First .dev Domains Go Live - <AUTHOR> https://blog.google/technology/developers/hello-dev/ <comment><USER2> On a recent thread Google personnel mentioned that ICANN forces all domain providers to backup their data so that any domain provider going bankrupt won't affect domains. However there was no mention of what procedures Google Domains themselves have put in place to protect their customers in case their customers get irreversibly banned somewhere within Google's vast empire.

[https://news.ycombinator.com/item?id=19178757](https://news.ycombinator.com/item?id=19178757)

If the answer is they keep your domains, like they do with Adsense revenue when they ban accounts, then you should definitely be getting your .dev through a different domain provider who Google cannot avoid cooperating with because of ICANN rules they have to follow.

[https://www.searchenginejournal.com/adsense- lawsuit/248135/](https://www.searchenginejournal.com/adsense-lawsuit/248135/)

<comment><USER3> For what reasons does Google actually ban accounts?

<comment> core-questions Google owns Youtube, which bans people for any reason they feel like, including people for whom it had become a full-time job with their channel monetization paying the bills.

It is extremely unwise and very much against the founding spirit of the Internet to allow one company this much control, especially one that has shown itself to be censorious in the past.

<comment><USER4> Wait, does a YT ban extend to all Google products? Does this lock someone out of, say, webmaster tools?

<comment><USER5> Not normally but they do ban your entire account if their bots believe you've been very naughty.

[https://www.bbc.co.uk/news/technology-47278362](https://www.bbc.co.uk/news/technology-47278362)

Despite the ban being due to a violation of YT terms of service they lost their entire Google account. > "But because my Google account was terminated as well I didn't have access to my email so I couldn't see what happened."

<comment><USER6> Now imagine you had a profitable business on Google Cloud and this happened.

<comment><USER7> There are even horror stories about personal accounts getting banned and the ban subsequently propagating to the corporate GApps account of the violator's employer, thus completely shutting down corporate email and document sharing.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Me: "Wow [myfirstname].dev is available! I gotta get it!"

Aaaaaaand its $11,500.

<comment><USER9> Try to register through Gandi. They give you options that decrease in price all the way down to ~$16 -- that's the "get it when it GAs" price. If someone scoops it up before you, you're refunded. Otherwise, it's yours.

I managed to get <lastname>.dev, and it's a somewhat common last name, for $133.50 on the "GA" pricing. I expect someone will grab it before then. But if not...

<comment><USER10> Nah, it says "Unavailable" on Gandi. It seems that somebody paid full price, although it is not operative => mauricio.dev

<comment><USER11> Unfortunately, 'mauricio' is on the global domain reserve list administered by ICANN, so it cannot be registered on any ngTLD. I believe it's Mauritius in another language?

<comment><USER10> Oh, interesting, yes this is "mauritius" in Spanish a not so common name. I didn't know this, thank you for pointing it out. I guess that list is recent as mauricio.com and mauricio.co belongs to regular people and are currently working.

Do you happen to have a link to said list? A quick googling returned nothing relevant for me.

<comment><USER12> I believe item #3 on this page is relevant:

[https://www.icann.org/resources/country-territory- names#rese...](https://www.icann.org/resources/country-territory- names#reserved)

<comment><USER11> Yeah that's it, it's Mauritius in Spanish apparently.

ICANN definitely went overboard on these required reservations, but of course we have no choice but to comply.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> There is one thing that annoys me about generic TLDs like .dev, .website, .cloud, .network etc. For example, Salesforce have [https://crm.dev](https://crm.dev) \- are they the only CRM in the world? Hell no, but they're the biggest, so they can be the only one in the .dev space. Same with workers.dev.

<comment><USER14> What's your proposed alternative? That generic category names should be disallowed within a TLD? Or that some public or community-driven version of a for-profit service should control the generic names?

<comment><USER15> Maybe names that have obvious "generic" squatter value—i.e. names that (at the time of their attempted purchase) describe entire verticals, rather than uniquely identifying a business—should be put up for auction rather than being first-come-first-served.

