Ask HN: Do web startups hire CS majors? - <AUTHOR>

Right now im a 1st year student at Cal Poly Pomona as a computer science major.  I have been interested in building web applications, however, there are no CS classes at my school that teaches web development.  I know i can learn it on my own (i know html, basic SEO, CSS, some php).  I was wondering if startups hire CS majors or should i switch to CIS, which has a few web classes related to the internet, but CIS is mostly buisness related from what i know about it. If startups do hire CS majors, what do they do? <comment><USER2> Having interviewed people fresh out of college for both web-startups and established companies, from my view the most important thing you'd need to know if you want to work in a web start-up are:

1\. how to get around a UNIX system (be comfortable with emacs and/or vi, know your shell, be able to install Apache/your favourite web frame _yourself_ on a machine

2\. know basics of TCP/IP networking (know how HTTP works, be able to debug it using telnet/netcat and tcpdump/pass through proxies)

3\. know databases (not just "SELECT Ajax FROM Php", but know about indices, joins and normalization/de-normalizations)

4\. or more dynamic languages (Python, Perl, Ruby, Php etc...) as well statically typed as object oriented languages (Java is common for enterprise web development)

These are really just the basics (give or take). Most of these (except for databases and dynamic languages) are a standard part of any CS curriculum. Databases course should be readily available as an in-major elective. Dynamic languages -- if not available as an elective -- should be easy to pick up as you go along.

These are also _very nice_ to have and would make you not look like a "PHP script kiddie":

* Understand how your OS works, at the least be comfortable using strace and gdb and digging around /proc and tuning sysctl/proc/kernel parameters

* Understand more about networks: more about DNS, know how a load balancer works (NAT)

* Know C/C++: that's what the extensions for your dynamic programming language are written in, that's what your web server/web proxy and database are (usually) written in.

* Know algorithms, data structures. Be able to do bitwise manipulation (e.g. how would you track on which day of a month a user visited a site?). Understand the advantage a message queue would provide, understand non-blocking I/O and threading/forking models.

* Know more about OO, meta-programming/reflection, functional languages -- be able to hack up your own ORM layer/ad-hoc MVC.

There are jobs in web development that don't even heavily touch HTML/CSS/Javascript and tend to be heavier towards algorithms, databases and UNIX hacking. These are called "back-end jobs". The other end is "front-end", which requires more familiarity with UX principles/Javascript/ActionScript/Flex and basic graphics design/layout in addition to HTML/CSS. The specific hot things (current frameworks, etc...) change but the general of computing is an invariant. The latter is what you learn in computer science classes.

Lastly, you should absolutely do programming/web-development for _fun_ \-- first, it's the way to learn things you won't learn in class (or at your first job). Secondly, many start-ups operate under the maxim of "don't hire anyone who doesn't code for fun", thirdly -- chances are, working for a web start-up won't make you a millionaire: if you don't find programming to be fun and worth your time (making long hours non-monetarily rewarding), enter a field that you _would_ (you're lucky to be amongst the few who has the chance to choose).

<comment><USER3> These are definitely good things to know, but I wouldn't necessarily expect a fresh-out-of-college 22 year old to know them all - I think you can pick them up on the job in the first couple of months/years.

The important thing is to be willing to learn and improve yourself, and to just have a natural talent for programming. Nobody expects you to hit the floor running in your very first job.

<comment><USER2> I knew most of these things at twenty two, coming out of college -- however, my case is slightly different -- I've been a hobbyist before and during college.

Nonetheless _all_ of the material I've described was offered at university I attended and getting a formalized training in the matter (particularly a rigorous mathematical approach to algorithms, data structures and formal languages/automata) definitely helped.

Nonetheless -- if one is motivated and disciplined -- they can pick these things up at a job (provided you get a job where the environment is conducive to learning, vs. one that merely expects you to crank out business logic 9-5) as well as entirely on their own.

<comment><USER3> I guess my experience is a bit different, since I was a math major.

Even in my first job, which was pretty much just cranking out business logic 9-5 I've learned a lot about databases, OO programming, UNIX and software development in general.

At the beginning you have so much to learn that even if you don't work for Google or Microsoft (they actually do a lot of non-trivial R&D) you will still probably be learning a lot.

</comment></comment></comment></comment><comment><USER4> You are simply conflating CS with programming, which is very commonplace.

Programming is the craft/art skill of manipulating digital code and data. Within programming you can learn about specific domains - for web apps that would mean databases, networking, a host of standard formats and protocols, and user interfaces. Many commercial programmers go their entire career focused only within one or two domains.

Computer science is the academic study of computation. As the rigorous curricula of today would have it, it is a more mathy endeavor than programming by itself. In particular there is a focus on provability and formality that doesn't come up in commercial programming.

Basically, stuff you learn in CS won't help you ship the ideal mix of features, stability, and time cost for (insert app here). What it will tell you is about a variety of methods with which you may approach the underlying computation problems and direct your own original research efforts.

<comment><USER5> _In particular there is a focus on provability and formality that doesn't come up in commercial programming._

I'd call tarsnap commercial, but it has involved proofs and formality. Right now I'm writing a paper which proves some properties about the efficient computability of functions -- because showing that these functions cannot be efficiently computed makes it possible to rely on them for security purposes.

Sure, tarsnap is unusual in the amount of cryptographic research behind it, but most interesting applications do _something_ new at least.

</comment></comment><comment><USER6> If startups hire CS majors, they code. CS at your college probably isn't pure theory, but rather closer to Software Engineering. And you can't expect college to teach you _everything_ that you'll need to know on your own.

Take this summer and spend it hacking on a project you find interesting. Learn a particular language (preferably one that your college _wont_ go over. Be it Haskell, Ruby, a Lisp variant, whatever) and learn it as well as you can in a few months.

Then when the next summer rolls around, you'll have two years of class + that summer building something on your resume. And that summer will help out a lot in terms of practical experience working on a project (as opposed to a 1-2 week assignment that you drop as soon as it's handed in for a grade).

</comment><comment><USER7> Just finished interviewing 5 programmers, all of them CS undergrads or grads, for my startup. (This might be a bit biased because CS majors were the ONLY ones we interviewed so far.) Two things occurred to me during the interview process: 1) CS majors have some formalized training in designing software, and 2) the most important part of their resumes was the experience/internships/projects section. Nothing can replace the work that is done outside of the classroom. Classes can't expect 40 hours/week of coding but real jobs can. So, initiate projects yourself or find internships that will actually utilize and grow your skills.

I am a sophomore in college, so take my advice for what it is. But, I wouldn't think I'm too far off from reality. Good luck

<comment><AUTHOR> Good advice. I think I will wait until I finish learning Java and C++ before looking for internships. Your a sophomore in college and interviewing people for your startup? I think im behind :(

<comment><USER7> Yeah like Zev said know something before you get there, but expect to rapidly learn new technology at your internship...that is the best way to impress and push forward in a job. I was hired a couple years ago to work on a company's employee portal, which started as sort of a joke because it was so rudimentary, but I learned the insides and outs of the existing software and quickly learned how to hack it (without using any real programming language). Within weeks my boss had me doing complex work flows/applications on the portal and paid me a pretty penny for it! Every internship will be different, but just try to be flexible with what you're given. My guess is this is what will impress potential employers the most, especially web startups looking for individuals who can think outside the box.

The interviews were actually slightly intimidating because most of the applicants knew more programming than I did! Cool experience though :)

</comment></comment></comment><comment><USER8> A good way to get a leg up:

1\. Do some jQuery tutorials and really bone up on flashy javascript.

2\. Learn to use any popular web 'stack' - LAMP is easiest on *Nix servers, RoR and Django are not rocket science. Nor is ASP for that matter.

3\. Go out and find a web designer, or yourself bone up on design and CSS

4\. Find easy contract work such needs basic web programming. Eg "install a picture gallery in my website" = $200/300/400.

5\. Move on up with the contract work or launch your own site.

6\. ???

7\. Profit!

If you do this through college (and I didn't start until my senior year, a deep regret), you will level up to the forefront of web programming by the time you graduate.

Also, now that web is mature - there are multiple paths to success. I think getting the Server Side Language/ Javascript/ CSS/ HTML loop right in your head is the most important. You can follow that up with MVC frameworks, Adobe Air, Silverlight there are at least 4 or 5 solidly "employable" paths you can take

</comment><comment><USER9> Have been working with Linux for over a decade. Had 9 interviews for a site reliability engineer role at Facebook here (which I gather is considered a startup until it becomes profitable or gets bought), before I got a 'no'. Interview that lost it for me was a guy (who'd just graduated college) presenting a page of math and telling me to write some Python to implement it. This wouldn't have been my job function, but I couldn't read the math = 'definite no hire' in Facebook speak.

Worked out better in the long run.

<comment><USER10> What kind of math? Just curious.

<comment><USER9> Literally this:

[http://upload.wikimedia.org/math/7/6/f/76f99713cf111eb035d90...](http://upload.wikimedia.org/math/7/6/f/76f99713cf111eb035d908228c351710.png)

What's being implemented is pretty simple to write with an English explanation. But my interviewer expected me to get it from the notation above.

It's been a decade since I left high school, and the programming in my career doesn't involve formulae. After a bunch of successful interviews I bombed on this question, and was never forgiven.

<comment><USER3> That's the Fibonacci Series. It would be hard for me to forgive anyone who wouldn't at least recognize it too, since it is so famous and is basically the classic example of recursion.

EDIT: seeing as this thread is about a CS major trying to get a job, this is also something that is taught quite early in a CS curriculum ;)

<comment><USER9> The job was as a system administrator, emphasizing troubleshooting and automation. The question wasn't job related.

I can handle Fibonacci when the problem is described, but a page of math means nothing to me.

</comment></comment></comment></comment></comment><comment><USER11> <http://code.google.com/soc/> maybe?</comment>


Devices being remotely wiped in police custody - <AUTHOR> http://www.bbc.co.uk/news/technology-29464889 <comment><USER2> > "We have cases where phones get seized, and they are not necessarily taken > from an arrested person - but we don't know the details of these cases as > there is not a reason to keep records of this," she added.

