Show HN: JavaScript Battle – A daily artificial intelligence battle - <AUTHOR> http://www.javascriptbattle.com/

<comment><USER2> CoreWars but with JS and GitHub! Cool idea.

I'd be very interested in hearing about the server-side setup, especially around isolating the code so some rando doesn't "require('fs')" and do damage to the server. How are you isolating the brains from the sensitive game data and from each other? How long does a single game take to run given max users? How are you protecting against "while(true);"?

Here's a repo that looks related: [https://github.com/JavascriptBattle/javascript-battle- webwor...](https://github.com/JavascriptBattle/javascript-battle-webworkers)

<comment><AUTHOR> Thanks so much for the interest and the questions. You are correct in that the web-workers repo is related. Its the repo we use on the back end. To answer your questions in turn: "How are you isolating the brains from the sensitive game data and from each other?" \- We are sandboxing each user's code in an isolated environment where a server listens for a POST request on a specified endpoint. That request carries the game data with it and after the user's code runs, the server sends back the result of that function, which is supposed to be a string (North, East, South, West, or Stay). The game data itself is update on our server, after receiving the response. "How long does a single game take to run given max users?" The games will take a maximum of 24 users, which will take a maximum of 30 minutes to run, if every user does something like "while(true)." Each server has a max-timeout setting of around 2 seconds. I hope that answers your questions and please feel free to offer any feedback. Thanks again!

<comment><USER3> So the AI can use up to 2 seconds of "thinking time" for each move on a some x86-server-like machine? Having played BitBath [0], I think this limit matters.

No matter how many turns are played, a match ends after 30 minutes? According to the rules, no team wins in this case?

[0] [http://www.hacker.org/bitbath/](http://www.hacker.org/bitbath/)

<comment><AUTHOR> Thanks for the clarification. I wasn't very clear in my answer before. The game ends after a maximum of 1250 turns or when all of one team's heroes are killed. If the maximum turn is reached, the team with the most diamonds wins. If every player on the team took the full 2 seconds on every turn, the game would last around 30-40 minutes.

</comment></comment></comment></comment><comment><USER4> That's interesting, I like that everyone's code has to be public on github so if you get relentlessly destroyed you will at least have the chance to learn from how your opponent works.

I haven't yet tried the game itself, but the testing page mentioned on the frontpage seems rather important, and I think I'll hold off on trying the game until that is implemented.

Also I think it would be good to mention at what time (in which timezone) each day the code is pulled and the battles are run.

<comment><USER5> That the code is public could easily be manipulated, by commiting minified code instead. It doesn't make it non-copyable but mostly unreadable.

There is a small testing utility (called " test_your_hero_code.js") in the repository where you can make sure your hero is working as it should. But I'm also looking forward to a proper testing page where I can see the battle.

Interesting idea however, looking forward to having some free time to trying it out fully.

<comment><AUTHOR> Thanks so much for the feedback. As you said, we do have a temporary testing utility for users while we finish up our testing site. Hope to see you soon!

</comment></comment></comment><comment><USER6> Is there a place to comment on gameplay design? As looking at the current rules, if a 'Coward hero' just sits at a health well hitting it ever turn they can't be killed by a single enemy hero attacking? If I'm reading the rules correctly the attacking hero can hit 10 from 'moving' at the coward and 20 again at turn end for a total of 30, which the coward can heal by simply moving at the well?

Either way cool game/site will give spin up a Hero soon.

<comment><AUTHOR> Thanks for the feedback. Feel free to use the 'contact us' link at the bottom of the page with any specific suggestions that you might have for gameplay. In the meantime, we hope you enjoy it! *Note: The way to beat the Coward is by collecting diamonds. The Coward won't collect any, so won't be contributing to the team's score.

</comment></comment><comment><USER7> What other games like this exist out there?

<comment><USER8> [https://www.reddit.com/r/programminggames/](https://www.reddit.com/r/programminggames/)

[https://www.reddit.com/r/gameai/comments/v86kk/list_of_games...](https://www.reddit.com/r/gameai/comments/v86kk/list_of_games_suitable_for_msc_ai_project_ai/)

</comment></comment><comment><USER9> Cool idea!

I registered yesterday but today I can't login. The 'login with github' button doesn't do anything (just reloads the page).

Also the leaderboard seems to breakdown if you interact with it for a bit - just stops updating.

<comment><USER10> Strange. It seems to all be working at the moment, but we'll try to squash more of the bugs today--please feel free to email firstname.lastname@example.com if you're continuing to see problems.

Thanks for bearing with us!

<comment><USER9> So - what happens is I get bounced through a few 302 redirects from github back to the page, but I remain not logged in. Then if I refresh the page it displays me as logged in then. Hope that helps. :)

<comment><AUTHOR> Interesting...We'll take a look at that. Sounds like something with our OAuth redirect. Thanks so much for the update!

</comment></comment></comment></comment><comment><USER11> UI seems to be broken [http://s15.postimg.org/p26vhk2p7/Screen_Shot_2014_10_07_at_9...](http://s15.postimg.org/p26vhk2p7/Screen_Shot_2014_10_07_at_9_06_22_PM.png)

<comment><AUTHOR> Thanks for the note and the screenshot. Should be fixed now.

<comment><USER12> no it is not: [http://s27.postimg.org/b06o5rls3/Unbenannt.png](http://s27.postimg.org/b06o5rls3/Unbenannt.png)

<comment><USER10> Thanks for the heads up--it looks like we have an infrequent but recurring bug that's causing this issue. We're working on a more permanent fix for the very near future, but for now it should all be working again.

</comment></comment></comment></comment><comment><USER13> >Each day your code will be assigned to a team at random

so today (500 diamonds vs 7) server randomly assigned one guy that dominates vs 10 pretty bad players?

<comment><USER10> Yep, it is "luck of the draw", and the default hero brain, while very good at gathering diamonds, does tend to be vulnerable to the "assassin" roles.

Eventually we'd like to add a slightly smarter matchmaking system (assign users to games based on some sort of performance ranking perhaps?), but for now it's very possible to end up on a less-than-stellar team.

</comment></comment><comment><USER14> Pretty awesome and good instructions on how to start!

What would be nice to see when the next battle will start (probably localized) :-)

<comment><USER10> At the moment, the battles run a bit after midnight (PST) each day. Thanks for the feedback--we can make this a bit more obvious on the site.

<comment><USER15> any chance the console output of the battle can be sent to the account? this would make fixing bugs easier... or if "see todays battle" allows you to click on each hero and see there stats & console output.

really great by the way!

</comment></comment></comment><comment><USER16> So Vindinium in JS. Not a bad idea.

<comment><USER10> Yep! The gameplay is very similar, but the tech stack, signup process, method for participating, stats, etc are all different from Vindinium. But they were definitely our inspiration (as Forrest mentioned, we actually have an "Inspired by Vindinium" link in our footer).

</comment></comment><comment><USER17> The "see todays battle" renders incorrectly on chrome Version 38.0.2125.101 beta

<comment><USER10> Thanks for the heads up--working on it now, should be back up in a couple minutes. I'll follow up when it is.

<comment><USER10> It should be up again--let me know if you're still having trouble viewing it.

</comment></comment></comment><comment><USER18> Awesome work, I think that this is a great way to ease into writing basic AI in JS.

<comment><USER10> Thanks!

</comment></comment><comment><USER19> This is great! Would ClojureScript (or other languages compiling down) do?

<comment><USER10> Thanks! ClojureScript (or Coffeescript, or anything other than JS) will not work "right off the bat", but you could compile to JavaScript on your end, then upload that compiled hero.js file to your github repository, and then THAT should work.

Hope that helps.</comment></comment>


Lego Engineering: From Kindergarten to College - <AUTHOR> http://www.youtube.com/watch?v=EG-izyXfFHI

<comment><USER2> Very interesting talk. Lots of concepts and learning behind simple experiments.</comment>


GitRoyalty – First OSS Paywall - <AUTHOR> https://gitroyalty.com/ <comment><USER3> Thanks Feross!

GitRoyalty is an experiment that allows OSS project maintainers to hide a package's manifest file (or build script) behind a monthly subscription. This way users will have to subscribe in order to install the package using dependency managers like NPM. The idea is that with low prices and the power of numbers, both popular and transitive OSS dependencies can sustain development instead of relying on a few enterprise sponsors that could influence the direction of the projects.

