Why we made Vorlon.js and how to use it to debug your JavaScript remotely - codepo8-hn http://blogs.msdn.com/b/eternalcoding/archive/2015/04/30/why-we-made-vorlon-js-and-how-to-use-it-to-debug-your-javascript-remotely.aspx <comment><AUTHOR> How is this different from weinre? [http://people.apache.org/~pmuellr/weinre/docs/latest/](http://people.apache.org/~pmuellr/weinre/docs/latest/)

<comment><USER2> maybe vorlon is usable

</comment></comment><comment><USER3> I tried to use this, but I kept getting mysterious error messages like "the avalanche has already started it is too late for the pebbles to vote" and "divide by zero".

</comment><comment><USER4> So, when does Microsoft release their Genetic Algorithm / Z3 based Fuzzer called 'Morden'? It's what I want at least.

</comment><comment><USER5> I cloned the project from [https://github.com/MicrosoftDX/Vorlonjs.git](https://github.com/MicrosoftDX/Vorlonjs.git) to play around with creating a plugin. The code in the plugin TS files (e.g. `Plugins/Vorlon/plugins/sample/sample.ts`) keeps reporting errors like `Cannot find name 'Core'`, `Cannot find name 'RuntimeSide'` etc. Is that expected?

I have run `npm i` from the project root.

      $ node -v && npm -v
      v0.10.36
      1.4.28

<comment><USER6> Can you please try a npm install at the root folder level?

</comment></comment><comment><USER7> I was hoping this was finally a release of Microsoft Research's Rivet Debugger: [http://research.microsoft.com/apps/pubs/default.aspx?id=1618...](http://research.microsoft.com/apps/pubs/default.aspx?id=161835)

<comment><USER7> Here's a more entertaining video of Rivet: [https://www.usenix.org/conference/atc12/technical- sessions/p...](https://www.usenix.org/conference/atc12/technical- sessions/presentation/mickens)

James Mickens is a crazy productive/smart dude.

</comment></comment><comment><USER8> I'm still reeling from a Microsoft web page showing commands at a Unix prompt.

<comment><USER9> [https://en.wikipedia.org/wiki/Xenix](https://en.wikipedia.org/wiki/Xenix)

</comment></comment><comment><USER10> Anyone know what sort of auth or security provisions are involved? It seems great for developers, but if I were a user, I would worry about giving someone a remote session at my browser's javascript console.

<comment><USER11> It won't have any access the hosting website doesn't already have... It's just interactive instead of strictly the delivered JS.

<comment><USER10> I'm sure that's the intended state of affairs. But there's a difference -- at once psychological and technical -- between "trusting someone else's application code" and "letting their developers have remote debugging access to your machine."

<comment><USER11> They don't have any remote debugging access they wouldn't have... the JS still runs in your browser, sandboxed to the window with their website in it... it can't do anything else that any JS could do... it may be a psychological difference, but it's not a technical one...

I've considered a number of times about actually shipping dom-diffs so that support could _see_ what a user is seeing. This technology has been around for a while.

</comment></comment></comment></comment><comment><USER12> I'm getting the following popup when I visit the page:

      The page at blogs.msdn.com says:
      The target of the callback could not be found

I really want to like Microsoft, but it's the little things like these that make me uneasy. Especially when you're blogging about debugging javascript.

<comment><USER6> Really sorry about that. Our blog platform is a crap. You can directly go to www.vorlonjs.com for more info and better web site:)

</comment></comment><comment><USER13> Anyone see what clients it supports? Could it be used to debug IE6?

</comment><comment><USER14> _Based on this, the second reason is because the Vorlons are one of the wisest and ancient race of the universe and thus, they are helpful as diplomats between younger races._

What? No. That's not how the Vorlons worked _at all_.

Also, Javascript is basically the Shadows (mordon.js lol).

Wonder what langauges/frameworks map onto other Babylon 5 concepts?

Angular -> Earth Alliance? Enterprisey but not super elegant, and collapsing under its own weight and propaganda?

<comment><USER15> > What? No. That's not how the Vorlons worked at all.

Maybe OP has only watched through season 3

<comment><USER16> Dude! Spoilers!

</comment></comment></comment><comment><USER17> I'm disappointed if like it's namesake it doesn't give vague, disturbing, portent information to the console.

"If you go to 'undefined', you will die"

<comment><USER14> " _this_ is a three-edged sword."

<comment><USER18> "You are not ready for immutability."

<comment><USER19> "What's inside there?"

"One moment of perfect Javascript."

<comment><USER15> "I will not be there to help you when you pollute the global namespace"</comment></comment></comment></comment></comment>


This title is link bait - <AUTHOR> http://raganwald.posterous.com/this-title-is-link-bait <comment><USER2> I'm 100% in favor of the content of this article, BUT the argument should only apply to the title of the post of the article on the author's own blog.

A blog post author has two audiences, himself and his readers, thus his obligation is to himself and his readers. He should try to get as many eyeballs for himself and try to entertain his readers as much as possible.

Hacker News has one audience, the community of hackers reading HN, thus the obligation of someone posting a link on HN is to their fellow HNers. The submitter of a link should give it a title that maximizes the utility for other Hacker News members. Karma doesn't exist for the benefit of individuals, it was instituted as an effort to promote good behavior that benefits the community. The title of the link on posted on HN should be written with the goal of providing the most utility possible to other Hackers and does not need to be the same as the post title, and in fact should be different if it can be improved to help other HNers better decide if it is a link that may interest them.

When a post author submits a link on HN, they have a responsibility to the larger community first and foremost, and to themselves as the author of the blog post in a far second.

It's acceptable for an author to give his post a link-bait title. It's unacceptable for a fellow HNer to give his submission a link bait title, because doing so benefits the blog post author at the expense of the HN community. When the person submitting a link is deciding what title to use for a link submission to their own article, they should determine that title based on their role/identity as a member of the HN community. To do otherwise is disrespectful.

Remember: A group is its own worst enemy. <http://www.shirky.com/writings/group_enemy.html>

<comment><USER3> I agree. It is the _submitter's_ responsibility, which is why the article addresses the blog author and explicitly tells HNers to use the site's existing tools: flags, votes, and the ability to edit the title to be appropriate for HN.

<comment><USER2> Yup. The only thing that wasn't clear is that when there is a conflict of interest, such as when the submitter is also the author, that one should look out for the commons first.</comment></comment></comment>


UK Signs Julian Assange's US Extradition Papers - <AUTHOR> https://edition-m.cnn.com/2019/06/13/uk/julian-assange-extradition-order-us-gbr-intl/index.html <comment><USER2> Go to war.

Kill civilians.

Get exposed for it.

Put the guy who exposed you behind bars for life.

Nice system.

</comment><comment><USER3> British lapdogs of American corporate, kleptoplutocratic hegemony.

</comment><comment><USER4> Surprised to see this on CNN. It's entirely missing from their front page this morning. Apparently keanu reeves not hugging women is more important news.

</comment><comment><USER5> What does it mean that they are signed?</comment>


Das Keyboard 5Q: The Cloud Connected Keyboard - <AUTHOR> https://www.kickstarter.com/projects/1229573443/das-keyboard-5q-the-cloud-connected-keyboard <comment><USER2> Cloud-connected keyboard + security vulnerability could mean remote key logger + remote typing capability (yes, if this has the right bug in its remote protocol handling, this could sniff your password and, possibly, log in to your bank from your IP address and transfer money, buy something on eBay, etc.)

Of course, they don't plan on delivering that security vulnerability, but I would hope the electronics for scanning the keys and sending data to the PC are 100% separate from those for controlling those lights, so that accidental vulnerabilities cannot have such consequences.

</comment><comment><USER3> I like my DAS keyboards. But this is teh stupid.

</comment><comment><USER4> "Where else could we put blinkenlights?"</comment>


Show HN: Convert photo, image or picture into a pencil drawing - <AUTHOR> https://pencilcyborg.com/ <comment><USER2> The result does not look like a pencil drawing. To me it looks like it is the original in black/white + amplified edges.

<comment><AUTHOR> Please try the new version, we just updated our algorithm i think you will be pleased with the new result.

<comment><USER2> Hmm.. yeah it's a bit more of a pencil drawing now. What is your business model?

<comment><AUTHOR> We will keep on improving it so it work better and better. For the moment the whole business is based on donation : [https://appscyborg.com/contribution](https://appscyborg.com/contribution) ,as unfortunately this is not enough we plan on developing sponsoring like [https://www.troyhunt.com/sponsorship/](https://www.troyhunt.com/sponsorship/) If any company is interested you can contact us at email@example.com</comment></comment></comment></comment>


Startup says what? - <AUTHOR> http://www.virgin.com/entrepreneur/blog/startup-says-what <comment><USER2> I would call it optimism. I guess that's how every startup starts and grows.</comment>


Internet activists take aim at a new House cybersecurity bill - <AUTHOR> http://thehill.com/blogs/hillicon-valley/technology/220419-after-killing-sopa-internet-activists-take-aim-at-new-cybersecurity-bill

<comment><USER2> This bill gives big internet companies more power and less oversight. We will see whether all the triumph and idealism around the "people power" defeat of SOPA/PIPA was effectively astroturf. CISPA threatens basic user privacy, not the user generated content cash cow. We will see how far this protest gets without the support of silicon valley big money.

</comment><comment><USER3> The list of companies supporting this bill:

[http://intelligence.house.gov/bill/cyber-intelligence- sharin...](http://intelligence.house.gov/bill/cyber-intelligence-sharing-and- protection-act-2011)

<comment><USER4> Didn't expect to see Facebook

</comment></comment><comment><USER5> _sigh_ Its annoying that such a large chunk of the internet falls under the jurisdiction of these clowns and their lobbying bullshit.

</comment><comment><USER6> I think folks need to understand what this bill is intended to do. When companies and governments detect and analyze intrusion attempts, they collect a lot of data. Currently they tend not to share that data with one another, for fear of opening themselves up to bad press, shareholder lawsuits, etc. As a result, a lot of easily preventable attacks work against company after company after company.

The idea behind this bill is to create a safe way for companies to more easily share and learn, with a minimum of lag, about new attack vectors. A simple analogy might be to think of an immune system--it works best if the entire immune system goes on alert to fight each new infection (this is how vaccines work).