Christ, this is the real story. Police seize items that don't belong to a suspect, apparently aren't important to an investigation, don't give them back to the owner, and don't keep records about these items.

<comment><USER3> Well, they're English cops. No bill of rights.

<comment><USER4> heh. quaint comment. america is actually the most liberal (ie less protection from the gov to common people) of the developed countries.

no matter how much your politicians and hollywood tries to sell it as freedom paradise

<comment><USER5> "less protection from the gov to common people" is a liberal ideal?

<comment><USER4> all those "less laws" and don't "tell me what to do" has its consequences.

you will find out it works both ways.

<comment><USER6> No, and in fact I think you are severely confused.

</comment></comment></comment></comment></comment></comment><comment><USER7> As the article makes clear, they're just incompetent. However police-types seem to be very conservative by nature which can lead to a very technophobic workforce.

It is pretty surprising how slowly police are changing with the times. You'd expect every major police force to have a "computer crimes" division, but they don't. Only really the MET (London's police force) has a decent computer crimes division.

You often read about digital crimes (e.g. harassment, theft, fraud, etc) going completely uninvestigated because of how few "digital police" they have (e.g. 1/1000th the size of the officers investigating physical crimes).

As a specific example, for almost a year when you Googled "UK passport renew" the first Google adword result was an obviously fraudulent one, yet nothing was done even though they had to have known about it.

PS - I bet you could use Tasker (or a similar app) to wipe your phone if it didn't regain data access for a long period of time (e.g. 6-12 hours). So if they took your phone and shoved it into a bag, the phone still auto-wipes if they fail to turn it off.

PPS - Although realistically you're best not storing the data on your phone at all. The UK police can force you to give up your encryption keys, however they would struggle to get your data off of a foreign owned-operated website.

<comment><USER8> In the US, I think the main issue has to do with most Police Departments only requiring a High School Diploma as an education requirement. I've had internships with Gov't agencies and volunteered at local PDs and it's a very common thread that a large portion of the workforce is computer illiterate. Sure higher education doesn't necessarily mean people will be proficient with computers but at least they will have exposure and familiarity. Also the people who make the decisions (higher ranking officials) are usually older and also phobic of technology.

<comment> mark-r It's worse than that: some police departments will actively reject you if you're too smart. There are lots of stories about this which you can find with a quick search, including this one where someone was dismissed and lost their court case: [http://abcnews.go.com/US/court-oks-barring-high-iqs- cops/sto...](http://abcnews.go.com/US/court-oks-barring-high-iqs- cops/story?id=95836)

</comment></comment></comment><comment><USER9> The comment about putting devices into a microwave is false.

If the microwave is from the 70's it will work, otherwise it will not.

Don't believe me/want to downvote me? Put your cell phone in the microwave and call it from a land line...

<comment><USER10> I've tried this over the past few months with a number of different microwaves because we wanted to know if the microwave would function as a Faraday cage... we tried it with every cell phone in the house, we also tried it with the cordless land phone. It didn't work. My conclusion is that a modern microwave will not function as a Faraday cage [Edit for clarity: for communications equipment (WiFi, Cellular, Home Phone etc.)] - I realize that may be painting with a broad brush, perhaps some of them will, but those I tried did not.

If someone has tried this successfully with a modern microwave, it would be useful to know what cellular/radio devices they tested and what make/model/year of microwave they used for their tests.

<comment><USER11> Microwave ovens most definitely function as faraday cages, however they are specifically designed to attenuate 2.4GHz signals. Anything higher or lower which isn't a harmonic (integer multiple) of 2.4GHz is going to experience much less attenuation.

</comment></comment></comment><comment><USER12> My takeaway was that somebody is selling a hard drive that will wipe itself if you go through a tunnel.

<comment><USER3> You'd figure the timeout would be pretty long, 4 hours or so.

<comment><USER13> Right. Whenever evidence is collected, it's not going to be thoroughly analyzed/saved/etc right away. Especially not in a thoroughly sealed environment.

Just an hour - 2 hour long timeout would be sufficient.

</comment></comment></comment><comment><USER14> > pop it in a microwave oven

Just popped my phone in the microwave oven. Was able to receive a call on 2G as well as 3G.

<comment><USER3> Huh.

I seemed to recall that Snowden made guests put their phones in the refrigerator, which is the same principle. So I went and tested my phone in on the work fridge, and you could still make calls to it.

Filing cabinet, ditto. Mylar antistatic bag, (which has a conductive layer, though not very conductive) ditto.

Tried some conductive fabric, which we sell for e-textiles stuff, and which the manufacturer's datasheet advertises as providing some 85dB of RF attenuation, and sure enough I couldn't call my phone anymore.

<comment><USER15> I assumed the fridge was more about "make sure the microphone can't pick up anything from outside" than blocking radio signals.

<comment><USER16> Yeah I think Snowden said that himself. It was about microphones mostly.

</comment></comment></comment></comment><comment><USER17> Interesting article. I didn't realise "romance fraud" was a thing.

<comment><USER18> It's an odd term, but I think what they mean is contracting non-romantic marriages in order to immigrate into the UK.

<comment><USER19> [http://en.wikipedia.org/wiki/Romance_scam](http://en.wikipedia.org/wiki/Romance_scam)

</comment></comment></comment><comment><USER20> From the article: "A spokeswoman for Dorset police told the BBC: "There were six incidents, but we don't know how people wiped them."

You'd think the police would know that some smartphones have a remote-wipe or kill-switch feature: it's something they'd tell people who report their smartphone stolen.

</comment><comment><USER21> Article provided courtesy of SecureDrives

<comment><USER5> No...

</comment></comment><comment><USER22> This reminds me of a movie scene in Breaking Bad where they remotely "wiped" a laptop's content. Guess that's plausible now.

</comment><comment><USER23> "The hard drive is constantly looking for GSM [Global System for Mobile Communications] signals, if it is starved of them it it would destroy itself. It would see such a bag as a threat," said James Little, head of sales at SecureDrives"

Don't take your laptop on the subway!

<comment><USER24> Yeah, have fun shipping it, or since there are for the military, in a bunker, airplane, submarine, desert base...

</comment></comment><comment><USER25> Maybe slightly off topic, is there a program that would allow me to remote wipe a system if one gets stolen? Or automatically wipe out a system if it has not communicated with a central server for a set amount of time?

<comment><USER16> Hmmmmm neither Windows nor Mac OS allow for this, mostly because neither system can ensure a complete destruction of the partition its located on. However, there are plenty of laptops on the market(high-end Dells, Lenovos, HPs) which have built in GSM modems which can be issued a command remotely to wipe the hard drive.

</comment></comment><comment><USER26> >If we can't get to the scene within an hour, we tell the client to pop it in a microwave oven

Doesn't just switching it off achieve the same thing?

<comment><USER27> switching it off might activate drive encryption

</comment></comment><comment><USER28> Is it even possible with the battery taken out?

<comment><USER18> iPhone batteries are not easily removable.</comment></comment>


Ask HN: How do you build a healthy code review culture? - <AUTHOR> I'm currently working at a startup that has a very bad code review culture. People either treat design/coding-style comments as annoying or not respect them at all. Needless to say, the code base is beyond shitty and new developers are finding it tough to understand the logic and figure out why the code is doing what its doing. I started out by suggesting minor design changes, better abstraction into classes and functions, defining clear interfaces between different components, but most of the time no one respects or even responds to those comments which makes me paranoid that my comments are probably stupid.<p>How do I turn this around and build a healthy code review culture? <comment><USER2> People get precious and personal about their code. They do. Some of them take any critique very personally. Some of them have a tantrum, some of them just ignore anything anyone says. Programming ego is a real problem.

A couple of jobs ago, I worked somewhere with an excellent code review culture, and it began with a simple, written standard, very small, that everyone had agreed to. I now refuse to review code unless I am able to say "This code doesn't conform to the document you agreed to; it's not that _I_ think this is bad code, it's that it doesn't meet the document that you agreed to." If there's no document to point at, no objective standard to meet or not meet, I'm not reviewing it because it's just not worth the tantrums and screaming from precious programmers.

There also need to be consequences for code that doesn't meet the document; basically, it's not ready to merge/commit until it does. There needs to be a way to allow code that violates the standard to be waived and permitted, with agreement from the developer and reviewer, with the waiver recorded so the developer feels listened to and the reviewer feels protected.

You're going to have to get buy-in for this from someone with power and authority.

<comment><USER3> "If there's no document to point at, no objective standard to meet or not meet, I'm not reviewing it because it's just not worth the tantrums and screaming from precious programmers."

What about rules for less objective things like how readable a function name is though? If someone wants to be difficult addressing code reviews, there's always plenty of subjective feedback they can do this for.

<comment><USER4> The Google c++ styleguide[0] has some examples, in general and specifically for files, functions, etc. Looking over them most are pretty objective so maybe it's worthwhile to come up with some usable rules that enforce qualities you notice readable code shares, even if they aren't completely comprehensive.

[0] [https://google.github.io/styleguide/cppguide.html#Naming](https://google.github.io/styleguide/cppguide.html#Naming)

</comment></comment></comment><comment><USER5> Code reviews shouldn't dwell on style issues that can be handled by linting. To the extent that you can automate some of the review process, and prevent sloppy commits from being merged in by having them fail CI, you'll eliminate part of the problem. Another thing that helps is reducing the semantic distance between what a commit message says a commit does, and what it actually does. This is pretty easy to enforce relative to more subjective aspects of coding. The last thing that can make a big difference is not getting hung up on wanting to rewrite a commit as you would have written it, but focusing on improving understanding and clarity for whoever will inherit the code next. If there are serious issues with the architecture and patterns the code is using, CR can be too late in the process to address them effectively (depends on the scale involved). I'd try to collaborate with other engineers earlier in the process to help set them on the right path.

</comment><comment><USER6> I am working in a team where code review are mandatory, but this was not so hard to implement because they are part of regulatory requirements.

