Ask HN: How do you think about programs? - <AUTHOR>

I've been trying to learn Apple's Cocoa libraries for a few weeks now. I found that writing small applications is a piece of cake, but when I start writing larger apps I tend to get lost in the complexity of my own creation.
My question is this: how do you think about your applications while you're writing code?
Hillegass uses object diagrams (is that what they're called?) to represent relationships between objects in his apps. How do you do it? More importantly, do you use a pen and paper to design your programs up-front (my preferred method) or do you jump right into the code? Do you use diagramming tools to create your object diagrams? Do you write specs? Do you write notes to yourself?
What I'm trying to find out here is an effective method for creating a high level overview of the app I'm working on so that I can tape it to the wall and look at it to figure out what I have to do next. My usual method of writing down TODOs in random notebooks and losing them at college doesn't seem to be working out that well. <comment><USER2> This is cocoa-specific, though some of it generalizes.

I'm not a huge fan of the Hillegrass book for actual beginners, but sadly there's not a better book out, yet; it's almost easiest to learn some other, better-documented GUI application framework, then come back to Cocoa (assuming you have time).

Assuming you don't have that kind of time, though, here's my recommendations:

Cocoa development also depends heavily on the workings of NSApplication, and it's a good idea to stop and read up on how that works; it's super helpful to actually know what's going on between the points where the code you wrote is being used, and to understand that you need to have a working understanding of how NSApplication is structured.

Apple has ok docs on this (I'd start by reading up on NSRunLoop, then looking up anything you encounter you don't understand), but nothing amazing.

Once you've gotten that understanding, you'll have a much easier time understanding what you have to do to make an application do what you want.

Now we move on to handling specific applications.

I suggest the following design algorithm:

"Simultaneously", start figuring out your application's user interface and its data model. I say "simultaneously" but it's really a bit of a back-and-forth.

For example, you decide you're going to write a blogging client (I think this is an example in Hillegrass's book?).

So, ask yourself what data items does a blog post typically have? Provisional answer: title and body.

What user interface elements do you need for a blog post? The data model dictates those: right now, a text field for title and a larger text field for the body.

If we were going to be more realistic we'd probably want a richer data model (some "authored by" field, some field for "tags" or "categories", etc.) and a more-complicated user interface to match.

If you hit a "stopping point" in this process -- meaning, a point @ which you are satisfied that your data model covers everything it needs to and your user interface elements are complete -- we can move on to the next step.

The next step is getting a sheet of paper, or a whiteboard, etc., and putting up some representation of each user interface (eg: each type of window or dialog), with lots of space between them.

Next, you go through each user interface item and ask

\- "what information does this item need to display itself properly"? (eg: a blog-post-editing view needs the blog post's data object.) You should annotate each user interface item with some representation of the data item(s) it needs to render itself.

Once you've done that, you make another pass through each user interface element, asking the question:

\- from this user interface item (say, the blog post editing window), which other user interface items can I get to? Which other user interface items can I be arriving from?

Once you've done that, you go back through and ask the following question for each "entry path" into a user interface item:

\- for each entry path into this user interface item, what information would I need to set up this user interface item correctly? (for example: if you're editing an existing post, you need to have the data object corresponding to the post you're editing; if you're creating a new post, maybe you need nothing, or maybe you need some kind of placeholder reference to the post-to- be-created)

Note this is DIFFERENT from the step where you listed the data item(s) the user interface item needed to render itself. For example, to render itself, the blog-post-editing-view needs SOME blog post data object; however, if you're moving from a list of all blog posts to editing a specific blog post, the blog post editing view needs THAT SPECIFIC BLOG POST.

Once you've done that, you make a final pass, asking the following question for each "exit" path:

\- for each exit path from a user interface item, can I supply the information the user interface item I'm entering needs? (ie: if you're leaving the "blog posts" listing view to go edit a blog post, the blog-post-editing-view needs the blog post's data object; can you supply it?)

For example: if I'm leaving the "blog post listing view" and heading into the "blog post editing view" to edit a specific blog post, then the "blog post editing view" needs to be given that specific blog post to render.

Is it possible to get that information from the "blog post listing view" to the "blog post editing view"? Yes, b/c the "blog post listing view" knows which "blog post object" you selected.

You'll find yourself answering "no" when you have what I'd call a long- distance dependency in your user interface workflow: to get to view C from view A you pass through B, but the naive implementation of B doesn't let you pass along some needed bit of information from A to C; this is probably the single-most-common source of frustration/head-slapping when you're first learning Cocoa (or any GUI app).

Hopefully, you'll finish all this work and have found no unpleasant surprises (ie: you have exhaustively analyzed your program's workflow using the above information and all information you need can be delivered to where it is needed).

If you've got some gaps -- user interface modes that can't get information they need -- you should fix your diagram (adding extra data-items to user interfaces as-needed).

Once you're done with this you should more or less have the "Model" and "View" tiers of your application figured out -- the "model" objects are all the data model objects, and the "view" tier is all the user interface items you've made (eg: all the separate .nib files).

You can go ahead and write the data model classes and create the .nib files now.

From here, building out skeletal controllers is pretty easy: for each user interface item, you build out a controller class, making sure it has fields for each user interface element in your user interface item (eg: it has one field each for the "title" text field and the "post" text field) and one field for each data item it has to know about (eg: a "post editing view" controller has a field for a "blog post" data object).

You now have to add the actual logic to the controller. This comes in three main forms:

\- you add code to synchronize the user-interface with the data item (ie: if I've got this "blog post" data item, write a method that makes the on-screen "title" field == the "title" field in the "blog post" data item, and so on)

\- you add code to synchronize the data model with the user interface (ie: if the on-screen "blog post" has such-and-such title and such-and-such post, this code makes the "blog post" data item's fields the same)

\- you add code for handling each "entry" and "exit" from the corresponding view (eg: one method for setting up a view to start editing an existing blog post, one method for setting up a view to start creating a new blog post, and some methods to handle closing-the-view-and-saving-your-work)

If get through with all the above, you're going to be pretty close to finished with whatever application you're writing; the last steps are dealing with stuff like the "startup" code (when the program starts, how does it bootstrap itself into a user interface state?) and similar tasks.

The above process is extremely heavyweight, and I don't pretend to use it anymore -- I might sketch out particularly-complicated parts, but not the whole app -- but I do recommend mocking up at least your first few progs with it; it's a good learning exercise, and it's a little more "obvious" than a pure "object diagram".

</comment><comment><USER3> I've tried a lot of systems (omni* and a few others), but here are what stick with me:

Emacs Org-Mode for the day-to-day stuff that I want to keep in front of me when I'm writing code. It's essentially perfect for it. Using the tables with pasted-in code is utterly fantastic (hint: replace-regex '^' with '|> ' and it'll keep your indentation before you hit tab and tablify the code).

Org mode does tables, outlines, todo lists, agendas, mostly everything a programmer's going to want day to day.

For higher-level planning, I leave the workstation. Get a cup of coffee/soda/juice/who-are-we-kidding-its-coffee and a table away from computers. A moleskine (the squared one, with the grid layout) and a good pen (I like these $4 pilot extra-fine vballs) is what I use. Relaxing music in noise-canceling headphones FTW.

Do yourself a favor and begin with the habit of writing the date on a page when you start writing on it. It's useful for you to see your progress over time, and it can be helpful later in patent disputes.

As for the thinking process itself, here's my heuristic:

\- Small apps are mostly driven by a framework you just use (probably some MFC/DI garbage). Keep your code clean & organized, and work a little to keep the expected chaos from working with always-mysterious frameworks contained. E.g. don't ever trust the framework to handle your model code for you. Use proxy classes, multiple inheritance, whatever to firewall yourself from that chaos.

\- Medium apps have enough internal structure to get past the cognitive mass of the framework. There, you end up with a top-level abstraction that structures the app. Be it a pipeline, a set of command objects, or a data structure you maintain, there's one big one and the app is structured by it.

\- Large apps have a few of these. They're independent subsystems and you firewall their interactions the best you can. Unless you've got the time/labor for large-scale refactoring, you generally just try to keep the abstractional dams from breaking. In those cases, I usually try to get some middleware in there, so I can easily handle stubs, testing, and interactive use with each. If you've got a REPL, you can avoid it, but in C++/Java, it can really help.

<comment><USER3> Edit: s/MFC/MVC/. Freudian slip there.

</comment></comment><comment><USER4> I started with post-it notes, but kept losing them too. Now I use Freemind, and have a really big whiteboard (of the manual variety) on the wall in my office.

You mentioned you're having a problem with big apps. I'm the same way. At the risk of sounding condescending (which I'm not) break the big app down into a bunch of small apps (features). I find this works for me in two ways. 1.) I can code the small apps easier (and then ideally put them together into the big app). and 2.) If I find I'm getting feature creep, it's easier to dump 1 or 2 "small" apps rather than rethinking the whole project.

</comment><comment><USER5> "Divide each difficulty into as many parts as is feasible and necessary to resolve it."

René Descartes

I break the program in functional parts that are easier to grasp and I assemble those parts only after having written tests for those parts.

</comment><comment><USER6> No one method works all the time, this depends on the paradigm of the target language. At least i can't use one method.

One thing that makes it much easier (at least for me) is trying to use dependency injection, otherwise i get lost.

Misko Hevery said it better. [http://misko.hevery.com/2008/11/11/clean-code- talks-dependen...](http://misko.hevery.com/2008/11/11/clean-code-talks- dependency-injection/)

</comment><comment><USER7> I outline first, then turn the outline into the program. Items on the outline are 'actions' or 'data', data goes to the top of the outline, actions follow.

I hope that's clear and that it will work for you, it works like a charm for me, even for very large projects.

Outline editors are a dime a dozen, not sure which ones you could use on the mac though...

