accountable. The reason being that they don't pay enough to hire the talent that would uncover the violations.

<comment><USER12> Real engineers are like true Scotsmen, because you can never have enough process.

In this case, _of course_ tests really do prove the absence of bugs rather than just (not) proving their presence.

I really don't like the whole "unit tests lets you not worry about breaking things" view. That's not confidence, it's _overconfidence_. And it doesn't even mostly work for things where "correct" is more fuzzy than "eventually produces this exact output".

<comment><USER2> It is confidence. It is the right tool for the job.

What would you propose as an alternative?

</comment></comment></comment></comment></comment></comment><comment><USER13> Acceptance testing fail! When changing code, and especially code that has consequences, doing so without tests is a bad idea. Doing so to protocol code without conformance tests is doubly bad.

<comment><USER2> Sadly, this is the norm in finance. You would be shocked at the shittastic state of the companies that dominate in this industry. They are literally a house of cards waiting for a strong gust of wind.

</comment></comment><comment><USER12> ...I'm missing something here. How do they not know how much they've asked to trade and not heard back on yet? Wouldn't they _have_ to track that, to not try to trade the same exact shares the same exact way a bunch of times? Is their local system maybe just more synchronous than I'm assuming would be possible?

</comment><comment><USER14> Can someone explain _why_ the SEC rules insist you _must_ buy from the exchange with the lowest price first? It appears to me to be a rule just to keep the small exchanges alive.

<comment><USER15> Otherwise a broker would just route mom n' pop's orders to the exchange that pays the biggest bribe to the broker (and screw mom n' pop).

<comment><USER8> Yes but for proprietary traders using their own capital, it doesn't make a lot of sense to force them to trade in a particular way since executing sub- optimally can only impact their own performance. There are legitimate reasons not to trade the lowest price market (maybe you believe the quote is slow, want to trade bigger size all at once, don't want to risk signaling to the market): [http://www.hudson- trading.com/static/files/RegNMShudsonriver...](http://www.hudson- trading.com/static/files/RegNMShudsonriver081304.pdf)

And retail brokers already do what you suggest. All their marketable flow gets sold to off-exchange market makers, while their limit order flow gets routed to exchanges that pay the highest liquidity rebates, Reg NMS just mandates what price it can trade at: [http://news.indiana.edu/releases/iu/2014/02/study-of- potenti...](http://news.indiana.edu/releases/iu/2014/02/study-of-potential- conflict-of-interest-in-routing-limit-orders%20.shtml)

</comment></comment></comment><comment><AUTHOR> On a related note, Knight Capital lost $440 million due to a software bug a few years ago.

[http://www.bloomberg.com/news/articles/2012-08-02/knight- has...](http://www.bloomberg.com/news/articles/2012-08-02/knight-has-all- hands-on-deck-after-440-million-bug)

<comment><USER16> Blew up the whole firm actually, and was more closely related to change management policies and systems monitoring.

The SEC order there is an interesting read for anyone involved in large scale transactional systems: [https://www.sec.gov/litigation/admin/2013/34-70694.pdf](https://www.sec.gov/litigation/admin/2013/34-70694.pdf)

</comment></comment><comment><AUTHOR> Given hindsight, it's always easier to ask for more tests or code comments. I guess the rule of thumb is that if the code is there, it most probably is there for a reason.

When something like this happens, it's always a series of oversights.

1\. Someone forgot to add comments or test cases while writing the code (or perhaps he wrote it but people are not running the test cases before commits).

2\. Someone else thought that the code is dead and deleted it (and skipped the test cases if there were some covering that particular scenario).

3\. Either the person deleting the code didn't wait for the code review or code reviewers missed that as well. (If code reviews are non-existent, it's a disaster waiting to happen).

So in the hindsight, write comments, write test cases, run test cases and do code reviews carefully.

</comment><comment><USER17> Move fast. Break things. Pay millions of dollars in SEC fines.