(That would also include names that describe a vertical that someone tried to trademark into being the name of a business anyway: pets.com and the like. If that trademark isn't _already_ well known, then this is just an attempt to end-run the auction system, rather than a valid claim.)

Given that TLDs can decide their own allocation policies, I'm surprised none of them have tried this yet.

<comment><USER16> Well the .dev domains are going up in a "dutch auction" style.

The price starts off at an insane $11,500 per domain, and then slowly over the course of 2 weeks goes down to $12 per domain, first come first serve.

It's a pretty good solution in my opinion to the problem of how to "fairly" distribute domain names.

I want to pick up a few, but I'm going to wait until they are down to the lowest tier as i'm pretty sure nobody is going to pay even $100 for them. And if they do, well then they probably want it more than I do!

<comment><USER17> > The price starts off at an insane $11,500 per domain

It's only insane if no one wants to pay that much. I bet tons of companies are willing to pay that for premium .dev domains.

</comment></comment></comment></comment></comment><comment><USER18> Kinda weird that Google issued itself web.dev and opensource.dev

It feels like those would've been better suited for non-profit orgs

<comment><USER19> Only if you for some reason attribute gravitas to it.

This is just yet another scattershot TLD. It's about as consequential as .ninja in the grand scheme of things.

</comment></comment><comment><USER20> This landrush is different.

Try putting a one-character .dev domain in your cart (0.dev is available as of now). It's not a lump sum plus $12/year. It's thousands every year after registration.

In a way, I guess this is useful for deterring "domainers".

Even a 4-letter word or name .dev is hundreds of dollars a year. I wonder if the annual fee will drop as the days go by or just the purchase price.

<comment><USER21> They're called "premium domains". I think all new gTLDs have them.

</comment></comment><comment><USER22> How did Google get in charge of this? Why did they get to set the price points for registering these domains? ICANN really sold out for this one.

<comment><USER23> A couple years ago ICANN started letting companies buy customized TLDs through an auction process. I'm not sure how much they paid, but for comparison, Google tried buying .blog a while ago but was outbid by Automattic, who paid $19 million. [https://news.ycombinator.com/item?id=11686086](https://news.ycombinator.com/item?id=11686086)

<comment><USER22> This is privatization of the web.

<comment><USER24> It's not. You can make your own DNS server and sell records to anyone you want. You just have to convince users to type in your address instead of 220.127.116.11.

<comment><USER25> Realistically, how could a project be setup around this?

I mean, how do we get everyday normal people to use it?

Its been attempted before (namecoin etc)...but maybe some advantage could be given to make it more attractive.

<comment><USER26> The current state of things are OK enough that it's not worth it to normal people to make the switch. If that time ever comes, people will do so.

</comment></comment></comment></comment></comment></comment><comment><USER27> Slack and Github were so worried about someone cybersquatting that they were willing to pay $11,500 each to get those domains today? I guess that's the point of the Dutch auction system, but still seems like a waste of money.

<comment><USER28> For Microsoft (which owns GitHub) that is a tiny expense, but if they couldn't really afford it they could just file a dispute under UDRP.

<comment><USER29> But does the money come from Microsoft or from GitHub?

In a lot of the large companies I've worked, money is siloed from one operating unit to the next. They would send bills between units and sometimes even departments.

The larger the company, the more common this seemed. It's not one giant piggy bank.

<comment><USER30> Does it really matter? Surely $11k is still a tiny amount for GitHub.

<comment><USER6> ~One month salary for a senior dev.

<comment><USER31> Junior most likely

</comment></comment></comment></comment></comment></comment><comment><USER32> Do TLDs even matter? I'm working on building a professional blog, and although a .dev TLD _seems_ appropriate, using a cheaper one like .co or .be, or even .io seems functionally identical and a lot less costly. Paying hundreds or thousands for .dev seems like paying for pure vanity.

Is it going to help people reach your site? I kinda doubt it. Will Google use it to index your site differently? Maybe, but I dunno. I hope not, but it would kind of make sense.

<comment><USER33> .dev is only prohibitively expensive during the pre-sale. After Feb 28, there will be no extra charge ($0 one-time fee).