</comment><comment><USER8> Omni Graffle and Mindmaps. Pen and Paper works too.</comment>


How We've Managed Growth Pains with Transparency and Communication - <AUTHOR> https://medium.com/eventmobi/how-weve-managed-growth-pains-with-transparency-communication-fff18c8a0dfb <comment><USER2> The do less and do more model is very interesting. Great for getting feedback on how the company is doing.</comment>


How to Backup Your Apple Airport or Time Capsule Settings - <AUTHOR> http://matt.coneybeare.me/how-to-backup-your-apple-airport-or-time-capsule-settings/

<comment><AUTHOR> So you don't get burned...</comment>


American Millennials are among the world's least skilled - <AUTHOR> http://fortune.com/2015/03/10/american-millennials-are-among-the-worlds-least-skilled/

<comment><USER2> Misleading title: only 22 developed countries were tested, hardly "the world".</comment>


Wall-O-Tron, the Interactive Rock Climbing Wall - <AUTHOR> http://hackaday.com/2013/06/26/wall-o-tron-the-interactive-rock-climbing-wall/ <comment><USER2> A Finnish university built something similar, but instead of touch sensitive holds and LEDs, they use a camera and a projector:

[http://www.augmentedclimbing.com](http://www.augmentedclimbing.com)

</comment><comment><USER3> Technically, all rock climbing walls are interactive, aren't they?</comment>


Ask HN: Do you ask to see the codebase before taking a job? - <AUTHOR> Every developer job that I have regretted taking could have been avoided by first asking to have an in-depth review of the existing codebase I would be working with.
But it seems to me that this is something very few people ever do?
I'm specifically talking about poor coding standards, spaghetti code, monolithic pieces of code that nobody understands and is too scared to changed for fear of breaking something, not enough tests or the wrong kinds of tests etc. The kind of stuff that people say "we really ought to tidy this up" and everybody agrees, but it never gets done. Especially for a large scale application with an existing user base - these kind of poor coding and architectural decisions can be very very time consuming and difficult to change. <comment><USER2> I've been compiling a mental list of things I want to know about a potential team. The code itself is not one of them - too sensitive to get access to, too large and context-dependent to evaluate from an outside perspective. But I do have a bunch:

\- How is the physical space, crowding, noise level, workstation quality? How many hours a week do you spend in meetings? How to decision makers think about focus vs. collaboration?

\- What is the process by which a proposed code change gets to production, and how long does it take? Code review? Linters? Unit tests? Integration tests? Human QA? CI/CD?

\- What is oncall like? How many alerts per shift? Signal to noise ratio? How do you manage incidents? What are postmortems like? Are they about accountability, system hardening, or trying to balance both?

\- What are some of the debugging/observability/operational tools you've developed for your product? What are the stories behind them?

\- How do decision makers think about tech debt vs. feature velocity? What if any official support is there for getting tech debt items worked on?

\- Can I fix & try things on my own initiative in addition to meeting assigned tasks, or must every work hour be dictated by the process/PM? Is an architect telling me exactly how my code has to be structured or am I making my own decisions?

\- Where do deadlines come from? How real are they? What happens when a project is looking like it won't meet its deadline?

\- What would happen to the business if your team disappeared? What are your current projects and why do they matter?

<comment><USER3> I also like to ask what tool does the team use that the interviewer personally doesn't like, a different way around, whats the worst part of your job.

</comment></comment><comment><USER4> No, because the quality of the existing code isn't what affects my interest in the job. The vast majority of software out there has mediocre structure at best. Your responsibility is to improve it gradually, leaving each function or module you touch a little bit better than you found it.

The jobs I've enjoyed the most and learned the most from were incidentally the ones with the worst codebases.

That said, it's probable that there's a certain degree of awful that it's simply impossible to work productively with. As a hiring manager, I wouldn't consider it unusual or a red flag for a developer to ask to see the codebase; and every project has at least some code that isn't too sensitive to share (well, there are probably some exceptions in regulated industries).

If a developer doesn't have the maturity to be willing to work with a codebase that's six years old, where the earliest layers were quick-and-dirty proofs of concept developed without automated testing just to get a startup off the ground, and the latest are better but still flawed, then they're a poor fit here anyway. We need developers who understand that the code exists to serve the business and not for its own sake.

<comment><USER5> > _leaving each function or module you touch a little bit better than you > found it._

This is some of the best advice you can give a developer I think it's known as; The Boy Scouts rule: "Always leave the campground cleaner than you found it".

Some people I've worked with seem to miss the importance of this...

<comment><USER6> The problem is that someone's definition of "cleaner" can be wildly different from yours. Sometimes even justifiably so.

<comment><USER7> That's the reason that all companies should have in-house coding standards. There are many different legitimate variations on "clean code", so the important thing is that one variation is chosen and used consistently by all devs. Which variation is chosen is less important.

</comment></comment></comment></comment><comment><USER8> At my previous company, I asked to have a look at the code base before joining. The reason was that this was a system that has been in development for the past 13 years and I wanted to get an idea of how well they handle tech-debt on such an old code base.

The application was developed in C# and ASP.NET and I ended up being quite impressed with how the team handled this. When developing a new feature they made a point to clean up the code they touched to make use of newer language and frameworks features. Also, from time-to-time, there were bigger efforts to clean up specific areas of the code.

This was a 13-year old code base that was in many parts in better condition than many greenfield projects I have seen.

It definitely made my choice to join the team easier.

<comment><USER9> Thanks for your explanation. I think the real question here is to what do you pay attention when you inspect codebase of your potential employer and what conclusions can you make from it. Your comment answers that. I also think the fact that you were able to make those conclusions gives you additional credit in the eyes of the potential employer.

</comment></comment><comment><USER10> I'm always surprised when candidates ask for this. I can see why they would want to, but it presents problems for the company:

Employees always sign stuff to protect the IP. I'd have to go get paperwork from the company attorney to cover non-employees before I can show them anything.

Can they really learn anything about the codebase in the limited interview time we have? They're not getting repo access.

Why is the candidate asking this question in the first place? It makes me wonder if they're inflexible or unwilling to be pragmatic about imperfect code. If they have a track record of leaving companies because the code isn't up to their puritanical standards then it's a hard pass.

<comment><USER11> > Why is the candidate asking this question in the first place?

Because every company says "we take quality very seriously" and standard crap like that, looking through the code and the most recent contributions is the only way to actually assess them.

> It makes me wonder if they're inflexible or unwilling to be pragmatic about > imperfect code.

Which is perfectly reasonable when the hiring companies try to avoid being pragmatic about imperfect people. They'll give stupid codes tests and look for rockstars, this is the employee equivalent. Rockstars are picky about their collaborations.

> Can they really learn anything about the codebase in the limited interview > time we have? They're not getting repo access.

Ideally I'd want to run some tooling over it and get some stats like cyclomatic complexity and collaboration graphs to see how many pointless layers they have. I'd also take a look at their unit testing to see if anyone in the company actually understands what a unit tests is.

Interviewing is meant to be a two-way street and code review is the only way to address the information asymmetry and make this true.

<comment><USER10> I absolutely agree that this is the employee equivalent of "jumping through hoops".

With that said, for the companies I've hired for in the past someone who sees the state of unit testing as a dealbreaker would likely be a bad fit. If they're hiring it might be because the company needs more hands to help make the tests better!

<comment><USER11> It really depends on how the rest of the interview process goes, if they said their tests were in horrible shape and were committed to making it better then it's not a dealbreaker, even less so if they can point to some commits where they've improved things. The two common types that you can sus out with a code review are the bullshit artists and the ones that really do think the code is great.

There are other factors too, I work somewhere with mountains of horrible code, but they compensate by not putting you under pressure and giving you time to work through the mess. If they had the same code and constant pressure then I'd be long gone, life is too short for that.

I'm really surprised by the opposition to the idea, we all seem to agree that good devs are in high demand but few on the hiring side seem willing to bend to that reality. We all seem to agree that hiring is expensive but the hiring side doesn't seem willing to let the candidate who will walk in a month eliminate themselves.

</comment></comment></comment></comment><comment><USER12> The easiest way to accomplish this, practically, is to do contract-to-hire. Do a couple of pull requests and take the temperature of what it's like to work there, and you'll figure out pretty quickly whether it's for you or not. Of course, many companies are averse to this for a variety of reasons -- at the end of the day, there can be agency problems if there isn't a base level of good faith commitment from both parties.

</comment><comment><USER7> I never have, and I probably never will. I'd be surprised if a potential employer would agree to doing so (why would they? It's additional risk and expense for no gain.)

I have worked at places with terrible existing codebases (including where I work now). I just make it my mission to do what is needed to improve the situation. That in itself can be fun and rewarding.

Also, the vast majority of commercial codebases out there are pretty awful, regardless of language or the size or apparent competency of the company. If you have a low tolerance for working with substandard code, you're going to have very limited options for employment.

</comment><comment><USER13> I think it's surprising that people are saying the code is too sensitive to view. We live in a world in which an increasingly large portion of code is open-source. Is it really that big of a deal if a prospective hire gets a glance at your CRUD web app code?

People don't have photographic memories. They aren't going to go home and write this stuff out.

Granted, there are areas where code is perhaps too sensitive for even a quick look. But I think those are the exception.

</comment><comment><USER14> Messy codebase is one thing, but messed up build/configuration system is much worse.

I don't ask to see it, but I've found it effective to ask a simple question: "So, How's your build system?". The engineers at an effective company where everything is in order, will just have this puzzled look on their face and say "it's fine", not really understand just how terrible things could be.

However, for those companies that have huge problems with their stack, the kind of places where builds and configurations break on a regular basis, the kinds of places where you spend half your work hours fighting against configurations and setups, well those interviewers start having steam come out of their ears. After asking this, One interviewer admitted their build system was a hot mess.

</comment><comment><USER15> I work at a place where the culture is definitely "everybody should tidy this up" and it never changes, or it changes very slowly. What I'm finding though is that there's no real defense against this kind of culture other than to be really tight about hiring. So, to your point, if you came to my company asking to look at source, it'd be a good thing -- particularly since so few people actually do it.

<comment><USER16> If the responsibility lies with everybody, nobody will do it[1]. There must be some rule or process whereby the job of tidying up something becomes a specific person's job - be it if they are committing changes to the same file, or whatever.