Your culture change is a problem of change management[0]

There are different model, but some example of actions, are :

* finding a sponsor

* creating a common vision of the end result and benefits, communicate it

* identify early adopters to deploy it with them

* identify people resistant to change (and why ? Is there a way to convince them ? [1])

* communicate your early success

Most of it is basically common sense, but it is good to have a kind of check list to help you establish your plan.

One thing that is important, because it is otherwise frustrating, you have to lay out very clearly what are the "coding rules" and what the code reviewer will actually check up front. If the "contract" is clear, it is easier to follow it.

The most annoying situation is written a whole bunch of code and having to rewrite everything.

[0] [https://en.wikipedia.org/wiki/Change_management](https://en.wikipedia.org/wiki/Change_management)

[1] for example, a human tendency is to resist change because a fear of loss of power. So using that you could decide that the guy that is more resistant to change will actually be the one responsible for doing a fair share of code review.

</comment><comment><USER7> We do a combination of things already mentioned here at work.

First, we have git hooks that prevent code that doesn't pass certain standards from even being committed. Mostly, that's stuff like PEP8 and eslint, but there are a few other automated checks.

Second, we require at least one other person to review and leave a comment that says the code is acceptable to merge. Anybody can look at anybody else's pull request, and anybody else can block a pull request from being merged if they feel it is necessary. These things are also enforced by automated tools.

Finally, we have CI tools that not only run our extensive test suite (which must pass before a PR can be merged), but also re-run the linting checks.

I've never seen anyone get defensive about a comment on their PR in this environment. The result isn't perfect code (there are still some hairy spots in our code, but when one has 300K+ LOC, one expects that), but it's rarely very bad, and that's the point.

</comment><comment><USER8> I worked at a company that started having code reviews. We started off by just "presenting" code to the team. The team would point out any thing that looked like a bug or areas that required extra QA effort. Just knowing you would have to present your code was enough to increase code quality. We didn't worry about style/best practices/subjective feedback at the beginning. Over a few months we all became more comfortable receiving and giving feedback and that's when we started to solidify the style guidelines. Also our ability to catch bugs without QA cycles helped increase buy-in for code reviews.

</comment><comment><USER9> Does management understand the benefits of a healthy code review culture? Managers often support code review in the abstract, but when faced with an actual decision between respecting code review or shipping a feature faster, they'll choose to ship faster. Your colleagues are probably just responding to this.

</comment><comment><USER10> I kinda like reading stuff like this online. It reminds me that I (and my colleagues) are doing this stuff extremely well.

The only way to change your culture is to draw up standards and then fail any code review that does not meet the standards. Nothing goes live until it passes code review.

</comment><comment><USER11> if you need to get heavy handed about it, people are probably going to leave. Which may be a good thing, since you shouldn't have to get heavy handed about simple things like styling.

I'm a big fan of strong linting where failure to pass linting will fail the build.

The general reason why I feel that way isn't anything to do with readability but because linting can teach you what NOT to do and make you a better programmer.

Code reviews shouldn't be "move this comma" let linting handle that.

Code reviews can then be more "is what this is doing sensible, are the test cases covering the change, and (possibly most importantly) do I understand how this changes the application"

</comment><comment><USER12> at this point, you have to ask that specific question directly to either the team, the leader, or management and ask them why they don't look at the comments.

</comment><comment><USER13> When I was a young programmer, all the code I looked at was awful. If there was a different format indentation, that distracted me. All I could think about was code format and superficials.

I worked at Ticketamster 1990-1996.

I went back in 2003. I remembered my first assignment. In 1990, the Linker at Ticketmaster that Troy wrote ran out of room because the MAP file grew too big.

In 2003, I went back a found a terrible kludge that I did in 1990 because I was stupid. In 2003, I fixed it correctly. I looked at the code and thought how beautiful it was. In 1990, I thought the code was bad.

As you get more experience, it is a little easier to read code. Take my word that all code is bad, LOL.

Personally, I don't like code that is made of 5-line functions with no rhyme nor reason spread seven levels deep.

Somebody said the smaller your functions the better. Bad advice.

God says... helices mists gewgaw's specced mesdames Lyndon's favoritism's fable's unequal apportions radioactivity's besoms thicknesses cordoned towel's spryer bobcat's suppressed Petra windscreen neckline overproduce meridians cartons prophylaxis's shoestring's retrospection's flubs amen thatcher bombshells cantankerous</comment>


Fed Tapes - <AUTHOR> https://www.propublica.org/series/fed-tapes <comment><USER2> It looks like you want to move to africa. Please have a look at my post :)

[https://news.ycombinator.com/item?id=21388166](https://news.ycombinator.com/item?id=21388166)</comment>


SOPA Vote Delayed - <AUTHOR> http://www.wired.com/threatlevel/2011/12/sopa-vote-delayed/

<comment><USER2> Delayed... till Wednesday.

I can hear the glass that was the internet shattering from the future.

Mike Masnick: Update.... Or not. Despite the fact that Congress was supposed to be out of session until the end of January, the Judiciary Committee has just announced plans to come back to continue the markup this coming Wednesday. This is rather unusual and totally unnecessary. But it shows just how desperate Hollywood is to pass this bill as quickly as possible, before the momentum of opposition builds up even further.

[http://www.techdirt.com/articles/20111216/11102617108/sopa-m...](http://www.techdirt.com/articles/20111216/11102617108/sopa- markup-runs-out-time-likely-delayed-until-2012.shtml)

<comment><USER3> I'm actually trying to get a Congressional Gallery pass for Wednesday, to see the session in person.

Although it looks like if I do, I can't live-blog/tweet it, as you can't bring anything electronic into the gallery. That makes watching it on CSPAN a little more appealing.

</comment></comment><comment><USER4> Or not [http://www.techdirt.com/articles/20111216/11102617108/sopa-m...](http://www.techdirt.com/articles/20111216/11102617108/sopa- markup-runs-out-time-likely-delayed-until-2012.shtml) "Or not. Despite the fact that Congress was supposed to be out of session until the end of January, the Judiciary Committee has just announced plans to come back to continue the markup this coming Wednesday. This is rather unusual and totally unnecessary. But it shows just how desperate Hollywood is to pass this bill as quickly as possible, before the momentum of opposition builds up even further."

</comment><comment><USER5> Can I express shock for a moment: first, Mike Lee voting against the defense appropriation bill, then Jason Chaffetz moving to put this on hold. I'm so used to Utah politicians like Hatch and Bennet that it is incredibly surprising to be proud of my state's representatives for a change.

</comment><comment><USER6> Just to note that the provision granting immunity to banks who pre-emptively blacklist "illegal" sites also breaks the contract law system...

The next step is will be... robbers are allowed to break into anyone's house and take their money - well as long as the robbers "think" the people are terrorists/counterfeiters/bad-people... (and as long as the robbers are ... cops).

<comment><USER7> _The next step is will be... robbers are allowed to break into anyone's house and take their money - well as long as the robbers "think" the people are terrorists/counterfeiters/bad-people... (and as long as the robbers are ... cops)._

Uh, that was the previous step: <https://www.google.com/search?q=asset+forfeiture>

<comment><USER6> Correct... I just couldn't think of any further next-next steps...

</comment></comment></comment><comment><USER8> I'm no expert, but this really sucks that we've reached this point. Can we just come up with a better bill? Why does it have to be this one that every media corp wants to go through.

<comment><USER9> We don't need a better bill. There's no reason to create any new internet piracy bill. We already have a copyright act, and the DMCA, and international treaties on intellectual property rights.

SOPA doesn't make anything that isn't already illegal illegal. It just creates new ways to shut down anyone the film and music industries want to shut down, without even having to prove infringement. It has no public support because it's a ridiculous, unneeded proposal.

SOPA should simply be voted down and the congress should move on to some real business, not creating new laws at the behest of their campaign contributors.

<comment><USER8> Thank you so much for clearing that up with me. I do agree with corporations having the copyright act and the DMCA to protect their intellectual property rights.

</comment></comment></comment><comment><USER10> Is the fact that Google and Facebook alone are worth more than the combined market capitalization of the entire entertainment sector getting any play in this discussion?

[http://www.wolframalpha.com/input/?i=entertainment+industry+...](http://www.wolframalpha.com/input/?i=entertainment+industry+market+cap%2F+%28google+market+cap+%2B+80+billion%29)

</comment><comment><USER11> Did Congress just realize they could manufacture a few extra days for the media companies to bump up their contributions?

</comment><comment><USER12> even if the security claims are "overstated," that's about the only argument that congressmen have paid attention to. If I was a congressman who only worried about getting re-elected, I certainly wouldn't want to be known as one of the men who "voted to censor the internet" by my opponents next election.</comment>


A man, a mop, a year, and an app - <AUTHOR> http://thestartuptoolkit.com/blog/2011/12/a-man-a-mop-a-year-and-an-app-joseph-hill-on-aeir-talk/ <comment><USER2> Disclaimer: I own the development company that built Aeir Talk for equity.

If there's anyone who can be labeled a "hustler", it's Joe Hill.

First, he had to sell us on the idea - we get a _ton_ of people who want us to take equity stakes in lieu of cash, and we almost always turn them away. But not Joe. He had tapped the few investors in our area (Hampton Roads, Virginia) and came up short. Our area is pretty conservative, and investing usually is restricted to real estate and other safe bets. But we heard him out and realized that even though he had no business background, no history of successful exits, or any other factors that mitigate risk, he had passion and an amazing story (along with board positions in a few autism societies).

He partnered with EVMS, a local medical school, along with a few speech pathologists with one goal: to bring Apple-like simplicity to medical products. He took the graveyard shift at a local Marriott, and managed to support his wife and two special-needs children WHILE working out of our office during the day.

He launched his app last month at Start Norfolk, a regional startup weekend we put together. If you really want to be inspired, check out the launch video: [http://www.youtube.com/watch?v=W2WLc1LszZ0&list=UUdXCw6_...](http://www.youtube.com/watch?v=W2WLc1LszZ0&list=UUdXCw6_wPeDrjjwhdj25img&index=5&feature=plcp)

<comment><USER3> > He took the graveyard shift at a local Marriott, and managed to support his > wife and two special-needs children WHILE working out of our office during > the day.