<comment><USER34> Unless it's a "premium domain" which has a separate pricing structure, independent of the release phase, and renewal fees that stay higher forever.

Hence, right now kjaegrlkjnfvaf.dev is "$11,500 + $12/year" [0] while hn.dev is "$11,500 + $720/year" [1]

So alex.dev and aj.dev will cost $720/year forever, tim.dev, james.dev and emma.dev are $360/year, tony.dev and grace.dev are $180/year, olivia.dev and harry.dev are $98/year, yusef.dev, oscar.dev and sanjay.dev are $12/year.

Maybe not "prohibitive" but a big premium for the Alexes among us!

[0] [https://domains.google.com/m/registrar/search?searchTerm=kja...](https://domains.google.com/m/registrar/search?searchTerm=kjaegrlkjnfvaf.dev) [1] [https://domains.google.com/m/registrar/search?searchTerm=hn....](https://domains.google.com/m/registrar/search?searchTerm=hn.dev)

<comment><USER35> Thank you for explaining this; I don't see these high yearly priced domains adequately disclosed anywhere. Google's marketing is all about how the "premium" is a one time fee for early registration, do they explain the higher yearly fee names anywhere?

</comment></comment></comment></comment><comment><USER36> [https://google.dev/](https://google.dev/) says:

> There was no service found for the uri requested.

<comment><USER37> Looks like they were in a hurry with the page title too:

> Error 404 (Not Found)!!1

<comment><USER38> That's an attempt at humor / adopting a jokey tone. Not an actual typo.

<comment><USER37> Wasn't aware of that. It is cool when you look at it that way

</comment></comment></comment></comment><comment><USER39> I'd really like to see which .dev domains are getting registered at the higher prices. Is there any way to see a feed of this data?

<comment><USER21> In theory, you can get that here: [https://dnpedia.com/tlds/daily.php](https://dnpedia.com/tlds/daily.php) (write "dev" in the TLD column)

Doesn't seem to have those listed in the top article, though, not sure why. Maybe it'll update later.

EDIT: The official source seems to be [https://czds.icann.org/](https://czds.icann.org/)

<comment><USER11> CZDS is a once-daily export. So the earliest you'd see information about domains registered today would be tomorrow.

</comment></comment></comment><comment><USER40> Such as [https://workers.dev/](https://workers.dev/)

</comment><comment><USER41> > ...it requires HTTPS to connect to all .dev websites. This protects people > who visit your site against ad malware and tracking injection by internet > service providers

The latter is true (it protects against injection), but I'm not sure how the former is. How would it protect against ad malware?

<comment><USER42> My assumption from that sentence is that both "ad malware" and "ad tracking" are injected by some ISPs somewhere between the client and the server. By forcing HTTPS, you'd prevent some amount of this by ensuring the data in transit from client-to-server-to-client is encrypted (and thus mostly tamper- proof) using the .dev domain's public cert.

<comment><USER11> Also commonly injected by malicious or compromised WiFi routers.

</comment></comment></comment><comment><USER43> Hmm, any idea why the list of countries are so limited?

[https://support.google.com/domains/answer/4639612?hl=en](https://support.google.com/domains/answer/4639612?hl=en)

<comment><USER11> Google Domains is one of many registrars selling .dev domains. Feel free to use a different registrar that offers support in your country.

<comment><USER44> Prices for early access .dev domains in other providers are at least 2x higher.

For example, using GoDaddy, you can buy .dev domain for 800$ instead of 350$ on Friday (4th stage of early access).

<comment><USER11> Filter down to just ".dev EAP" here to see all registrars participating in EAP: [https://www.registry.google/register-a- domain/#!/](https://www.registry.google/register-a-domain/#!/)

And we have no control over registrar prices, or countries that any given registrar operates in.

</comment></comment></comment></comment><comment><USER17> The example domains linked to in the announcement are all down for me:

[https://get.dev/](https://get.dev/) [https://github.dev/](https://github.dev/) [https://grow.dev/](https://grow.dev/) [https://accessibility.dev/](https://accessibility.dev/) [https://slack.dev/](https://slack.dev/)

etc.

<comment><USER45> Working for me; sounds like a DNS issue on your end.