[1]: [https://en.wikipedia.org/wiki/Tragedy_of_the_commons](https://en.wikipedia.org/wiki/Tragedy_of_the_commons)

<comment><USER17> not necessarily. if we're all working on a code base and reviewing each others work, and we all value cleanliness, things can reach an ok steady state.

you have to establish a cultural habit of tidying up a little when you're in there. often accompanied by a 'wow thats much better, thanks for doing that'.

more importantly you have to foster a sense of ownership. a common issue with the worst organizations I've worked with is fear and lack of understanding. the code isn't something we're shaping together - its just some large and awful monstrosity that bites you every time you get near it. every time you start pulling at a thread the whole thing unravels.

so you restrict your scope to as narrow a window as possible, and make the smallest changes you can to fix the bug or add the feature.

its the difference between living in a pleasant little village or a squalid favela.

<comment><AUTHOR> You expressed what I was trying to get at so perfectly and so much better than I ever did.

This is what I'm talking about. Not just "Hey can I see your codebase? Oh, you don't have 100% test coverage and I've seen some variable names that don't make sense, no thanks bye", which I feel is how some people have interpreted my post but I probably could have made that more clear.

</comment></comment></comment></comment><comment><USER18> In my experience, for most companies and projects, you'd have a hard time earning the trust to have much in-depth review of existing codebases, before getting hired.

Aside from legal reasons, much of this in my opinion is the traditional power dynamic between employer/employee, where the hiring side typically does a lot of due diligence and research into people being hired, and has the upper hand in the negotiation, much more than the other direction.

At least conceptually, I believe developers need to stand on equal ground, to judge and weigh their candidates (employers and clients) in the same way, including, like you say, assessing their code quality before making any commitment, to see if it's up to _your_ standards.

There's always a "discovery phase" before hiring/being hired, where the two sides are exploring what the other has to offer, to determine whether they can be trusted with the work. You can usually poke around enough to discover, for example, what stacks their main product is using, the general level of skills and standards in UX, performance, security, etc.

Some, maybe at increasingly more places, they'd have public or open-source repositories that give a fair insight into the engineering culture. This could be similar to how developers have (or are expected to have) GitHub profiles. I'd take that as a healthy sign of developer-led best practices and transparency in the company.

\---

I'd also like to add that the majority of codebases in the wild are bloated, complex spaghetti monoliths of questionable quality. It's just a reflection of limited time, budget, average skill sets, and the real world being practically chaotic. Knowing how to consistently improve the situation is part of being a valuable developer/team.

</comment><comment><USER19> Yes - I want to see exactly what you're talking about. So far, there were 2 places where I interviewed at (out of roughly 50) that could provide this information.

London based, dealing with Laravel / Vue, fullstack.

If there's no github public code / no code can be provided I ask following things:

\- are you following standards (PSR2 for PHP, anything for JS); do you apply linting that makes the standard mandatory

\- do you have naming standards

\- do you have CI pipeline

\- how much of the codebase is unit / feature tested

\- how much time within sprint do you spend on fixing existing code

\- how much of the job would be working on existing code vs new code

In the end people lie and I picked up a job where some of the things ended diverging from what I was told at the interview

</comment><comment><USER20> I've done this once ever, I was being asked to build an extremely technically difficult proof of concept so I asked for access and it was granted. I had already worked for the client previously so there was some trust, and they were thinking of open sourcing the project once it was farther along anyway. I wouldn't expect to have it happen again.

I feel like most of these problems can probably be sussed out in other ways. Ask the developers about things that typically lead to a better codebase: do they do code review, testing, QA, etc.

</comment><comment><USER21> No. In general I'm less worried about bad code (more often than not I'm contracted to fix said bad code) as I am a shit working arrangement.

I can usually convince people why and how to resolve technical debt. Convincing a shitbag to pay a fucking invoice is much harder.</comment>


Requiring secure contexts for all new features - <AUTHOR> https://blog.mozilla.org/security/2018/01/15/secure-contexts-everywhere/ <comment><USER2> They probably should've linked to a better intro to Secure Contexts than a standards document. Here's a simple explanation for them from Mozilla:

[https://developer.mozilla.org/en- US/docs/Web/Security/Secure...](https://developer.mozilla.org/en- US/docs/Web/Security/Secure_Contexts)

Features Restricted to Secure Contexts:

[https://developer.mozilla.org/en- US/docs/Web/Security/Secure...](https://developer.mozilla.org/en- US/docs/Web/Security/Secure_Contexts/features_restricted_to_secure_contexts)

Chrome's Secure Origins seem to be the same thing:

[https://www.chromium.org/Home/chromium-security/prefer- secur...](https://www.chromium.org/Home/chromium-security/prefer-secure- origins-for-powerful-new-features)

<comment><USER3> I adjusted the post to take your feedback into account. Thanks!

</comment></comment><comment><USER4> This seems reasonable.

Declarative code, such as HTML or CSS, which describe particular behaviors of rendering from a broad, but limited palette, are a different severity from imperative code that can interact with various features of your host platform.

As a user, for the web execution trust model to work, you need to know that the code you're about to execute was vetted by originating site and not altered in transit. TLS provides this. It won't help you with easing the cognitive load of making that decision, or extending your trust model to third-party origins referred to by the site you visit, but it does provide baseline assurance that the content wasn't tampered with by an agent that wasn't a party known to you or your origin ahead of time.

As a side-effect, this move serves to further segregate the document-based 'legacy' web and the new web that's an application delivery platform. In my opinion, any move that sets these two use-cases further apart, without necessarily impacting the nameplate usability expectation of either, is a welcome step.

<comment><USER5> The post states that any new features including something as simple as a CSS property will now require a secure context, regardless of whether the new feature exposes more security risk or not. This is a marked departure from the declarative markup vs imperative scripts distinction that you make, or any other risk analysis which has guided which features require a secure context in the past. It doesn't distinguish between simple web pages and web applications. Instead it is a blanket policy that if you don't encrypt, you will not be able to use any modern web standards, period.

<comment><USER6> Correct me here if I'm wrong but the linked article actually uses the example of a new CSS property as an instance of something that would _not_ require a security context.

<comment><USER7> No. It says a new CSS color keyword would not require a secure context, but that a new CSS property likely would.

</comment></comment></comment></comment><comment><USER8> My eye got caught by the author's signature on the side: "Standards hacker. Mozillian. Loves talking about turning the web into an OS."

I'm personally going the opposite direction, I started using browsing with JS disabled a while ago and found my browsing experience improved.

With the recent security issues, is that really the way we want to go?

<comment><USER9> Probably, you're putting an extra layer of protection (the browser sandbox) between the attack vector and your system.

<comment><USER10> But by doing that you're feeling ok with running untrusted code which could easily exploit the JIT. Whereas with native code you have to trust it so you'll only run good trusted code.

<comment><USER7> > with native code you have to trust it

I consider that a drawback of native code. Not an advantage.

> so you'll only run good trusted code

In practice this isn't a very safe assumption to make.

<comment><USER11> There is some truth in the fact that until we have support for signed code on the web - and a way to check that whoever signed can be trusted, we only have "level 1" security.

In FxOS we used code signing to grant access to more powerful apis. I think that something like what the Dat project is doing could be interesting in this regard, or web packages as described in [https://github.com/WICG/webpackage/blob/master/explainer.md](https://github.com/WICG/webpackage/blob/master/explainer.md)

</comment></comment></comment></comment></comment><comment><USER12> New CSS properties are only going to work in secure contexts?

How is local development supposed to occur?

E: there's going to be some flag to enable it for development

<comment><USER13> [http://localhost](http://localhost) and file:// are considered secure contexts according to [https://developer.mozilla.org/en- US/docs/Web/Security/Secure...](https://developer.mozilla.org/en- US/docs/Web/Security/Secure_Contexts#When_is_a_context_considered_secure)</comment></comment>


Ask HN: Anyone else play Magic: The Gathering? - <AUTHOR>

I'm just curious. I played pretty seriously from 1995-1998 or so and recently started playing casually again. It's one of those few things that's as fun as nostalgia convinced me it was. Magic and Quake1 (CA/RA/CTF) both hold up 10+ years later.
I know it's died down a lot since its heyday, but with all the geeks we have here surely some play? What do you play? Written any code for it I can use?
A friend of mine and I have been dabbling with creating our own web based (simple) player for it, since we're too cheap to pay full retail price for digital cards (that can't be redeemed!) with The Official Magic Online. I've checked out Magic Workstation, which seems bloated/lame and doesn't work under Linux or Mac. <comment><USER2> I'm pretty involved with the tournament operation side of Magic - it hasn't died down, it's done pretty much nothing but grow. It's always bigger than it ever has been.

Magic Online is actually quite worthwhile, especially if you don't have much access to physical Magic. You _can_ redeem.

Magic Workstation hasn't been actively developed in years, but you _can_ get it to work on linux with Wine (and probably OSX too).

<comment><USER3> I agree with this... I just got back into it recently and MtG is pretty much growing and growing. It seems like the 360 Planeswalkers game also gave it a nice boost.

Actually, I'm planning to do some pretty involved development related to card games which is why I got back into it in the first place, but I don't have anything to share yet.

</comment></comment><comment><USER4> <http://mtgrares.blogspot.com/2007/09/mtg-forge-20.html> is an mtg ai project, unfortunately it doesn't have fireball or ivory tower for some reason :( Firemox and incantus are the major projects i'm aware of. Personally, I like playing multiplayer.

</comment><comment><USER5> I certainly played. I also played online (7 or 8 years ago?) with <http://www.magic-league.com/>.

Looks like the programs to play online are <http://www.magicworkstation.com/> or Apprentice: <http://www.magic-league.com/download/apprentice.php>

</comment><comment><USER6> Played a fair bit at highschool. That was before this Interweb business came to town so have never played online. Still have a box of cards in a storage container back home.

</comment><comment><USER7> I used to play. I've got some good memories of playing on Monday nights after school, at the pub I shouldn't have been allowed into!