After setting up an Individual or Team subscription, users are given a license key which is used to install a package with their dependency manager:

      npm i git+https://<license>@gitroyalty.com/user/repo#semver:^2.0.1

* GitRoyalty works for projects with permissive licenses like MIT or Apache 2.0, but not copyleft licenses like GPL (which most companies like Microsoft avoid completely)

* While this isn't FOSS, it keeps the best parts of open source in place (open GitHub collaboration, permissive licensing) while incentivizing users to pay contributors

* Although some wildly successful OSS projects can sustain from donations, only core contributors get paid anything, when in reality there are hundreds or thousands of other developers. GitRoyalty distributes subscription earnings to all developers based on their contributions.

* The barrier to subscribe and install a package is quite low, especially after adding a payment method once. Login with GitHub, hit Subscribe, install. All subscriptions come with a 2 week free trial and are charged in aggregate the 1st of every month to keep processing fees low. [https://imgur.com/3WpwBUz](https://imgur.com/3WpwBUz)

I just set up my own 2.6k star GitHub project with GitRoyalty and have 6 subscribers so far, for a total of ~$10/month for me and my contributors.

[https://gitroyalty.com/saoudrizwan/Disk](https://gitroyalty.com/saoudrizwan/Disk)

I hope to get more subscribers as I release more updates to my project, since any previous versions before GitRoyalty will always be free (due to the fact that previous manifest/build scripts will be in git history).

Let me know what you think! I'd love for more people to try this out with even completely new projects so we can see if this experiment has potential. Obviously this won't work for everyone but I hope it can be a solution for projects that desperately need funding and can't find sponsors.

<comment><USER4> > * While this isn't FOSS, it keeps the best parts of open source in place > (open GitHub collaboration, permissive licensing) while incentivizing users > to pay contributors

No, those aren't "the best parts of open source". The best part of open-source is building a collective public commons, which this model does not allow for.

<comment><USER3> GitRoyalty works for transitive dependencies as well (dependencies of dependencies) by ensuring users are subscribed to all transitive dependencies before installing the direct dependency. So in this way this model not only still allows building a collective public project, but also compensates each developer that's involved in it.

</comment></comment></comment><comment><USER5> Not sure hiding/removing the project build or manifest is the best approach. Documentation seems like it'd be a better target. Use the software free full OSS but non-simple or extensive documentation for a subscription fee. It seems a number of OSS devs make money by writing books, and it could incentivize good documentation as well. There's been many times I'd not want to pay for a license but would've begged for in depth documentation.

<comment><USER3> Great idea and you can do this with GitRoyalty! You can hide any files you want behind the subscription–it doesn't have to be the manifest or build script. So in your case you can hide a docs.md file.

<comment><USER6> Accessing the documentation is more like a one time thing. I could always copy it somewhere else for later reference.

<comment><USER7> Like any file that you would hide with GitRoyalty, you could always share the full repo once you have access to it (probably illegally)

I believe documentation would become outdated sooner than build scripts with new releases, and would require effort to maintain (more than build scripts), which would better justify to pay.

Anyway, the idea of GitRoyalty seems not to make technically impossible to share the payed content, but rather to propose a way for honest people to remunerate honest developers and library maintainers.

</comment></comment></comment></comment><comment><USER8> I very much sympathize with the goals here (I'm deeply concerned about open source sustainability), but this doesn't strike me as a good solution. Not a single company I have worked for would allow a dependency like this in their repo (and I wouldn't blame them). Not only is it legally gray, but somebody has to maintain that subscription. We do buy licenses but only for big/important stuff. Something like this could work for a project of sufficient magnitude, but I don't think it will for smaller stuff.

<comment><USER3> I think companies will hop on board if it means saving engineering hours. OSS has monetary value to these businesses, enough to make a small subscription to support the tremendous development efforts behind it. In most projects, OSS makes up the majority of the codebase, so it is "big/important" IMO.

As for the legal aspect, permissive licensing like MIT/Apache 2.0 allows developers and consumers to distribute and use code pretty freely, which is what makes OSS so great and why GitRoyalty doesn't impose any other licensing.

One of the driving factors behind making GitRoyalty was the corporate mentality I've experienced where management will pay for whatever is necessary, but think twice before sponsoring anything (especially transitive projects).

<comment><USER9> Have you ever dealt with the purchasing department at a large corporation? Hint: They really don't care about saving engineering hours.

</comment></comment></comment><comment><USER10> > GitRoyalty looks at a repository's contributions history and determines each > contributor's relative work on the project based on various factors. Even if > a developer only made a contribution that we've deemed to be worth 0.001% of > the total contributions, that user will get 0.001% of all subscription > proceeds. Project maintainers cannot control who gets what share, so > developers can rest assured knowing that they will get paid what they are > owed, no matter how small their contribution.

Seems like a really hard problem to measure contribution automatically. Anyone know how you'd do this?

[0]: [https://gitroyalty.com/docs/faq/how-do-open-source- developer...](https://gitroyalty.com/docs/faq/how-do-open-source-developers- get-paid#earnings-split)

<comment><USER3> We measure contributions using a project's git history (i.e. # of commits) every time a release is published. I realize this is terrible and it's my #1 priority to improve this after we get some engineers on board. I'm currently talking to the owner of SourceCred to see how we can use their protocol: [https://sourcecred.io/](https://sourcecred.io/)

<comment><USER10> ah . sourcecred looks cool, but the current solution sounds a bit like counting klocs.

congrats on the launch though, i'm really excited about incentivized cooperation without dedicated managers!

</comment></comment></comment><comment><USER11> Maybe I'm wrong(I hope I'm missing something, if I do please elaborate), but given the unpredictable behavior of package managers caching behavior and general dynamic IPs the individual license is basically meaningless.

I can't even begin to imagine the headache and potential problems of having to deal with this. Isn't there a better way to handle supporting open source projects?

But other than that looks pretty with more or less clean execution.

<comment><USER3> We whitelist common dynamic IPs, for example CI, CD, and deployment IP address ranges including:

* AWS

* Heroku

* GitHub

* Circle CI

(this whitelist is a WIP and I'm open to adding more)

Also since the goal of rate limiting by IP is to limit # of users, not necessarily # of machines, we allow you to remove any previously used IP addresses from your subscription's history. This way if you hit your limit, just go to the payment page, hit 'Manage IPs' and remove any unused IPs.

See this doc for more details: [https://gitroyalty.com/docs/faq/how-do- subscriptions-work](https://gitroyalty.com/docs/faq/how-do-subscriptions-work)

</comment></comment><comment><USER12> From their ToS:

>In addition, Content found on or through this Service are the property of GitRoyalty, Inc. or used with permission. You may not distribute, modify, transmit, reuse, download, repost, copy, or use said Content, whether in whole or in part, for commercial purposes or for personal gain, without express advance written permission from us.

So anything obtained through this service is proprietary now. After reading this, it's clear why this doesn't work with the GPL.

If software obtained through GitRoyalty remained free software, I honestly might have been fine with it. But as is, no thanks.

<comment><USER3> You're absolutely right this should not be a clause in our ToS. I've just removed it and notified all repository owners of the change.

There was a misunderstanding of what 'Content' entailed on my part–it was meant to encompass anything without a license already attached in order to grant us rights to distribute unlicensed software. Our ToS should have been more specific, I apologize.

</comment></comment><comment><USER13> "8 profitable repositories"

Profitable is a strong word for making 75 cents a month, which is the highest of all the repositories.

<comment><USER3> The purple dollar value on the Discover page shows the Individual price of the repository, not the total profits.

<comment><USER13> Oh, fair enough then. It seemed to line up with less than $8 total payout, which itself I don't quite get because the minimum payout is $20..??

I took it as the equivalent of looking at a list of "Patreon" projects and the total contributions they make, rather than a storefront with sticker prices.

</comment></comment></comment><comment><USER14> How does it distribute fairly based on contribution? If you just go off number of lines added/deleted that's going to cause major issues. Maintainers will be less likely to accept PR's as it will dilute their cut. Not to mention, not every contribution is equal in effort. If I submit a bunch of readme changes or add type defs should that count the same building out some new & complex feature?

<comment><USER3> This is a tough problem and something we're actively working on improving. I'm currently talking to the owner of SourceCred to see how we can use their protocol: [https://sourcecred.io/](https://sourcecred.io/)

<comment><USER14> Just seems like the incentive structure is a little bit misaligned with the best interest of the project:

1\. Rewards bigger, more verbose contributions 2\. Punishes maintainers for accepting contributions

Contributors will optimise for the largest impact and core maintainers will end up spending most their time trying to reduce that impact.

<comment><USER3> Very interesting thought–I'd love to see how this dynamic actually plays out. I personally would welcome more contributors v.s. doing their work myself.

I think if a project maintainer were to act maliciously in terms of earnings share, developers would call them out and less people would contribute as a result.

</comment></comment></comment></comment><comment><USER15> Isn't this going to get banned by npm like those ads did?