He is undoubtedly a hustler, but above all he sounds like a great man.

<comment><USER4> Agreed.

</comment></comment></comment><comment><USER5> Disclaimer: I am the founder of Aeir Talk. Thanks to all who have read the article so far. It's a great joy to see Aeir Talk be so well received and see that it helping a lot of people. Feel free to reach out if you want more information, also the app is at aeirtalk.com if you want to see it. Thanks again everyone.

<comment><USER6> At what age/level did the therapists find this helpful? My son is currently in autism therapy I have noticed therapists using polaroids so I can see where this would be useful.

<comment><USER7> To be honest any age group can use this. You can make the flash card's as hard or as easy as you want. One of our customers purchased the app for her 14 year old child. You can read her son's reaction here: [http://hamptonroads.com/2011/12/chesapeake-father-creates- ap...](http://hamptonroads.com/2011/12/chesapeake-father-creates-app-navigate- autism)

We are brand new but the feedback I am getting from therapists working in the age group 18 months - 10 years and in the moderate to severe category of Autism. Older children with higher ranges of Autism are still using the app. Rather than words however, they are using it for social interaction (learning visual and emotional cues) through the flash cards.

</comment></comment></comment><comment><USER8> Pleasant surprise waking up to see this as the top story on HN. I work with We Are Titans (the company that developed Aeir Talk in exchange for equity) and did most of the technical development (along with @nickmjones) on what became the final product. Feel free to ask or reach out if you've got any questions about that side of things.

</comment><comment><USER9> This actually seems like a much bigger market than just autistic children. I would imagine that many parents that have iPad-crazed kids would would gladly give their kids an app to learn new words instead of Angry Birds. A child would probably be more interested and learn faster if it was Mom's voice talking instead of a robot.

Another interesting case that comes to mind is how Clay Christiansen, author of Innovator's Dilemma, used Rosetta Stone to practice speaking again after having a stroke.

I would imagine too that you could scale pretty quickly by allowing users to create Flashcard sets, and then other users can buy the flash card sets and rate them. This could turn into a crowdsourced Rosetta Stone pretty quickly.

<comment><USER2> The iPad 2's onboard camera and microphone make it perfect for personalized flashcards. Aeir Talk, while built for special-needs kids, could be used as a flashcard app for any child.

My 3 year old uses it and loves it. Instead of simple clip art of a cat and a robotic reading of the word, we're able to take a picture of our cat Tobi accompanied with mom's voice.

</comment></comment><comment><AUTHOR> Regarding the site slowness: A while back, I changed the blog from a subdomain to a directory and didn't update the caching. It was caching pages at the wrong URL and thus being entirely useless.

It's fixed now -- sorry for the annoyance to anyone who got held up.

</comment><comment><USER10> As an cofounder of a startup and an aunt of a autistic nephew, I am inspired. Thanks for a great way to start may day smiling and motivated.

</comment><comment><USER11> This is invaluable for anyone trying to raise a bilingual child. Big, big thanks to the developers!

</comment><comment><USER12> Bump! This is awesome!

</comment><comment><USER13> Am I the only one to have read/noticed: "My background is in bible theology. I went to school to be basically a history teacher." and instantly tensed up??

<comment><USER14> Are you worried that he would try to teach things like young-earth creationism etc?

<comment><USER13> Afaik bible theology and history are two completely separate circles on the venn diagram, one completely based on evidence the other completely on the lack of evidence and entirely on faith/beleif? How did this get so far off topic?

<comment><USER15> You started an off-topic thread. This is the second thread I've read on HN this morning that is judgmental of others religious convictions. Why even focus on it?

<comment><USER13> OP was quoting the article, about as on topic as you can get! I am never judgemental of others religious convictions, people are obviously entitled to believe what they want, however I would expect someone with a background in mathematics to teach mathematics, someone with a background in history to teach history, someone with a background in science to teach science and someone with a background in bible theology to teach R.E. (religious education)! I cant help but wince every time I hear a story about a deeply religious person becoming a teacher to teach biology or history! Especially in america where some already dispute the "theory" of evolution and refuse to teach it in schools!

<comment> k-mcgrady Just because somebody believes in religion does not mean that they do not believe in science. And because someone believes that God created everything does not mean they do not believe in evolution. It is perfectly fine to believe in both.

<comment><USER16> Fitzgerald: "The test of a first-rate intelligence is the ability to hold two opposing ideas in mind at the same time and still retain the ability to function."

Hitchens: "Some people say it's a sign of intelligence to be able to keep two contradictory ideas in your head at the same time, and it can be a sign of intelligence. It can also be a sign of stupidity, or of unwillingness to make up the mind."

Take your pick.</comment></comment></comment></comment></comment></comment></comment>


Tesla goes up in flames in video captured by actor Mary McCormack - <AUTHOR> https://www.theguardian.com/technology/2018/jun/17/tesla-fire-video-mary-mccormack-california <comment><USER2> Is this news because its Tesla?

"On average, 31 highway vehicle fires were reported per hour. These fires killed one person a day. Overall, highway vehicles fires were involved in 17% of reported U.S. fires, 12% of U.S. fire deaths, 8% of U.S. civilian fire injuries, and 9% of the direct property damage from reported fires. "

[https://www.nfpa.org/News-and-Research/Fire-statistics- and-r...](https://www.nfpa.org/News-and-Research/Fire-statistics-and- reports/Fire-statistics/Vehicle-fires/Vehicle-fire-trends-and-patterns)

<comment><USER3> Probably because of ratio of count by vehicles maker to incidents.

</comment></comment><comment><USER4> Electrek has a longer video in their article: [https://electrek.co/2018/06/16/tesla-model-s-battery-fire- in...](https://electrek.co/2018/06/16/tesla-model-s-battery-fire- investigating/) The fire looks like some high pressure gas burning to me, with the flames violently exiting to the left. If you watch the longer video, this is mostly over by the time the firefighters arrive.

This could point to the fire being not in the battery, but the AC unit, which is in the front of the vehicle. Modern AC units contain flammable chemicals and when operating would be pressurized.

<comment><USER5> Automotive AC units use HCFC/HFC gases not HC, HCFC/HFC are not flammable.

If Tesla used R-290 or R-600 (propane and iso-butane) refrigerants in their AC they are well idiots and there is little chance that this would've passed regulation.

The video you linked looks just like batery venting.

[https://youtu.be/WnZuMfq6kec](https://youtu.be/WnZuMfq6kec)

<comment><USER4> At least in Europe, the traditional refrigerants have been banned because of their impact on the ozone layer, and currently some car manufacturers are using R123yf, which is flammeable. I don't know what Tesla uses.

<comment><USER5> R1234yf is an HFO and it isn't practically flammable it's classified as a mild flammable material and even that's a stretch.

>"Although the product is classified slightly flammable by ASHRAE, several years of testing by SAE proved that the product could not be ignited under conditions normally experienced by a vehicle. In addition several independent authorities evaluated the safety of the product in vehicles and some of them concluded that it was as safe to use as R-134a..."

As far as Europe goes "traditional" referigerants are not banned they can be restricted depending on the industry and usecase. HFOs are used by a few car manufacturers and ironically this isn't even an EU thing the US started using it first iirc GM was the first as these HFOs are produced by Honeywell.

HFC and HCFC are commonly used in Europe.

Also it's important to note that Daimler and BMW specifically stated that they will not use R1234 and Daimler even recalled the Benz's that used it. They claimed it's unsafe and flammable but the actual reason was most likely the cost that Honeywell and DuPont enforced on manufacturers. IIRC not only was that R1234 was more expensive Honeywell and DuPont also had patents issued on the evaporators that need to be used in conjunction with this refrigerant.

</comment></comment></comment></comment><comment><USER6> If need be, Tesla will come out with a huge report at some point adding up the _so many more_ incidents and faults of other car companies out there that happen every week of every month of every year, to remind people how unfairly Tesla are being singled out (for every damn incident that happens) just because they're the sexiest car company in the world.

It's good though to end the false perception that Tesla is the pure stuff of world-saving unicorns. Sorry Elon those times are over. Just get to work and do your best to achieve the goals you've set out in public. I sure don't want you to stop.

</comment><comment> martin-adams As the owner of a Vauxhall Zafira which has 2 recalls to fix an issue of catching fire, it is very important to make sure any manufacturer has swiftly and addresses the issues. Vauxhall dragged its feet in publicly recognising the issue which ultimately caused them a lot of negative press and a criminal investigation. I want a Tesla someday, but do pay attention to how they respond to such issues.

</comment><comment><USER7> Ah, I see Mr. Musk is surreptitiously testing those rockets that are to grace the new coupe in the near future.

</comment><comment><USER8> And ?

<comment><AUTHOR> If it's big enough news to be covered by The Guardian (a major "serious" news outlet here in the UK) it seems it may be of interest given Tesla tends to be closely followed on this board. A car catching fire for no apparent reason while driving normally in traffic in an urban area could point to an important problem, do you not think?

<comment><USER9> The cause of the fire is important, I think. Logs state something that could suggest a battery issue, but without more information, it's hard to draw any conclusions.

Also, statistically speaking, it's hard to draw any conclusions. IMO this article preys on our biases, and people may draw the false conclusion that Tesla are inherently less safe, due to this single reported incident (regardless of the actual occurrence rate).

</comment></comment></comment><comment><USER10> integrated flamethrower</comment>


Ask YC: How important is it to make your domain defensible? - <AUTHOR>

If you can get the .com how important is it to have the .net and .org as well as domains for potential competitors and defensive domains like companynamesucks.com? <comment><USER2> For the $10 it costs you to register another domain, I'd say it's worth the price to get the .net, .org, and possibly some European/Asian domains if you can see yourself doing business there in the future. I wouldn't go into companynamesucks.com and the like though - there's no end to the number of such domains that people can come up with if they really want to hurt you. A better use of your time and money would be to make sure you don't give customers a reason to say you suck...