</comment><comment><USER18> A change like this making it through to production is indicative of a test failure, either automated or human. I have had the luxury of substantial human test teams on trading systems before 2008, and it was great. They wouldn't let something like this through...

</comment><comment><USER19> Who doesn't notice a huge deletion in one changeset? This seems to be a convenient excuse. The SEC report.

[http://www.sec.gov/litigation/admin/2015/34-76029.pdf](http://www.sec.gov/litigation/admin/2015/34-76029.pdf)

</comment><comment><USER20> I don't know much about stocks trading, can someone ELI5? Thanks.

<comment><USER2> Basically imagine you want to buy apples from 3 different fruit stands in different parts of a city.

Fruit stand 1 is the cheapest, fruit stand 2 is the 2nd cheapest, and fruit stand 3 is the third cheapest.

You want to buy all the apples out there.

The rule is that you have to go to the cheapest fruit stand first, and exhaust their supply before moving onto the next cheapest fruit stand. If you want to go to ALL the fruit stands at the same time you need to tell them you are an 'OK' guy and are really buying fruit everywhere.

Well, someone deleted code and ignored one of the fruit stands. This violated a rule and cost the fruit buyer a lot of money in penalties.

<comment><USER21> Why does the SEC care that you bought shares at a price higher than the cheapest? How does that hurt anyone other than yourself?

<comment><USER22> If I ask my broker to buy some stock, I want it at the lowest price. My broker, left to his own devices, may prefer to buy at a higher price because it is more profitable _for him_.

This rule seems designed to protect the consumer when the consumer and the stock brokers goals are not aligned.

<comment><USER12> The article says they only do proprietary trading, which I thought means they only use their own money. I guess that's rare enough that the rules apply regardless in order to simplify things?

<comment><USER23> The rules apply to the whole system -- notably exchanges, the exchange "members", and broker-dealers. Latour is a broker-dealer (BD) and thus have to play by the rules, even if they don't have customers.

If they weren't a BD, their BD (which is required to ultimately reach the markets) would be on the hook for letting this happen. ISOs are something that get a lot of compliance/regulatory scrutiny and most BDs don't let their customers use them. If they are allowed, there's a lot of reporting/transparency/surveillance to ensure they are issued properly. And as you can see from this fine, there are a lot of rules and corner cases one must cover and apparently even the best firms mess it up one way or another.

Latour's previous fine (read Matt Levine's continually excellent articles about this stuff) was for "Net Capital Requirements" which are designed to keep customer money safe, particularly in the presence of other customers who might blow up ... of course Latour has no customers, but it is still the rules. [Although IMO this one was a grey area where Latour probably had better models than what the rules required, but since they didn't match the rules properly they got fined.]

</comment></comment></comment></comment></comment></comment><comment><USER24> Another reason code needs to be idiomatic.</comment>


Gimp and more in your html5 browser - <AUTHOR> http://blogs.gnome.org/alexl/2011/04/18/broadway-update-3/ <comment><USER2> Definitely some amazing work.

Now just combine this with emscripten (<http://emscripten.org/>), and you have GTK+ applications running entirely in the browser.</comment>


Is Require.js worth using for large applications? - <AUTHOR>

I've been working on porting a large application to Require.js and keep hitting roadblocks that lack documented solutions that work for me (Underscore not loading, dependencies for modules being undefined)? I was wondering if anyone else had this experience and if it's worth continuing to try to implement on my site. I don't want to spend all this time implementing it and then have to deal with bugs whenever I add some JS to the site. <comment><USER2> yes it is worth it. you should always use require.js or other AMD.</comment>


Time travel experiment - <AUTHOR> https://twitter.com/Machine1235/status/645948089388298240 <comment><AUTHOR> I think it would be a better way to know if time travel to the past is possible. A physical meeting is too dangerous for them.</comment>


Show HN: The Internet Thinks – Say what you'd like to see - <AUTHOR> http://theinternetthinks.com