<comment><USER3> GitRoyalty just hosts a git remote repository that you pay to get access to. NPM and almost all other package managers support installing from git URLs, and too many people rely on this functionality for it to ever be removed.

<comment><USER16> How do you stop someone from forking the project on GitHub, adding in a manifest, and then pushing to a package repository like npm?

Is there a risk of popular projects that are distributed through GitRoyalty having unofficial versions with malicious code on the package repositories, similar to now typo-squatting works?

<comment><USER17> There are a few reasons to not rely on unofficial forks. The chance of malicious code is one. Also: unwanted changes, missing updates, maintenance confusion...

These issues already exist in the world of open source, as you note, and the only way that I know of to stop it would be to have a more restrictive license (and to pursue any violations).

</comment></comment></comment></comment><comment><USER18> If it's truly OSS what's there to prevent someone from simply forking it to make a version where the manifest file is distributed freely (in both senses of the word)?

<comment><USER17> What is the incentive for someone to pay to access the manifest file and then maintain a free fork that includes it?

<comment><USER18> I feel like a manifest file is not that hard to write yourself. It's the same incentive as any other FLOSS work.

</comment></comment></comment><comment><USER19> I had to check that today is not April 1st.

If you badly want my money, sell me your product honestly, under a commercial license, and don't call it OSS. There are other "source available" licenses.

If you want a donation from me, show your tipping jar / patreon / whatever else link.

If you want your software be OSS, well, don't conceal the source.

I suppose that a project of any significance that would use such a "paywall" will be plainly forked, with a build / manifest / whatever file maintained manually.

<comment><USER3> The problem with non-permissive licensing is that a lot of employment contracts strictly forbid them. That and commercially licensed OSS projects have no way to distribute funds to arbitrary contributors in a legally straightforward way.

And I personally have not had any success with donations, whereas 2 days after setting up my project with GitRoyalty me and my contributors are making $10/month.

<comment><USER19> This is indeed an interesting problem! It looks like a way to sell a commercial license in effect, without selling it in any legal terms.

I wonder how funds acquired via GitRoyalty get distributed, from the legal standpoint, and what makes such distribution different from distributing a share from a sale of a commercial license.

</comment></comment></comment><comment><USER20> This is a very interesting idea and looks like a promising execution - I may try this with one of my repos. I have a question: it seems the only license options are IP-locked. What if a developer wants to issue non-IP locked licenses to paying users? This is a feature I would consider enabling - <USER2> that something you will support in the future?

</comment><comment> Null-Set Am I allowed to make a subscription url publically available? Say I write a package which has a paywalled package as a dependency. If I want to publish MY package freely on npm under an MIT license, can I pay the subscription fee and commit the resulting fetch-url with my license key into github, and transitivly allow users of my package to use the paywalled package?

<comment><USER3> If the transitive project's owner agrees to letting anyone use your license key freely, we can certainly do this.

However I recommend setting up your own project on GitRoyalty since we automatically replace your license key with a bundle identifier (i.e. bundle:<repo>). This way, before users can download your project, we confirm their IP addresses are associated with active subscriptions to all your transitive dependencies.

I wrote a bit more about transitive dependencies here: [https://gitroyalty.com/docs/faq/how-do-transitive- dependenci...](https://gitroyalty.com/docs/faq/how-do-transitive-dependencies- work)

</comment></comment><comment><USER21> Ok, I'm pretty fond with this, and it looks like a great model.

Some things that bugs me:

* I wouldn't term it as an 'OSS paywall'. I would rather term it as an 'package paywall', or 'repo paywall', or something else.

* I would prefer not using GitHub accounts, and rather have an own GitRoyalty account. I would like to have multiple login methods (like GitHub, GitLab, Google, Facebook, GitRoyalty account).

* I think the process of using GitRoyalty package as dependencies are too complex, I'm not sure if anyone would like an experience of searching (a git-committed) package-lock.json, changing all of the GitRoyalty package links, installing the packages, and removing the license keys when committing an updated package-lock.json. There should be a more straightforward way (preferably without any file changes, e.g. using environment variables) to install dependencies.

Also, I'm pretty impressed with the beautifully done website. May I ask what the site/docs are made of?

<comment><USER3> > rather have an own GitRoyalty account

This is definitely on the roadmap and eventually we'll expand outside of GitHub and allow repos from other hosts like GitLab.

> ... changing all of the GitRoyalty package links, installing the packages...

You should always commit your GitRoyalty license keys and share it with your teammates. This way you never have to deal with your package.json/lock files directly, just `npm install` and you're good to go! (This takes care of updating for you as well)

> I'm pretty impressed with the beautifully done website.

Thank you! I just used bootstrap and made the docs myself.

</comment></comment><comment><USER14> Do contributors get a pass on the licensing fee?</comment>


William Shatner explains what microprocessors are and do (1976) - <AUTHOR> http://www.engadget.com/2011/03/15/william-shatner-explains-what-microprocessors-are-and-do-from/

<comment><USER2> I gotta say, that was a really great film! +1 to AT&T for making it available.</comment>


Blood Donations from 'Man with the Golden Arm' Saved Millions of Babies - <AUTHOR> https://www.nytimes.com/2018/05/14/world/australia/australian-blood-donor.html <comment><USER2> Previous submissions of this story:

[https://news.ycombinator.com/item?id=17060600](https://news.ycombinator.com/item?id=17060600)

[https://news.ycombinator.com/item?id=17058516](https://news.ycombinator.com/item?id=17058516)

[https://news.ycombinator.com/item?id=17052185](https://news.ycombinator.com/item?id=17052185) <\- 94 comments

[https://news.ycombinator.com/item?id=17051696](https://news.ycombinator.com/item?id=17051696)

[https://news.ycombinator.com/item?id=17051076](https://news.ycombinator.com/item?id=17051076) <\- 13 comments

[https://news.ycombinator.com/item?id=9686933](https://news.ycombinator.com/item?id=9686933)</comment>


What is best proxy for Google chrome? - <AUTHOR>

<comment><AUTHOR> Free and Reliable to use VPN Proxies for Google Chrome is : [http://techfumes.com/free-vpn-for-google-chrome/](http://techfumes.com/free- vpn-for-google-chrome/)</comment>


Firefox extensions cannot securely clear browsing data - <AUTHOR> https://armin.dev/blog/2019/03/firefox-extensions-browsing-data-security/ <comment><USER2> My startup and shutdown of FF calls Bleachbit [1], which addresses at least some of the concerns.

[1] - [https://www.bleachbit.org/](https://www.bleachbit.org/)</comment>


Defecting Chinese spy offers information trove to Australian government - <AUTHOR> https://www.smh.com.au/national/defecting-chinese-spy-offers-information-trove-to-australian-government-20191122-p53d1l.html <comment><USER2> There's also a more discursive article here about his thought process and some of his activities:

[https://www.smh.com.au/national/the-moment-a-chinese-spy- dec...](https://www.smh.com.au/national/the-moment-a-chinese-spy-decided-to- defect-to-australia-20191122-p53d0x.html)

I particularly liked his quote here, which echoes my thoughts on even 'benevolent dictatorship':

"China's view of life and the world simply cannot create outstanding talents because it is totalitarianism, it is dictatorship," Wang says. "I hope that my child and my family can ... do something for human beings. I feel that in Australia this can be achieved."

<comment><AUTHOR> Thanks, there are going to be many articles through Monday. Here's another good one: [https://www.smh.com.au/national/peter-hartcher-on-china-s- in...](https://www.smh.com.au/national/peter-hartcher-on-china-s-infiltration- of-australia-20191118-p53bly.html)

<comment><USER2> Thanks also for that. As a NSW resident I'm really feeling this one. There's this huge focus on law and order in the small against individuals, while businesses and organisations are left alone on systemic issues.

"Australia has many fine laws that are being flouted through lack of political will. As we've learnt in the past few years, major businesses and famous chefs have for years been systematically underpaying their workers and getting away with it because the Fair Work Commission wasn't enforcing the law. Misconduct by the major banks was rampant because federal agencies lacked the staff and the will to investigate. Newly built apartment blocks are uninhabitable because state governments have failed to enforce their building codes.

It is a characteristic of Australia today that governments, state and federal, are failing as functional entities. They have allowed vital laws to lapse through inexcusable neglect. They snap into action only when the media expose a vacuum where there is supposed to be an operational core."</comment></comment></comment>


I'm tired of the way Microsoft is shoving Windows 10 down everyones throat - <AUTHOR> https://medium.com/@viet/dear-microsoft-stop-making-games-exclusive-only-to-windows-10-587217c206e6#.tzw0l9jwt <comment><USER2> Personally I'm happy MS is 'shoving it down everyones throat'

Nothing worse than people refusing to upgrade from Windows XP but expecting your software to work for them.