<comment><USER17> Ah, fudge, yep.

I remember people complaining about the .dev tld for this reason. Many people have it routed locally.

</comment></comment></comment><comment><USER46> What happens if there is a conflict between companies that have submitted a trademark of a generic term to the Trademark Clearinghouse? (two companies that have a trademark of the same generic name, but on a different field for example) How is this settled?

</comment><comment><USER47> I sort of get the appeal of a '.dev' TLD, but I wish that google donated the whole thing to those who were using it informally for local development.

That would have been a good gift to all the devs out there.

<comment><USER48> The `.test` and `.localhost` TLDs are already reserved for such purposes: [https://tools.ietf.org/html/rfc2606](https://tools.ietf.org/html/rfc2606)

<comment><USER49> Interesting. Because my /etc/hosts file had the following as a default:

        127.0.0.1 localhost.localdomain localhost
        ::1  localhost.localdomain localhost

I thought it was `.localdomain` that was reserved.

<comment><USER48> I really thought so too! But I can't find any reference for it.

</comment></comment></comment></comment><comment><USER50> I checked out a few, the prices are excessive imo, $11,011.00

</comment><comment><USER51> Damn, the only domain I want is premium. And renews for $720 per year.

I guess that miiight stop squatters, but I feel like it will result in a squatter with deeper pockets.

</comment><comment><USER52> This sucks.

We used .dev domain internally in dev/testing environments and one day we were forced to switch domains because google bought it

<comment><USER53> That's your fault for using something that's a valid domain and not a reserved one for exactly that use case decided on 20 years ago:

[https://tools.ietf.org/html/rfc2606](https://tools.ietf.org/html/rfc2606)

.test, .example, .invalid, .localhost

</comment></comment><comment><USER54> .dev meh. I would dig an .api tld.

</comment><comment><USER55> No one has got "null.dev". I'm disappointed.

<comment><USER11> I suspect it'll go soon, if not at the very top price tier.

</comment></comment><comment><USER56> It didn't work, top domains were already gone at 09:00

<comment><USER43> It certainly worked to stop me grabbing top domains.

</comment></comment><comment><USER57> I'm not familiar with all of the details of how domain registration works, but will these always have to go through Google?

I'm interested in buying one, but not from them.

<comment><USER58> Many other registrars, like Namecheap, Gandi, etc. also can register .dev

<comment><USER11> The full list of participating registrars is here: [https://www.registry.google/register-a- domain/#!/](https://www.registry.google/register-a-domain/#!/)

</comment></comment></comment><comment><USER59> 12000 a pop and filed under "small business".

Ok.

<comment><USER60> Also as another commenter said, Trademark owners (GitHub, Slack, etc) could get their domains earlier at a lower price.

<comment><USER59> Which is funny because trademark owners tend to not be "small businesses".

<comment><USER60> I agree, although this requirement of from ICANN, not Google themselves

</comment></comment></comment></comment><comment><USER61> where is the men.dev domain? I see there is a women.dev...

</comment><comment><USER62> $98 a year? Are they serious? Do they think all developers live in the first world?

<comment><USER21> Where are you seeing that price? Maybe you found a "premium" domain, the base rate seems to be (will be, after EAP) about $12/year.

<comment><USER62> Google domains page says $98 a year after early-access.

<comment><USER21> Doesn't it say "PREMIUM"? Here I'm seeing 12€/year: [https://domains.google.com/m/registrar/search?searchTerm=ran...](https://domains.google.com/m/registrar/search?searchTerm=randomstring.dev&hl=en)

</comment></comment></comment></comment><comment><USER63> Stupid expensive for what really?

<comment><USER64> They get progressively cheaper as we approach February 28. After that, I believe registrations are free with a $12 maintenance cost.

<comment><USER11> Minor correction, registrations are never free. Come 2019-02-28 16:00:00Z, they will be available at the base price. Registrars set their own prices, so depending on which registrar you're using, expect that to be around $12-20/yr (including the initial year).

<comment><USER65> Do you happen to have a source for the 16:00 UTC base price switch? I am not seeing a specific time on any of the linked pages.