The definitions in the bill seem overly broad, and the fears are that it will be used to collect and share personal info and user-generated content.

These fears are legitimate, but I think it would be better to address these fears by narrowing the language rather than killing the bill.

It's not SOPA in disguise. It's a cybersecurity bill that needs some work. Most bills that are introduced need work; that's why the Congressional legislative process is so complex and long.

* Edit: for grammar</comment>


Why machine learning hyped if easily fooled? - <AUTHOR> I asked a similar question regarding deep learning, and one answer stated this problem is not unique to DL, but is common to many ML approaches.
https://news.ycombinator.com/item?id=14850096
Given the widespread adoption of ML, shouldn't this be of great concern?  Yet I do not see much discussion of ML's shortcomings and being easy to manipulate.  Seems an easy to exploit attack vector, could be the next buffer overflow equivalent. <comment><USER2> 1\. Hype is often about how something _will_ be, not how it is today. Examples include self-driving cars, VR, and even the original iPhone (which didn't have third-party apps when it was released).

2\. For some uses of ML/DL, it doesn't matter if it's easily fooled. There will either not be an opportunity to feed it tricky data, or it just isn't a problem if it makes some mistakes.</comment>


Fear of Ignorance - <AUTHOR> http://randfishkin.com/blog/153/fear-of-ignorance

<comment><USER2> I think the fear/hatred he describes among techies for non-technical managers is overall pretty reasonable.

A lot of managers believe their job is to make decisions, and a lot of employees even encourage that. But technology decisions often have subtle, far-reaching implications. So when managers make decisions they shouldn't (e.g., picking a toolset, or outsourcing a project, or simultaneously fixing resources, scope and schedule), they end up thoroughly screwing the developers involved. But if none of the other managers understand the tech either, then managers can happily blame the devs. Hands up everybody who has seen that?

Software is almost unique, in that it's a collective intellectual work that is expected to function and grow and change over many years. The only close equivalent I can think of is legal code, but I think software is worse in that legal code is made to be interpreted by humans.

The only non-technical managers I've had that I didn't at least briefly consider murdering were the ones who, like Rand Fishkin, were comfortable admitting ignorance. That let them leave technical decisions to the techies.

<comment><USER3> >(e.g., picking a toolset, or outsourcing a project, or simultaneously fixing resources, scope and schedule)

My company had non-developers make these decisions and we paid the price. We were an org of PHP and Python developers "forced" to switch to C#/.NET (At the request of two technical-ish, but non-developer VPs) It really sucked because the teams expert knowledge got wiped to zero and we had to spend several months learning new tools while also keeping our original deadlines. At the time, I jumped at the opportunity to explore something new. Ultimately however, it was bad business and continues to cost the company money as nothing we were doing received any direct or indirect benefit from being done in .NET. The only difference was we worked slower and produced more defects.

</comment></comment><comment><USER4> I'm constantly telling a good friend of mine who is a co-founder of a start-up NOT to learn to code. He's absolutely brilliant in his field (a technical but non-CS field) and while he wishes he could code up his ideas I've directed him to developing flowcharts and spending time writing - his ability to think up new ways of doing things within his field is unparalleled. Personally I think he's a genius at what he does and I see that when he tried to code he stops focusing on what he does best. Even though he understand enough core computing concepts to design applications I think he's jealous of my ability to mock up a demo app, while maybe I'm just clever enough to not go down the rabbit hole of trying to learn everything about everything..

<comment><USER5> His burning curiosity may help explain his genius.

What's the name of the startup? It sounds very cool.

<comment><USER4> Stealth mode right now, it's a niche market but lots of fun.

<comment><USER5> Congrats! Sometimes it sounds like having fun is half the battle. (Pardon the war metaphor.)

</comment></comment></comment></comment><comment><USER6> I suspect that the main reason for attitudes towards non-technical people is due to a wide distrust of "business type" guys. I think coders often have a great amount of respect for product designers, UI/UX folks making wireframes, .. or anyone who shows some capacity to actually make something, for deep thought & creativity, or to articulate a convincing & unique vision.

The greater myth is that "technical" people must lack "soft" skills. If you go beyond anecdotes, software engineers on the whole are more likely to be married & enjoy happy marriages, less likely to get divorced, have long lasting friendships, communicate honestly & care about others, are more likely to be engaged in politics and charities, etc. etc.

Likewise, engineering & building large software systems together (or any machine of complexity...), requires a great degree of communication & cooperation, thus it is no surprise that software engineers on the whole are actually pretty engaging people & have good communication skills.

<comment><USER7> Not that I think you're wrong, but do you have a citation for your second paragraph?

<comment><USER8> Also, is that compared to other professional fields, or the general population? The latter wouldn't be very remarkable.

</comment></comment></comment><comment><USER9> I think the main crux of the article is ultimately dependent on the one thing he mentions at the very end:

      It goes (almost) without saying that the only reason I can
      afford to be non-technical is because I'm surrounded by a
      bunch of geniuses.

His points are valid, but if you're a single non-technical founder, it can often be hard to even know whom to surround yourself with if you lack the ability to evaluate them in the first place. This point is not made very apparent in the article.

</comment><comment><USER10> Yes, non technical people can lead technical people successful - but I think they are the exceptions on the rule.

As the leader you are responsible for the results of the project - and if you don't understand the technology, you don't understand the risks of the technology. If you don't have an A+ team, they might be doing the wrong things and you wouldn't know. I'm talking about bad architecture, bad technology choices, full dependence on one developer,..

<comment><USER11> There is another side to the story - the worst managers I have had throughout my career have all been former programmers. Leadership and managerial skills plus an analytical orientation trump a coding background or specific technology skills to me.

</comment></comment><comment><USER12> The article makes a great point, it's not necessary to be technical to be successful in technology management. Also you should be proud of your strengths and the contributions they enable you to make rather than focus on power psychology.

I would also agree with the author that a technical background helps.

It seems to me that without a technical background it's possible to make an incorrect appraisal about problems with tecnical projects.

For example, the product is incorrect or late. Why?

As a manager you need to determine a belief on why things are problematic and how they can be improved.

There are a lot of possible problems. If a non-technical person gets this incorrect it can have very negative consequences. It's a minefield that is typically, though not always, better traversed by people with technical skills.

</comment><comment><USER13> Strong article. I think fear of technical ignorance is scar tissue. It's an overcompensation of the fact that traditionally programmers were undervalued until silicon valley proved that software does matter and is in fact a place where talent and decision-making power are incredibly important.

But in the end, technical knowledge is just one pillar. You also need strategy, management and ops to build a successful company. Rarely can one person bring all these to the table, instead you put together the right team of founders and employees to cover the essential skills. As long as you have a strong tech team whose knowledge and wisdom is feeding into the core of your decision making process then I think a CEO with more hard business experience is probably an advantage. It depends a lot on the company though.

</comment><comment><USER14> Well, come on. The basics are not that difficult. If you just attended the first 1-2 lectures of a CS 101 class, you wouldn't be talking about "the ability to call variables via programmatic statements". Plus, I'm sure any of your developers would be happy to spend a couple of hours and get you up to speed on the difference between variables and function calls.

</comment><comment><USER15> Technical skills as a founder aren't important because you can build the product youself, but because they enable you find the best people who can.

</comment><comment> johnx123-up Another "morons are good managers" kind of article...

As far as I heard, this attitude is currently killing Google. Google has lots of MBAs to manage hackers and it really hurts Google.

<comment><USER16> I don't think you have either: a) read the article, or b) the first clue of what's going on inside Google.

Rand is not a moron, nor is he advocating management by morons. He's not an MBA either; he's a self-taught college dropout. He's saying that company founders who are nontechnical should be humble but not ashamed.

Google may have faults, but hiring MBAs to manage engineers is certainly not one of them. The engineering management hierarchy is almost exclusively extremely technical.

<comment> johnx123-up Everybody I know there in Google confirms that MBAs are really crippling it. Recently I had a lengthy discussion with couple of them on that. They do have politics and chaos.

Self-taught and nontechnical are two different terms. In real world scenario, self-taught people often associate themselves with "technical".

</comment></comment></comment><comment><USER17> Rand appears to be, or at least to have become, a domain expert in SEO. I think devs, at least those not working on the latest social mobile local photo coupon sharing, tend to be respectful of domain experts. I think non-technical people seems to often be used to mean people without technical expertise _or_ deep domain knowledge.

<comment><USER18> That's right. I respect ALL competence.

What I don't like is to be bossed around by puffy people with ZERO self- insight and INFINITE delusion.

</comment></comment><comment><USER19> At the end of the day I have no respect for a person who cannot take the time to learn CS Basics...If a technical guy can read Steve Blank,Clayton Christensen,Hayek and Friedman....a non-techie can definitely read The Art of Computer Programming if he intends to run a software business.....coming up with nonsensical excuses will not help!..Here are some common excuses.

1) I need to have a degree in Engineering

Well not really...Myself and all the best programmers I have known have learnt very little from educational institutions than they have from man pages.

2) Little Knowledge can be dangerous

Yes...it can be but noone is asking you to be en expert....by learning the basics you will only begin to understand the complexity of the problems being solved and will learn when to open your mouth and when not to...saying things like "lets move to the cloud" or "lets do this in an agile manner" without having a clue only makes you look bad!

3) It is not my cup of tea.

Noone is asking you to become Linus Torvalds...at least try to know as much as some kid in high school would...If you dont have the thirst for knowledge to begin with,you are in the wrong business!

<comment><USER20> > If a technical guy can read Steve Blank,Clayton Christensen,Hayek and > Friedman....a non-techie can definitely read The Art of Computer Programming

What utter nonsense. The theoretical difficulty of pop-economics books like Hayek's Economics In One Lesson or The Road to Serfdom is less than Teach Yourself Programming In 24 Hours. That's not meant as a slight on any of those books or their authors, but your comparison is so inapt it beggars belief. The mathematical prerequisites alone for reading TAOCP are so significant that Knuth had to write an advanced undergraduate and graduate-level textbook (Concrete Mathematics) to equip students with even a small subset of the tools required.