</comment><comment><USER3> I put worrying about this (and paying for lesser domains) in the pointless waste of time and money box. It's more important to test ideas fast and cheap than to protect a non-business from unlikely squatters. Who goes to the .org site first? No one whose business I'm worried about losing. The investment has zero return, and protects you from nothing if you have the .com. I changed names 4 times for my last idea; I'm very glad I never bought the variant domains.

Edit: On top of the reasons above--if you get to the point where you've trademarked your name and succeeded, I think you can kick people off the squatter domains through legal means.

</comment><comment><USER4> You can't guess all the possible alternative names for your site, and for your enemy site. Drop it.

</comment><comment><USER5> I'd say it depends on how big your idea is and how much capital you have to start with...

</comment><comment><USER6> I'm not doing it.</comment>


Advances in AI are used to spot signs of sexuality - <AUTHOR> https://www.economist.com/news/science-and-technology/21728614-machines-read-faces-are-coming-advances-ai-are-used-spot-signs <comment><USER2> Discussion here (although this article is better IMO): [https://news.ycombinator.com/item?id=15197287](https://news.ycombinator.com/item?id=15197287)

<comment><USER3> Also: [https://news.ycombinator.com/item?id=15198997](https://news.ycombinator.com/item?id=15198997)</comment></comment>


NeuroOn, the smart sleep mask: not a medical device, but better than a coin toss - <AUTHOR> https://alxd.org/neuroon-analysis-results.html <comment><USER2> Amazon marketplace, kickstarter, and etsy have unleashed a FIREHOSE of pseudo- medical products (And other consumer products) that review systems and regulators are just not equipped to handle.

A startup that I wish would happen would be a truly NON biased review organization - eg consumer reports but for the internet age.

Not just a consumer reports as digital first but an organization that is able to respond to the deluge of new products & product claims we see as consumers.

We were recently trying to buy a foam mattress and immediately got sucked into this huge vortex of misinformation to the point that I just gave up.

On the one side you have "mommy bloggers" yelling "tempurpedic offgasses give you CANCER!" and linking to a group of similar non-scientific studies.

On the other end is a group that says "latex is the only all natural foam!!!!" but then links to amazon products made in Thailand / etc full of mispellings / no oversight / etc.

Or the recent expose of how truffle oils (1) don't actually contain truffles.

It's insanity!

Clearly the FTC isn't the solution @ this point to oversee consumer protection.

(1) [https://news.ycombinator.com/item?id=12453103](https://news.ycombinator.com/item?id=12453103)

<comment><USER3> I'm actually working on exactly this currently. It's called Praisee. We're trying to focus just on the review and product decision making side of things, with a heavy emphasis on community, trust and personalization.

Amazon is not a reviews service, nor is YouTube, yet this is where people turn. Nobody else seems to be taking the issue seriously, so we are.

The hardest part of building something like this is the chicken and egg problem, which is why I don't think there exists a good service for this yet. It's actually really hard to find a group of trustable product reviewers who stay engaged. People don't buy reviewable things that often, so you need another hook to get them to come back and sustain the ecosystem. This has been the hardest part of getting traction for our startup.

We're working hard on the problem. Hopefully you'll hear more about us soon.

<comment><USER4> > It's actually really hard to find a group of trustable product reviewers who > stay engaged.

There's a ton of bloggers and paid reviewers: [http://www.productreviewmom.com/2013/11/how-to-become- produc...](http://www.productreviewmom.com/2013/11/how-to-become-product- review-blogger.html). All you need is a way to aggregate the one or two complaints / solid facts per review while filtering out all the fluff promotion verbiage. Mining truth, in other words.

<comment><USER3> It's an interesting idea. I'm not sure if that information is usually structured enough to distill objective facts and criticisms. Are we talking about using NLP to pull out those details? I think the tech might not be quite there yet, but maybe there's a better way that I'm not familiar with.

<comment><USER4> Yeah, NLP. I was thinking of a version of [http://newsblaster.cs.columbia.edu/](http://newsblaster.cs.columbia.edu/) (now open-source: [https://github.com/kedz/newsblaster](https://github.com/kedz/newsblaster)). That code doesn't use sentiment analysis or word/phrase vectors so there's significant room for improvement by borrowing ideas from other research. Of course, the amount of improvement is uncertain, so I'm not sure if it translates into a startup per se.

It's probably lower-risk to target a specific segment and do in-depth reviews, e.g. [https://examine.com/about/](https://examine.com/about/) is apparently quite profitable ([http://www.solorwell.com/examine-com-is-grown- up-700000-in-t...](http://www.solorwell.com/examine-com-is-grown-up-700000-in- the-past-year/)), and Grokstyle is doing interior design ([http://www.ldv.co/blog/2016/5/30/grokstyle-wins-ldv- vision-s...](http://www.ldv.co/blog/2016/5/30/grokstyle-wins-ldv-vision- summit-2016) [https://www.cs.cornell.edu/~sbell/pdf/siggraph2015-bell- bala...](https://www.cs.cornell.edu/~sbell/pdf/siggraph2015-bell-bala.pdf)). But that sort of site will never cover everything, or even a significant fraction of products, so there's lots of room for value-added reviews. I envision a site like [https://reviewmeta.com/](https://reviewmeta.com/), but with more emphasis on information extraction (& actual reviews) instead of machine learning (ML metrics don't help much when comparing products; to really corner the market the flow needs to be review site -> Amazon rather than the reverse).

<comment><USER4> For an concrete example let's take garlic peelers (a typical "long-tail" product). The top search results are e-commerce sites, affiliate reviews, Cook's Illustrated, WikiHow, a 1996 NYT article describing its invention, and a Kickstarter campaign to reinvent the garlic peeler. Finally somewhere on page 2-3 is this review site: [https://moo.review/garlic- peelers/](https://moo.review/garlic-peelers/).

They clearly spent some effort on this; it's all original content, nice pictures, good layout, etc. But as a person buying a garlic peeler, it's pretty much unusable due to the lack of editing; spelling errors such as "realy", the majority of the page taken up by a how-to, and tons of fluff such as "Some of the peelers presented more problems than they solved." There's about one paragraph per item.

Meanwhile, Amazon reviews are composed mostly of worse fluff ("amazing", "excellent", "I use it every day", etc.), and there's more of it. But there is also the occasional interesting complaint such as "The interior has to be cleaned after 2-3 uses due to garlic juice." and "The rolling motion gave my friend arthritis". Definitely more than a paragraph of info, maybe even two or three. So the info is there, it's just a problem of extracting it.

</comment></comment></comment></comment></comment></comment><comment><USER5> If you have any questions about my blogpost or NeuroOn experiment story, I'll be happy to address them.

I have been already notified that I may have misinterpreted actigraphy publications I cited - I'll look into that tomorrow and gladly update the post with my findings :)

<comment><USER6> my question is why do you make false assertions such as this:

"it could try to wake the user, resulting in grogginess and complete lack of energy till the end of the day". you cite source [4], which is the wikipedia article on "sleep inertia" : [https://en.wikipedia.org/wiki/Sleep_inertia](https://en.wikipedia.org/wiki/Sleep_inertia)

The wikipedia page doesn't say you'll have a "complete lack of energy till the end of the day", or anything _close_ to that. it says "Morning sleep inertia may take several hours to dissipate" and "Sleep inertia is the impaired cognitive performance immediately upon awakening, which decays over tens of minutes", and "In the majority of cases, morning sleep inertia is experienced for 15 to 30 minutes after waking".

so my question is, whose idea was it to embellish using the phrases "complete lack of energy" and "for the rest of the day" ?

<comment><USER5> Thank you for pointing that out, I will update it in a moment.

I've written a dozen versions of this article trying to accommodate different readers, including non-technical startup community. One of the main functions of NeuroOn is its alarm clock, which promises to "always wake you up in the best moment", which seems not to be true in ~31% of cases.

When I used direct wording about "sleep inertia", my test readers with no background in sleep science just said "Meh, it's better than without the mask anyway, isn't it?".

It's an honest mistake on my part, which only shows how hard science communication really is - and how hard is to choose a language in debunking bold claims.

</comment></comment></comment><comment><USER7> I miss zeo so much :| It was easily hackable, it had a serial interface and apart from scripting your own alarm clock you could e.g. train meditation by looking at the realtime chart. I wish there was a comparable product (that also does not depend on cloud).

Lucid dreaming induction function in neuroon looks pretty neat though.

<comment><USER5> Have you tried OpenBCI? [http://openbci.com/](http://openbci.com/)

It's not standardized - so you'll have to make a headband yourself and choose some electrodes, but it gives you full access to all the signals. And don't worry about the 250/125Hz limitation, it can be quite easily hacked to write to SD with much better sampling rate.

<comment><USER7> Haven't heard of it. Looks quite promising. Price for the board doesn't seem to be too bad either given the ADC used. Definitely not something to sleep in, but could be an interesting time sink. Have you? And did you maybe do any nouroon like experiments with some other devices?

<comment><USER5> Sadly, not many. I'm doing a lot of other things, being a front end developer full-time ;)

I've played with OpenBCI and with some friends we tried to make it save signals with 1kHz sampling rate. No big-scale experiments so far.

Two days ago I checked out Myo on a friend born without a hand, with some hopes to create a simple interface based on her "phantom limb" gestures (she has full forearm with normal enough muscles). Sadly, Myo doesn't allow access to raw EMG signal - and my idea is to create Myo-like open hardware electrode boards to connect with OpenBCI and get some serious signals.

EDIT: Regarding OpenBCI - it's open hardware, you can make it yourself for ~under $100 if I'm right.

<comment><USER8> I'm pretty sure OpenBCI has an EMG board, called MyoWave.

<comment><USER5> Haven't heard about MyoWave. Do you mean the Ganglion Board?

<comment><USER8> Found it! It's actually called MyoWare:

[http://shop.openbci.com/collections/frontpage/products/myowa...](http://shop.openbci.com/collections/frontpage/products/myoware- muscle-sensor?variant=29472011267)

It's a little 3-lead EMG sensor intended for use with arduinos and the like. It's not _quite_ as nice as the Myo (it uses sticky electrodes), but it's a similar form factor and much cheaper.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Is there any data on the lucid dreaming aspect of NeuroOn?