<comment><USER2> a possible chrome microphone exploit? (refer: [https://threatpost.com/chrome- eavesdropping-exploit-publishe...](https://threatpost.com/chrome- eavesdropping-exploit-published/103798))</comment>


Ask HN: How can I run a program for 1 month against my will? - <AUTHOR> I wrote a program that does various things around my smart home at various times. I want this program to run for exactly 1 month, even against my will if I change my mind. What's an interesting way to try and achieve this?
Perhaps something along the lines of: starting the program in admin mode, having the password changed to something I don't know, having the password somehow revealed to me at the end of the month. That way, hopefully, the only way to stop the program is by reformatting or some other similar annoying barrier. Just a random idea. <comment><USER2> How strong is your will? You can always just unplug the box the program is running on, so your in-the-moment desires will always have the opportunity to win.

So the real question is what kind of disincentive can you bake in that will be stronger than your future self's desire to turn off this mysterious program.

If you like money, you could have the program generate a crypto wallet but don't save the private key to disk. Program it to refund any coins sent to it after 30 days, and now you have a financial incentive to keep that process running, since if it ever loses power or otherwise terminates, your money disappears.

<comment><USER3> Well, if the program ran on their main computer, that would be a pretty strong disincentive to unplug it.

</comment></comment><comment><USER4> How about some basic psychological barrier ? Do some 'strange' ritual before getting the password under pursuing circumstances. Like break emergency glass et.etc.

[https://psychcentral.com/blog/3-more-obstacles-in-therapy- an...](https://psychcentral.com/blog/3-more-obstacles-in-therapy-and-how-to- overcome-them/)

</comment><comment><USER5> This is so vague. What do you want done around your house? Why do you not want the ability to stop it? How unstoppable does it need to be?

<comment><USER6> Probably something like turning off the lights at a specific time to reinforce good scheduling and with the ability to not turn them back on to prevent easily un-breaking a habit?

</comment></comment><comment><USER7> Make a program which changes the password that you mention to something random (as in, the executable executes Random() on start and changes the password). After that the programs waits for one month and at the end outputs that string to you. This has the effect that 1. killing the process won't do anything because the password is alredy changed 2. you can't figure out what's the new password because it was created during runtime and it's random 3. you have to wait for 1 month for sleep command to finish and outpuy be displayed in the console.

</comment><comment><USER8> Just an idea, don't know how workable it is...

Rent a vps. Prepay for a month. Start your program. Write code to change the vps provider account's password (and 2FA?) and ssh password to lock you out. Have the code change passwords back after a month.

On second thought - don't have the code change passwords. Just have the code generate a long random password that you paste into the change password fields. Then the code emails you the password after the month is up. That way you don't have to try to automate the VPS provider's change password system.

</comment><comment><USER9> This seems like the kind of thing a father might impose on a teenage child and have backfire hugely, not that this is your situation! Not to mention malicious pranks...

However, if it's just for you, maybe you could make the smart home keee $CONDITION until a particular smart contract on the Etherium blockchain changes state, and have the contract keep some money in escrow until one month has elapsed, at which time it is sent back to your wallet. If you cancel early, then the money goes into, say, the pi-hole donation address.

</comment><comment><USER10> Just consider yourself a failure if you stop the program.

<comment><USER11> exit code 1

</comment></comment><comment><USER12> Don't forget, even if you can't physically access it you could always flip the breaker. Run it on a raspberry Pi running off of a 10000mah phone battery, charging from an outlet. Make sure the outlet is on a breaker you couldn't live without for 24 hours (fridge is a good bet). For physical barrier, put it behind the fridge (if that's enough to dissuade you, don't know the use case).

</comment><comment><USER13> I don't know your setup, but a few Ideas:

\- program just runs 1 month, put a raspberry in epoxy

\- generate a long password (long enough so it doesn't matter you saw it a few times), find some reminder service or ask a friend to mail it back in a month, delete all local evidence of the password

\- generally sealing all relevant equipment with a lock could work. Key has to go to someone else.