<comment><USER21> > Hayek's Economics In One Lesson

s/Hayek/Hazlitt/

</comment></comment></comment><comment><USER22> Nice try, Hermain Cain.</comment>


Angel Investing – The Most Underrated Skill: Access to Buyers - <AUTHOR> http://www.bothsidesofthetable.com/2010/09/19/angel-investing-%E2%80%93-the-most-underrated-skill-access-to-buyers/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed:+BothSidesOfTheTable+(Both+Sides+of+the+Table) <comment><USER2> I think he overestimates the value of connections in this respect. Acquirers are not easily influenced. I don't think any investor can affect e.g. Google's interest in an acquisition by more than a couple percent.

<comment><USER3> No, but I'm sure they can make introductions, get a company into consideration, or at least make Google aware of the startup and the value it can bring as an acquisition.

</comment></comment><comment><USER4> He mentions Sequoia as an investor in Zynga, but I'm not seeing that on Crunchbase. Wonder if that's an error or if he knows something we don't.

<comment><USER5> It was an error - sorry. I meant to put it under KP. thanks for spotting.</comment></comment>


New Technology Adoption is Getting More Painful - <AUTHOR> http://www.caycon.com/blog/2011/10/new-technology-adoption-is-getting-more-painful/ <comment><AUTHOR> It is only painful because the inventing entrepreneur thinks the invention is the be all, end all. The best technology accepts that it will have flaws and take time to penetrate the market.</comment>


Yelp accused of burying good customer reviews - <AUTHOR> http://www.cbc.ca/news/canada/british-columbia/story/2012/06/08/bc-yelpreviews.html <comment><USER2> That particular topic about Yelp and their reviews have been discussed many times on HN. Yelp is a major scam company that absolutely do not care about the business owner. They are in it for the money -doh- and what matters for them is Page Views, and regular users posting more reviews, thus more page views. Their filtering system is a total mess but since it is a secret on how it works they can say whatever they want... As long as their filtering system goes into promoting page views. Nowhere in there they care about the small business that are badly hurt by their lack of common sense.

Simply don't use Yelp for posting reviews or reading reviews, this is the best thing anyone can do.

PS: I speak from close personal experience with my wife small business being hit hard by Yelp algorithms for filtering review, and Yelp scammy sales people.

<comment><USER3> Out of curiosity, what is the alternative? Just allow twenty five-star or one- star reviews to show up and say hey, if business owners want to scam the system by putting in fake reviews, then great? Or just open-source their algorithms?

I guess to me it seems infinitely easier to criticize the way someone else does it than to present a more efficient way of doing it.

<comment><USER4> One possibility would be to allow users to manually flag reviews, instead of trying to do it algorithmically. They could also have some sort of confidence rating for reviews, or possibly a reputation system for reviewers. From looking at the hidden reviews for a couple of stores while I've been trying to find a place to get new glasses, they seem to be hiding a good number of legitimate reviews with their current system.

<comment><USER2> You are correct. Such simple change will be already going in the right direction. It is amazing to see all the reviews hidden that are legit: you can see if the reviewer use Yelp often by checking the number of reviews posted. The current filtering system seems to ignore that most of the times, but reviewers with no previous review prior giving 1 star will see that review stick.

</comment></comment></comment></comment><comment><USER5> This is a pretty crummy article. If you read it carefully, you see:

\- a woman owns a shady company

\- she tries to get her friends to write five star reviews of her on Yelp

\- Yelp intentionally tries to filter out these reviews so the site isn't filled with spam opinions

\- the woman is upset

The real question is why there's a news story taking her side in this.

<comment><USER6> Agreed. Not to say there isn't a problem with Yelp's practices (as have been documented elsewhere), but this article does not make a good case against them.

From an algorithmic standpoint, filtering out reviews from new users makes sense. Otherwise you'll get the owner and friends stuffing in good reviews.

Just look at what the data might look like for the 17 people. -They all sign up in a period of a few weeks. -They all review this one place and nothing else. -16 of the 17 never sign back in again.

It's pretty clear that it's a blatant rating stuff, so filter it out. Again, I'm not saying that the algorithm is perfect, but it makes sense to at least filter out these reviews.

<comment><USER7> > (as have been documented elsewhere)

I don't think that really has been documented elsewhere. There have been lawsuits and allegations, but no proof, as far as I know, that Yelp has offered to compromise their reviews for cash. Yes, they give business owners willing to advertise some editorial control over their listing, but the extent of that control is fairly well-understood and not much more nefarious than Google's text ads. Correct me if there's documented evidence otherwise.

Instead, we get article after article of business owners complaining because their Yelp reviews suck and their obvious attempts to game them have been thwarted. But that's exactly what Yelp should be doing. They're useless if they can be gamed. They're also useless if it becomes well-known that they're pay-to-play, but again, I don't think there's actual evidence of that. They'd have to be pretty stupid to take that course.

</comment></comment></comment><comment><USER8> [http://eater.com/archives/2011/07/20/yelp-accused-of- fivesta...](http://eater.com/archives/2011/07/20/yelp-accused-of-fivestar- review-extortion.php)

[http://www.eastbayexpress.com/ebx/yelp-and-the-business- of-e...](http://www.eastbayexpress.com/ebx/yelp-and-the-business-of- extortion-20/Content?oid=1176635)

[http://consumerist.com/2010/02/yelp-accused-of-more- negative...](http://consumerist.com/2010/02/yelp-accused-of-more-negative- review-extortion.html)

[http://jonathanturley.org/2010/02/27/yelp-accused-of- extorti...](http://jonathanturley.org/2010/02/27/yelp-accused-of-extortion-in- trading-positive-review-for-advertising-money/)

<http://techcrunch.com/2010/03/04/yelp-lawsuit-extortion/>

[http://techcrunch.com/2010/03/17/complaints-against-yelps- ex...](http://techcrunch.com/2010/03/17/complaints-against-yelps-extortion- practices-grow-louder/)

[http://www.pcworld.com/article/190231/yelp_hit_with_class_ac...](http://www.pcworld.com/article/190231/yelp_hit_with_class_action_lawsuit.html)

[http://www.wired.com/business/2010/04/yelp-fights-fraud- alle...](http://www.wired.com/business/2010/04/yelp-fights-fraud-allegations- by-unfiltering-reviews-killing-pay-for-favorite-feature/)

Yelp has a pretty shady history with this. The class action suit from a year or two ago was dismissed, so I assume what they are doing is legal in some sense.

<comment><USER9> The suit was dismissed because of lack of evidence of extortion.

<comment><USER10> Not only is there a lack of evidence from the plaintiffs, Yelp has mountains of evidence proving the opposite.

</comment></comment></comment><comment><USER11> I've been running a business review website for about 4/5 years and I absolutely hate it.

If I had $1 for every time a business owner writes a review for themselves (signing up for an account with their business email address no less), our system removes it and then they email me _within minutes_ complaining that a genuine customer had written them a review, where has it gone...

There are lots of variables our algorithms track to try and make a decision on whether to filter a review or not and of course it will get things wrong but if there wasn't any filtering in place, the amount of spammy reviews would be overwhelming.

I feel somewhat for Yelp, even with all their millions of dollars to throw at the problem as there is no easy solution, ignoring any potential pay for stars type nonsense. That is something I would never do and am very proactive when it comes to protecting small businesses.

Like I said though, after years of seeing people try to pull a fast one, the warmth in my heart fades.

</comment><comment><USER12> I keep seeing articles like this. I read the article, then I find the company on Yelp and read through the reviews.

 _Every single time_ it's been very clear that Yelp is telling these businesses that they have a problem. But rather than acting on this extraordinarily valuable feedback the owners/managers react by blaming Yelp for the bad reviews or accusing Yelp of hiding the good reviews.

This behavior frequently exposes the characteristics about which customers are complaining: there's a problem, the owners have been told about it, and they're killing the messenger.

EDIT: I have no connection to Yelp whatsoever. I'm communicating the scope of my experience and the conclusions I've drawn. These conclusions may be grossly flawed. It wouldn't be the first time today. :)

<comment><USER2> Clearly you have not been running a small business. Some reviews are posted from time to time by people that are not even customers or stopped by the business; for some dumb reason they post a 1 star review.. And that review usually stick and doesn't get filtered out...but other reviews from true customers posting 4 to 5 stars reviews disappear usually in less than 24 hours after they were posted.

What kind of explanation do you have?

<comment><USER13> Spam filtering is hard? You are a programmer, imagine trying to find a way to objectively and fairly filter reviews. Unlike with emails you don't know whose labels to trust. There are good business owners who will only report spam reviews as spam. Then there are bad business owners who will report negative ham as spam to try and boost their reviews. Finally, there are bad business owners who will use shell accounts to submit positive spam and then mark it as ham.

In general the labels from business owners are not trust worthy which gets them into these situations. Thus they try and create other ways of identifying spam: like user engagement on the site. However, engagement doesn't always work as a metric as spammers can cultivate spam accounts by posting lots of "legitimate" reviews on unrelated businesses and then sell reviews from the accounts to attack (boost) specific businesses. Finally, users who have a tremendous experience at a business and go on Yelp to give them 5 star reviews may have no history with yelp except as a passive browser. The engagement metric will weight poorly for their review.

So what is to be done? I don't have a good answer for that. This seems more like a human problem than a technical one. The best course seems to be: act ethically, serve your customers with compassion, write responses offering assistance to negative reviewers, and if you feel Yelp (and similar review system are a bad idea) put your advertising dollars elsewhere.

<comment><USER2> They are various ways to solve the problem but again it is not in Yelp's interest. Yelp's business is about selling Ad and they don't really care about the underlying issues. One simple thing that could be added to their system was a way to verify that a reviewer did really have a business relation for posting a reviews. They are various ways for solving that.

Even a simpler approach: why hide those reviews. Keep them here and introduce a way for other viewer to rate the reviews aka 'X people found that review helpful'. That way all reviews are visible and the random person reading the Yelp page can decide for themselves. Unfortunately Yelp and their filtering system have a different approach and instead usually end up filtering real customer reviews and leave the more 'spammy' visible. Then after a few weeks like that, you will receive a phone call from Yelp sales folks telling you that if you purchase 'ads' then your potential 5 stars review (if any are left visible) will be pushed to the top.

Sorry but for me I consider that a scam!