</comment><comment><USER8> no, although i also used to play a while ago, ending around 2000 or so. won a JSS in my prime.</comment>


Ask HN: FB Login vs BrowserID vs OpenID vs Normal signup/signin? - <AUTHOR>

I've developed a web app(not launched yet) to discover, organize and share music videos. Most of it can be accessed without signing in. Anyone can search/view music videos and playlists. Login is required only to create/manage own playlists.
As of now, FB-Login is the only supported login method. I can also use FB Graph API along with it to let users share music videos and playlists on Facebook. Ideally I would like it to be deeply integrated with facebook.
Which one of these I should choose -
1) FB Login
2) Twitter Login
3) Google Login
4) BrowserID
5) OpenID
6) Normal email registration/login
7) A combination of some or all of above.
Is it ok to launch with only FB Login and then add more login options if required? <comment><USER2> 6) is mandatory. Add at least one from 1) 2) or 3)

If your app is heavily dependent upon fb, make it known upfront about what the app uses facebook for, and only then use it as the only option.

4) & 5) would not be much appreciated and used options IMO for such an app.

</comment><comment><USER3> If you launch with just a FB Connect login, you're ignoring potential users. I personally don't have a facebook, never will. If you launched with only a FB login, I would hit the back button and never return to your site. I would have no idea when and if you added a regular registration, nor would I care at that point.

</comment><comment><USER4> Personally if there is 6) I avoid it. Instead just create an account from their FB/Twitter/whatever.</comment>


Musk's Money Mystery Intrigues SEC - <AUTHOR> https://www.bloomberg.com/view/articles/2018-08-09/musk-s-money-mystery-intrigues-sec <comment><USER2> MuskMania has reached information heat death: it can generate nothing new on its own. See the thread below for a good example.

Since this article doesn't supply enough new information to get us out of that state, we're treating it as a dupe of [https://news.ycombinator.com/item?id=17709543](https://news.ycombinator.com/item?id=17709543).

When significant new information arises (note: not the same thing as the next provocation), then there will be something to discuss.

<comment><AUTHOR> I feel this is a questionable call. The SEC questioning Tesla is in my opinion a pretty significant development. Also, I think this was the only Tesla article on the front page - not exactly a mania ...

<comment><USER2> The mania isn't in having more than one article on the front page at a time (though that happened repeatedly yesterday). It's in rehashing the same cartoonish argument over and over. Elon is a superhero! vs. no way he's a supervillain!

That monster has been bred, of course, by the hyper feedback loop between Musk and the media. A hyperloop, you might call it. But we've passed the point at which it's all noise. Our kingdom for some signal.

</comment></comment></comment><comment><USER3> The problem, at this point, is that I think the average person must find all this very tiresome. Let's set aside all the theories about whether or not Musk is actually a stable genius for doing everything he's done lately (including calling one of his critics "pedo guy"). With everything that's going on in the world today, I just don't have the energy to keep up with all this grandstanding. The result? I'm sick of hearing about Elon Musk. I'm sick of hearing what he has to say. I'm sick of thinking about Tesla and, now, I probably won't ever buy one.

<comment><USER4> How's this Elon's fault? He's endlessly criticized in unjustified ways. That guy didn't reasonably critize Elon's plans, he instantly attacked his motives and said to stick his submarine up his rearend.

And 10% of Thailand's GDP is based on the sex industry or $6.4 billion a year. "Pedo" is kind of a misused connotation but when people get attacked their impulse is to respond with a personal attack.

It's not a "meltdown". It's just human nature magnified by Twitter.

<comment><USER5> Musk is not 12. I can't believe somebody would seriously try to justify his pedo insult...What's next? justifying Trump?

<comment><USER6> Paging Scott Adams (or one of his sock puppets)...

</comment></comment></comment></comment><comment><USER7> DISCLAIMER: I work for a Tesla competitor, any opinions are solely my own. I am not a financial analyst, I may be a lizard-person.

If I were Elon, I would love it if I could take my company private and keep my fans as shareholders. I would love it if I could "go private" and not have to actually buy back all of the shares of people who want to go long anyway. I would love it if shorts had no mechanism to short my company.

I would love it, but I don't know if I could find a real financial instrument that allows for it.

</comment><comment><USER8> "or that the real financing is the friends we made along the way."

I love it every time this type of line is used.

</comment><comment><USER9> Wall st is not really buying it either. Time will tell, of course, but the shorts may end up winning big in the end.

</comment><comment><USER10> This is an opinion piece and not very informative.

<comment><USER11> On the contrary, there's lots of information. It's the first real attempt at analyzing the legality of it all that I've seen.

<comment><USER12> And Mr. Levine's writing is highly entertaining, in _addition_ to giving a clear explanation that the layman can understand of the story. And the entertainment value is because the situation is actually ridiculous to begin with.

</comment></comment></comment><comment><USER13> If hoaxing inevitably lands you on a loss, why would it be a hoax?

</comment><comment><USER14> Is Musk constantly inside-joking himself? Why $420 a share? Why do his car models spell S3X? Is his internal email firstname.lastname@example.com? I love this guy.

<comment><USER9> Do you think calling heroes "pedos" is funny too?

<comment><USER15> Do you think it make sense to judge the entire work/life of someone by an affirmation made at some point in the past on a public forum ? From a moral point of view people are not black and white, there are infinite shades of grey in between.

If you dig deep enough you will find morally questionable things in everybody's past.

That being said, that tweet was a bad idea.

<comment><USER9> That's just the tip of the iceberg for Elon. He has a lot to answer for Tesla including the "self-driving" claim fiascos and all this erratic behavior. He puts video games into the center console of the Model 3 while also claiming that drivers need to pay complete attention during operation.

Compared to Sergey, Besoz or Tim Cook and I'd rather have them as CEO than someone interested in "memes".

<comment><USER13> One of the reasons to go private... no shareholders that demand a bland CEO.

</comment></comment></comment></comment></comment><comment><USER16> Yea my first thought was that Musk was just trying to squeeze the shorts, but that would be highly illegal. Musk can't be that stupid. The CEO of a publicly traded company can't act like Trump and tweet in bad-faith to try to bully reality into conforming to his wishes.

<comment><USER17> I suppose the CEO of a publicly trading company CAN act like the President of the United States?

Seems like a good strategy actually. The strategy got Donald Trump the Presidency.

(edit): why all the downvotes? I realize my comment might have come off as sarcastic. Sorry that was not my intent--I just wanted to point out something I noticed.

<comment><USER18> Lol, a private company CEO should be more serious than USA president?! At least I didn't see from where Trump is not serious about his tweet.

<comment><USER19> _> a private company CEO should be more serious than USA president_

We live in interesting times. Statistically speaking, a jackass CEO is born every minute, whereas a jackass POTUS is very, very rare.

</comment></comment></comment></comment><comment><USER20> > Of course the SEC is looking into this. I can't think of a thing that the > SEC would look into more. If Warren Buffett was giving insider tips about > accounting fraud at the Fed to Lloyd Blankfein so that he could help Donald > Trump and the pope insider trade against the Illuminati, the SEC team > investigating that would be scheming to get transferred to the Elon Musk > team.

Obviously, this is a silly article. But the point remains: Mr. Musk clearly put himself at risk with that tweet. The core questions are:

1\. Was Mr. Musk telling the truth about "secured funding" ?

2\. What is the SEC's plan of action on investigating this matter?

The opinion piece otherwise doesn't contribute much information, aside from giggles and snide comments. It will be a mystery. Feds often don't like talking about pending cases, so it could be weeks, or even months, before any official action comes down from this. And who knows? Maybe Musk really is telling the truth about secured funding and there's no fraud involved.

EDIT: Yo downvotes: care to explain why you're downvoting a direct quote from the article? As I stated above: the opinion piece is clearly a silly piece of work that doesn't contribute much to the discussion. The core facts are still "at large" and we really won't get much information on this matter for weeks and/or months. That's really all there is to this story.

<comment><USER9> Probably because it's not quite an opinion piece. A buyout at this massive scale would've been rumored by now by the potential suiters. The only other alternative is single-buyers who are willing to put up that much personal capital, also highly unlikely.

<comment><USER21> Larry Page is on record a few years back saying he'd give his fortune to Musk rather than donate it to charity [0].

I imagine Musk has a handful of billionaire friends he could probably hit up for cash. Throw in some money from SpaceX, and he could probably make the buyout price.

0: [https://www.businessinsider.com/larry-page-elon- musk-2014-3](https://www.businessinsider.com/larry-page-elon-musk-2014-3)

<comment><USER20> The buyout at $420 would cost around $70 Billion. Maybe a bit less if they leverage things (aka: find another bank who is willing to loan them some money).

Larry Page doesn't have $70 Billion in cash. That's the other important part: $420 implies this is a cash buyout. Larry Page has tons of Google shares that he can offer, but that's not cash.

\</comment></comment></comment></comment><comment></comment><comment>

Either someone (most likely a bank and/or international fund) has the $70 Billion that Mr. Musk alleges he has "secured", or Mr. Musk was lying on that tweet. That's really the only two scenarios here. Unfortunately, it will take a very long time for information to come about on this issue.

</comment><comment><USER22> "$420" \- pretty sure this is Musk just being his hilarious mad lad self as usual.

<comment><USER23> I've read speculation that this was a pot joke. Fortunes were made and lost after he made that comment.</comment></comment>


Be Careful What Your Bumper Sticker Says - <AUTHOR> http://www.wired.com/threatlevel/2010/02/bumper-sticker-speech/ <comment><USER2> This is highly unsurprising considering the law and the attitude of the public (including HN). The first amendment has no bearing on "private" places, even if a public figure such as the President is involved.

However disagreeable this may be, it seems that most people on HN would agree with the ruling as evidenced by highly voted comments such as this: <http://news.ycombinator.com/item?id=1068959>

</comment><comment><USER3> It's not a great result, but it was _private_ property - I was thrown out of a friend's wedding at the Eagle's because my hair was too long! (collar length!)