</comment><comment><USER14> Encase the computer (along with a backup power supply that can last up to one month) in enough concrete that it would be impractical to break open. Ensure network packets can get out to issue commands to your smart house, but inbound connections are not allowed for one month.

</comment><comment><USER15> Hmm is forcing future you to do something going to change how you feel about doing that something?

</comment><comment><USER16> If you have physical access to the box, you can always unplug it or destroy the unit. Where do you draw the line for the obstacle? Regardless, you may want to look into running a dead man's switch on an external box that you don't physically control (AWS?).

</comment><comment><USER17> A low power device, powered by a battery, and put into a safe. Tell a friend to lock the safe with a code, go somewhere unknown to you, and block you from all kinds of contact for a month.

</comment><comment><USER18> Ehereum was designed to do this. Look it up. I'm a bit stunned no one has mentioned it.

</comment><comment><USER19> Have someone else run it for you.

</comment><comment><USER20> Pay me $1000. I give you it back if you don't change your mind.

</comment><comment><USER21> I think the better question is _why_?

Why do you want to run for one month even if you change your mind?</comment>


Meet Cupid: Its not for Dating - <AUTHOR> https://github.com/lgrangeia/cupid/ Here's the latest in the HeartBleed fiasco. Those of you running 802.1x with EAP should make sure your systems are fully patched <comment><USER2> TL;DR: It's a Heartbleed exploit.</comment>


In search of the perfect writing font - <AUTHOR> https://ia.net/topics/in-search-of-the-perfect-writing-font/ <comment><USER2> I used to tell myself I couldn't code or write without the perfect font. I'd spend hours looking for it, and end up not getting any work done. When I finally did get around to actually working, five minutes in and I'd forget about the font completely.

I have a (rather lazy) friend who's been asking me to help him start a blog for years now. I've promised to after he produces his first block of content, and he keeps saying he can't write if he doesn't feel the design is aesthetically pleasing. If he'd spent his time writing instead of worrying about this, he'd have a crappy initial draft, several revised drafts, and probably something decent by now. But no, that prohibitively unattractive font!

It was nice of iA to write this up, and design posts are a fun read, but does anyone who's busy actually writing care about this?

<comment><USER3> I recently converted my dynamic DB-driven blog to a static website. I did not predict how badly the added latency between having an idea, writing down the first flawed paragraph, saving a draft, reading what I wrote, then revising and publishing would reduce my writing output. Sure, I can write in Google Docs, but because it's not on my site one click away from being "out there" I am far less compelled to write down my fleeting ideas. Over time I have learned that fleeting ideas are the best ones because they exist at the limit of your understanding. Maybe if you help set up his blog, he'll be more likely to write?

<comment><USER4> I had the opposite feeling. I wrote my PhD thesis in 1998-2000 and the editor of choice at the time was Word. It was a pain to deal with the formatting, spacing, page breaking and other -ings.

I then tried LaTeX and all problems vanished. Since I could not influence the output (at least without a lot of work) I simply gave up and started to "code my text". It was way faster than admiring my artful working all the time, I just complied the text from time to time and I was done.

This is how I see Markdown today.

<comment><USER3> Markdown is a must. I used it on dynamic blog and on my static site, but I paid less attention to my writing when posts were not "live".

I believe that Bret Victor's Inventing on Principle concept of minimising the time between having an idea and seeing a change universally applies to every user kind of interface.

</comment></comment></comment></comment><comment><USER5> If you want a blog post about actual innovation with monospaced fonts, try _Class Based Contextual Positioning in MonoSpaced Fonts_ by Andreas Larsen, which is used in his Monoid font[0][1]. It also deals with this problem of characters not having the same natural width, but in a way that actually preserves the monospace characteristic.