<comment><USER13> There is no relationship between the sales calls and the filtering algorithm. That is what the dismissed class action lawsuit was about. All "evidence" people have is purely anecdotal.

Verifying a "business" relationship may work but it still won't solve all of the problems. You can still pay people to show up at your restaurant, pay with their credit card and write a five star review. You can still pay people to show up at a competitors restaurant, pay with their credit card and write a one star review. It simply increases the cost of the spam (which is a good thing). They should probably create a way to do this but it won't solve the fundamental problem: the reviewer pool is an unreliable source of information.

"X people found that review helpful"

A helpful review is not the same as an accurate review based on experience. I would find a well written review helpful. However, the review could still be inaccurate or fake just well written. This is simply another data point for spam detection and one with many confounders at that. One has to simply google around about the state of Amazon reviews to see the flaws in this approach.

Once again. I stand by my assertion, detecting spam reviews is extremely difficult because it is a _human_ problem.

</comment></comment></comment></comment></comment><comment><USER14> I'm on the opposite side of the equation: I quit using it after I discovered it was hiding my positive reviews of establishments I frequent. I refuse to trust anything on that site now.

</comment><comment><USER15> This does demonstrate the value of third-party "professional" reviews (e.g. Consumer Reports, Zagat) and a big reason why Google bought Zagat -- the trust factor.

You never know if personal reviews on various sites were driven by ulterior motives. Although it's likely that the majority of personal reviews are genuine, you should try not to be swayed by just a few reviews without further research.

<comment><USER16> Are you saying professionals are not prone to bias or influence?

<comment><USER17> Professionals have a reputation, which should reduce bias or influence. If Zagat was known to take bribes, they wouldn't be around for very long.

It may happen, but is less likely to happen than non-professionals. You have a much larger issue with selection bias for reviews, and a much easier way for vendors to bias them. I've been in shops that insist, rather persistently, that I write a good review for their store _on their computer, at the shop_.

<comment><USER15> Great points! The issue of selection bias is very real on many review sites. Especially with the volume of reviews being so low for most products and services.

</comment></comment></comment></comment><comment><USER3> I don't really see a good logistical way to deal with this kind of problem. Any algorithm is going to see a bunch of sudden reviews of extreme positive or negative opinions as possible spam, and for users who never review more than once, I'm not sure how the filter is supposed to know what is and is not legitimate.

Yelp does seem to have a conflict of interest with advertisements, but considering the only alternative seems to be a subscription-based model, and people don't like paying for things on the Internet, I suspect that this is still the best possible case at the moment. Plenty of room for innovation, though.

<comment><USER9> There's a well known solution for this and it's called a chinese wall. You segregate the ad team from the other teams and restrict the data flow between them.

It's what Google and many others use to stop ad revenues biasing their product.

<comment><USER18> How does this in any way mitigate the issue of fly-by / socket puppet reviewers?

</comment></comment></comment><comment><USER19> 718 Cyclery in Brooklyn, NY has had long running issues with Yelp. Some detail at [http://brooklynian.com/bk/2012/01/25/digital-shakedown- is-71...](http://brooklynian.com/bk/2012/01/25/digital-shakedown- is-718-cyclery-in-gowanus-being-screwed-by-yelp/)

</comment><comment><USER20> It seems like social networking could be used to good effect to try and filter reviews, or at least let me see review from people I trust first.</comment>


TypeScript is weakening the JavaScript ecosystem - <AUTHOR> https://timdaub.github.io/2020/09/01/typescript/ <comment><USER2> I think comparing typescript to coffeescript is a very amateur call.

Coffeescript specifically decided to throw out ECMA script. Typescript embraces it.

There was SO SO SO much waiting around the ".?" operator in TS because they specifically did NOT want to do what coffeescript did (make their own, and then get hosed when the official spec came out and they were different from their own implimentation).

The -only- difference between TS and JS is the type annotations. It should be perfectly readable JS aside from that.

Objective-C can actually compile C. Objective-C is a -superset- of C. So again, the argument is misguided.

All the typescript webpack plugin does is strip out typescript stuff. And that leaves you with the underlying JS.

Typescript projects should be pushed up to NPM with their transpiled modules.

I believe any small bug that the author of this article was hoping to fix in subprojects should have been caught by the typing system. You should see about 25% less bugs in TS code vs JS (number pulled semi-out of my ass, pulled from some strong blog with strong opinions against TS).

I believe, if anything, that TS's impact on the JS ecosystem is incredibly important for the long term survivability and reliability of it. As our sub projects get larger and more complicated, having the compiler save our collective butts is huge.

<comment><USER3> > The -only- difference between TS and JS is the type annotations. It should > be perfectly readable JS aside from that.

TypeScript has a few differences:

Automatic class properties from arguments:

      class Foo {
        constructor(
          public bar: string,
        ) {}
      }

Enums, and probably other stuff I've forgotten. I think they're avoiding adding any other differences though.

<comment><AUTHOR> I find this argument weird. JS doesn't have Public Class fields yet [1] (stage 3), hence any TS or JS code making use of such concept will differ.

Similarly, as reliance of types in JS is not guaranteed, as it may in TS, will produce code with different assumptions too.

So while you may "easily" go from (1) JS => TS, it may be much harder going from (2) TS => JS, as in (1) you're preserving all information and in (2) you're losing information.

My point being, TS !== JS.

\- [1]: [https://developer.mozilla.org/en- US/docs/Web/JavaScript/Refe...](https://developer.mozilla.org/en- US/docs/Web/JavaScript/Reference/Classes/Public_class_fields)

</comment></comment></comment><comment><USER4> The author admits to not using Typescript and not knowing how it works but is quick to point out that it's polluting the JavaScript community?

He does state that typescript is a subset of JavaScript and this compiles to JS so I largely don't see the problem. TS is making complex projects in JS more tenable and I believe we should encourage TS.

A separate repo for TS doesn't make sense, Microsoft owns npm now by extension of github and is doing fantastic work supporting TS and by extension JS.

My hope is the opposite, at some point TS is the gold standard for a package, it is self documenting and again the types can be stripped out (and usually are for distribution).

<comment><USER5> But the point is it creates fragmentation.

<comment><USER6> No, JavaScript being the kind of language that requires 3rd parties to implement what should be core features is what creates fragmentation.

There was similar fragmentation with JavaScript's async patterns. Callbacks, promises, async/await also resulted in fragmentation as you had different projects supporting different patterns as 3rd parties introduced new capabilities (that eventually graduated into fully-fledged language features).

Hopefully the best of what TypeScript provides will make its way into the ECMAScript spec eventually...

<comment><USER7> Agreed. And importantly, the fragmentation of the Javacript ecosystem is _on purpose_ : [https://github.com/extensibleweb/manifesto](https://github.com/extensibleweb/manifesto)

I think about the fragmentation that shows up in the form of multiple frameworks and patterns as a necessary part of that. It's not something that I want to fix.

So to draw a line and say, "extending core Javascript features is fine, but compiling into Javascript isn't" \-- I just don't get that. Typescript is a testing ground not just for typed programming in general, but also for features like decorators and meta-programming features. It's good to have a diversity in what people are building and using, that's how we get real world data on what works.

</comment></comment></comment></comment><comment><USER8> > My context is that I've not looked into TypeScript yet. That means I have no > idea how it works.

This is all you need to know about this article. There is no such thing as a "TypeScript package" on npm. It's simply a JavaScript package with a bundled type definition file. A pure JavaScript project can use this package as they normally would, and just ignore the types. So I don't understand where the question of fragmentation even comes from.

If the author is concerned that they aren't going to be able to contribute to projects written in TypeScript, then it's really the same problem as having JavaScript projects that enforce ES6 syntax, a specific module strategy, have custom linting rules, file structures, use Promises vs callbacks etc. Should those be disallowed as well?

<comment><USER9> The author's context is that he has no context. No frame of reference. Out of his element. I wonder who's more misguided, author, or the person who decided this link is worth posting.

<comment><USER10> That was the author himself. A lot of ppl do instead of a comment section under posts.

</comment></comment></comment><comment><USER11> > My context is that I've not looked into TypeScript yet. That means I have no > idea how it works.

The main problem Tim has is that he doesn't write TypeScript, so he wouldn't be able to contribute to dependencies. I don't think that's a huge problem since learning limited TypeScript to make patches to projects isn't very hard. In most cases, some patches might not require any TypeScript features at all.

> So essentially, the problem is that TypeScript authors publish their > packages on npm, the package manager for Node.js. And to me, that's what is > weakening the JavaScript ecosystem.

This doesn't make much sense to me, because the convention is to publish the "dist" folder to npm that has compiled JavaScript with declaration files, not the TypeScript source. To the Node.js engine, a package written in TypeScript is indistinguishable from one written in plain JavaScript. Declaration files have the added advantage of intellisense in IDEs that support language tools like VS Code.

> However, continuing to publish TypeScript packages to npm is, in my opinion > weakening the JavaScript ecosystem as it's splitting its community and > polluting the npm namespace.

Again, I point out that you can use TypeScript packages in Node.js/JavaScript projects. The pollution argument doesn't hold for me. npm packages already have a lot of "versions", like publishing ES Modules, compiled JS, legacy Node.js modules (module.exports), etc., so having TypeScript-compiled code that doesn't require additional tooling is the least of our problems. :)

</comment><comment><USER7> > Since its inception, and throughout trends like Coffeescript, npm has mostly > held the promise of only hosting JavaScript packages.

I don't think this is true. There are multiple NPM packages that rely on non- JS extensions and external binaries to run. The entire `node-gyp` ecosystem, which is a pain because it makes it impossible to vendor dependencies in a portable way.

On that front, compiled Typescript isn't that hard to read. I'm less concerned about someone cross-compiling a language into Javascript than I am about someone pushing a C binary alongside their code as part of the install script. WASM modules are going to start becoming more common in Node eventually. Deciphering Typescript with a pure-JS background is way easier than deciphering Rust.

I see this argument come up with frameworks and libraries as well: "Javascript has too many frameworks, it makes it impossible to evaluate a 3rd-party package." I don't think the argument stands up to much scrutiny there, and I don't think it stands up to a ton of scrutiny here.