Kind of pales next to people not being allowed to demonstrate unless they 1. have a permit and/or 2. are willing to stand inside a fenced-off area. Or to gather together on private property to attend a rave party (invaded by SWAT team, in Utah).

Repent, Harlequin!' Said the Ticktockman

</comment><comment><USER4> What about the freedom to peacefully assemble? That's in the first amendment as well.

If you want to see more of these rights violations, wait a couple weeks until people start protesting a particular sporting event in america's neighbor to the north. If you are carrying a sign in opposition to the rings, you'll be arrested!

<comment><USER5> Nobody has the right to assemble on someone else's private property. Moreover, even with public property, the right to peacefully assemble seems to be not without restraint. For instance, the courts have upheld laws creating "buffer zones" for abortion clinic protests. Likewise, a lot of cities require you to get a permit for demonstration purposes.

<comment><USER4> It was property rented by the government for the event and so it was therefore temporarily public property and a public event.

</comment></comment></comment><comment><USER6> Is this museum a wholly private institution?

It seems so, but the link at the bottom of their page to SCFD (which seems like a state governmental body) confuses me. Does the museum get tax payer dollars?</comment>


Have you ever hired or met a great developer named Mohamed? - <AUTHOR> My name is Mohamed and i live in the Middle East. It's a very popular name worldwide, yet i haven't met another Mohamed in the industry. i'm constantly told by Westerners in the industry that they haven't met a Mohamed with tech skills. i find it funny but is it true? <comment><USER2> [https://www.linkedin.com/in/mohamed- attar-b073537/](https://www.linkedin.com/in/mohamed-attar-b073537/)

[https://www.linkedin.com/in/mohideen-syed- masood-9040312/](https://www.linkedin.com/in/mohideen-syed-masood-9040312/)

[https://www.linkedin.com/in/mohamed- farah-8a838075/](https://www.linkedin.com/in/mohamed-farah-8a838075/)

</comment><comment><USER3> Nope.

(Although in fairness some people called him "Mo". He was very productive and prolific and increased the group's revenue. This led to the obvious jokes about how Mohammed was his profit.)

</comment><comment><USER4> I have, but often the dev went by their middle name or some other anglo-ized name since (as you point out) Mohamed is a really common name. I've worked with people named Ali, Amir, Bahar, etc who's name was Mohamed Ali or Mohamed Amir.

</comment><comment><USER5> Like @kognate, I have worked with someone where their full name was XXXXX Mohamed Ali. I guess you'd say their middle name was Mohamed.

</comment><comment><USER6> Our architect as SpaceX was named Mohamed; he went by 'Mo'.

</comment><comment><USER7> Yes, I have.</comment>


Ask HN: Google removed my site from search results, what can I do? - <AUTHOR> Hi HN,
I have a website for a piece of software I make, and Google search traffic accounts for a reasonably large portion of downloads. At the end of April, I moved the site to a new domain (using Google's "site move" tool), and everything appeared to be fine – Google indexed the new site within a few days, and traffic remained the same. However, in the past few weeks, I've noticed a drop in traffic to the site, and when I looked at the Search Console, I realized that all traffic from Google suddenly disappeared in the middle of June: https://i.imgur.com/S1CCl2f.png
Google has all the pages in the site indexed - when I search for "site:[my URL]", the pages show up as expected – but they seem to have been completely removed from any search results. If I search for the exact name of my app, where my site was previously the first result, the site appears nowhere in the 16 pages of results that are returned (I looked at all of them!). Similarly, if I copy a few sentences or an entire paragraph from the site and search for exact matches, Google will return irrelevant results or no results at all, and my site won't be included anywhere in the results.
At least from the search console, everything appears fine - there are no errors reported, and the "manual actions" and "security issues" sections are empty. The site content has barely changed in the last few months, so I can't see any reason for the change.
What can I do? There seems to be no way to contact an actual human, and since nothing on the site has changed, I can't think of anything to revert. I could try going back to my old domain, but I'm worried that would confuse Google even more, and I'm not sure that's even the source of the issue. Has anyone on HN ever faced this problem before? <comment><USER3> Do you still control the old domain?

Don't rely on the "site move" tool to talk to the crawler.

You need to 301 redirect your pages from the old domain to the new domain.

I see this all the time with clients who skip some basics when changing domains.

I'm happy to talk you through this via HN comments

<comment><AUTHOR> The old site was hosted on Github Pages, so there isn't a way to do a server- side redirect AFAIK, but I replaced each page on the old site with a client- side redirect in the following format:

        <link rel="canonical" href="new page URL" />
        <meta http-equiv="refresh" content="0;URL=new page URL">

<comment><USER3> When you say it was on github pages, do you mean it was on a github subdomain like example.github.io ?

<comment><AUTHOR> Yes.

<comment><USER3> Were you (1) using example.github.io as a CNAME with another domain, or (2) were people going to example.github.io directly?

I'm still not 100% clear on how the previous domain was configured with github pages

if it's 1) then you should be able to set up redirects for the domain using something like cloudflare to serve the 301s to the old domain.

if it's 2) then there really aren't any more "simple" solutions that you can implement purely technically. You've already added the canonical reference and the meta refresh. You could also add an A tag link to "Download the software on our new website" in addition to the other measures. Users are already sent over via the meta refresh, but the link will encourage crawlers who skip that tag to find you as well.

If your goal is to show up when people search the name of the software (example: "iterm2"), then the solution is to register on every possible social media website you can find and link them to your new domain. In addition to that it's worth using an online PR service to distribute a press release with a link to your new site announcing the new domain.

If there's a more generic term (example: "mac terminal software") then you've got a longer road ahead of you with a regular SEO campaign.

<comment><AUTHOR> It's the second one.

Most of my previous traffic was from direct searches for the name of the software, so I think I'll try the social media approach - thanks!

<comment><USER3> Sounds good, good luck. Assuming your name is relatively unique then this should be something that resolves within 4-6 weeks. If it takes longer you might need to do some high profile PR to get the name out there and linked to the right place.

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> I think it sees your new domain as just a blatant copy of the old one. Quickly set up a server on the old domain and redirect to the new domain, so you tell Google that the new one is the authoritative site.

<comment><AUTHOR> Sorry for not including this in the original post, but I did replace the old site with a set of redirects: [https://news.ycombinator.com/item?id=23884449](https://news.ycombinator.com/item?id=23884449)

<comment><USER5> I think the person above is telling you to set up a webserver to 301 redirect pages from your old domain to your new one. I think that will tell Google that you have chosen to move the site to a new domain, not just copied the site off someone else

<comment><AUTHOR> The old domain was a *.github.io domain (which I migrated to a custom domain), so I don't think it's possible to use my own server for it.

Google did pick up the relationship correctly, at least in the beginning - <USER2> new domain got the same ranking as the old one, and the "backlinks" section of the search console shows links to the old domain under the property information for the new domain. So it seems like this type of redirect does have an effect, unless it somehow expires after a few months and a 301 redirect doesn't?

</comment></comment></comment></comment><comment><USER6> > There seems to be no way to contact an actual human, and since nothing on > the site has changed, I can't think of anything to revert.

There are some Google people on Twitter responding to concerns such as yours. @JohnMu is one of them. You can send a private message to him about it.

We've experienced similar issues, but possibly with a different cause, see [https://seotool.ee/indexed-not-submitted-in- sitemap](https://seotool.ee/indexed-not-submitted-in-sitemap)

Once Google doesn't like your site, it's not easy to get it back. It involves being patient and trying to understand what's wrong. Sometimes though, there is nothing to be done and your site just comes back up. Google is a big black box in this regard, and doesn't give any message in search console about what may be wrong.

<comment><USER7> Why should Twitter be the space for Google's customer support service? This is absurd

<comment><USER8> The actual answer to your question is probably that it's better for Google if it's difficult to reach a human without sufficient effort, since it lowers their support costs. Providing a escape hatch in their support process might mean that too many people use it.

Also, the person in this case is neither a Google user nor a customer, so there's a particularly small incentive to provide easy support.

Maybe a lot of it comes down to Google's tendency to rely on AI, but the fact that so many companies have crappy support to me indicates that it's a harder problem than one might think.

</comment></comment></comment><comment> huy-nguyen I've done this a few times. Even if you do 301 redirects properly, it still can take a month or two for google traffic to day get back to previous level. You might just have to be patient.

</comment><comment><USER9> I have tried this 'perfect switch over' for a major domain after many months of planning. Everything worked fine for a month and then the traffic dropped to 30%. The traffic went back to normal level after few months.

As usual there was no response from Google/ Forums etc. All I could speculate is the loss of backlinks. It takes months to reach the original level.

Keep improving the site and you should be back and kicking in 6 months.

</comment><comment><USER10> This doesn't help you now, but why didn't you keep the old site and just 301'd to the new page for a year or so?

<comment><USER11> There is a really good spec by google on how to move sites: [https://support.google.com/webmasters/answer/6033049?hl=en](https://support.google.com/webmasters/answer/6033049?hl=en) Googles best spec in my eyes. 301 (what, how, and what not) change of address request, sitemap.xml,

</comment></comment><comment><USER12> Always... Always setup your site with Google search console and submit your sitemap to it.

You don't need to setup the old site on a server to 301 everything. You can just CNAME the old domain to the new one. And yes, you can do this with a GitHub.io domain, just have a .CNAME file in the repo. Then setup 301s on the new domain for the old paths to point to the new ones. The Redirections plugins for WordPress make this easy as hell if you are running WordPress.

hopefully this will help you out and get your new site index in no time

</comment><comment><USER13> I've been through this multiple times in the last couple of years, it's worked well for me to move domain authority around in this manner. Maintaining a 301 redirect map on the original subdomain should work fine (probably better than meta headers on reinstated pages, I haven't heard of Google paying much attention to that) and you should be able to claw back your rankings. Running something like jekyll-redirect-from within your old github pages project looks like the ticket. Good luck!

</comment><comment><USER14> I have had something similar happen to me. It was resolved by getting more sites to link into mine. Getting new incoming linkes just immediately set things right.