<comment><USER66> The schedule is documented here: [https://domains.google/tld/dev/](https://domains.google/tld/dev/)

</comment></comment></comment></comment></comment><comment><USER67> Would rather spend that money on validating a product idea or improving customer experience.</comment>


Myspace to lay off over half of staff tomorrow - <AUTHOR> http://networkeffect.allthingsd.com/20110110/myspace-plans-to-lay-off-550-to-600-employees-tomorrow/?mod=tweet

<comment><USER2> We're hiring a lead Rails dev, if anyone there is interested.

</comment><comment><USER3> At least this was done after the holidays (unlike Yahoo which gave it's employees an early christmas present).</comment>


A proof-of-concept of a vulnerability in custom shell prompt scripts - <AUTHOR> https://github.com/njhartwell/pw3nage <comment><USER2> The "official" git prompt[1] is safe on Bash; the script doesn't run.

[1]: [https://github.com/git/git/blob/master/contrib/completion/gi...](https://github.com/git/git/blob/master/contrib/completion/git- prompt.sh)

<comment><USER3> In particular see the long comment at line 324.

<comment><USER4> > If the shell would expand the contents of PS1 when drawing the prompt, a raw > ref name must not be included in PS1. This protects the user from arbitrary > code execution via specially crafted ref names. For example, a ref named > 'refs/heads/$(IFS=_;cmd=sudo_rm_-rf_/;$cmd)' might cause the shell to > execute 'sudo rm -rf /' when the prompt is drawn.

[1]: [https://github.com/git/git/blob/9d77b0405ce6b471cb5ce3a90436...](https://github.com/git/git/blob/9d77b0405ce6b471cb5ce3a904368fc25e55643d/contrib/completion/git- prompt.sh#L331-L336)

</comment></comment></comment><comment><USER5> Tab autocompletion looks to be affected too, at least on my system. Create a branch called 'complete_$(./foo)'. Then type 'git checkout comp<TAB>'. This gets autocompleted to

        git checkout complete_$(./foo)

If you hit Enter at this point without thinking you'll end up running './foo'. It should have expanded instead to something like

        git checkout 'complete_$(./foo)'

or

        git checkout complete_\$\(./foo\)

<comment><USER6> Zsh seems to do the escaping correctly there.

<comment><USER7> Confirming what GP said on version 5.3.1, not seeing any escaping

        git checkout <Tab>
        git checkout $(./pwd)

<comment><USER8> Escaped here. How are you configuring your completion?

        -% zsh -f
        voi% echo $ZSH_VERSION
        5.3.1
        voi% autoload -U compinit
        voi% compinit
        voi% git checkout <tab><tab>\$\(./pw3n\)
        Already on '$(./pw3n)'
        Your branch is up-to-date with 'origin/$(./pw3n)'.
        voi% git checkout com<tab>plete_\$\(./foo\)
        Switched to branch 'complete_$(./foo)'

</comment></comment></comment></comment><comment><USER9> It's always cute to find new vectors for command injection. Really anytime you mix data and commands this type of crap is bound to happen (ex: sql injection).

Still not as worrisome to me as the full scripts that get executed by package managers when you install dependencies. Effectively every time you run something like "npm install" you're putting your faith in the entire tree of ancestor dependencies as any of them could have a pwnage script as a post install.

<comment><USER10> More often than not, building and deploying is secondary for developers to writing the library itself, if that. Build scripts and installation don't get the same treatment and care the library does.

The is one of the primary reasons why I prefer distribution-packaged libraries to pulling a library and its dependencies directly from developers. Staleness is a small price to pay relative to having at least two sets of eyes glance over the source and not execute arbitrary build scripts on my system.

</comment></comment><comment><USER11> Cute idea. I'm willing to bet that the Bash script I wrote for some of my co- workers is vulnerable. I guess that's something I should find out ... by making their computers do stuff.

However, I currently use Fish shell myself and it seems to be safe: [http://imgur.com/a/rjocA](http://imgur.com/a/rjocA)

<comment><USER12> Maybe someone could craft a similar vulnerability for Fish.