<comment><USER3> Ya it's kinda a bad thing to make everyone upgrade but I probably would've done the same thing if I could see how expensive supporting xp for forever was</comment></comment>


Ask HN: How do you stay focused on your 9 to 5 whilst bootstrapping a startup? - <AUTHOR>

<comment><USER3> It's hard, damn hard. For a quite a while I was lucky enough to have a very boring, mundane, easy $DAYJOB where I could go in, slog through fixing a couple of bugs, and go home, retaining most of my creative, emotional, and intellectual energy for the startup. By my current $DAYJOB is a lot different... more challenging, but also more fun. But it really makes it hard to balance things.

I wish I could say I had some real solid advice for you, but all I can really do is share some anecdotes in the hope that you can glean something useful from that.

Basically, I try to compartmentalize my thinking as much as I can. During the day, at the 9-5, I _mostly_ try not to let myself get drawn into thinking about "startup stuff", except during lunch. I treat lunch time as "startup time" and I often leave the office, go to a restaurant or coffee shop, and do startup work for an hour there. The delineation isn't perfect though, as I do keep a browser tab open all the time, with Gmail for my startup email address, and I do answer and send a few emails or whatever, throughout the day.

I might also, rarely, pop into the wiki for the startup and make a few notes about an idea that occurred to me, or a link I found or something.

Then, after work at the $DAYJOB, I immediately go back into "startup mode" most evenings. I leave the office, drive to a Barnes & Noble or something, sit in the cafe with my laptop and get back to work. Since I know I have "startup time" built into the evenings, it reduces _some_ of the temptation to think startup stuff while I'm supposed to be working.

Now the fortunate thing is, my $DAYJOB employer knows about the startup, is an entrepreneur himself and is generally supportive. As long as I'm getting my work done and not letting things slip, he doesn't mind if I leave work early on occasion, or take a long lunch now and then, to have a meeting related to the startup, or whatever. I will also sometimes just flat out take a vacation day, to accommodate the need to do something for the startup.

I also allocate almost 100% of my weekend time to working on the startup. So the toughest day to stay focused can be Friday, since I'm mentally preparing to shift gears into startup mode for the weekend, and as Friday winds down, I might start drifting that way a bit. Luckily, Friday afternoons here are usually pretty relaxed.

The toughest part, really, is dealing with meetings during the day. Writing code, market research, writing, etc. I can do anytime. But meeting potential customers, investors, partners, etc., is a challenge since my daytime availability is somewhat limited. Basically I just try to schedule meetings for either A. over lunch (and just take a slightly long lunch), B. as early as possible in the morning (so that, at worst, I come in a little late), or B. as late in the evening as possible.

It's tough to balance both, but it can be done...

<comment><AUTHOR> Wow, thank you very much for the insightful response. I too am currently allocating 100% of my weekend time, and find that the statement about Friday definitely holds true for me. I think the key term is 'balance'. I'll certainly be working on finding more of that.

<comment><USER3> Yeah, it's a tough thing to do. I tell people I have 2.5 full-time jobs, as the $DAYJOB is 1 full-time job, and the startup is one and a half (at least) by itself. But I keep telling myself that the result of all this hard work will be worth it someday.

BTW, I'd also caution anyone against taking much (or any) advice from me. I'm one of those people who gets obsessive about things and will push things to - and beyond - logical and reasonable boundaries and will do crazy shit.

Especially considering that I'll turn 40 this year, the way I look at it, I don't have a whole lot of "at bats" left to achieve some of my dreams. I've basically conceded that it's "desperation time" here and that pretty much any option that doesn't violate some core ethical principle of mine, is on the table, as far as pushing to make this startup a success. My lifestyle is probably not normal, reasonable, or healthy by most standards. But, to my way of thinking, it's either succeed, or "the water under the Golden Gate is freezing cold".

</comment></comment></comment><comment><USER4> I did this for three months with Geddit, but mostly on creating the MVP with my cofounder rather than sales.

Unlike mindcrime, my employer did not know what else I was working on, and I did no work on my startup during 9-5 business hours. I had to keep everything absolutely separate - not so much as IMing my cofounder about the startup during working hours. I did keep a personal journal a work where I would write down ideas and other startup related things, as well as general thoughts, but that was it.

The 9-5 job was mind numbingly boring, and occasionally pretty stressful. I developed some tactics to make sure I kept going with the startup while still doing my 9-5 well. Firstly, I developed a routine together with my cofounder, and stuck to it religiously. 9 to 5, we were at our day jobs. 6 to 7 we were at the gym. 8pm we had had dinner and were ready to work on a weeknight. Work had a midnight curfew, no matter what. This helped to establish compartmentalised parts of the day, as well as an effective transition between one and the other. At my 9-5, I could focus on my job since I knew no startup business would enter. Weekends were devoted entirely to startup work, or leisure activities about twice a month.

Secondly, we established a goal where we could switch to working on the startup full time. For us this was saving the money needed to move to Berlin plus 6 months runway. Having this in our sights made the harder parts of the three months more bearable because we knew we were working toward a determined fixed goal. We were able to execute on our MVP through this sort of discipline and successfully switched to working full time on Geddit.

This stuff was very tough, but I had the support of my awesome cofounder and we had each other's backs. If you're going at this alone your mileage may vary, but we managed to succeed on the 'nights and weekends' route, at least for some time.

Eventually you'll have to switch to working on your idea full time - <USER2> sooner than you feel comfortable - but it'll be worth it.

</comment><comment><USER5> At the time I was working for a .NET consultancy firm, every morning around 6 am I was learning and coding in RoR. 1.5 h uninterrupted time every week day for 2 months makes a huge difference. Plus the weekends.

Don't forget to embrace a healthy down time. You body and mind need to relax.

</comment><comment><USER6> I generally like my job, so it has not been too bad. But there are moments when I'm way more excited to work on my startup idea as opposed to my full time job. I think it depends on how much creativity and engagement your full time job requires. I have had to push myself away from my startup for a few weeks so I can catch up on sleep as well as focus on my creative energies on my job.

I wish I had the time mindcrime has - I have wife and kids so my job is pretty important. I find time late at night as well as on the weekends when I can.

</comment><comment><USER7> It isn't easy, although paradoxically I prefer the 9-5 to be interesting work in its own right. It is surprising how many ideas can flow from your day job into your own projects.

<comment><USER8> _It is surprising how many ideas can flow from your day job into your own projects._

I've definitely noticed that. At work, we have a few hundred EC2 instances running at any given time, so we've had to deal with monitoring and scalability issues. Now that I'm working nights and weekends on my own project, I apply a lot of that expertise to a much smaller setup (5 instances in my case). When I get to the point where I need to scale up to hundreds of instances, it won't be foreign to me.

</comment></comment><comment><USER9> I don't think it's possible. Just put 30 hours into the startup on the weekend and try not to work on it too much during the week.

</comment><comment><USER10> If you're passionate about your startup, it's impossible.

<comment><USER3> If not "impossible" it's damn close, for sure. I guess for a lot of us, the startup becomes our life in many ways. It's that way for me. I don't have any children, but right now this startup is as close to having a "baby" as anything I can imagine.

BTW, love the username!

<comment><USER10> I did not copy off of you, I swear!

:)

<comment><USER3> I assumed you were an Orwell fan, actually. :-)</comment></comment></comment></comment>


New option for great free images (commercial use) that involves no legal risk - <AUTHOR> http://www.rawpixel.com <comment><AUTHOR> Check it for free images every day for the cost of nothing. Real, authentic, HD images that don't suck. You also won't risk yourself on model or property releases. It is all covered ;).</comment>


Cloujure Distilled - <AUTHOR> http://yogthos.github.io/ClojureDistilled.html/#

<comment><USER2> The URL is entered wrong. Remove the /# from the end and that should fix it.

<comment><AUTHOR> Oops! My bad. Guess its too late to change.

<comment><USER2> Actually, HN lets you edit titles and URL's after they're already submitted. There might be limits on that, though. Check for an 'edit' link.</comment></comment></comment>


Amazon Sued for Saying You've 'Bought' Movies That It Can Take Away from You - <AUTHOR> https://www.techdirt.com/articles/20200505/23193344443/amazon-sued-saying-youve-bought-movies-that-it-can-take-away-you.shtml <comment><USER2> I truly believe in the power of ownership, and have been working very hard to build a service that honors this with respect to media.

14 years ago I started working on it, and have experienced many ups and downs along the way.

Last December I read here about a company called Murfie shutting it's service down and I flew to Wisconsin to save it. I bought the company, aquired all the customers and assets, rebuilt much of their website and saved the million CDs that were in danger.