What percentage of people have lucid dreaming using it? Are those people experienced lucid dreamer already? Just this aspect alone is enough to gain my interest.

Also how is it for side sleepers? Ever since my motorcycle accident I can only sleep on my side.

<comment><USER5> There is no data that I know of, haven't heard about any papers from NeuroOn, they aren't very fond of whitepapers. As to real science on the topic, you can check [http://www.sciencedirect.com/science/article/pii/S1053810012...](http://www.sciencedirect.com/science/article/pii/S1053810012001614)

As someone who used NeuroOn I can't see anything wrong with using it sleeping on the side. It's still uncomfortable (to me), but it's not a deal-breaker.</comment></comment>


Show HN: Pull up bars (klimmzugstangen in german) - <AUTHOR> https://www.klimmzugstangen.de/xt/ <comment><AUTHOR> We created these pull up bars [1] years ago and continously try to improve them or introduce some new models, but, all in all, without great success. If you're into something, then it's difficult to think out of the box. So fresh eyes are needed! Any feedback would be a great help. Maybe you see another model, a new feature or a new design that would be cool to make. Thanks!

[1] [https://www.klimmzugstangen.de/xt/en/pull-up- bars](https://www.klimmzugstangen.de/xt/en/pull-up-bars)</comment>


EFF to Japan: Reject Website Blocking - <AUTHOR> https://www.eff.org/deeplinks/2018/07/eff-japan-reject-website-blocking <comment><USER2> I sympathize with the EFF here to some degree... But why in the world do they think Japan cares one bit what the EFF say? Japan likes doing things their own way, and they will learn on their own terms what works best for them and what doesn't.

It'd be like the ACLU telling Japan how to do justice in Japan.

<comment><USER3> To be fair to the EFF, it isn't like your ACLU example at all. Lawmakers have only been grappling with the internet and it's implications for a relatively short period (historically speaking). And there have been some bad decisions/policies. Sometimes culture plays a part, sometimes it doesn't. So it's fair for the EFF to say: "we feel this has worked for other people, and this hasn't. please take it into consideration, including chilling effects and technical pitfalls", especially for a global resource like the internet. (It's also fair for Japanese lawmakers to ignore them, which is the most likely outcome.)

</comment></comment><comment><USER4> Seriously for now? It was like a few months old news and the situation was not what they're describing. I generally support EFF but I think EFF should hire the staff who is good at reading Japanese before saying something to Japan because their recognition is totally off from the real world situation.

There was a massive manga uploading web site, 漫画村(manga mura) who has many users. I really don't understand why 漫画村(manga mura) is particularly blamed for since there are bunch of these copyright infringing manga-uploading sites. My guess is that their UI was good for smartphone, not too many ads and fast or they prepared smartphone app which is just a wrapper of the browser(I really don't understand smartphone app ecosystem).

Technically, it's just traditional server-hosted web site. Nothing special or technically interesting like file sharing implemented on P2P mesh network.

漫画村(manga mura) boasted that they are perfectly legal for they are based on a country which has no diplomatic recognition with Japan. So the Japanese copyright has no effect on them.

This is my opinion and I'm not the lawyer but the interesting thing is there is a case I think it relate to this. Japanese court denied North korea's copyright for Japan and North Korea has no diplomatic recognition with each other.

Anyway the point is, 漫画村(manga mura) server is physically located at foreign countries(presumably a country which has no diplomatic recognition with Japan) so Japan has no jurisdiction over them.

Japan has strong 通信の秘密(Secrecy of correspondence) supported by the constitution so blocking and Deep Packet Inspection is illegal.

So a bunch of publishers gathered up and pressured government to do something and what they come up? The blocking with 緊急避難(emergency escape).

緊急避難(neccesity) is the legal concept in Japan that illegal act for avoiding emergency threat is considered not illegal if the thing it try to prevent is more worse than doing so.(I'm not lawyer so don't relies on my explanation)

The Japanese government said that blocking the 漫画村(manga mura) will be considered legal under the 緊急避難(necessity).

The problem is, it's not the Japanese government who interpret the law. It's the court. So Japanese government's announcement is just a suggestion and no authority over the court.

NTT bite the trap and enthusiastically announced they will block the 漫画村(manga mura).

Later, 漫画村(manga mura) was shutdown for their own, and government retracted the 緊急避難(necessity) interpretation. NTT was NTT and it's been sadi that they're still working on implementing the blocking.

But if you look back the history, Japan already does blocking.

In 2011 and onward, Major Japanese ISPs started blocking the child pornography. There is no law and it violates the 通信の秘密(Secrecy of correspondence) but it is considered not illegal under 緊急避難(necessity).

It is said that child pornography blocking was implemented by organization maintained list consists of a few hundred URLs confirmed to refer to the child pornography now.

It's useless for a few hundred URLs can't block all the child pornography on the Internet. It's not effective but the fact that there is ongoing blocking which shall be illegal under normal circumstances without due process but merely considered non-illegal by 緊急避難(necessity)

This child porn blocking we already have doesn't led to wide criticism like we do now for copyright infringement blocking. Perhaps, considering 緊急避難(necessity), people think child porn is worse than violating the constitution, but copyright infringement isn't worthy of violating the constitution.

I do understand that. Child porn and violation of constitution are both basic human right violation so they are same level of violation.

Copyright infringement is, on the other hand, just monetary damage on private citizen or organization. My common sense prioritize human right violation over monetary damage.

Disclaimer: I am heavily biased that I am employed at one of the publisher who suggested the blocking. That said, I think 通信の秘密(Secrecy of correspondence) shall never be violated. Not for copyright infringement, even for child porn. I also think copyright/patent/trademark are outdated concepts and shall be abolished ASAP.</comment>


Cookie policy notifications have ruined user experience on the web - <AUTHOR> https://www.reddit.com/r/web_design/comments/93o0eg/cookie_policy_notifications_have_ruined_user/ <comment><USER2> How ironic, websites have been breaking user experience for years by embedding always more trackers that took forever to load.

If a publisher doesn't want to display a GDPR notification to its users there's a simple trick : just don't collect and monetize personal informations!

<comment><USER3> Even if we use cookies for basic sessions (absolutely no personal tracking, just session ID) - Isn't it mandatory to show "Cookie bar" on the said site?

<comment><USER4> No.

[http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm](http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm)

(Perhaps surprisingly there is an exemption for "third‑party social plug‑in content‑sharing cookies, for logged‑in members of a social network.")

<comment><USER5> The operative phrase in that last one is "for logged‑in members", because in that case the cookies fall under the earlier

 _provider of an information society service explicitly required by the user to provide that service._

For a user logged-in to a social network, the user clearly consents to the social network providing a service. Note that it is not allowed if the user is not logged in to the social network.

</comment></comment></comment></comment><comment><USER6> then there's reddit and its giant full page ad for the app before finally redirecting me to the content once i find the tiny link to continue instead of opening the app store...

yes reddit and fb and gmail and the like are intentionally crippled when viewed on mobile. why? maybe because the data an app can suck up off your phone is much more valuable. no pesky same-origin policies!

i digress :(

<comment><USER7> I noticed that reddit now has three separate "use our app" prompts, which don't seem to communicate so they can all appear on the same page. There's the loading-in system popup, the bottom-of-screen one, and the internal popup with a picture and two choices.

And then the bottom-bar one, instead of having two buttons, makes the entire field open the app store except for a tiny 'x' in the top right. Talk about unsubtle dark patterns.

<comment><USER8> The reddit redesign feels a lot like the Digg changes before everyone moved away. I think reddit still has a lot more going for it, and being able to opt out solves the problem, but I'm still every so slightly worried.

<comment><USER7> It hasn't been pushed very hard, but the new 'chat' feature - on a website that already had private messaging - strikes me as a fundamental misunderstanding of what reddit's value is, one bad enough that it makes me doubt for the future design of the site as a whole.

<comment><USER9> Agreed. It's only a matter of time before they get rid of the opt-out of the redesign. When that happens, I'll likely quit. I find the redesign absolutely impossible to use.

<comment><USER7> It certainly doesn't help that they've apparently adopted the game development definition of a 'beta'. (i.e. an alpha that you roll out to all users.) There are several core features of the existing site which simply haven't been implemented yet - I consider that unacceptable for an all-users beta, especially in a redesign where those features are expected.

Visiting a user page and checking 'top' simply _doesn 't work_, with a note that it will someday. And that's made even worse because the new 'hot' on user pages has some sort of godawful logic that only shows a handful of posts from a given thread. This is painfully apparent with AMAs, where visiting the AMA account and checking all posts is a standard action - after trashing the AMA infrastructure on the business side (the Victoria mess), the same thing is now happening on the tech side.

The new redesign requires every sub to build a new theme just to maintain existing functionality, and is apparently harder to theme for also. I suspect it's an attempt at homogeneity to be more welcoming to new users, but the practical consequence is that sidebars (rules, links, info) have simply vanished. Which means more work for moderators, less info for visitors, and occasionally complete dysfunction for subs that used the sidebar for something important.

And, of course, the redesign is nakedly anti-user in much the same way as the recent TechCrunch one. It's designed to make sponsored-content ads harder to distinguish, sacrifice content space for site features space, and promote time-on-site over user choice and experience.

I retreated to a handful of low-use, well-moderated subs quite a while ago, and with the site changes tarring even those I'll probably give up soon also.

<comment><USER9> Completely agree, with all of it. I pretty much only use it for a few things that I have interest in, and don't really venture outside of there. Even then, I've tried to limit my posting and frequenting of the site; there are some weeks where the only thing I'll post is the weekly one on a sub I help moderate.