</comment><comment><USER15> I think for your software product, you may have underestimated the value of GitHub.io domain. Your post makde it sound like it went from one custom self owned domain to another, that's not the case at all. I would move it back to github.io, and build your other domain over time until they are 1&2 in results (or there abouts)

<comment><USER16> Had exactly this experience. Had some very popular content up on a platform site, ranked very well. Wanted to move to my own domain. Found it nearly impossible to show up in search results at all. Even searching for the exact title wouldn't bring it up despite seemingly being "indexed".

</comment></comment><comment><USER17> I would definitely put up your old domain and leave the content the way it was, to try to get that back in the SERP.

Take your new domain and create new content there to try to build it up in the SERP over time.

Google seems to love aged domains.

I've always been hesitant to change domains.

I have changed the URLs on sites so going from services.html to /service with a 301 Google seems to keep the pages in the same place in the SERP.

I feel it's very risky to depend on Google for your traffic at this point. Definitely easier for it to disappear/drop, it doesn't feel like it used to be this way, it was pretty dependable if you had good content and were user friendly.

I miss Classic Google, I feel like SEO was more fair and even back then. You create a site, with good human content and Google rewards you.

Now I can search for a clients keywords and there is spam, malware and even 404 on the first page but no regular sites with good content.

Maybe Google or someone will bring back what was Classic Search someday and can get the majority of people using it again.

I literally loved Google, I have shirts and hats, dreamed of working there. I'm definitely heart broken over the way they have changed over the past few years.

RIP Classic Google.

<comment><USER18> > I feel it's very risky to depend on Google for your traffic at this point.

Yes, but what choice do you have?

<comment><USER19> When you SEO, you test across Yandex, BING, DDG and you make sure to build up back-links

</comment></comment></comment><comment><USER20> This might help if you can edit your html's meta tags on your old domain: [https://moz.com/learn/seo/canonicalization](https://moz.com/learn/seo/canonicalization)

</comment><comment><USER21> Put up your old domain with content and then do a rel canonical from each page on the old domain to the corresponding page on new domain.

I faced same issue couple years back. Hope it helps.

Sorry if the same answer has been given before mine.

<comment><AUTHOR> So the old domain should have the same content as the new one? Right now, I have blank pages on the old domain with a canonical link and a redirect. I could try duplicating the content, but it seems like having duplicate content might cause Google to penalize me even further?

</comment></comment><comment><USER22> Sounds like you need an SEO audit - contact someone who understand technical SEO that can provide you an audit. It may be a small/simple issue causing your website to be de-indexed.

</comment><comment><USER23> How did you drive traffic to your site in the first place? I'm starting an online SaaS but having trouble getting my first users.

<comment><USER24> It helps to write more. A lot more. Getting traffic from Google only works if you have a _ton_ of content.

Your video is great, but doesn't tell me why I would use this over Trello or something similar.

\- "Pricing is free" feels ominous (to me), say it's a free beta or something instead.

\- It's not entirely clear what "roadmap" means on your landing page. Is it your product roadmap?

\- Your colour contrast hurts my eyes (maybe I'm weird), particularly black + purple.

<comment><USER23> Thanks for the feedback! Perhaps I need an animation showing how when you click on a card it takes you into that cards Kanban board. (The feature differentiator from Trello)

As for the color contrast I plan to add more options in the future such as light mode.

</comment></comment></comment><comment><USER11> Give us more info: current domain, old domain

<comment><USER11> Could be lots of self made issues.

How do the 4 SEO Tests look like? Outlined here in the "is it me or is it google" section [https://firstname.lastname@example.com/what-to-do-when-a- googl...](https://firstname.lastname@example.com/what-to-do-when-a-google-core- update-hits-you-3d0a891c367d)

<comment><AUTHOR> Thanks for the suggestions. I think those 4 all look OK. The site content is purely static HTML (and some images) that hasn't changed significantly in months, so I'm guessing that's not the issue.

I'd rather not post the site URL here; is it OK if I email you?

<comment><USER11> Honestly, as with most other tools that you have to care about but don't want to: just follow the spec [https://support.google.com/webmasters/answer/6033049?hl=en](https://support.google.com/webmasters/answer/6033049?hl=en)

</comment></comment></comment></comment><comment><USER25> Buy google ads ? Put google ads in your site ? Google bots will certainly notice you if you do that

</comment><comment><USER26> Don't use Google!

</comment><comment><USER27> I'd rather go onto DuckDuckGo to drive SEO traffic.

Don't give money to Google, it isn't worth it since they are surveillance capitalists.

Boost your traffic through an ethical search engine instead.

<comment><USER28> DuckDuckGo doesn't really have their own index. They mostly just fall through to Google and Bing for their actual results. It's cool they supposedly don't track you, but they are really just a proxy rather than a full fledged index themselves.</comment></comment>


Ask HN - Twitter accounts hacked due to internal leaks? - <AUTHOR>

This isn't intended to be a support request, but a discussion around my current issue with twitter.
The Problem: Over the past few weeks my twitter account keeps getting compromised. No phishing attacks or anything, just dirty DMs from my account to various friends. Sometimes my account will be "forced to reset password" multiple times a day, even. Each reset I use a 8-16 character password, randomly generated. I've revoked all apps except Disqus, Siri, Dropbox, and Medium.
Other Information: Plenty of my friends have been seeing similar things happen. Have you guys?
Theory: Is there a chance that this attack is coming from inside twitter? Maybe some internal app's api key was compromised? Could this in fact become an issue.
Twitter's support doesn't make this easy to work with. Hopefully the community has some input. <comment><USER2> I have been getting a few spam DMs from a couple people I was following. Both were very inactive, and I only got spam from them after they were completely inactive for a couple months.

</comment><comment><USER3> I believe some people were speculating that Hootsuite was hacked recently. None of my Twitter accounts have been compromised. (I don't use Hootsuite)

<comment><USER4> I had two accounts that have never touched Hootsuite compromised yesterday. That said, my main account had no trouble.

<comment><AUTHOR> I mean, I don't wanna draw conclusions, but it's very strange that so many accounts are compromised compared to, say, facebook. On facebook, it happens, but it's because you were phished.

Too bad there's no insight from twitter itself.</comment></comment></comment>


Ask HN: why are domain names reversely ordered? - <AUTHOR> Why is it www.google.com instead of com.google.www? Tried searching for a good explanation but found nothing helpful. Is there any solid reasons for the arrangement, or is it just a random choice?
[EDIT]: as bajsejohannes points out, the major problem of the current arrangement is that it differs from the order of the path component, as in

    www.google.com/path/to/the/file
 it really makes more sense to say

    com.google.www/path/to/the/file
 <comment><USER2> I think it comes down to history. Host names existed before domain names. When domains were bolted on they used the idea of a default domain for each host and that made sense to be on the end.

Consider:

      telnet hosta          # established way
      telnet hosta.abc      # domain bolted on back
      telnet abc.hosta      # domain bolted on front

Since people knew the host names and were used to dealing with them, the suffix was more natural since it kept the domain cruft out at the edge.

<comment><USER3> This seems pretty much right based on the historical data.

It doesn't seem like ordering of domain name parts was given much thought. RFC 882, which first defined the domain name space, said only this:

 _By convention, the labels that compose a domain name are read left to right, from the most specific (lowest) to the least specific (highest)._

Additionally, it seems that when the first TLD was defined, .arpa, some people were hacking to support it by just concatenating .arpa to the end of all the domain names. Concatenation, of course, is much easier than prepending when you are programming in C. Note the following from RFC 881, which described the transition to using domain names, at a time when the domain name mapping was all stored in HOSTS.TXT files:

 _So far, no new domains have been introduced. Only a table with all the entries having official names in the ARPA domain has been provided. This should allow programs to be constructed to deal with domain style names in a general way without any special hacks to add or delete the string ".ARPA" to or from host names._

</comment></comment><comment><USER4> (Just to clarify...) I know what you mean, but I don't think your question makes sense without comparing it to something. That something would naturally be the path.

www.google.com makes as much sense as com.google.www

but

www.google.com/root/sub/subsub makes less sense than com.google.www/root/sub/subsub or subsub/sub/root/www.google.com

Since the latter has consistent increasing or decreasing of specificity, while the former has not.

This incidentally mirrors what I don't like about the date format MM/DD/YY.

<comment><AUTHOR> That's exactly what is in my mind! The mismatch of domain name order and path order really bothers me for a while and I just couldn't find a sound reason for that.

For the date format, AFAIK, only English speaking countries use MM/DD/YY, possibly due to the same order in plain writing style, e.g. October 17, 2009. This is completely insane for virtually other parts of the world because logically it's either YY/MM/DD (big to small) or DD/MM/YY (small to big), but NEVER MIXED!

<comment><USER5> actually, only USA does the rediculous MM/DD/YY. the UK is DD/MM/YY

<comment><USER6> Plus when saying a date it is usual to say the day first in the UK then the month if it's not clear from context. The US date ordering is one of those things (like non-metric units) that make me feel that they're being purposefully obstructive; kinda like Microsoft, always avoiding using other peoples agreed standards.

</comment></comment></comment></comment><comment><USER7> Interview with Tim Berners-Lee where he says he regrets this:

[http://www.impactlab.com/2006/03/25/interview-with-tim- berne...](http://www.impactlab.com/2006/03/25/interview-with-tim-berners-lee/)

Looking at what he accomplished, I forgive him.

<comment><USER8> If he had done that it would've been massively confusing, given that domain names would still be the current ordering for everything else (e-mail etc.).

</comment></comment><comment><USER9> Why? Independent invention of the domain name system, and the URL-path system, at different times by different people.

URL-inventors did not think it important enough to break the already- established convention for domain names to acheive hierarchical ordering consistency. With hindsight, nearly 20 years later, it might seem that it would have been worth the nonstandard novelty, but I still wouldn't be so sure.