</comment><comment><USER12> TypeScript strengthens the JavaScript ecosystem by making it easier to write correct code, and easier to use code correctly. I suspect the author's self- professed lack of knowledge of TypeScript is the biggest barrier, but that's not why I decided to write this comment.

I wonder how many times the author has used node-gyp, node-sass, or even a wasm-pack packaged NPM package? The latter allows writing NPM packages in any language that compiles to web assembly. That's quite a few languages already, most of which are much further removed from JavaScript.

Despite that, I think that strengthens the NPM ecosystem, even if it "weakens" the JavaScript ecosystem. (I don't think it does, actually.) It means NPM is one the first and largest polyglot package repository. It's certainly the largest public source code and library repository in the world, and now or very soon, it will be possible to reap the benefits of packages using webassembly to get (nearly) bare metal performance without compromising security.

I would also argue this strengthens the JavaScript ecosystem too because all of these languages work transparently with JavaScript. The first-class citizen remains JS, for now, and people writing C/C++, Rust, Scala, ML, and others to webassembly are making their code available with JS bindings that just work. That's pretty amazing.

The closest thing to this is Python, and it's so nontrivial to contribute native or FFI code that works reliably to pip that it's not done outside of a handful of extremely performance sensitive data science projects. For this reason, I think JS (and webassembly) is ascendant, and Python's star is at its peak.

<comment><USER10> Also why thinking NPM to limit to a language. The browsers and node are essentially virtual machines (evidence: see wasm). NPM is the package manager of this VM and not the JS language (ignoring that there is no TS code shipped).

</comment></comment><comment><USER13> What the OP is talking about? Nobody is publishing TypeScript to npm. Maybe they need to understand how things work before writing a lengthy blog post. Those packages have types built in because of the emitted .d.ts files.

<comment><USER14> I think he's suggesting that one of his criteria for package selection is his ability to contribute changes to the upstream project if needed, which he feels he can't do for TypeScript on account of him not knowing the language.

<comment><AUTHOR> Yep that's what I intended to say.

<comment><USER10> That is a valid point, but honestly, avoiding (learning) TypeScript as a modern day JavaScript developer is a mistake.

I know it is annoying that there is a breach into the purity of the JavaScript language by a different actor. But let us face it: TS is useful, it is the right tool for the job and it is not niche. It complements JavaScript and solves problems JavaScript is structurally unable to solve. It helps and improves the JavaScript language. It helps millions of developers with static typing backgrounds to accept and deal with the imperfections of JavaScript.

In my primary language - C# - there is tons of influx of functional programming nowadays (sourced via F# and OCaml). I could fight against it but I do not. I embrace change and adapt. Take the Linux Kernel: After three decades of C code they are talking/merging support for Rust. Why: it is the right thing and it is a good complement for their C tooling.

<comment><AUTHOR> > That is a valid point, but honestly, avoiding (learning) TypeScript as a > modern day JavaScript developer is a mistake.

You're probably right. My argument, however, was purely about separation of concerns: different language means different package manager (or namespace...).

<comment><USER10> I disagree. Node and the browsers script engines are virtual machines nowadays. Package managers go by VMs not by language.

<comment><AUTHOR> Not sure I get your argument. As far as I understand there's no VM for Typescript specifically. Hence as "no VM" is different from Spidermonkey/V8, Typescript packages _should_ go into its own package manager?

<comment><USER2> A kotlin project is going to use both java and kotlin sources (and maybe closure).

We're going to start seeing a lot more WASM stuff on npm, which is going to be whatever language anyone wants.

The VM for typescript is node/browser. Because it gets compiled to target those.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> By this argument, JSX shouldn't be published to NPM either.

You might argue that you know what you're consuming if you're importing, say, a React component, and it's likely written in JSX, but it's really a categorization issue.

A standard field in the package.json indicating what the source is written in might be useful, but would probably be left unpopulated. Personally, I find it fairly straightforward to tell what a package is written in just by looking at the source.

</comment><comment><USER16> IMO including TS packages in JS ecosystem strengthens rather then weakens the ecosystem. A library consumer doesn't have to know whether a package is written in JS or just compiled to JS. Either way, it's still useful.

And TS isn't so magically different from plain JS that it's not understandable. Most TS ends up being plain JS, so the comparison to CoffeeScript or even Objective-C doesn't see fair to me.

</comment><comment><USER10> I would highly recommend the author to "pause" this post, learn the little of TS you need to understand, and then rewrite the post.

I mean there is a valid argument about TS making JS more typed than the ecosystem should (not my personal opinion) but that was not even scratched as a topic here.

</comment><comment><USER17> I think Typescript as a standalone language will reach is maximum adoption in a couple of years. Than we will gradually see more and more packages roll-back to standard ECMA script eventually with typescript checks by JsDoc annotation and .d.ts files. That's the more trational solution. Take as case Deno migrating from Typescript to Javascript [https://startfunction.com/deno-will- stop-using-typescript/](https://startfunction.com/deno-will-stop-using- typescript/)

<comment><USER18> I only see that happening if TC39 pulls a PEP 3107 [1] approach and adds type annotations as optional part of the JS language directly that browsers don't need to understand and can ignore but should parse. The Typescript format of type annotations is much more convenient than the JSDoc style (and think Typescript surpassing Flow is in part because of that; among several other reasons), so there likely will always be people wanting it. At that point a PEP 3107 approach would both mean a lot less need for Typescript and also a lot more use of Typescript-like type annotations.

Deno's odd choices made on V8 performance issues (failures) also does not look to implicate a trend so much as Deno making some interesting choices. (There too a PEP 3107 approach would have helped them as the performance issue they were trying to fix was type stripping as V8 itself doesn't today have any reason to performantly type strip TS-like annotations, but of course that would change tomorrow if TC39 made that a first class citizen of the JS parser directly.)

[1] [https://www.python.org/dev/peps/pep-3107/](https://www.python.org/dev/peps/pep-3107/)

</comment></comment><comment><USER18> I would think most Typescript packages today would fall under the author's second criterion:

> picking packages that are well-maintained by a large community

Whether or not the author feels they can directly contribute to a Typescript package, overall Typescript seems to balancing the scale on npm in favor of well-maintained and large community. Admittedly, I've been a fan of Typescript since 0.97 so I'm biased but I very deeply feel that you cannot have well- maintained in JS overall without Typescript.

I don't see that as weakening the ecosystem at all, in that the rising tide of Typescript quite clearly seems to me to reflect a rising tide of maintenance in the ecosystem.

Obviously opinions will continue to vary, but I certainly invite the author to spend at least a bit more time with Typescript before jumping to the conclusion that Typescript is neither well maintained nor encourages a large community as it this article implies if the author truly does not feel comfortable under their own criteria of worse case treating typescript as a blackbox similar to C/WASM and trusting communities that do use Typescript.

I think the attempted analogy between C and Objective-C especially points out that probably at least a bit more familiarity with Typescript might help the author a ton. The comparison between C and Objective-C seems pretty weak to me. Objective-C makes a ton of syntax changes to the language. Typescript makes relatively few. About the best comparison I can think of is Python and MyPy with the only missing piece being a PEP 3107 [1] equivalent asking browsers to support Typescript annotations even if they don't understand them.

What the analogy says to me, if Typescript looks foreign enough from JS to the author as Objective-C to C is much more that JS itself has changed so much in the last few years that the author is perhaps behind on what ES2015+ flavors of JS look like as most of what makes Typescript look "foreign" today really is just JS today. It may be worth digging more into Typescript simply to learn more about how JS is evolving/has evolved.

[1] [https://www.python.org/dev/peps/pep-3107/](https://www.python.org/dev/peps/pep-3107/)

</comment><comment><USER19> > My context is that I've not looked into TypeScript yet. That means I have no > idea how it works.

The problem lies in the author, since knowing TypeScript is an essential skill if you are doing anything browser-related or JavaScript-related.

Also TypeScript produces readable JavaScript, and anyway it's trivial to mentally strip the types when reading TypeScript, and also very easy to learn enough to fully understand most TypeScript code.

</comment><comment><USER20> Actually, it should be: JavaScript is weakening the JavaScript ecosystem.

In the olden days, html, css, js were it. But each were "subclassed" by better solutions compiling to html, css, js.

Then huge frameworks arrived to try to organize the mess we'd created. Making devs further than ever from html, css, js.

Remember the old saw: Sure I understand JS, I use jQuery every day! Er, but how about closures? direct DOM use via JS? And so on.

To be fair, jQuery and later CoffeeScript, improved JS considerably.

I don't get the feeling that TS is going to help JS, but hopefully I'm wrong. But unarguably it is SPLITTING the JS ecosystem into warring camps.

</comment><comment><USER21> Typescript is SUPERSET of JavaScript, not subset...

<comment><AUTHOR> Right. I think it should be fixed soon.

<comment><USER22> What needs fixing is not just replacing the word "subset" with the word "superset," but the entire argument in the paragraph. Your argument is based on your misunderstanding. Valid TS in not necessarily valid JS. No informed person will claim that you can just drop TS into a JS project the same way you can drop JS into TS. Also, no one is publishing TS to NPM, and certainly not for the (mistaken) reason you describe.

<comment><AUTHOR> I think there may be a misunderstanding. I too know that nobody published TypeScript packages directly in NPM, but they always include a transpiled version. Nevertheless it'd consider it a "TypeScript package (that was transpiled to JS and then published to NPM)".

Edit: To make sure this misunderstanding is avoided, I've adjusted a section in the blog post to make it super clear.

<comment><USER22> If your claim is that it's impossible to contribute to a package written in TS without writing TS, even if the authors publish a JS version to NPM, I completely agree. I also agree that this creates a divide between authors who write TS/publish JS, and those who write JS directly.

<comment><AUTHOR> OK. Then I guess we're on the same page.

</comment></comment></comment></comment></comment></comment><comment><USER23> As your run-of-the-mill web dev who's been using TypeScript professionally for about 5 years, I find posts like this fascinating.

Other comments address the main themes in this guys article, mostly not having any context on which to base the argument.

If you don't keep up with the trend, you're going to lose out.

</comment><comment><USER24> It is getting in the way of the way the author decided to select the packages for their projects, just that. It is not weakening the JavaScript ecosystem in the least.