Now I'm in Arkansas getting a 220,000 sqft warehouse ready to take Murfie to the next level.

It is based on true ownership of physical media, and I'm doing everything possible to truly protect the rights of the owners of these assets.

<comment><USER3> What company is this? Sounds cool what you are doing

<comment><USER4> Pretty sure it's this: [https://www.crossies.com](https://www.crossies.com)

Related from a few months ago: [https://news.ycombinator.com/item?id=22250659](https://news.ycombinator.com/item?id=22250659)

</comment></comment></comment><comment><USER5> I hope property rights are accepted as basic human right. No law or contract should deprive a person rights to posess,use, modify and share something they own. If a person comes into lawful posession of any item, unless a lease or rental agreement is in place, that item is fully theirs forever. When someone gives you something and tells you what you can or cannot do with it,they are treating you bound as their sibject,inflicting their will over you. This isn't equal treatment under the law. If you own something, the item no longer bears any relation to the seller, the seller has no authority by whih they can claim rights to that item. The whole point of ownership is that it is full,final and permanent.

This is a main reason why I refuse to use apple products. If I pay $700 for a device without agreeing before hand the terms of posession is confined to renting or lessing a device, if I have a lawful exchange where ownership of the device is transfered to me, then how dare they even think to tell me what to do with it? Regardless of quality,how dare they consider their customers as lesser subjects who pay to be told what do and not do? My breaking point was when the legally restricted what programming language can be used to write code code for the device.

Imagine a cookware company making it illegal to cook a certain food on their line of pans. No amount legal polishing will make this right.

</comment><comment><USER6> Login to Steam. Go to your profile page, look for "Games Owned"

That is a lie. What it should say is "Licenses Owned".

Their EULA, and any additional you agree to as part of the purchase process make it clear (some do it better than others) that you do NOT own the game. You have a license to play it, and that license can be revoked.

Battle.net, Origin and others have the same.

They can take anything away.

<comment><USER7> I don't think it says games owned, it just says games... Maybe a recent change?

</comment></comment><comment><USER8> Perhaps its just semantics, but can you truly "own" a copyrighted work, unless you are the copyright holder?

In the US, first sale doctrine and decades of case law says I can re-sell the spinny plastic disc I get when I buy a movie on DVD, but I'm greatly restricted in what else I can do with it. I cant make copies, I cant show the content publicly, I cant sublicence access to the disc remotely - these are all things the actual owner of the content can do.

I'm very sympathetic to people losing access to digital content, but it seems its fairly clear that wording aside, all copyrighted content is licensed, not sold. The only difference here is that you can use physical media until it wears out, where as digital content can only be used as long as it is made available to you (which in some cases, may be much less than an equivalent physical copy).</comment>


Chromium devs want the browser to talk to devices, computers directly - <AUTHOR> https://www.theregister.com/2020/08/22/chromium_devs_raw_sockets/ <comment><USER3> Could we please just fix native software development, so it doesn't suck, rather than adding the kitchen sink to web browsers?

Web pages and JavaScript are the only universally trusted medium for sharing information and simple software. Making it possible for news websites to touch ethernet/usb/serial/gpu compromises that. Same goes for optimizations ilke JIT'ing and WebAssembly which have certainly done a great job making it possible for Gawker to reprogram the microcode in AMD K8 CPUs. Has the long tail of browser innovations made the web go faster? No. It went faster in 2010 IMHO. Whatever performance glut the geniuses who work on Chrome end up creating, it'll just get gobbled by more aggressive display ads and things like wild-eyed web component frameworks.

<comment><USER4> I think WASM will eventually produce the solution (hear me out before you tune out). I've been thinking about this for a while. So we have WASI[0], which doesn't yet address the UI issue, but there's half a dozen at least projects attempting to create runtimes for WASM. If most languages wind up compiling for WASM / WASI I think eventually a good effort could be done towards a WASI- UI or WASUI.

Imagine if major OS platforms had a common UI framework that any language can produce a UI for, every major browser already supports WASM, why not a WASI based common runtime that would benefit every OS that supports it. I havent seen anyone else discussing this I've just been contemplating it for a while and I'm not sure what it would look like short of recreating a cross-platform X window system.

However, as crazy as I sound my reason for this is simple: the issue with a lot of UI frameworks is that they tend to be language specific and are mostly useful to the languages they officially or directly support. If you can build a UI compatible stack that any language can target, you can gain a lot more adoption. I could easily see Rust, D, Go, etc supporting a common UI runtime.

Electron sells itself rather easily cause most devs are familiar with HTML / CSS / JS. What we need is a cross-platform cross-language solution that isn't XML based but something a language can implement rather simply, or maybe even a compiler / standard library could manage.

[0]: [https://wasi.dev/](https://wasi.dev/)

<comment><USER5> _Imagine if major OS platforms had a common UI framework that any language can produce a UI_

This has been attempted a number of times, both in the browser and without, and it always comes down to people complaining that the widget set isn't "native" in look and feel and operation, and the pendulum swings back the other way.

People used to complain that browser widgets didn't confirm to the OS's UI guidelines. Then you could style them with CSS and things really started looking crappy, then you have web UI frameworks that forgo all that customization (or at least discourages it in the name of ease of development).

<comment><USER6> Umm - a large group of most popular productivity apps are cross platform and look nothing like native - from dev tools like IDEA, VSCode over Slack, MS Office, to multimedia tools like Adobe tools, almost all 3D modeling software like maya, max, audio software like Ableton, FL. None of the apps I use on a day to day basis look native (ie. like the apps provided by Apple)

You are confusing cross platform UI with frameworks that have programmer art widgets and no cross platform polish - eg. GTK+, FLTK, and even to some extent QT widgets (and many more). When people say widgets don't look native they usually mean "the widgets suck", you can create beautiful cross platform apps - Electron has quite a few because it allows standard designer tools from web dev.

Flutter is another promising development, but the desktop port seems underwhelming - it's obvious the widgets were intended for mobile apps, they will probably need a custom widget set to cover desktop UI - but the approach is sound.

<comment><USER5> If MS Office was truly cross platform in look, feel, and operation, then finance people who insist on using Excel wouldn't also insist on using Windows just to use Excel.

All those specialized tools can get away with having completely-unlike- anything else UI/UX because people are paying for them and they are considered best(and only)-of-breed.

Electron apps are cross platform only in terms of them looking alike on different platforms, because they use the same widget set. If slack was a truly, full native app on OSX, it wouldn't look like it does.

<comment><USER7> In my experience, finance people who insist on using Excel only on Windows generally do so not because of any reliance on "native controls", but on longstanding dependencies upon VBA macros with hard-coded dependencies on specific legacy COM components.

</comment></comment></comment></comment></comment></comment><comment><USER8> _" Note that this capability is already available to Chrome Apps and Extensions and in no scenario will we be handing it out like candy to any website that asks nicely; [the API] will come with a higher barrier to use."_

Involving Google as a gatekeeper, of course.

Google is trying to establish the level of control on the Web it has on Android.

<comment><USER9> Google just wants browsers to become more powerful cuz then more people will use Chromebooks. since everything can be done on a browser.

Why do you think PWA's are being pushed so hard by google? So people can build PWA's that also run on Chromebooks. No need for native apps

<comment><USER10> I think PWA's were pushed because the google cannot crawl native applications for its search engine.

<comment><USER11> With a few tweaks to a native app, they can [https://firebase.google.com/docs/app- indexing](https://firebase.google.com/docs/app-indexing)

On Android they already crawl your app with various devices when you upload it to Google play and let you know about any crashes or accessibility issues. Nothing to stop them capturing the content too if they wanted.

</comment></comment></comment></comment><comment><USER12> Local apps

\- I can install once and check signature.

\- I can store them in a backup for later forensics if they do something bad.

\- I can firewall the process only to required services.

\- I can disable outside network access for local process.

\- I can analyze what it does before and after the fact.

\- They can be scanned by a malware scanner / virus scanner.

Web apps:

\- need network access to load (and probably at runtime?),I cant firewall off...

\- can be refreshed by app provider - targetted to a specific user.

\- Traffic is bundled together with chromium?

\- I have no clue after the fact what happened. I cant sniff https traffic that app used to load its code...

Bad App owners should be considered as well... or well intentioned but hacked ones...

<comment><USER13> We could bring those advantages to web apps, but there isn't money in it, so it won't happen yet.

<comment><USER12> wouldn't that mean making them native apps, like something on top of electron?

seems like reinventing the wheel.