I've even gone to the point of deleting the app on my phone, and, if I have to, I'll open it in mobile browser (and deal with their shit) to check messages/etc in the morning. I need to start trying to wean myself away from it completely, if only to help kill off that online identity.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> We wouldn't be having this discussion if cookies were opt-in rather than opt- out. I don't sign into 90% of websites I visit, but why are all of them allowed to track me? If cookies were opt-in, then the legal issue of "consent" would be cleanly resolved, and the interface can be handled by the user agent rather than through obtrusive modals.

<comment><USER11> The problem is, the purpose of cookies isn't tracking, they're a hack to maintain state between requests for what's supposed to be a stateless protocol (and until HTML5 came along with session storage and local storage, they were the only way to do that in the browser.) So cookies are useful (and often used) for purposes besides tracking and advertising.

Having cookies be opt-in by default would just punish anyone using cookies for benign purposes.

<comment><USER7> I'd be interested to know what percentage of sites would actually lose functionality.

At a crude estimate, >90% of the sites that show me cookie warnings do everything I actually want them to statelessly. And I have some backup for that, because when I block cookies by default very few sites actually seem to get worse.

Are there clever user-aiding tricks with cookies that I don't realize I'm losing? Or is the average site with cookies purely for tracking and advertising?

(This is all a separate question from "should cookies be blocked by default"; I know a few uses really do suffer badly.)

<comment><USER12> Pretty much any site with a login is using cookies to do it

<comment><USER13> Sure but to create a login there is a transaction of consent.

<comment><USER14> Exactly. No one -has- to add a cookie that tracks you across sites they don't even own. They can easily be used for authentication and session management without scraping a bunch of personal information from every visitor, logged in or not

</comment></comment></comment></comment></comment></comment><comment><USER15> I'm a really big fan of geotargeting these notices only to the EU. If the EU wants cookie notices, give the EU cookie notices. Don't give anyone else cookie notices, because they're garish and few people reasonably care.

<comment><USER2> You can't do geotargetting here, because to perform geotargetting you need the user consent to use his location (which is a personal data ;) ) if he is european.

<comment><USER16> This isn't true.

You can use cookies for necessary operations of the website, which this almost certainly is. Also, country level location data isn't PII, and also doing a geoip lookup that you don't store anywhere also isn't in violation.

<comment><USER5> This isn't true either. If you're using an IP lookup to determine the user's current country, that's still processing PII (since many courts have already ruled that an IP address is unique enough to identify a person -- technical challenges notwithstanding).

However, you have a clear and stated use case for processing that PII so consent is not required, but you are required to mention this processing in your privacy policy. Not publishing this processing is (strictly speaking) a violation of the GDPR, but the processing itself isn't.

<comment><USER17> For the purpose of the GDPR, an IP is PII. However, one can get rough location using an anonymized version of an IP address (say one that has zeroed out the last octet or two).

From Recital 26 ([https://gdpr-info.eu/recitals/no-26/](https://gdpr- info.eu/recitals/no-26/)):

> The principles of data protection should therefore not apply to anonymous > information, namely information which does not relate to an identified or > identifiable natural person or to personal data rendered anonymous in such a > manner that the data subject is not or no longer identifiable.

</comment></comment></comment></comment></comment><comment><USER18> Are Cookie policy notifications a thing outside of the EU? I always assumed that websites geo target these notifications and life with the small risk of corner cases (like EU customer in the US). If anyone has experience, or numbers I'd find that highly interesting.

One datapoint from Germany: We were largely unaffected by cookie notifications before GDPR, because of a local law (TMG) that superseded the EU "cookie law".

Since GDPR we are in the curious situation that every small and medium sized business plasters it's website with extravagant opt-in notification pop-ups while the worst privacy offenders, like the nations largest newspapers, bombard you with all kinds of cookies with no notification at all.

Just one example I tried a few moments ago:

spiegel.de one of the most widely read German-language news sites set 54 cookies from lots of different domains plus local storage usage. No cookie notification whatsoever.

Another example: bundesregierung.de, the official government website, states in it's privacy policy that they set a web analytics cookie (Matomo) but they don't show a notification either.

<comment><USER19> The « funniest » part is that Spiegel probably made several news article about GDPR. In France it's the same.

Sad thing for them, they won't be able to pretend they didn't knew (which will be a good lesson taught)

<comment><USER18> Heise is even worse. They covered GDPR extensively, yet don't do any notifications on their own websites.

</comment></comment></comment><comment><USER20> HA, this made it to the front page right as I was composing this Ask HN submission about picking a de facto standard element CSS class so that ad blockers could just start including a simple rule to get rid of them: [https://news.ycombinator.com/item?id=17679932](https://news.ycombinator.com/item?id=17679932)

<comment><USER21> It'd be even better if my user agent could simply indicate my acceptance (or lack thereof) for me

<comment><USER22> This is what Do Not Track was supposed to be. Unfortunately it never got much momentum. Google, Facebook, Twitter, etc. ignore the DNT header.

<comment><USER20> Another useless attempt at reducing tracking I wish would be banished from the web. The amount of pollution in web standards; official, legal, or accidental; is becoming just as annoying as the annoying things they're trying to fix.

</comment></comment></comment></comment><comment><USER23> Here is an idea: instead of a cookie policy notification, have a setting in the browser with the user's cookie setting. That way a website can look at that setting and store cookies or not.

<comment><USER24> You can already have your website check for the Do Not Track header, don't set non-essential cookies and don't show a notice when it's set. Basically no website does that.

</comment></comment><comment><USER25> It would be cool if we could develop a protocol where users could flip a setting on their browser that tells every website they visit that the user has consciously, legally opted-in to all cookies. Heck, it would be cool to also have an option that says I accept all your Privacy Policies and Terms of Agreement, so don't show me any banners related to those either.

<comment><USER26> > a setting on their browser that tells every website they visit that the user > has consciously, legally opted-in to all cookies

IMO, you do this when you open the browser. Why does every website need to explain how the internet works?

<comment><USER27> Many websites legally need opt-in permission to put (and use) a tracking cookie, so unless the user intentionally _chooses_ to do opt in, they're not legally permitted to do so even if the internet technologies enable them to make it happen.

There are many things that are technically easily possible, but prohibited unless certain nontechnical conditions are met. Tracking cookies is one of them.

Opening a browser doesn't constitute freely opting in to your _specific_ use of data; at most it constitutes not opting out, but that's not legally sufficient.

</comment></comment></comment><comment><USER28> Not just cookie policy notifs but all bottom or top aligned overlays present on page load... like the one on this reddit page begging me to install a mobile app so they can get my advertising id

</comment><comment><USER29> What happens if you use cookies and don't show any banner?

Does this also apply to localStorage and other offline storage methods?

</comment><comment><USER30> I wish we could converge on a way to tag such notifications, so that those who want to can filter them out.

</comment><comment><USER31> Do these notifications actually help with GDPR compliance or are they just a CYA for the websites?

<comment><USER32> Given that (from my IANAL understanding) the GDPR requires opt-in _and_ forbids "click I accept or leave our service" style forced opt-in, I'd say this is not even CYA - it's closer to magical cargo cult incantations.

<comment><USER33> > _the GDPR requires opt-in and forbids "click I accept or leave our service"_

That's an asinine law if I ever saw one. Telling me how I should run my business? Really? From what vantage point, if I may ask?

If I had a company, I would ignore the whole thing and invite them to cross the pond and try their crap in my jurisdiction, under my laws. Or just block them altogether. If they want to go back to the middle ages, let them.

<comment><USER32> It's called "regulation". Yes, I think, the GDPR is quite opinionated in that they want to discourage "pay with your data"/"surveillance capitalism" type business models - the reasons have been discussed enough in the last years.

I guess the authors understood that without that clause, there would be an obvious loophole that would indeed lead to nothing more than annoying pop-ups and reduce the desired consumer choice to name-only. So they took the logical step to close the loophole.

Of course many businesses are trying to counter with a pop-up anyway. But then, that's not the fault of the regulation.

</comment></comment></comment></comment><comment><USER34> I can't count how many times i right clicked to hide element thanks to u block origin

</comment><comment><USER35> works for most:

        javascript:(function()%7Bvoid([].forEach.call(document.querySelectorAll('body *'),e=>/fixed|sticky/.test(getComputedStyle(e).position)&&e.parentNode.removeChild(e)))%3Bdocument.body.style.overflow%3D'auto'%3Bdocument.body.style.height%3D'auto'%7D)()

</comment><comment><USER36> They're terrible. Who are we kidding, no one has backed out of the website after seeing one of these notices.

<comment><USER37> I back out of them all time.

Particularly the egregious dark-pattern ones: "Click this giant green button to let us track you out the wazoo, or click this tiny misleadingly-named link to drag you through a six-hour hell of settings dialogs which will drop you out without actually changing anything the instant it thinks it can get away with it."

<comment><USER36> The vast majority of people are not backing out. They're instinctively clicking that button to get it out of the way, it's the new banner blindness.</comment></comment></comment>


Python composable command line interface toolkit - <AUTHOR> https://github.com/pallets/click <comment><USER2> Please stop calling this kind of thing "beautiful".</comment>


HSBC voice recognition system breached by customer's twin - <AUTHOR> https://www.theguardian.com/business/2017/may/19/hsbc-voice-recognition-system-breached-by-customers-twin <comment><USER2> It's amazing that they'd allow 7+ attempts to correctly identify the customer's voice. To me, that signals either poor security practices or a lack of confidence from HSBC in the technology itself.

</comment><comment><USER3> i'd say a determined adversary is probably more difficult than my customer's twin....</comment>


The road to Java 9: Modular Java finally gets OK'd - <AUTHOR> http://www.infoworld.com/article/3203931/java/the-road-to-java-9-modular-java-finally-gets-okd.html <comment><USER2> Hi all,

Martijn Verburg here - London Java Community (LJC) representative on the Java Community Process (JCP) Executive Committee (EC) (dear Cthulu, the acronyms) otherwise known as the Java standards body.