In my opinion, by solving a pain point that a relevant part of the developers involved in the JavaScript ecosystem have, it is making the ecosystem stronger. An ecosystem that make more people happier is a more robust one.</comment>


What is your opinion on syntax-coloring of code? - <AUTHOR> Here is an example:
http://crystal-lang.org/
Not for or against Crystal, was just most handy URL. <comment><USER2> Syntax highlighting is good overall, the best is having some sane defaults and the IDE/environment allowing the user to make tweaks to it. I personally don't like dark schemes and prefer the white backgrounds now.

I never thought of the color blind side of it till I read Finnucane's point, but the ability to tweak the colors mostly would solve that I guess.

I also really like that most editors are starting to highlight local, global, class members/parameters/variables all subtly different. It makes identifying them even easier. However, having that type of highlighting doesn't remove the need for good naming (and coding) standards to make it easy to distinguish proper scope etc.

<comment><USER3> It would be interesting if style guides were also integrated, e.g. you have a non-standard variable name it highlights the background in a striking colour, or the Word style red squiggly underline.

<comment><USER2> Yea, that would be nice. Basically a style checker that integrated into the syntax highlighting in some way.

</comment></comment></comment><comment><USER4> As opposed to not coloring it? I am for syntax highlighting. Those particular colors you see on the site are a little bit harsh, but maybe because of the bold/font weight.

I use the default dark color scheme on Visual Studio and while the colors are a little muted, they feel easier on the eyes.

<comment><AUTHOR> Yes, I meant as opposed to not coloring it at all, i.e. all the code is of one (foreground) color. Sorry if I did not make it clear enough earlier.

</comment></comment><comment><USER5> I have red-green color blindness, so it's a problem. Dark red on black is bad, green with yellow or brown is bad, shades of blue and purple can be hard to distinguish. Yellow on black good, bright red on light background good.

<comment><USER3> Do many of them have the option to change the colours?

<comment><USER5> Yeah, it seems like most editors now it's not that hard to customize the settings--so I end up futzing around with the colors every now and then to see if I can come up with something better. It remains a not very satisfactorily solved problem.

</comment></comment></comment><comment><USER3> I am not quite sure which part of it you are asking about. However in general I find syntax highlighting useful, helps quickly get the gist of code. I am indifferent on colors, as long as they are consistent.

<comment><AUTHOR> I was asking about the idea of its usefulness in general.

</comment></comment><comment><USER6> I turn it off and on. Sometimes, syntax coloring can be of benefit, like mismatched single- and double-quotes un-terminated strings. Other times, the colors make things less clear, and I turn it off. Vim's C syntax coloring is an example of the latter.

As a side note, if you're looking at PHP malware, which is almost always in a single long, long line, syntax coloring can be quite time consuming.

<comment><AUTHOR> >Vim's C syntax coloring is an example of the latter.

Yes. On Vim I do:

:syntax off

Find all the different colors too jarring.

</comment></comment><comment><USER7> I prefer syntax-coloring -- makes it easier to catch errors quickly, as the colors go all wonky if I miss a parens or a double quote, etc. This way I can catch the error right in the editor, before it ever hits the parser.

</comment><comment><AUTHOR> I realized that I did not make the question clear enough. I meant : "Do you prefer or not prefer syntax-coloring (vs. monochromatic B/W or W/B)?"

</comment><comment><AUTHOR> Thanks to all those who comment.</comment>


Ask HN: Review my startup: Trendero.com - <AUTHOR>

http://bit.ly/bnP7ll
Trendero is the best place on the web to find exciting new things that are gaining attention around the world. Use our customized map interface to create, report on and discover breaking lifestyle trends happening right now, anywhere on the globe. Top indie bands in Western Europe, underground films in Asia, the most talked-about web destinations in Latin America; these and other lifestyle trends are on trendero.com, right now, where you can find what you need to live like a global insider.
CURRENTLY LOOKING FOR TECHNICAL CO-FOUNDERS.  Have great user feedback and detailed plans for a version 2.0, including mobile app, social media API integration, etc.  Message me if interested. <comment><USER2> I like this. I can see this catching on. For the "Report a Trend" input feature, you might want to consider having some artwork done to make it a little more friendly looking. To me it looks very much like input your credit card number here, and the rest of the page has a more trendy modern friendly look. You would want it to match the rest of the site, but not blend in too much. Maybe do a focus group and get some feedback on 3 or 4 designs for it.

I like this idea, and I think you are possibly onto something big here. Iterate!

([edit] I can see this thread has been pending without much activity for a couple of hours. You might want to try reposting later in the day when more of the guys are online in here. This seems like a good idea, it deserves some exposure.)

<comment><USER3> The site is nice and clean looking, but I agree with Scott that it lacks a bit of energy,vibrancy & passion.

I'd hope that with the market you are going after, you may be able to inject some of that trendyness into your site's look.

best of luck</comment></comment>


Start Traditions That Won't Last - <AUTHOR> https://medium.com/@robbieallen/start-traditions-that-won-t-last-4aa49abaf6e4#.mf4jur7yg <comment><USER2> My favorite startup tradition I've been exposed to is Twilio's: employee jackets are something you earn, regardless of role in the company, only after you've pushed a Twilio app into production. After you do so -- and they'll coach you on it if you're not in engineering (or I suppose if you are) -- you get recognized at the next all-hands meeting and the CEO drapes the jacket over your shoulders, in a manner similar to knighting.

(They also control distribution of jackets externally, which is one of the reasons I loved my four jackets to death and wore them so frequently that many people were under the impression that I was actually a Twilio developer evangelist.)

</comment><comment><USER3> I like the fact that he explicitly mentions letting go of traditions. As companies grow, all kinds of things have to change, and this includes informal activities as well.

It's good advice for life too--if you are too afraid of setting up a tradition or trying something because it needs to be perfect and last through the ages (or at least your life), you won't do _anything_.

The perfect is the enemy of the good.

</comment><comment><USER4> Letting go of traditions is a hard thing to manage. Employees who've been in a company a long time don't appreciate the change, especially if the traditions are seen as a "perk" for working there that's being taken away, and stopping buying something sends a signal that the company can't afford it any more.

</comment><comment><USER5> I think most of these things happen when people get along, have fun, and just live life. Traditions in a company like this usually just happen naturally.

Side note: This is nice but it surprises me that an article like this makes the front page.

</comment><comment><USER6> At the start of our morning team standups, we have a song playing and anyone can add song to the queue (and also re-arrange to put their selection first, if they wish). 80s Thursdays and Metal Mondays have emerged organically. Then there's the unique music like Tuvan throat singing [1] that gets included.

[1] [https://www.youtube.com/watch?v=-qn27GOAkwo](https://www.youtube.com/watch?v=-qn27GOAkwo)

</comment><comment><USER7> At Analytical Flavor Systems[0], we have a ridiculous number of traditions... and as Founder/CEO, I have nearly no control over them!

 _A select subset of our traditions include:_

\- Daily: 24 hour goals (what did you accomplish in the last 24 hours? what do you plan to accomplish in the next 24 hours?) every morning as a standing meeting, with pour-over coffee (usually client, sometimes... almost clients). We always discuss our analysis of the coffee and the brewer/barista (which rotates through employees) after 24 hour goals.

\- Daily: Highs and Lows. What was the best part of your day? What was the worst part of your day? (confusingly, we start with the low, and end on the high note).

\- Monday: we have a modified version of the Rebeca Black Friday song... about how much we like to work/twerk on Mondays... This was created, died, and revived a number of ties has the team has grown and changed.

\- Friday: Beverage Exchange: We don't hold official panel tastings on Friday's, out of respect for people who have lives outside of the office (this is totally theoretical) - so we exchange and share rare and interesting products we've collected. Considering the company is building AI for the beer, coffee, spirit, and wine industries... we have access to a lot of rare products to share and taste outside of official panel tastings!

\- Hazing of new employees: It takes a long time to become an able barista (coffee tastings during 24 hour goals) or capable beer/wine taster. We're very upfront about how much new employees suck until they get it - experience and trust scores are read out, deviations in perceived quality due to brewing skill is listed, and missing variables that needed to be interpolated are explained (in excruciating detail).

Clearly all of these traditions won't continue as we move from 12 to ~40 employees over the next ~18 months... but the important thing is that we've set ourselves up with a strong culture that cares about our clients and cares about the same things our clients care about (these two topics are very different!)

The best piece of advice that I have for other founders: create the seeds for traditions to form, but allow the employees to decide which to water and cultivate - allow them to decide which traditions get proginated and carried forward from generation to generation. And if possible, record past traditions in your Phabricator[2] Wiki.

[1] www.Gastrograph.com [2] [http://phabricator.org/](http://phabricator.org/)</comment>


Ask HN: Using C or C++ for parallel Android and iOS dev. - <AUTHOR>

I have read quite a few comments in the past about people using C or C++ as the backend to their Android / iOS projects, with Objective C / Java being used for the front end interface code.  Unfortunately, I've never seen a project like this open sourced, and I am sure I will fall into a whole set of pitfalls if I begin from scratch.<p>Are there any books or example source for even trivial applications that actually use C or C++ from the backend work?<p>(I am aware that you can use C# through mono touch, but I try to avoid the .NET technologies outside of work) <comment><USER2> I think you want to have a good, close look at MOAI:

<http://getmoai.com/>

Its a C/C++ based engine that includes a Lua VM, wherein you write your real app code. The engine runs on Android/iOS/OSX/Linux/Windows. There is a 'host' element to the MOAI project, where native stuff happens for each environment, and the host itself ends up running the VM to interpret the Lua code needed.

Another approach is with games, where a 3D engine is built in C++, with the NDK (on Android) used to interface with a 'wrapper' app that gets the library loaded and in use. I used this approach with a 3d game which uses the same C++ code for Android/iOS clients .. it was a fair bit of work, but the result is that we can do the game logic in C++ and forget about the platform-specific stuff.