<comment><USER14> The web platform has lots of tech now for fully offline web apps - <USER2> currently used term for this is a 'PWA' or Progressive Web Application. On Android and iOS in many cases there's a little option in your browser to install a website as a PWA, which puts it on your home screen and locally caches the assets. IIRC Twitter and Google Maps both support this for their website.

Of course, writing a PWA is still a huge pain in the ass, and it doesn't give you those guarantees you mention from native apps - auditability, etc. But maybe it could get there, who knows...

</comment></comment></comment></comment><comment><USER15> As a gopher dweeb forced to write hackarounds like an external helper to get Firefox into Gopherspace again (either a proxy server: [https://addons.mozilla.org/en- US/firefox/addon/overbitewx/](https://addons.mozilla.org/en- US/firefox/addon/overbitewx/) or an actual executable: [https://addons.mozilla.org/en- US/firefox/addon/overbitenx/](https://addons.mozilla.org/en- US/firefox/addon/overbitenx/)), I'm torn. I would love to see the browser able to speak raw TCP again like I could when XUL/XPCOM extensions were still a thing. But this should really be restricted to browser extensions rather than arbitrary websites because we know someone is going to abuse it, and if we go full Windows Vista as proposed here and ask every connection to be confirmed it will eventually annoy people enough that security will be slackened (and then someone is going to abuse it).

<comment><USER16> The next thunderbird will contain OpenPGP support build-in because they are finally getting rid of XUL addon support and enigmail would not work with it.

<comment><USER17> Context: [https://blog.thunderbird.net/2019/10/thunderbird-enigmail- an...](https://blog.thunderbird.net/2019/10/thunderbird-enigmail-and-openpgp/)

> _" It has always been my goal to have OpenPGP support included in the core > Thunderbird product."_

</comment></comment></comment><comment><USER14> Until widespread code-signing exists on the web this seems incredibly reckless to expose. Even if you require https and put it behind a modal, history has shown that both of those measures are not impenetrable barriers to attackers and raw sockets open up a whole new set of attacks.

HTTPS is basically useless for authenticating dangerous code: There are thousands of https domains out there that you can easily put your own code onto, and many of them have EV/DV certificates with reputable names like GitHub attached to them so there won't be any obvious red flags other than the text of the domain name. A prompt with a textbox in it is a barrier but it's not hard to get users to paste random stuff into text fields (just look at the big message that appears when you open devtools in Discord warning people not to paste stuff in there) and I agree with the concern that eventually the text box will be made friendlier.

Many existing Dangerous APIs have worst-case attacks that just do things like talk to a USB device from a small list of authorized devices or talk to a MIDI keyboard. Raw Sockets are an entire new world of attacks: Hit a router or PC on the local network with a zero day and get persistent root on it, then use that to spread through the network and perform a ransomware attack, etc. The blink team needs to accept reality and catch up with where native apps have been for over a decade: Require code signing with revocable certificates and pair that with a mechanism to ensure the code was signed by the owner of the domain.

<comment><USER18> Why does discord even let users access dev tools? This is trivially easy to disable in prod builds. Seems odd. Is there a valid use case?

<comment><USER19> > Why does discord even let users access dev tools? This is trivially easy to > disable in prod builds.

Even if you disable the usual way to pop the dev tools open in desktop electron mode, this is a dangerous attitude. A malicious client can _always_ edit the DOM, send arbitrary data to your server, read whatever you send back, etc. "Disabling the dev tools" is never the correct solution to any security problem.

<comment><USER18> I didn't say that they should do this for security of the execution environment of the code, I'm not sure how you got to that interpretation. The GP said that there is output to tell users not to compromise themselves by blindly pasting unsafe code, which is easily prevented by disabling dev tools altogether, and there is no reason for an end user to have access to dev tools in an electron app. The other replies are probably what the GP meant and were related to the web version of discord.

<comment> j-james > there is output to tell users not to compromise themselves by blindly > pasting unsafe code

For reference: [https://user- images.githubusercontent.com/47160230/51995729-...](https://user- images.githubusercontent.com/47160230/51995729-275e2680-24ab-11e9-8b1b-470c62883ec0.png)

This is also present in the Electron version of Discord.

> there is no reason for an end user to have access to dev tools in an > electron app.

Certainly there is - there are various user-made applications that take advantage of Discord being built on Electron to allow you to write your own custom styles and scripts.

</comment></comment></comment></comment></comment><comment><USER20> I don't know; I understand the cynicism here.. But can we assume an optimistic scenario where vendors are able to properly address the security implications and this enables web developers to build all kinds of new applications? I for one would love to be able to write web applications that could, say, control the lights in my house or smart devices. I hate interfacing with my phone to control these types of actions; I don't have the same bandwidth with my phone as I do with a full-blown computer, and therefore use my phone as little as possible. Therefore, I am closed off from really having fine-grained control over the devices on my LAN. Using the browser for this type of behavior would be awesome, IMO.

<comment><USER21> The cynicism isn't fully appreciated, if the optimistic scenario is assumed.

Security is hard, and exposing more by default (or making it defacto required) is simply asking for trouble.

<comment><USER22> It's funny - in the arguments about Apple and the App Store, I've seen plenty of people making the opposite case - 'it's not scary out there', the security benefits of the App Store are 'bullshit', etc.

<comment><USER21> Using both I prefer Apple's philosophy.

I like Google's stock phone and features more, but I like that Apple is strict about about something that has my personal info.

It's worth the money.

</comment></comment></comment></comment><comment><USER23> This is good. I guess. I have to develop relatively complex desktop-like applications on Chromium platform and I still feel that there are quite a few gaps until it can become a full desktop-able development platform.

What's really missing for me is Android-like permission system where website could request permissions to access webcam, bluetooth, microphone, local storage, notifications, audio playback etc...

At the moment, most of the access is provided by a number of different APIs, and, in some instances, it is heuristics-based decision (looking at audio playback).

</comment><comment><USER24> I would have loved this in 2008 for the Beijing Olympics. My team created the point of sale, which included printing specialized tickets on specialized printers. These were going to be deployed across 1,000+ Bank of China locations, including many in pretty remote regions.

Instead, we created an applet to handle the IO with the printer. It was a nightmare. All sorts of little differences between Windows XP & JRE made it ridiculous hard to debug. While the banks were given exact specs, the culture was such that whenever they would have a problem, they insist the machine was the right spec, which wasn't true 90% of the time.

</comment><comment><USER25> Have they even fixed websocket portscanning, canvas/audio/font fingerprinting, their crippled request blocking API etc. etc. before coming up with this new privacy and security nightmare?

Can we maybe have a breather?

There must be something about the term _sandboxed environment_ that makes people want to poke holes in it.

</comment><comment><USER26> I am kind of against all of this, as it will inevitably lead to better fingerprinting. I already think its a serious breach of privacy that browsers supply hardware information such as joysticks and game controllers connected etc. without any kind of permission dialog. This is even worse because it allows for malicious websites to absolutely pwn the living sh*t out of the end user. You thought that ebays port scanning through websockets was bad, then just wait to see what they will use this for.

</comment><comment><USER27> See also yesterday's discussion: [https://news.ycombinator.com/item?id=24249392](https://news.ycombinator.com/item?id=24249392)

</comment><comment><USER28> Guys, "The Birth & Death of JavaScript" was supposed to be a joke. In all seriousness though, I'm beginning to get tired of webdevs reading OS books and going "oh, this would be a great addition to The Web™". Slap "in the browser" after a feature all operating systems have supported for decades and you'll hit the front page of HN in no time. What's old is new again and all that.

</comment><comment><USER29> The upcoming WebTransport/QuicTransport seems like it would address similar use-cases but with some built-in security considerations:

[https://web.dev/quictransport/](https://web.dev/quictransport/)

[https://wicg.github.io/web-transport/#privacy- security](https://wicg.github.io/web-transport/#privacy-security)

</comment><comment><USER30> Browsers in ring 0? Why not, it's 2020, anything could happen. Ditch WASM, more languages support ASM anyhow.

</comment><comment><USER31> Would webkit ever come along with this?

<comment><USER32> Absolutely not.

</comment></comment><comment><USER33> Would probably be better to have abstractions on the protocol level rather then raw ip or radio.

</comment><comment><USER34> Security concerns here are overblown, and this is IMHO more useful than WebRTC. This is how it should have been done to begin with, as well as the ugly hack known as web sockets.

There should be some restrictions. No ports under 1024 without asking the user would go a long way.

Anyone saying "the web isn't an application platform" needs to just accept reality. That ship sailed almost 20 years ago.