I wish its usage would spread to other fonts. It's probably a lot of work to implement though.

[0] [https://medium.com/larsenwork-andreas-larsen/class-based- con...](https://medium.com/larsenwork-andreas-larsen/class-based-contextual- positioning-in-monospaced-fonts-cb6b8b9ffe6f)

[1] [http://larsenwork.com/monoid/](http://larsenwork.com/monoid/)

</comment><comment><USER6> Despite this article's length, there isn't a single full text example.

The author uses the phrase "duospace" font a dozen times before actually explaining what it is: a mostly monospace font. I find it ironic that an article about perfecting the art of writing is so devoid of content. Did we really need 3 pages of justification for a big reveal of... a font specimen?

</comment><comment><USER7> For the last couple of years I've been using Triplicate as my standard monospace font, and it has a Poly variant which is proportional and works really well for code presentation (provided you aren't trying to line things up with spaces).

It makes things like i, j and space _narrower_ , rather than things like w and m wider as this article discusses. I reckon narrowing some yields a more pleasing result than widening some.

[http://triplicatefont.com/](http://triplicatefont.com/)

<comment><USER8> I'm also using Triplicate for a lot of writing. I switch between Triplicate Code and Font Bureau's free Input Mono family for coding (and console display), but Triplicate Poly is terrific for prose writing. I suppose I feel some of the same psychological "draft vs. final" reasons that iA talks about in the linked article, but I just don't like iA's font choices very much.

Triplicate Poly _does_ make the 'm' and 'w' characters a little wider, too, although not by the same amount. It's a true proportional font rather than "duospace."

</comment></comment><comment><USER9> This view seems to have fallen to the wayside, but I vehemently prefer rasterized / bitmapped fonts. Every type of font smoothing looks blurry to me and causes eye strain. Of course, very few modern fonts look good without smoothing - only a few of the old standbys (Arial, etc...) have usable bitmapped versions.

While Linux handles this fine, Windows requires replacing Segoe UI at the registry level in order to fully change over.

<comment><USER10> What are your favorite fonts?

<comment><USER11> Personally, I use Terminus in my text editor and terminal. Bitmap fonts just look much crisper and cleaner to me.

<comment><USER12> I have found that I dislike fonts that have overly squared-off corners, in which all the letters look so uniform. So, I just don't understand the appeal a lot of boutique "programming" fonts like proggy or monoid.

I tend to like monospace fonts with a bit more rounded corners, which to me gives them a bit more "character" (one could almost say quirkyness) and readability.

good examples of this would be Bitstream Vera Sans Mono, Monaco and to a lesser extent, Iosevka

</comment></comment></comment></comment><comment><USER13> I can recommend Iosevka¹. It looks a bit condensed, which takes time getting used to, but after that you have the benefit of monospaced, without it being so wide.

It's also highly customizable.

¹ [https://be5invis.github.io/Iosevka/](https://be5invis.github.io/Iosevka/)

white on black paragraph sample: [http://malea.lacerta.uberspace.de/up/11a0e427-7717-4f25-a74d...](http://malea.lacerta.uberspace.de/up/11a0e427-7717-4f25-a74d-7dcad933e0d0.png)

<comment><USER12> I switched to Iosevka for terminal can't stop using Bitstream Vera Sans Mono (or Monaco) for code editors, though

</comment></comment><comment><USER14> The goal here seems to be to have that "typewritery" look that people associate with writing drafts, but add a bit more readability than is possible in a monospace font. Fair enough, though I'm not sure why having exactly two character widths is preferable to having three, or five, or simply designing a proportional font with wider typewriter-style characters.