</comment></comment><comment><USER13> Confirmed that default bash-it Git shell prompt is vulnerable on OS X.

[https://github.com/Bash-it/bash-it](https://github.com/Bash-it/bash-it)

</comment><comment><USER14> On fish and omf here, not vulnerable. I suppose I should test fisherman on my other machine as well.

<comment><USER15> I've confirmed fisherman is safe on my machine.

<comment><USER16> Omf is also safe

</comment></comment></comment><comment><USER17> TIL. Never expected bash would do an expansion on PS1 by default. Thanks a bunch.

bash-powerline is affected. I've sent out a PR: [https://github.com/riobard/bash- powerline/pull/12/](https://github.com/riobard/bash-powerline/pull/12/)

My own fork (with some additional features) is already patched: [https://github.com/Hexcles/bash-powerline](https://github.com/Hexcles/bash- powerline)

</comment><comment><USER7> Since branch name parsing is done by a lot of scripts, and I can't control the default branch name, I've installed this global post-checkout hook for now until I can stop panicking and think clearly.

        #!/bin/sh
        prev_head=$1
        new_head=$2
        changing_branch=$3

        REPO_DIR="$(git rev-parse --show-toplevel 2>/dev/null)"

        if [ "$changing_branch" = 1 -a "$prev_head" = "0000000000000000000000000000000000000000" ]; then
            new_head_name="$(git name-rev --name-only "$new_head"|sed -e 's|`|_|g' -e 's|$(|_|g')"
            new_head_name_untaint="$(git name-rev --name-only "$new_head"|sed -e 's|`|x|g' -e 's|$(|x|g')"
            if [ "$new_head_name" != "$new_head_name_untaint" ]; then
                echo "
        DANGER! INSECURE BRANCH NAME.
        ">&2
                git name-rev --name-only "$new_head"

                echo "
        MOVING $REPO_DIR TO TRASH.
        ">&2
                mkdir -p ~/.Trash
                mv "$REPO_DIR" "$HOME/.Trash/${REPO_DIR##*/}.$(date +"%Y%m%d%H%M%S")"
            fi
        fi

</comment><comment><USER18> Dang. Unfortunately I am not vulnerable, and I use default ohmyzsh.

This is a neat bug, though. Lots of package managers have similar problems, and I would not be surprised if there's a lot of git/shell/environment problems left to find.

<comment><USER19> Why is it unfortunate that you're not vulnerable? Isn't that a good thing?

<comment><USER20> He's an applications security researcher. That stuff is fun for him.

</comment></comment></comment><comment><USER21> Neat. My fancy Git prompt is a program I wrote in C, though. I'm sure it's vulnerable to something, but not to this. Maybe it should escape shell metacharacters in branch names, though.

</comment><comment><USER22> Nice find. Luckily I am hyper-paranoid about escaping, so even though my custom jankery is probably not as performant as it could be, it's not vulnerable to this or similar exploits.

</comment><comment><USER7> This is worrisome. Even carelessly trying to checkout a branch named like that is vulnerable without a prompt being involved:

        git co -b foo <Tab> to complete branch names
        git co -b foo $(./pw3n) <- execution right here

</comment><comment><USER23> Liquid Prompt [0] seems safe.

[0] [https://github.com/nojhan/liquidprompt](https://github.com/nojhan/liquidprompt)

</comment><comment><USER24> My OSX shell prompt is vunerable, I'm using zsh, oh-my-zsh, and powerlevel9k/powerlevel9k as my theme.

</comment><comment><USER25> Forgive me if I'm misunderstanding the vulnerability, but isn't this one of Raymond Chen's "It rather involved being on the other side of this airtight hatchway" exploits? That is, any commands you run has the same permissions as you have.

Now, I understand that you may not intimately understand 100% the code of the commands and shell extensions you use, but is that a "vulnerability"?