<comment><USER35> > _That ship sailed almost 20 years ago._

Which would still be some time _after_ the 1024 port distinction stopped being relevant for security.</comment></comment>


On Firebase –  a personal musing - <AUTHOR> https://medium.com/from-the-couch/on-firebase-31e1e39a18c9 <comment><USER2> Thank god someone did something besides 'todo'. Thank you for that.</comment>


Big Tech Has Become Too Powerful - <AUTHOR> http://www.nytimes.com/2015/09/20/opinion/is-big-tech-too-powerful-ask-google.html <comment><USER2> In what way does everyone "have to use Google's search engine"? There are no barriers to switching; you could switch to Bing forever in about five seconds.

Unlike switching from Facebook, you don't need to get all your friends to come along. Unlike switching from GMail, you don't need to move a bunch of data. Unlike switching your company away from Windows, you don't need to buy all new software, retrain all staff, or get your partners to change the format they use to interchange data with you.

If someone were to build a better search engine, we would all just switch. Like when everyone left Altavista in 1999.

<comment><USER3> I've tried switching from Google to reasonable alternatives, and I usually have to go back to Google to search twice because the results are not what I was expecting, nowhere near. I'm not sure if this is only my own experience, no offence to other engines (and their engineers), but if you can't find what I'm looking for I'm going somewhere else to find it.

<comment><USER4> Getting a bit tangential: I've been trying Bing again recently out of curiosity, and at least for my usage I find it now pretty reasonable. A few years ago it was barely usable, but now I'm fairly happy with it. It also feels slightly snappier to me than Google on loading results. The main problem is that a small but significant number of sites have a robots.txt that excludes all non-Google crawlers, making it impossible for other search engines to display equally good results in cases where that site has something relevant (unless they blatantly ignore robots.txt).

<comment><USER5> Why would someone do that?

If a site owner wants traffic on their site - and most do - they want to make their site as easily discoverable as possible. That means being in all the search engines. Blocking one engine (or all except one) flies in the face of most business models.

The only exception I can think of is Google properties. By blocking out competitors, they can try to worsen the experience on other engines. Like imagine a video search on Bing that didn't include YouTube? But even then, it seems like someone finding a Google property via Bing still furthers their interests.

<comment><USER4> Few deliberately block Bing specifically, it's just a sloppy attempt to block unwanted crawlers, like the billions of crawlers running on AWS and DigitalOcean boxes. A quick-but-not-great hack is to have an entry blocking * by default, and then specifically whitelist GoogleBot to avoid getting delisted from Google. You could also whitelist other search engines, but that requires you to know and care about them, and for a long period Google was the only engine people really cared about, since it drove >95% of organic search traffic. I do feel we're past the peak of that period, however, and site owners are now getting more cognizant of non-Google search engines having at least some value in driving traffic.

Related, "Please Don't Block Everything but Googlebot in robots.txt": [http://danluu.com/googlebot-monopoly/](http://danluu.com/googlebot-monopoly/)

<comment><USER5> So it's more out of ignorance than maliciousness. That makes sense.

Odds are the more troublesome scrapers are probably ignoring robots.txt anyway, so I wonder how useful it is.

</comment></comment></comment></comment></comment></comment><comment><USER6> What a joke. Big Tech too powerful? How about the military industrial complex? Pharmaceutical companies? THE BANKS? THE FEDERAL GOVERNMENT ITSELF?

No, those are all OK because they fit the agenda of total control. Technology is the only industry putting up a fight, the only industry that is solving problems for people instead of creating them.

Can't have that.

<comment><USER7> This. Our society happily tolerates so many entrenched monopolies and cartels that are actively hostile to their customers and blatantly manipulate government to keep competitors out. The tech industry is the least of our worries.

<comment><USER8> While true, the main concern I have with tech companies becoming too powerful is their access and control of personal data. This becomes even more concerning when they're so big they have significant data on individuals who actively avoid their services.

</comment></comment></comment><comment><USER9> I take issue with the characterizations of industries as "Big X". Big Pharma, Big Tech... It's clearly an attempt at demonizing larger players in the tech industry.

My opinion is that antitrust laws and such are not applicable here because even though the companies in question have an effective monopoly on traffic, it does not make it impossible for other players to create a profitable business.

Google is not a domineering empire like Standard Oil or Ma Bell once were. They do not have total control over everything. Even if they have a certain product (for example, Google Drawings), it doesn't stop other smaller players from making quality products that people buy (Sketch, Illustrator, Inkscape, etc.)

I don't really think this is a problem. (And where it is, existing antitrust laws are performing as they should.)

<comment><USER10> I do have a problem with Apple forcing the iPhone app developers to use MacBooks, given that about 90% of the purchases from cellphone app stores are made using iPhones (as far as I remember). This is the kind of anti competitive behavior that an anti trust law is supposed to punish. I don't know the legal technicality they are using to avoid it.

Big Tech also formed a cartel to lower engineers salaries. This is also something that should be punished by law (and AFAIK, they did win a class action suit).

I do think this is a problem and needs to be addressed.

<comment><USER11> Antitrust law can't force you to develop your products for platforms you don't want to target. You will never see an antitrust decision that Apple _must_ develop a Windows version of XCode, and in fact doing so would probably require a total re-architecture of the iOS platform.

You _might_ see antitrust law force Apple to allow sideloading, including apps built by toolchains third parties have hacked together.

You're also not required to use a Macbook; the Mini is $500.

<comment><USER10> Why not?

If a monopoly is allowed to choose, it can use its domination in one vertical to influence another vertical.

Anyway, I would prefer a Linux version of the iPhone SDK. I do not use neither Windows nor OSX normally.

</comment></comment></comment></comment><comment><USER12> I think this problem takes care of itself, but it takes time, more time perhaps than people are willing to allow.

1\. As organizations metastasize, the negative tail of the competence distribution becomes more and more populated. In response, the organization clamps down with restrictive rules that retard its innovation in exchange for protecting itself from the invisible stupid within. See Microsoft, see IBM, and see increasingly Google and Facebook as they turn to acqui-hires over internal expertise.

2\. It's nice to rant yet again about 20-year patent cycles, but when are we going to fix the copyright system? Or will we eternally be Mickey Mouse's beeyotch? At this point, I'd be happy with a Mickey Mouse Forever Amendment(tm) to the constitution if it would free up all the other copyrights.

3\. Working around patents is what clever people do best. Make more or import more clever people and you'll eventually get the companies that knock Google and Facebook onto their increasingly lethargic keesters. And free bonus, if you make more technically literate young adults, they'll have a lot less to fear from looming technological unemployment.

<comment><USER13> i recently was having a discussion about #1 with some folks. I'm not sure its about the competence fall off, i think it's the desire to draw on productivity gains by orienting themselves in a process-centric fashion, versus the original product-centric design. Process centric makes sense for specialization and squeezing productivity gains out (standardized tooling/platforms, bureacracy, layers of middle management to bring it all together). Product-centric makes sense for innovation, but its inefficient in the long-term (small teams, wide range of responsibility).

<comment><USER12> So unless you want your core talent to flee for startups and begin the cycle anew, one has to find a middle ground, no? The moonshots seem like a reasonable attempt to do so to me.

But perhaps that because I'm 100% progress-driven. Process drives me nuts. It's great to have someone who can drive your progress through the channels of process, but I find that talent exceedingly rare. That said, my best work has happened the few times I've found that magic combo.

</comment></comment></comment><comment><USER14> It's interesting he points to acquisition of patent portfolios of the big 3 (Apple, Amazon, Google) but no real mention of their defensive necessity given the current patent climate (vs using them offensively to sue competitors)

<comment><USER15> Seriously. This is possibly the most important comment in the thread. End software patents, restrict the use of other patents, and then watch the rate of portfolio expansion plummet.

</comment></comment><comment><USER16> Apple rolls out ad blocking because modern ads are hugely invasive and slow down the experience.

Those most impacted by this proclaim that big tech is too powerful. Throw in Google to skirt the thrust of the issue.

Color me unimpressed by the Times' "value-added" coverage.

</comment><comment><USER17> If there's anything I take away from this discussion, it is that I miss the days when technology was about technology and people where skeptical about big corporations rather than having some weird personal relationship with them. Things have overall gotten better and better for people that want to create rather than consume, but I'm not sure it's going to last. It's weird to me that people put forward disruption as something prevalent in the industry, but they assume everything will somehow magically only get better.

</comment><comment><USER18> OT, but important I think. It's interesting that the article title is

> Big Tech Has Become Way Too Powerful

but on HN it was changed into a question:

> Is Big Tech Too Powerful?

<comment><USER19> Take a look at the URL slug:

        nytimes.com/2015/09/20/opinion/is-big-tech-too-powerful-ask-google.html

It looks like they changed the headline on the website. The slug usually reflects the original headline and they don't want to change it later to keep links working. (I'm assuming this is the case here since I didn't personally see the original headline).