For programming, "duospace" works exactly like any other proportional font. The fact that some letters have the same width doesn't buy you anything in terms of alignment. Unless your style guide forbids the letters "m" and "w" in method names. ;)

</comment><comment><USER15> I disagree with iA'a philosophy. I like to write fiction with proportional serif fonts, often quite similar to fonts that would be used in print. Sometimes I change fonts to defamiliarize the text, which helps me read it with fresh eyes. The last couple years I've mostly been using the Mate font. [https://www.fontsquirrel.com/fonts/mate](https://www.fontsquirrel.com/fonts/mate)

<comment><USER16> I don't know why, but that font is giving me some serious comic sans ms vibes.

<comment><USER13> it's not meant to be blown up. Look at the paragraph examples in the "specimen" tab. It looks really tidy in smaller size.

</comment></comment></comment><comment><USER7> Fun fact that people may not be aware of: not all glyphs in monospace fonts are actually the same width (provided the font supports enough of Unicode). Some glyphs are twice as wide, such as CJK/fullwidth characters in general. The Unicode standard includes a list of codepoint column widths—some zero (e.g. combining characters), some one, some two, some one or two depending on the context (the language).

<comment><USER17> a lovely example is uFDFD, ﷽ (single char)

<comment><USER7> I am referring to Annex #11 (East Asian Width) of the Unicode Standard, which is all about CJK. Under those rules, U+FDFD is one column wide. If you happen to see it rendering really wide in the middle of text set in a monospaced typeface, it's probably because a fallback font is being employed. In one arrangement locally I see it as eleven-and-a-bit columns, because it's using it from another font; in another which sticks stringently to actual columns and doesn't use fallbacks at all, it's one-column-wide blank.

I do not know of any monospaced fonts that include U+FDFD. I'm not at all sure what they would do with it.

What I find particularly amusing about U+FDFD is the broad range of widths and styles it can take. I see three wildly differing styles depending on the font employed (two long ones and one roughly square one).

<comment><USER18> My terminal displays it just fine, so it must be in at least one of the bitmap monospace fonts that I have configured it with.

<comment><USER7> That doesn't mean it's being rendered monospace.

(When herein I say "terminals" I mean "terminals/renderers/text editors/things like that".)

Some terminals are truly monospace, simply not drawing glyphs that aren't available at the right size (e.g. xterm).

Some terminals don't actually care about being monospaced all that much, and are quite happy to handle glyphs of differing sizes, though up/down movements _may_ still be character-based (e.g. Notepad++).

Some terminals try hard to both be monospaced and show you useful stuff, and will either horizontally truncate the glyph, or draw subsequent glyphs on top of any overflow (e.g. gVim).

Some terminals simply make a total hash of it, with the cursor positioning being monospaced, but drawing subsequent characters after the incorrectly-wide glyph (e.g. Ace).

Your example of U+FDFD is bonus fun because it's RTL. Most terminals don't handle RTL at all well. (Terminals capable of proportional rendering such as Notepad++ and plain old Notepad are much more likely to treat it properly in my experience.)

<comment><USER18> Yes it does. I wrote the terminal program. I know what it does with fonts.

<comment><USER7> I'm curious: how many columns is it occupying? From all that I can see, it should be a single column, with the font incapable of overriding that.

<comment><USER18> I can tell you that terminal emulator is finding the character in the fonts that I have configured it with. But it won't tell you the stuff about character widths that you want to know, I suspect.

As I mentioned, my terminal emulator uses bitmap fonts. Whilst bitmap fonts do have a mechanism of specifying either single-width or double-width characters, it ignores that and displays _everything_ in the same width, rescaling everything with some slight special-casing of block graphic and horizontally repeatable characters. So whilst by the looks of the amount of detail in the glyph on screen, U+FDFD is a double-width character in the font file; it occupies a single column.

See the "Fonts" section of [http://jdebp.eu./Softwares/nosh/guide/console-fb- realizer.ht...](http://jdebp.eu./Softwares/nosh/guide/console-fb- realizer.html)

I am currently using a mixture of monospace bitmap fonts that I have obtained from various places:

        --vtfont-normal-i fonts/t0-16i-unicode.fnt --vtfont fonts/9x15.fnt --vtfont fonts/k16-1990.fnt --vtfont fonts/unifont-7.0.06.fnt

So U+FDFD is somewhere in those. (-:

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> It's painful to see an article this long discussing typefaces in detail that uses the word font incorrectly so many times. In casual usage I let the mistake by, but the author of this article really should know better.