Consistency with telnet and email was very important for early URL comprehension and adoption among technical folk. And, the reversal-of-ordering corresponds with an important threshold in URL-resolution, from one system (network-layer and owned-domains in a collaborative framework) to another (a single hostname's internal organization, usually under a unified authority). That signification can be helpful even if it's hard to explain why. (The same goes for seemingly arbitrary, path-dependent choices in natural language grammars that nonetheless dominate logically-designed synthetic languages.)

It's easy enough for specialized applications to adopt a reversed form; junklight mentions the 'SURT' form used by my project, Heritrix, which reorders a URI internally for certain scoping/sorting/policy-decision purposes as:

      http://(com,example,www,)/path/to/the/resource

(joshu's proposed move of the port/protocol to 'between' the host and path also has a strong puff of logic about it. I think Google, in their BigTable URI-keys, tends to reverse domain-segments and put the protocol/port later.)

</comment><comment><USER10> It's just a convention, and one that took a while to work itself out. Some older mail servers used to route (and even rewrite -- shudder) domains the other way round. Like little- and big-endian numbers, the merits of either method are less important than having everyone do it the same way.

<http://catb.org/jargon/html/B/big-endian.html>

</comment><comment><USER11> I have no idea. UUCP (Usenet) addresses used to be (are?) "backwards" and ! separated. Maybe some historical references related to that would point you to more info.

If I were to guess though, I'd guess email addresses. me@machine being originally valid makes firstname.lastname@example.com harder to parse?

<comment><USER12> They weren't really addresses; it was a series of hosts. It was thus more like a route.

</comment></comment><comment><USER13> I think everybody that has to write applications that deal with URLs as core identifiers have asked this. It's also hairy 'cause leading part of a URL (protocol and hostname) is case insensitive but the trailing part (path, query string and fragment) isn't. At my last job I created a framework for normalizing and canonicalizing URLs as well as storing them consistently (with the hostname components reversed), it was a big improvement for retrieval and duplication detection accuracy and performance.

</comment><comment><USER14> For the same reason your address doesn't go 'USA, California, San Jose, 1297 Fray way'.

<comment><USER15> Bad analogy:

email:

       email@example.com

www:

       http://somedomain.sometld/~georgex/

real life:

       George Xandros
       553 Sunset Blvd
       12322 San Jose
       USA

So, the web is mixed up, and the other two are 'backwards'. None of them get it in the most logical way.

Same with dates:

       2002.10.09

vs

       09.10.2002

or

       10.09.2002

It's all about conventions, what we're used to, so to say 'the same reason' is calling upon a reason that you don't state, when if you thought about it long enough would boil down to 'that's how we've always done it'.

But that doesn't really answer the question.

The most 'logical' order is to put the larger units up front, and smaller ones towards the end.

But since we are where we are that isn't going to change 'for the same reason' (too much investment) that England isn't going to switch to driving on the 'right' side of the road.

Once a convention is established even if there is a marginally better one the cost of switching usually outweighs the advantage of the switch, not to mention a whole bunch of messy stuff during the transition.

<comment><USER16> Is there a clear benefit to driving on the right hand side of the road, over the left?

<comment><USER15> On the whole there might be, but I'm not sure of that. In the current situation, yes, because there is a cost associated with having to support two kinds of driving styles.

I have both 'LHD' and 'RHD' cars and find that I can switch at will, but most people are uncomfortable in the 'wrong' kind of car because it messes up your overview when overtaking on 'b' roads (two laners).

If everybody would be driving the same kind of car on the same kind of road then that problem would go away.

</comment></comment></comment></comment><comment><USER17> Because the US internet won out over the UK JANET?

<http://en.wikipedia.org/wiki/JANET_NRS>

Which caused no end of problems in mail relay at the time.

<comment><USER18> Yes, I think this is the answer. There are two choices, so being human, we chose both. Then eventually chose one of those two. I used to have an email address email@example.com i.e. with the domains reversed.

~Matt

</comment></comment><comment><USER19> If it was ordered com.google.www, you might not even need to use different characters for path separators than domain separators.

com.google.www.path.to.the.file

com/google/www/path/to/the/file

</comment><comment><USER20> Has anyone written a browser plugin that makes it seem like everything is reversed (or 'correct' if that's your view)?

<comment><USER15> That would be pretty invasive, because plenty of the places where the urls appear are not so easy to get to.

Statusbar, url bar, hovers over links, view source etc.

</comment></comment><comment><USER12> com.google:http/80:/path/to/the/file perhaps?

<comment><USER21> Or even

      com/google:http/80:path/to/the/file

However, it could just as conceivably be

      http/80:com/google:path/to/the/file

because, imho, the protocol and port are not really part of the hierarchical structure (part of the url, but not necessarily part of the uri).

</comment></comment><comment><USER15> This is widely considered to be a mistake.

<comment><USER22> _This is widely considered to be a mistake._

Citations, please? I've been able to deal with it over the years.

<comment><USER23> It turns out to be a complete pain for working out scope in Web crawlers because you need to separate the domain from the path part and deal with them separately. If it was in the opposite order it would be much simpler to process.

The Heritrix crawler (primarily worked on by the Internet Archive) introduces a "surt" form which is basically the domain in the same order as the path so that Reading from left to right it goes from least specific to most specific.

<comment><USER15> Crawling is an inconvenience, sure it is problematic, but phishing is much more problematic. You can train a machine to parse that thing right-to-left no problem, to tell users to start middle-to-left and then middle-to-right is too much of a burden.

<comment><USER23> Agreed. Not so much "a burden" as something that you will never be able to teach a large number of people.</comment></comment></comment></comment></comment>


A new approach to mobile search - <AUTHOR> http://www.gabrielweinberg.com/blog/2010/08/a-new-approach-to-mobile-search.html

<comment><USER2> So you're scraping the info from the pages and displaying it in the DDG app? From the user's perspective it's a wonderful idea and I would love to use a search engine that did this well, but that could piss off a lot of website owners.

<comment><USER3> I had tested similar functionality on the Web site and never got any complaints. I'm only showing a snippet and linking to the real page, i.e. like all the other search engines. The only difference is that my snippet should be much better (when shown for these cases) in that it is a readable paragraph chosen for your particular search. That said, if anyone does have any issues with it, I'm happy to take that into account.

</comment></comment><comment><USER4> Interesting app but I disagree with the "going to Web sites on your phone to find information is a pain" assertion. On the iOS devices I've never found "web searches" that difficult. Am I the only one? I do like the zero-click for information though, so that could be worth it. It is also nice to see DDG's continuing efforts to ensure "private" searches.

</comment><comment><USER5> I wish my phone could be listening to me all the time, and search for things I say like "when was Mozart born". I'm not sure how it would get the answers back to me. Maybe an ear-piece?

I think that would be the ultimate mobile search.

Has anyone tried making an app like that? Can an app on the iPhone or Android access an ear-piece?

</comment><comment><USER6> You (epi0Bauqu) should take a look at i.reddit.com as the interface looks similar and it already works on android and iphone and going to m.dukgo.com or m.duckduckgo.com would be somewhat enticing

<comment><USER3> Thx--will do. I've actually had this (mobile formatting) on my list for a while, but just haven't gotten to it yet.

</comment></comment><comment><USER7> I just wish I could have Spotlight be a Google search instead of searching my phone. Then maybe I would actually use it.</comment>


Microsoft brings git support to its CodePlex hosting service - <AUTHOR> http://arstechnica.com/#!/microsoft/news/2012/03/microsoft-brings-git-support-to-its-codeplex-hosting-service.ars <comment><USER2> I hope support for git continues to improve for Windows. Git Extensions is not bad, and works well for me, but I imagine it's still strange enough to put off developers that don't have _nix experience. I love_ nix, but Windows is a reality in my life, so I am happy when I see good tools move to Windows.

<comment><USER3> Yes, Windows developers with a very Windowy lineage of experience (something like DBase -> FoxPro -> Delphi/VB -> C#) don't get Unix tools at all. Someone could make a lot of money on a Windows git tool done right.

<comment><USER4> There's a big part of me that wants to say, "It's already been done. It's called TortoiesHg."

All the usual Mercurial command-line goodness, plus some very well-done Windows shell extensions. The biggest downside is that there just doesn't seem to be a good 3-way merge tool for Windows. Well, that and it doesn't enjoy Git's brand recognition.

<comment><USER5> SmartGIT is not bad either and it includes a decent three way merge tool.

</comment></comment></comment></comment><comment><USER6> I wonder how much this was directly influenced by Phil Haack (@haacked) leaving Microsoft to go work at Github.

<comment><USER7> Maybe a little. The request to support Git was opened back in Nov 2008. [1] I bet Scott Gu helped as well. He's very supportive of Open Source and I feel the reason we see Node on Azure and various Microsoft projects on git. As a .Net developer myself, I've very excited to see this!

[1] <http://codeplex.codeplex.com/workitem/19723>

</comment></comment><comment><USER8> I'm curious as to whether they have __nix or Windows servers at Codeplex. I've tried to setup a git server on Windows and it was ridiculously complicated compared to __nix

<comment><USER9> It is. Needs ssh server and whatnot. I ended up just creating a share and git pull/push into it as local files.

</comment></comment><comment><USER10> Previous discussion: <http://news.ycombinator.com/item?id=3741776>

</comment><comment><USER11> Talk about late to the party. LOL .</comment>


The Acid Farmers - <AUTHOR> https://mikejay.net/the-acid-farmers/ <comment><USER2> I think psychedelics have untapped potential for ADHD. A significant DMT experience I had greatly helped lessen my ADHD symptoms. I've also found that threshold doses of LSD increase my ability to focus as well as provide several other micro-benefits. I also suffered from anablephobia (fear of looking up into the sky), and after a particularly intense 100mcg LSD experience, that pretty much faded away and now I can look up in the sky with impunity.

<comment><USER3> It is an interesting observation. As a person with ADHD, I also saw that it makes my thoughts calmer (relaxed, dreamy, not rushed) and "flowing" rather than "jumping".

Or in other words, the transitions were smoother and continuous rather than discrete.

</comment></comment><comment><USER4> I've always wanted to try LSD, everything I can find though is either a 'research chemical' that is LSD-like or is of dubious origin.