News sites are much too fond playing with their headlines to drum up hits, and with New York Times in particular I can't help but think of this quote from one of their editors:

        I often hear from readers that they would prefer a straight, neutral
        treatment — just the facts. But The Times has moved away from that,
        reflecting editors' reasonable belief that the basics can be found in
        many news outlets, every minute of the day. They want to provide
        "value-added" coverage.

source: [http://www.nytimes.com/2015/07/19/sunday-review/did- reddit-b...](http://www.nytimes.com/2015/07/19/sunday-review/did-reddit-boss- coverage-cross-a-line-ellen-pao.html)

<comment><USER20> That's awesome, the editors spitting in the face of their readers and the graves of their ancestors. It puts a clear point on what's wrong the Times, though: rich kid rambligs in a classic font.

</comment></comment></comment><comment><USER21> Consolidation of resources and broadness of ecosystem produces synergistic effects that advance tech. Google benefits in its pursuit of self-driving cars and drone delivery from existing investments in maps, AI, machine learning, and data centers. Plus, the ad revenue stream funds R&D.

</comment><comment><USER22> This is backwards. More of humanity is empowered to go into business and compete today than ever in history.

There are forces that level the playing field: Open source; Utility-Grade Internet services (where Google and Amazon compete head-to-head); cheap, ubiquitous connected computers; billions of Internet-connected customers...

It has never been easier for a couple of people to build and launch an app or online business and sell to the entire planet. If you consider anyone who has done this a 'business' I am skeptical that there are in fact fewer businesses being created.

</comment><comment><USER23> Big Tech is a total monster. But it's not the current Google, Apple, Amazon who are the monsters of Big Tech. It's the company being born today that will be the Big Tech of the future that will be the true monster. I'm not looking forward to it...

EDIT: Or maybe I am. Is it better to live in a cage if the cage is nice enough? Who knows. Humanity possibly just hasn't developed a good enough cage yet.

</comment><comment><USER24> The monopoly concern is legitimate, especially if the accusations against Apple, Google and Amazon have validaty in them. I think the real issue at hand is the bullying that is taking place for new entrants. Google arm restling a new entrant is like a child trying to wrestle with a boxer. There should be better policies in place to prevent frivilous litigations from tech giants.

</comment><comment><USER25> Unfortunately they are big enough to fuel a lot of the irrational valuation exuberance in the startup world as exiting to e.g. Facebook is a valid exit strategy instead of building a standalone (and profitable) business.

Besides, the giants diversifying into experimental R&D moonshot projects is a bad sign too. Shareholders should not support that and probably wont in the mid- to long-term.

<comment><USER26>
        Besides, the giants diversifying into experimental
        R&D moonshot projects is a bad sign too.

Isn't that how society gets technological advances?

<comment><USER12> So right now the moonshots are privatized and the liberals are unhappy about it. When the pendulum shifts, the moonshots will be publicly funded again and the conservatives will be unhappy. Takeaway: happiness is unattainable.

<comment><USER27> > the moonshots are privatized and the liberals are unhappy about it

I've never heard this take before, can you elaborate?

<comment><USER12> Really? IMO as a former Ph.D. academic who chose industry because there was no future there, science funding in America has dried up into a shriveled husk of its former self in an age of bottomless pockets for overseas military adventures and an educational system that isn't creating the next generation we need.

So we're left with mostly Elon Musk to carry the embers of our space program while Craig Venter, Google and a few other companies are increasingly taking on aging research, something I think will ultimately have enormous returns in the private sector. Just not in time for next quarter's results so David Einhorn (and his net worth of 1/40th that of Bill Gates) can go @#$% himself.

And for all the supposedly wasted public money on science cited by conservative sorts that got us here, it's trivial to find yet another dead-end weapons system or overseas military adventure that cost the taxpayers exponentially more.

To be fair, there is the Connectome Project ($100M annually) and also the Exascale Project ($126M) but those won't even cover the cost of a single F-22 fighter jet ($339M).

<comment><USER27> Does SpaceX have any contracts that aren't for the U.S. government? Aren't most of their aeronautical engineers former NASA employees? I'm sorry to get stuck on the Elon Musk side comment, but NASA is still doing really important stuff such as the Mars rover, comet landing, etc.

Defense R&D spending is way higher but nondefense spending is still keeping up with inflation [1]. There are some agencies who have had reduced budgets, such as National Institutes of Health, while DoE and NSF have enjoyed increased budgets. [2]

Overall I find your post hyperbolic and not consistent with the stats and figures. I'm assuming that your university's research was defunded and that's why you have adopted this world view. It's consistent with your experience but I believe that it doesn't represent funding in general.

[1] [http://www.aaas.org/sites/default/files/DefNon_1.jpg](http://www.aaas.org/sites/default/files/DefNon_1.jpg)

[2] [http://www.math.columbia.edu/~woit/wordpress/?p=5703](http://www.math.columbia.edu/~woit/wordpress/?p=5703)

<comment><USER12> I'd throw stupid money at NASA any day, just maybe not so much for manned exploration until it's cost-effective. We both want more space probes I suspect.

But from the above articles, I see two trends.

From (1) Nonmilitary science funding has been effectively flat for a decade while military research was increasing annually roughly until a year or so into the Obama administration.

From (2) and its responses, the money itself is being misallocated to the top (just like everywhere else) and also into a metastasizing tumor of administrators:

[http://www.bloomberg.com/bw/articles/2012-11-21/the- troublin...](http://www.bloomberg.com/bw/articles/2012-11-21/the-troubling- dean-to-professor-ratio)

And then there are articles like this:

[https://www.americanprogress.org/issues/economy/report/2014/...](https://www.americanprogress.org/issues/economy/report/2014/03/25/86369/erosion- of-funding-for-the-national-institutes-of-health-threatens-u-s-leadership-in- biomedical-research/)

[http://dellweb.bfa.nsf.gov/nsffundhist_files/frame.htm](http://dellweb.bfa.nsf.gov/nsffundhist_files/frame.htm)

which imply the NSF is relatively OK but that the NIH is increasingly underfunded relative to GDP, no?

It's not like we've cracked mortality, figured out our own minds, or even cured a whole bunch of nasty diseases yet.

</comment></comment></comment></comment></comment></comment></comment><comment><USER28> OT: This page loads the full article, flickers for a moment, and then hides everything but the first three paragraphs. Instead I see a button to 'Show the full article'.

What is the reason for this? I've seen this pattern in a few places and assumed it was to speed up mobile page loads. But seeing as it loads the full page before hiding it I'm now not sure.

<comment><USER11> NYT will let you hit any number of pages; your paywall quota is only consumed by those where you are interested enough to click "Show Full Article."

<comment><USER29> I do not think this is the case. I tested this out by clicking on several articles without hitting "Show Full Article" on any of them. On the first article, I was told I was reading 2 of 10 free articles. After 8 clicks I hit my quota.

</comment></comment></comment><comment><USER30> Maybe I'm missing something, but it seems to me that the OSS Movement in general is a response to the problems that this article is enumerating. And yet, there's no mention of open source in the NY Times article.

Perhaps a better-researched version of this article would merely lament that OSS hasn't been more successful than it has.

</comment><comment><USER31> The regulators come just when natural forces are eroding a monopoly - Microsoft, then Google, next Apple.

</comment><comment><USER32> I forget the context, but I saw someone (a writer for the National Review, I think) say this to someone:

You must be one of those people that think that airplanes fly not because physicists and engineers found a way to propel steel through the air, but because the FAA allows them to.

This reminds me of that.

<comment><USER20> It is fair to say that planes don't come crashing down much, because the FAA prohibits it. Private enterprise had a very low bar for safety, when left to its own devices.

</comment></comment><comment><USER33> >Contrary to the conventional view of an American economy bubbling with innovative small companies, the reality is quite different. The rate at which new businesses have formed in the United States has slowed markedly since the late 1970s. Big Tech's sweeping patents, standard platforms, fleets of lawyers to litigate against potential rivals and armies of lobbyists have created formidable barriers to new entrants.

Eh... nice try on that stolen base. The internet, which is what drives "big tech", wasn't really an economic force until the mid '90s. If business formation has slowed since the '70s it's more likely to be a result of rise of the regulatory state. You can't do _anything_ without a permit any more, something that wasn't true in 1970.

</comment><comment><USER34> "Big Tech" should told Big Media to piss off when content protection was first introduced. Then we'd have smaller attack surfaces and better business models.

</comment><comment><USER35> Totally unrelated, but it's nice to find another J. Rowley out there!

</comment><comment><USER36> I believe that Big Media is too powerful - unfairly promotes the interests of the establishment at the expense of the middle class.</comment>