The visual design of the letterforms and spacing of text is a typeface, not a font. A font is the delivery vehicle for a typeface -- it's a file format.

<comment><USER20> A typeface is the design, a font is a specific incarnation of it. Helvetica Bold 12pt and Helvetica 18pt are two different fonts from the same typeface, Helvetica.

This comes from letterpress days where "font" referred to a collection of lead characters of a given typeface, weight, and size.

<comment><USER21> No, couchand is right. Now a font is the file (you're almost right on it's origin, it originates from steel punchcutting where each point size did need it's own font). So a font is helvetica-bold.otf not Helvetica Bold. Helvetica Bold is a weight of Helvetica. (All of this is likely to alter slightly though with the advent of variable fonts.)

<comment><USER22> Except, arguably he's also wrong.

One definition it font is as described above. Another, as defined by usage, is as the original author used

</comment></comment></comment></comment><comment><USER23> The best font is the one you're most used to. When I've been involved with people testing their new "greatest ever" font, their user testing always shows people have a strong preference for what they're familiar with. Even if that's Arial or Comic Sans.

</comment><comment><USER24> As someone who has often spent hours readjusting fonts on their documents/apps to achieve the correct feel, it's somewhat comforting to know that there are people out there who take this obsession to whole new level!

<comment><USER25> I don't think its about obsession. Most fonts I tried I could not read or write code. I settled to amazing Adobe Source Code Pro Semi-light, but time to time Notepad++ resets it to default which immediately bothers my eyes. Adobe came with wonderful font, and its free!

<comment><USER24> I just checked it out on github - that is indeed a nice font for development.

</comment></comment></comment><comment><USER26> With a 50% width space option, the duospace approach might be usable for "pedantic" code indentation (that is indentation beyond just nesting, but also vertically aligning elements other than the start)

<comment><USER27> Exactly. But without that, midline alignment is shot.

I'll stick with 8x13.

</comment></comment><comment><USER28> For coding, anything like Menlo, Consolas seems to do the trick.

For reading, I've come to admire Amazon's new fonts: Bookerly, Ember, and Interface.

But I also find myself going back to good 'ol Times New Roman for writing and reading most things. Runner-up: Georgia.

Other interesting serif fonts include:

Adobe Caslon Pro (used by The New Yorker) ITC Galliard (used by Library of America)

</comment><comment><USER29> Another attempt for a quite similar idea is Cartograph [http://connary.com/cartograph.html](http://connary.com/cartograph.html)

</comment><comment><USER30> The author claims that monospace fonts are better for writing (while proportional fonts are better for reading). Is there any research to actually support this central claim?

</comment><comment> d--b I think iA's deal is to simulate a typewriter. It's a hipster's thing. Like obsessing on font design.

It's not a bad writing experience though.

</comment><comment><USER31> There's also the question of the perfect writing font for non-Roman languages, such as CJK (Chinese, Japanese, Korean), Arabic, Greek, etc.

</comment><comment> mark-r The ink traps in IA 735 are pure ugliness at large font sizes. They're totally unnecessary unless you're printing with actual ink!

<comment> mark-r For those that might be confused by what I mean: [https://en.wikipedia.org/wiki/Ink_trap](https://en.wikipedia.org/wiki/Ink_trap)</comment></comment>


Bluetooth technology turns red lights green for emergency vehicles - <AUTHOR> http://www.brisbanetimes.com.au/queensland/bluetooth-technology-turns-red-lights-green-for-emergency-vehicles-20170221-guhs0y.html <comment><USER2> what could possibly go wrong? im sure theyre totally 100% hack proof!</comment>