I've thought about mushrooms/psylobicin instead but I really would like my first 'journey' to be proper old school 60's LSD not your modern china-made 'one molecule off' RC.

A wise old head once told me the drug would find me once I am ready.

<comment><USER5> You should absolutely do it.

Here is my playlist. [https://www.youtube.com/playlist?list=PLjIYRqpIFecr00pZcfWM4...](https://www.youtube.com/playlist?list=PLjIYRqpIFecr00pZcfWM44Q5OsGJrsKZh)

Don't worry too much about the 60's. What you really want is an aesthetic which overlaps a lot (but isn't identically equal to) the 60's.

Try and find a tree swaying in the wind, or something which moves at similar speeds with difficult to track shapes. Fireworks are also nice.

Your sense of time is wrong. Set yourself a deadman switch. Use your phone to set a 20 min timer, and when it goes off acknowledge it and then reset it.

Stare at a bright spot or a lightbulb for a few seconds then close your eyes. The after image will look like it got chopped up in frequency space.

Do it with a friend.

Give yourself 8 hours. This is a whole day affair.

Ignore the old head and get on the darknet or find an in person broker.

<comment><USER6> This is good advice. The swaying trees are etched into my memory from events well more than a decade back. Also be watchful not to straddle the line between explorative and habit-forming.

<comment><USER7> FYI: I know of no person who's formed a habit around LSD (MDMA is another story). I know at least four people who either did or do LSD weekly, and at least two of those weren't microdosing. Anecdotally, LSD is habit forming the way watching sunsets is habit forming.

<comment><USER6> LSD isn't addictive - sorry I should have been clearer. What I meant to say was that some experiments could be, or something like that.

</comment></comment></comment></comment></comment><comment><USER8> It's a pity that such a powerful drug has been demonized.

<comment><USER9> Eh, I think it's pretty good that it's only really taken by enthusiasts. It's not really a party drug, IME it's for drug nerds who want to 'expand their mind' etc. If everyone and their dog was taking it on a friday night to have fun, the world would be a much worse place IMO.

<comment><USER10> As one of those enthusiasts, I don't think that's a situation you really have to worry about. It takes a little while to reconstruct oneself to the point where you'd want another deconstruction. For most people, it's not going to be every day or even every month.

Only once have I run across somebody who wanted to trip twice in the same week, and I think he was just following habits ingrained in him by his previous cocaine problem.

Still, there would be outliers. If availability were higher, I would be worried about the few for which this isn't the case. They might cause some significant harm to their sanity.

<comment><USER11> > They might cause some significant harm to their sanity.

Is that possible?

The drug counselor at my college, when asked by someone in the audience at a presentation he was giving about drug history, which drug would be the least harmful to use if someone wanted to, said immediately, "LSD."

A collective gasp was let out by the crowd, especially considering he'd just said earlier it would take smoking 15 pounds of marijuana in 30 minutes to OD on it. That seemed pretty darn safe.

<comment><USER12> it's nearly impossible to cause _physical_ harm with lsd, but not difficult to inflict psychological harm, especially in people who would are already vulnerable or predisposed to mental illness

<comment> xkcd-sucks Well shit, we should make dating and work illegal too

</comment></comment></comment></comment></comment></comment><comment><USER13> In re: LSD,

> Of course, the drug dose does not produce the transcendent experience. It > merely acts as a chemical key — it opens the mind, frees the nervous system > of its ordinary patterns and structures. The nature of the experience > depends almost entirely on set and setting. Set denotes the preparation of > the individual, including his personality structure and his mood at the > time. Setting is physical — the weather, the room's atmosphere; social — > feelings of persons present towards one another; and cultural — prevailing > views as to what is real. It is for this reason that manuals or guide-books > are necessary. Their purpose is to enable a person to understand the new > realities of the expanded consciousness, to serve as road maps for new > interior territories which modern science has made accessible.

— Timothy Leary, The Psychedelic Experience: A Manual Based on the Tibetan Book of the Dead

[https://en.wikipedia.org/wiki/Set_and_setting](https://en.wikipedia.org/wiki/Set_and_setting)

LSD merely gets you "high as a Lord".

Leonard Orr used to help people have very profound healing "trips" using set and setting and oxygen (hyperventilation) [https://en.wikipedia.org/wiki/Rebirthing_(breathwork)](https://en.wikipedia.org/wiki/Rebirthing_\(breathwork\))

If you want to explore your inner world in a responsible way, a few LSD trips with deliberate set and setting _might_ be educational, but it's much safer and easier to just use hypnosis and/or meditation.

<comment><USER14> Leonard has since gone in for immortality.

Stan Grof of course (one of the original LSD psychotherapists) has developed breathwork into a substitute for psychedelic work over many years.

</comment></comment><comment><USER15> Anybody have some legitimate technical or scientific insights while on LSD? I'm talking along the lines of something like discovering General Relativity or figuring out a solution to a technical problem because you tripped on LSD.

<comment><USER16> Not sure if you'd consider it a technical or scientific insight, but I mentioned this on another HN post a while ago:

I was able to visualize four dimensional structures on LSD. I can't see it "instinctually" anymore, but I had a vision of our universe as the 3D surface of a 4D hypersphere, and from that perspective it's subjective whether you consider the entirety of the universe inside of you or outside of you. After coming down I thought it was probably some nonsense that my brain dreamt up, but I analogized it as a 2D surface of a 3D sphere and it makes complete sense. Drawing a circle on a sphere and calling one side of the line you draw the "inside" is completely subjective—we just tend to call the smaller side inside. If you grow the circle to the greatest meridian of the sphere, which side is now "inside"? Is my brain on the inside and the universe on the outside, or is the universe on the inside and my brain on the outside?

I also kept seeing (when I say "see", it isn't the type of hallucination that appears like a real object in front of you, these all form in my mind's eye but are more vivid than what I can usually visualize) these grid-like, branching "corridors". I'm not sure what the best term for it would be and it may have not been 4 dimensional per se, but I don't think the way it's laid out would work in 3 dimensions. It was like I was floating in an intersection with rows (x), columns (y), and aisles (z) passing through me. A lot of this is hard to visualize when not tripping.

<comment><USER15> Were you actively attempting to visualize a 4D structure while tripping or did it just appear?

<comment><USER16> They appeared by themselves but I could manipulate them. Most visualizations are usually part of some train of thought though, they don't appear out of completely nowhere.

</comment></comment></comment></comment><comment><USER17> I have had fabulous times on LSD. Kind, beautiful, full of light. Educational too. I highly recommend it.

</comment><comment><USER18> Honest question: Is there anybody here who regrets taking LSD? Is it really safe or are we dealing with a self-selection problem of the people who would regret taking LSD not being sane enough to bother being on internet forums?

I'm no puritan but it just seems to me like a taking acid is a huge risk to take with one's mental health.

<comment><USER19> I have tried LSD a few times and had nothing but positive experiences. My wife, however, tried it once and had a bad trip. She was convinced I was going to murder her (obviously everything I did further proved that point) and everything was scary for her. She was afraid of large trees in a kind of "raises my anxiety baseline" kind of way for about a year after the trip. But, the experience wore off, and she's fine now. She believes that it's possible that the experience contributed to her being a more anxious person now, but that's conflated with all kinds of things like marrying me and changing careers and having greater responsibility for those around her.

I don't think it's as big a risk as you seem to think. The people who I have met who have had bad trips did not see lasting side effects, though they did take a while to wear off.

I'm sure someone else will post it, but if this is something you genuinely want to know more about, read "How to Change Your Mind".

<comment><USER20> I think when taking mind altering drugs you have to be self-confident, otherwise you should avoid them since that/anxiety is what normally leads to a bad trip. Having a benzo, ex. xanax, around as a backup plan can help _sort of_ stop a trip.

<comment><USER21> Enough benzos have always turned LSD completely off for me.

Enough, for me, has been 1x 10mm diazepam (Valium) followed by another 1x 10mg diazepam one hour later if I also want to go to sleep.

Or approximately equivalent alprazolam (Xanax) or temazepam.

</comment></comment></comment></comment><comment><USER22> I love this kind of information-packed article, especially on topics that usually yield fluff/opinion/anecdote pieces. The author seems to have written a lot of visionary-related texts and I'm curious to look at these.</comment>


Ask HN: Is it still too hard to allow "back" buttons on a banking website? - <AUTHOR> Its really frustrating not being to go back using the back button, it hampers the general flow by which I use most of the websites. Its already 2015 here, why does bank websites not allow back buttons?<p>Bank I used was: ICICI bank. <comment><USER2> Banks are extremely slow movers, probably for somewhat valid reasons since every little change must be examined and tested in the extreme for defects, vulnerabilities and regulatory compliance.

Adding that it actually takes a fair amount of work to make browser back/forward buttons work in a web application, it is really no wonder that the situation is what it is.

</comment><comment><USER3> The back button exists, banks can not refuse to allow its use. All they can do is warn against its use.

Have a unique hidden input for every form. If a user goes back, regenerate the form.

If a form is somehow resubmitted, print a nice message saying saying that transaction was already submitted.

<comment><USER4> My bank immediately logs me out if I hit the back button (instead of using their "go back" link) at any time during a logged-in session. That's whether I'm making a payment, looking at my statements, setting up direct-debits etc, or just sitting ambiently on the home-screen. It's incredibly annoying.

</comment></comment><comment><USER5> I google that and this was my third result.

[http://www.gcflearnfree.org/internetsafety/6/print](http://www.gcflearnfree.org/internetsafety/6/print)

Topic 6 talks about it. So simple.

<comment><USER6> Except that you don't get charged twice on Amazon or basically any web merchant when using the back button.

<comment><USER7> You won't get charged twice on any well-written site, but I'm still careful with the back button around any transaction.

It's not really an issue at either of my banks, because a transaction is a lot more than merely submitting a form, and requires authorization with a single- use code. But webshops tend to have far more linear transactions, and I don't always fully trust them to use the back button the way I think it should work.</comment></comment></comment>