</comment><comment><USER3> I know of two, but haven't used either so far:

1\. Cocos2dx (open-source)

2\. Marmalade (commercial, you don't even need a mac, can prepare iOS binaries on a Windows machine)

<comment><USER4> I have used all 3 of them. Here are my impressions:

-Marmalade ( Airplay when I used it ) is the most professional framework. I have never found a bug and also the number of documented bugs is very low. The framework is supported on many platforms ( IOS,Android,Ipad,Bata, Nokia,Windows CE, [Blackberry also if i remember well]and also consoles if you are willing to spend some more big bucks). It is possible to develop on windows using Visual Studio and one can obtain installations packages (ipa,apk and so on) with a single click without ever leaving windows. The framework is pretty low level so you are going to write more code using a more robust platform. Documentation is very complete. The framework has also some tools for asset packaging, fonts, etc. Both 2d and 3d apps are supported. There is also a basic GUI engine that is resolution/device indipendent ( with a basic GUI designer ).

\- Moai is the easiest framework to use if you are willing to use LUA as your main development language. However I have found it a little bit counterintuitive if you want primarly to do C++ development. Documentation is sufficient. 2D games only. MOAI license put some constraint on apps that store information on the internet/cloud and/or have multiplayer support

\- Cocos2d-x is a community effort. I found it more convenient for pure C++ development than Moai. Cocos2d-x API is modeled after Objective-C and sometimes uses Obj-C idioms instead of C++ idioms. While this considerably ease the porting from pure Obj-C Cocos2d app it may not be to everyone taste especially for experienced C++ developers. Cocos2d-x community is bigger than Moai's. While Cocos2d community is very activy on further developing cocos2d-x and fixing bugs Moia community is more active on the development of extensions and new features. 2d games only. Support for lua even if I have not used it.Almost no documentation. However the API is a 1 to 1 mapping of Cocos2d for which there is an abudance of information.

At the end these are my suggestions:

\- You are a big studio-> go for Marmelade.Documentation is better, you have professional support and probably the framework is the most stable and certainly the more mature.

\- You are a small/indie studio and like to code in Lua-> go for MOAI.

-You are a small/indie studio and prefer pure C++ coding and not be constrained in any way by the license-> go for Cocos2d-x.

After using Airplay when it was free now I am using cocos2d-x for my new projects.

<comment><USER5> Just to clarify your comment - the Moai engine supports isometric (2.5D) and 3D functions for effects. Shadowrun Returns, a 2.5D title, is being developed with Moai. See <http://getmoai.com/blog/thinking-isometric.html> for an overview.

There is no license restriction on Moai as noted. It's a standard CPAL license, approved by the Open Source Initiative. CPAL itself is a derivative of the Mozilla license. <http://getmoai.com/moai-faqs.html></comment></comment></comment>


From Employee To Entrepreneur or Investor? - <AUTHOR>

I want to quit my job, but I am scared. I have enough money saved to possibly invest in other small companies or to pursue some kind of active investment strategy. I am a programmer, not a business person as such, and have never had my own company. Can anyone succinctly give some hints as to how they made the transition from employee to self-sufficiency? My instinct is to sidestep the operational risk that comes with direct involvement in a startup, by investing in other ventures. Is that an untrustworthy instinct? <comment><USER2> Ultimately this comes down to 'it depends' (on your personality and skills and such).

Personally, I'd 'invest' in your own business first - give that a shot. There's obviously a lot of operational stuff you may need to get involved in, but if you've got the money, outsource that. Hire people to do it, but retain the control to direct them as you see fit. This would be similar to investing in another company, you just likely won't have as much control over that other company as you would your own.

On the other hand, investing in someone else's passion may be a better fit for you. I'm not at the stage where I would take that approach - I prefer to have too much control over things, and not sure I'd have that control investing in someone else's business.

What sorts of businesses are you looking at?

</comment><comment><USER3> It's (mostly) a tradeoff of time, investment size, and risk/type of risk. Your investment strategy also determines your lifestyle to some extent. If you're completely hands-off with your money, you may get bored very quickly.

If you're very distant from a company(e.g. a publicly traded stock) you are only required to put money in a portfolio and start clicking "buy" and "sell." All time apart from that is in the research and due diligence that will make buy/sell actions profitable. This is simple enough if you're working with a portfolio of large-cap, heavily traded companies.

But if you try to achieve a return similar to an early-stage startup on the markets, you generally have to look at tiny companies with low information and regulatory scrutiny; and the market for a penny stock is rarely fair and orderly, it's more likely to become an explosive, melodramatic war involving some combination of institutional manipulators(hedge funds and colluding market-makers), a corrupt company CEO, paid promoters and bashers on message boards, and stock flippers that rush in trying for the quick money. i.e. it's great if you enjoy theatrics with your gambling, or wish to learn the feeling of being a bag-holder.

(I excluded day-trading from this analysis; it's both so difficult to learn that most people dismiss it out of hand, and - once you do have a system, and emotions are out of the way - it's also kind of boring as a way to grow your investment. But if you approach it extremely patiently and systematically, it can work very well.)

So then, if you want a better chance of early-stage returns, you can probably do well as an angel. To do so means giving up a lot more time to meet the company leadership and work out a deal and monitor them, and it means having the funds available to have accredited investor status(which you presumably do). I'm not one to comment further on this, since I'm not in a position to be an angel. But I've tried everything else.

If you want the most direct control over your financial destiny, want to learn _all_ aspects of business, and want to continue doing some kind of work, you'd do best starting your own company. It doesn't have to be a web startup. It doesn't have to use a lot of initial capital either. You just need to be focused enough to create the all-important "something people will want" and not stray away into a hobby project or pure research. This can be as simple as buying up a form of property(physical, IP, etc.) that you think will gain value, and then working or paying some money to perform the actual developments/improvements; done well, this could be a lot less risky than betting on an idea and some founders.

The best part about the start-a-company option is that your risk is more incremental. You can try lots of things, as long as you don't spend too much on any one of them, and the whole time you are going to make money, learn something, or both, which is a great feeling. And you can pair up a business- building strategy with investments in public markets fairly easily, since money in the market is generally pretty liquid.</comment>


Ask HN: A social media company is hostile to my side project. Do I fight or not? - <AUTHOR>

I run an app that crowd sources the collection of comments so you can see what gets censored, changed or deleted. It gained a good amount of popularity (about 40k users) and I even started charging for it.
I've managed to break out of api jail, but my app has been taken out of the chrome marketplace at this companies request. I have options, but I'm sure the conflict will continue.
Does HN have experience dealing with larger hostile entities? Am I destined to get beat down by overwhelming force? I'd love to hear about how similar situations played out. <comment><USER2> Looking at the discussion you started 2 years ago on the social media company's website [1], there were two objections raised:

1\. users who think that deleting their comment will remove it are ill-served by your extension

2\. your extension increases load on their servers

Besides the obvious trademark violation of the domain you are using [2] (which might be why your extension was removed from the Chrome marketplace), you should be able to avoid objection #2 by refactoring your extension (you may have already done so, I did not spend time looking around in the Firefox extension source to find out).

#1 is probably more insurmountable. It seems likely that if your side project becomes more popular, the way that deleted comments are implemented will change on the site for the worse, and functionality for all users would decrease. From a moral standpoint, you might want to stop working on this for that reason.

[1]: [http://www.reddit.com/r/reddit.com/comments/etd52/lets_have_...](http://www.reddit.com/r/reddit.com/comments/etd52/lets_have_a_discussion_about_deleted_comments/)

[2]: <http://www.unedditreddit.com/>

<comment><AUTHOR> Thanks for your thoughts martey.

The reddit comment thread you are linking is indeed a bit old. Here is a more recent, really good discussion: [http://www.reddit.com/r/TheoryOfReddit/comments/1ao3zf/shoul...](http://www.reddit.com/r/TheoryOfReddit/comments/1ao3zf/should_uneditreddit_be_allowed_and_does_its/)

(as an aside: I didn't mean to by too coy about what my extension was or that I'm talking about reddit, I just wasn't sure about the etiquette of trying to publicize something by name here)

As for your points I have to disagree with both of them.

1\. No users are ill served my extension. Somebody who posts something to the internet in a public forum and expect that they can delete that information whenever they want are ill-served by a system that perpetuates such an illusion. This often manifests itself as the Barbra Streisand effect.

2\. My extension does not increase load on their servers. It does not interact with reddit servers in anyway. I can see why the old thread would lead you to believe that, but it is no longer the case.

I understand this idea is somewhat controversial but it is not immoral or unethical, just different.

</comment></comment><comment><USER3> This is what's known as a sucker's game: At the end of the day you're playing on someone else's playground and they set the rules. In an ideal world you own your own playground, but if you can't afford one find one with more open policies.

If you want an example from the big boys take a look at Facebook: They couldn't offer a custom experience on iOS so they forked Android (Amazon did the same thing too, and so will Samsung before long).

<comment><AUTHOR> Yes, that was a painful lesson that was reinforced when my app was unceremoniously dumped.

I've since moved to a firefox app hosted by me, not an appstore. The chrome extension is still available but google has made it really difficult for a non appstore extension to be installed. I'm also looking into greasemonkey.

So I can come back from this stumble but I'm wondering if there is just some bigger hammer waiting for me as soon as I get back up.

<comment><USER3> Something to keep in mind: Google was never really interested in the idea of "open" — yes they love "open" when it helps them, but it's actually a very opaque company which has a "my way or the highway" mindset. Honestly I prefer the honesty of companies like Apple that don't pretend to be anything but a huge company.

But chalk it up to a good learning experience! And be glad that you didn't start to make real money, hired employees and then watched it all implode in a minute because of a small call at a big company.

<comment><AUTHOR> Here is my question though. I've solved the appstore issue. I've got a small amount of customers who are still being served and satisfied. I've got a forward path with firefox extension. I can continue business as things stand.

Am I just going to run into some other iceberg. I know this company really really doesn't like my extension. They have many resources, and I have none. Will I just get lawyered into the ground? Because I've got a feeling they are going to keep coming after me.

edit: Another thought, you are so right about the google my way or the highway attitude. I was notified of my app being taken down by a red "taken down" notice. No warning, no contact, no explanation or appeal process. If nothing else maybe some other developers will take this story as a warning.

<comment><USER3> What you're talking about is really an add-on feature with fans rather than a true business.

Your real talent is clearly the ability to spot an opportunity, build something and get it out there: So why not think about the audience of customers you want to build? Start with that and then look at the opportunities. And look at a bunch of them...

<comment><AUTHOR> You might have a point here. This really started out as a social experiment, and then it took off, so I started charging so it could be sustainable.