Here's our reasoning for voting "Yes" the 2nd time around:

[https://londonjavacommunity.wordpress.com/2017/06/28/our- yes...](https://londonjavacommunity.wordpress.com/2017/06/28/our-yes-vote-on- the-2nd-go-around-for-jsr-376-java-platform-module-system/)

This is a great step forwards for Java _as a platform_ as it lays the foundation for a smaller, more secure and lightweight footprint. There is still more to tackle on the modularity story (expect to see further updates in Java 9.1 and beyond).

It's very important to note that you can still run your normal Java classpath based application with Java 9. The Classpath and Classloader mechanism is still there, although you'll see a few more warnings pop up if your application or its dependencies are relying on a deprecated API or dangerous internal lib.

 _If_ you choose to port an existing project to the new module system and module path way of loading then you can gain some of the benefits but of course there will be a learning curve and I'd argue that unless you're really needing that modular help then wait for Java 9.1 or even 10 until some of the edges have been ironed out.

Any other Q's throw my way!

<comment><USER3> How confident are you that Oracle keeps on iterating on Jigsaw rather than moving on to the next shiny thing?

<comment><USER2> They are highly motivated by internal (Oracle cloud) and external factors (Oracle as A technology leader) factors as well as professional pride (core Java folks are ex Sun) so I'm personally highly confident

<comment><USER3> > internal (Oracle cloud)

What gives you this confidence? What kind of Java applications do you expect to run on Oracle could because they seem to target none of the existing ones? I don't see how Jigsaw can help existing Java applications with Oracle could:

They seem to be assuming nobody will use JAXB or activation either directly or indirectly because that will force you to deploy the full java.desktop module with all Swing PLAFs and everything including sound. They seem to be completely fine with this and do not seem to want to spend any time on splitting up java.desktop, having at least a headless version java.desktop or improving JAXB so that it doesn't depend on java.desktop anymore.

They seem to not care about existing Java EE APIs at all and have posted no replacements.

They seem oblivious to any needs of any dependency injection container (Spring, Guice, …).

Jigsaw only helps with disk footprint. It does not help with runtime footprint (which is usually several times larger than disk footprint) or startup time, if anything it makes both of them worse.

</comment></comment></comment></comment><comment> le-mark Lots of noise here about what it actually consists of. This blog post is a good overview[1]

> Creating a module is relatively simple however. A module is typically just a > jar file that has a module-info.class file at the root - known as a modular > jar file. And that file is created from a module-info.java file in your > sourcebase (see below for more details).

> Using a modular jar file involves adding the jar file to the modulepath > instead of the classpath. If a modular jar file is on the classpath, it will > not act as a module at all, and the module-info.class will be ignored. As > such, while a modular jar file on the modulepath will have hidden packages > enforced by the JVM, a modular jar file on the classpath will not have > hidden packages at all.

[1] [http://blog.joda.org/2017/04/java-9-modules-jpms- basics.html](http://blog.joda.org/2017/04/java-9-modules-jpms-basics.html)

<comment><USER4> On the user side of things maybe, but the devs in charge made videos about this and it's not trivial.

<comment><USER5> (No snark) When talking about java-as-a-platform, what do you mean by user vs dev?

<comment><USER4> the people designing the module system for this JCP

</comment></comment></comment></comment><comment><USER6> Does anyone who has been following this in more detail have a summary of the sort of benefits developers 'at the coal face' will see from this change?

I've read a few articles and they've left me very confused.

Is this about parts of the Java standard library (like the mentions of SQL and logging imply) and meaning it's only relevant for people targeting small devices?

Does it replace JARs, like the mentions of 'JAR hell' imply?

Does it add a maven-style package manager that can resolve dependencies by downloading code from the internet, like the mentions of npm imply?

Or are the changes / benefits something else entirely?

<comment><USER7> It won't change anything for you most likely.

The module system is taking the place of whatever you were previously using to order your dependencies on the classpath.

Now, instead, the module files list the dependencies of a module and, Java does a resolution of all of them to determine the dependency graph. So the order of modules on the module path doesn't matter, unlike the classpath.

The only advantage I know of is that the standard lib has been split in over 92 modules. So if you don't use everything, your resulting Jar will be smaller. Basically, making Java more modular in the sense that packages are now grouped into smaller Jars.

Now Java 9 has some other features, one of them is to prevent reflection access of non public methods. This was made optional for Java 9. But might be made default in 10 and mandatory in 11. This is the biggest issue people have with Java 9 modules, because it will not be backwards compatible, and certain code can't even be ported, since no public APIs exist for certain things.

Finally, most programmer at the cast, like me and you, we're hoping that modules would be version aware, and allow multiple versions of the same module to coexist, but they didn't do that unfortunately.

<comment><USER8> > So if you don't use everything, your resulting Jar will be smaller

I'll admit that I'm not super well-versed in Java packaging, but I kinda assume that typical jars do not include any bits from standard library, so modularizing standard library wouldn't have any impact on jar size. I'd imagine that the effect would be instead visible for self-contained distributions, like e.g. docker containers.

<comment><USER9> One of the worst things about the Docker fad is that people are wasting effort minifying things like the JRE and libc so that having _many copies on the same machine_ isn't quite so blatantly foolish. They could be accomplishing something but instead they're wallowing in a problem that was solved decades ago.

</comment></comment></comment></comment><comment><USER10> Meanwhile Kotlin is gaining momentum because everything on the Java roadmap is stuff most developers don't need or care about.

</comment><comment><USER11> So it passed without any technical changes?

How about the whole module versioning thing? I get the impression that the real discussions and negotiations happen in private and even the somewhat technical messages in the mailing list are only the tip of the iceberg.

<comment><USER12> More details here:

[http://openjdk.java.net/projects/jigsaw/spec/minutes/2017-05...](http://openjdk.java.net/projects/jigsaw/spec/minutes/2017-05-18)

[http://openjdk.java.net/projects/jigsaw/spec/minutes/2017-05...](http://openjdk.java.net/projects/jigsaw/spec/minutes/2017-05-22)

[http://openjdk.java.net/projects/jigsaw/spec/minutes/2017-05...](http://openjdk.java.net/projects/jigsaw/spec/minutes/2017-05-23)

<comment><USER13> It looks like none of the technical problems that resulted in it being voted down last time have been addressed?

I liked this comment about #MultipleModuleVersions:

" _...Addressing this issue may entail reconsidering the multiple versions non-requirement. [Mike Hearn]_

" _Resolution Defer a specific solution of this problem to a future release since effective, though crude, solutions already exist and the lack of an immediate solution should not block developers who want to modularize existing applications. [Proposal]_ "

<comment><USER14> I'm the Mike Hearn named in the document. I think they probably made the right call here.

The stated justification for the decision goes like this. With the current design of Java/the JVM, the only way to load two incompatible versions of the same module is to use different classloaders. You can in fact do this with Jigsaw. There is an API that can be used by an app loader or container of some kind to put every module into its own classloader.

This leads to an obvious question: if doing that lets you eliminate version conflicts, why not do it by default? The reason is compatibility. It turns out that lots of software makes assumptions about the classloader structure and which classloaders load it. They tried doing it that way early in Jigsaw's life and backed off because too much stuff broke.

It may seem odd to worry about breaking apps when Java 9 spent most of its development period unable to run basically any real Java software due to the widespread reliance on internal APIs, but:

• They backed off on that, one of the changes that let Jigsaw get voted through this time is that Java 9 no longer breaks apps that use internal APIs by default.

• Encapsulating internal APIs is at least a change that was always signposted as being possible - developers were warned not to use them in Java docs from decades ago. Whilst the classloader structure isn't something guaranteed by the spec (as far as I know), changes to it were at least not widely telegraphed in advance.

Ultimately, backwards compatibility concerns have won the day. So Java will not allow conflicting modules to be loaded by default. If you find yourself in a situation where you need that, there's an easy fix: change your app's startup code to use the Layer API to put every module in its own classpath and fix any modules you use that make now-invalid classloader assumptions.

<comment><USER3> > It turns out that lots of software makes assumptions about the classloader > structure and which classloaders load it. They tried doing it that way early > in Jigsaw's life and backed off because too much stuff broke.

Do you have a source for this? I have trouble accepting this argument for two reasons. First WilFly 7 and later (modular service container) completely changed the classloader layout to a non-traditional, non-hierarchical one. The amount of breakage introduced was negligible. In my experience the biggest source of breakage was read-only JNDI which is completely unrelated. Second they (Oracle people working on Jigsaw) were completely unaware of the amount of breakage encapsulating internal APIs would introduce and had to back out of it at the last minute (i.e. this year). This suggest to me they did at best minimal testing, they certainly never even started a hello world Spring or Guice application.

My recollection from one of many Jigsaw talks that Mark Reinhold gave at was they would have to implement a SAT solver (like OSGi) and didn't want to do that because reasons.

<comment><USER14> My source is a comment to that effect on the JPMS/Jigsaw mailing lists, from Mark Reinhold. I don't have the link off hand unfortunately and pipermail is from the dark ages so searching for it again would take time.

I think the Oracle guys _were_ aware of how much would break when they blocked access to internal APIs, but felt the costs were worth it and/or that people would adjust their code during the Java 9 development cycle so the breakage would be less by the end.

Another cited reason was simply getting to the point of shipping something. Java 9 is already quite late. I can see why they'd punt features to future releases to try and ship what they have.

</comment></comment></comment></comment></comment></comment><comment><USER15> Great to see this happen. It was supposed to be one of the big features of Java 8 and to have it pushed to 10 because of last minute squabbling and objections that had never been raised before seemed ridiculous.

<comment><USER16> > last minute squabbling and objections that had never been raised before > seemed ridiculous.

Jigsaw has always been controversial, and for good reasons.

<comment><USER17> True, but at least the news cycle made it seem like companies raised formal objections at a late stage.</comment></comment></comment>


Inflated laptop battery claims may lead to class action lawsuit - <AUTHOR> http://digital.venturebeat.com/2009/06/29/laptop-battery-claims-start-heading-toward-class-action-lawsuit/ <comment><USER2> i really wish the modern OS came with a utility to measure the idle time and the in-use time of the battery, similar to what the iphone does. this information is very useful in tracking the life of the battery and gives consumers some insight into their usage patterns.</comment>