Looking at unedditreddit through the harsh prism of business, it probably isn't that great of an opportunity.

I just got ruffled by the idea of somebody forcing me to shutdown because it didn't fit with their interests, and it made me want to fight. I probably just need to make the rational decision to work on something with more potential.

Thanks for hashing this out with me.

<comment><USER3> my pleasure! : )

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> You should make your OWN social network... with blackjack... and hookers...

<comment><USER5> This isn't funny or original. Please keep comments like these off of HN.</comment></comment>


Cannabis Use Not Associated with Increased Risk for Mood or Anxiety Disorders - <AUTHOR> http://archpsyc.jamanetwork.com/article.aspx?articleid=2491944 <comment><USER2> The spin in the title (which differs greatly from the original article) is very misleading, and seems to cherry pick from the article's conclusions, which are very clearly stated:

 _Key Points_

 _Question: Does cannabis use increase the risk of psychiatric disorders?_

 _Findings: In this survey of a nationally representative sample of US adults, cannabis use was associated with significantly increased risk for developing alcohol, cannabis, and other drug use disorders as defined by the DSM-IV at 3 years of follow-up. However, cannabis use was not associated with increased risk for developing mood or anxiety disorders._

 _Meaning: Cannabis use is associated with an increased risk of developing drug and alcohol use disorders._

So they very clearly stated "Cannabis use increases risk X, but not risk Y." But for some reason you've chosen a title which says "Cannabis doesn't increase risk Y", as if that was the main message of the article. It wasn't.</comment>


Airbnb admits to deleting questionable listings before data release - <AUTHOR> http://www.theverge.com/2016/2/25/11116426/airbnb-report-data-purge-new-york-city <comment><AUTHOR> I wouldn't see an issue with removing junk data, but removing data to improve the results, especially if what bloombergs claims in correct (that those supposed "junk" listings" are back on airbnb) then Airbnb is not acting in an honest way to the community and their customers.</comment>


Darpa Wants to Perform Learning with Less Labels - <AUTHOR> https://www.darpa.mil/news-events/2018-07-11 <comment><AUTHOR> Have there been Kaggle competitions to do this kind of thing before?</comment>


Neuromation to Use Proof of Work Towards Mining Artificial Intelligence - <AUTHOR> http://www.trustnodes.com/2017/10/08/neuromation-use-proof-work-towards-mining-artificial-intelligence <comment><USER2> How does the client keep their IP secret in this network?</comment>


IPhone 4: the Ars Technica review - <AUTHOR> http://arstechnica.com/apple/reviews/2010/06/iphone-4.ars <comment><USER2> _The performance gap in the Mozilla SunSpider test is much smaller_ [last page]

Wait wait wait... How'd they derive that SunSpider is a Mozilla test _when it's hosted on webkit.org?_

<comment><USER3> The browser technology scene is a bewildering menagerie of spiders, monkeys, squirrels, fish, and mythical birds, so a little confusion is understandable.

<comment><USER2> And lets not forget smallish, elemental animals and zillas which, despite their name, do _not_ have a bowl-cut.

</comment></comment></comment><comment><USER4> Their first portrait photo comparison between the iPhone generations is completely invalidated by the fact that only the 3g is using a tolerable white balance:

<http://arstechnica.com/apple/reviews/2010/06/iphone-4.ars/4>

<comment><USER5> I was surprised many of their photos seem to show the 3g better than the 3gs. Is this something they could fix in their evaluation photo technique, or inherently an advantage of the 3g?

<comment><USER6> in the few comparisons I remember studying closely the 3GS pics were always better than the 3G pics (the 4 shown clockwise from top-left ones) -- are we just thinking of different sets?

<comment><USER5> On p. 4 and p. 5 of the review, the 3g pics (top-left of a 4-set, or leftmost of the 3 magnified) look at least as good to me, if not better, than the 3gs pics (top-right-of-4; middle-of-three).

(The 3g pic on p.4 seems a bit orange compared to all others -- but I don't know the subject's real complexion, and that's why I asked my question of baddox. Is this an inherent skew of the 3g or an artifact of their technique? Except for the color-difference in that set, the 3g photo has as much or more definition/contrast.)

</comment></comment></comment></comment><comment><USER7> The communications-psychologist in me found this observation about FaceTime interesting (the author seemed to warm to FT as he spent time with it, even to the point of productive "meetings"):

>You almost feel as if you need to talk about something substantial when you're looking at the person.

</comment><comment><USER8> Anyone found some good reviews comparing the IPhone 4 and the google nexus/htc desire? I was going to get the Htc Desire but hesitated when I saw the IPhone 4 screenresolution. Any thoughts?

<comment><USER9> The Nexus is somewhat last-generation at this point (as odd as that is for a new device). It's all about IPS or Super AMOLED displays now. I'll being going Super AMOLED myself, but only for the software that comes on it.

<comment><USER10> >It's all about IPS or Super AMOLED displays now.

Pretty bizarre way to differentiate generations.

</comment></comment></comment><comment><USER11> I'm amazed that in none of the reviews I've read is there any complaint about the horrible sound quality. I bought a pair of iPhone 4s for myself and my girlfriend and we returned them the next day. We each sounded to the other like we were in a cave. This is with full 3G signal strength on both ends.

It's surprising because the 3GS and 2G always sound great. Never any hint of this hollow, echoey sound.

<comment><USER12> Were you in the same room? I found mine to do some weird stuff when two phones could hear one another, probably due to the new noise canceling stuff.

<comment><USER11> Nope, we were 7 miles apart.

</comment></comment></comment><comment><USER6> most useful review i've seen yet</comment>


Serialization in Rust - <AUTHOR> http://rnestler.github.io/serialization-in-rust.html

<comment><USER2> The Encodable implementation can be simplified further in this case:

\- The match is not necessary for a single possible type. Simply use the "dot" syntax. \- The return value of a closure can be derived automatically. `|enc| -> _ {` can be simplified to `|enc| {`. \- An explicit return is not necessary, simply leave an expression at the end of the scope. \- I'm not sure why `p_url` was dereferenced, but `p_type` not. Apparently it's not necessary at all. \- Some redundant braces can be removed.

Before:

      match *self {
          Feed { _type: ref p_type, url: ref p_url } =>
              encoder.emit_struct("Feed", 2usize, |enc| -> _ {
                  try!(enc.emit_struct_field( "type", 0usize, |enc| p_type.encode(enc)));
                  return enc.emit_struct_field("url", 1usize, |enc| -> _ { (*p_url).encode(enc) });
              }),
      }

After:

      encoder.emit_struct("Feed", 2usize, |enc| {
          try!(
              enc.emit_struct_field("type", 0usize, |enc| self._type.encode(enc))
          );
          enc.emit_struct_field("url", 1usize, |enc| self.url.encode(enc))
      })</comment>


_NSAKEY (1999) - <AUTHOR> http://en.wikipedia.org/wiki/NSAKEY

<comment><USER2> Bruce Schneier's analysis: [http://www.schneier.com/crypto- gram-9909.html](http://www.schneier.com/crypto-gram-9909.html)

</comment><comment><USER3> And before someone else says this is bollocks, I've worked at a company with shared source access to Windows and there are still bits you can't get at like the CSP implementations so there may still be stuff like that in there.

No open review for any crypto functions in Windows is possible.

That's basically a fucking massive red flag.

<comment><USER4> The Windows source code is the most comprehensively reverse engineered codebase in the world. Virtually every software security firm and every security product company has someone on staff who has the lay of the land for the kernel, services, and drivers. Even if Microsoft didn't publish most of the debug symbols for the OS, which they do, it'd still be the best understood closed source codebase in the world.

The likelihood of them hiding backdoors in software that you don't know about simply because some company you worked at that had access to some of their actual source code didn't have _all_ that source code is low.

<comment><USER3> You underestimate the problem.

Look at just chrome for example, which I've posted my rationale for here:

[https://news.ycombinator.com/item?id=6035091](https://news.ycombinator.com/item?id=6035091)

Not a chance in hell.

<comment><USER4> I don't understand your comment. Mine was a statement of fact. Your assessment of the information density of Chrome versus that of the human genome was comprehensively debunked.

<comment><USER3> there are no facts in your comment. Please cite your sources. Not only that, my hypothesis hasn't been debunked or disproved.

</comment></comment></comment></comment></comment><comment><USER5> All those conspiracy theories sound a lot more reasonable today than they did back in 1999.

<comment><USER4> No. This reframing of the scariness of the NSA is one of the things that drives me batty about the NSA coverage on HN.

The NSAKEY conspiracy theory wasn't dismissed in the late '90s because people thought the NSA wouldn't backdoor Windows. The opposite is true; the NSA was so feared in the '90s that people didn't (and still don't) trust standards like DSA, for fear that the parameter generation algorithms they use were backdoored.

No, the reason nobody takes the NSAKEY conspiracy theory seriously is because if the NSA was going to backdoor Windows, they wouldn't do it with the ASCII string "NSAKEY".

</comment></comment><comment><USER6> They could also just send someone in there to steal the keys... Either way is plausible. But this is just one example of how open source peer-review improves security over proprietary implementations.</comment>


Fun with Cryptographic Hash Functions and PBKDF1-Like Constructions - <AUTHOR> https://soatok.blog/2020/05/05/putting-the-fun-in-hash-function/ <comment><USER2> Curiously, finding cycles in graphs defined by siphash-2-4 is exactly what my Cuckoo Cycle Proof-of-Work is about [1].

Furthermore, the most efficient algorithm for solving it, by edge-trimming, also suggests an interesting memory-hard PBKDF, where you hash the edge bitmap after a small fixed number of edge trimming rounds.

[1] [https://github.com/tromp/cuckoo](https://github.com/tromp/cuckoo)

</comment><comment><AUTHOR> I wrote this because the cautionary tale of PBKDF1 led to some really interesting thought experiments.

After I wrote this, I received some math corrections from cryptographers, which led me to discover an interesting (but intuitively sensible) observation:

1\. There are roughly O(sqrt(N)) cycles.

2\. The average cycle length is roughly O(sqrt(N)).

Unless you're supremely unlucky, most of the hashes you generate will fall within a cycle. (That is, of course, assuming that your hash is securely pseudorandom in the first place.)</comment>