<comment><USER26> The privilege escalation is from "can push code to a repository that you pull from" to "can run code as you". The idea is that you trust the shell extension you're using, but a particular git repo exploits a vulnerability in that shell extension.

git cloning code vs. running code is sometimes a security boundary and sometimes not. For instance, if you go cd into that directory and then run make or ./configure or ./setup.py install or docker run or something, then yeah, you've removed that boundary. But in general, it's reasonable to keep the boundary there. Perhaps you're doing code review of code by an untrusted author, either of someone else's project or of a pull request to your own project. Perhaps you're packaging up the software to run it as a less- privileged account. Perhaps you're a sysadmin helping a user figure something out. And so forth.

<comment><USER25> Thanks for the explanation.

</comment></comment></comment><comment><USER27> Confirmed that the official git prompt for Fish is not vulnerable.

<comment><USER28> edit: nevermind - pbkac, does not appear to be vulnerable !

Did you try creating a branch called "(./pw3n)" ?

I'm running fish with git-radar. I'm not vulnerable to that specific attack but to a similar one with the branch name (./pw3n)

</comment></comment><comment><USER29> ohmyzsh `pure` theme is vulnerable, most of the other themes seems fine to me, but no theme is safe when using ohmyzsh in tmux.

</comment><comment><USER30> only allowing know characters is a simple fix: branch=${BRANCH//[^a-z0-9\/]/-}

</comment><comment><USER31> git for windows seems to be fine.

</comment><comment><USER32> bash-git-prompt is vulnerable.

</comment><comment><USER33> ohmyzsh is vulnerable.

<comment><USER34> Didn't work for me - I'm using oh-my-zsh in iTerm2, and I'm just using the git plugin & a custom theme, nothing else. Maybe we're using different plugins?</comment></comment>


Show HN: Anyway – A live feed of stuff going on around you, kind of like Yik Yak - <AUTHOR> https://www.getanyway.com/ <comment><USER2> A yik yak clone, what could go wrong?

[https://www.gimletmedia.com/reply-all/9-yik- yak](https://www.gimletmedia.com/reply-all/9-yik-yak)

<comment><AUTHOR> :)

[https://www.media.mit.edu/publications/tracking-the-yak- an-e...](https://www.media.mit.edu/publications/tracking-the-yak-an-empirical- study-of-yik-yak/)

</comment></comment><comment><USER3> Whats the point of pasting this second time in 24hour span?

<comment><AUTHOR> The first didn't link the Android version.</comment></comment>


Russian cosmism - <AUTHOR> http://en.wikipedia.org/wiki/Russian_cosmism

<comment><AUTHOR> P.S. I found out about this movement while looking up Konstantin Tsiolkovsky [1], a remarkable figure on his own.

[1] [http://en.wikipedia.org/wiki/Konstantin_Tsiolkovsky](http://en.wikipedia.org/wiki/Konstantin_Tsiolkovsky)

</comment><comment><USER2> I always found the concept of noosphere very cool.

[http://en.wikipedia.org/wiki/Noosphere](http://en.wikipedia.org/wiki/Noosphere)

I remember reading about it one of the ex-Soviet popular scientific journal (Yuniy Tehnik, or Tehnika Molodyoji, don't remember). And it was kind of facsinated by it.

Perhaps Solaris presents ([https://en.wikipedia.org/wiki/Solaris_%28novel%29](https://en.wikipedia.org/wiki/Solaris_%28novel%29)) kind of an extreme manifestation of it -- a whole planet that works as one unified mind.

</comment><comment><USER3> Yeah, that's why they are engaged in genocide against other peoples - Georgians, Ukrainians, Crimean Tatars, Chechens, etc.

[http://en.wikipedia.org/wiki/Deportation_of_the_Crimean_Tata...](http://en.wikipedia.org/wiki/Deportation_of_the_Crimean_Tatars)

[https://en.wikipedia.org/wiki/Operation_Lentil_%28Caucasus%2...](https://en.wikipedia.org/wiki/Operation_Lentil_%28Caucasus%29)</comment>


Javascript Bitcoin Miner - <AUTHOR> http://forum.bitcoin.org/index.php?topic=9042.0 <comment><USER3> It is bad to use a bunch of the user's CPU without any notice. They will probably notice that your site makes their computer slow and never come back again. Also, once they find out you've been using their CPU power/electricity/battery life surreptitiously for private, unshared gain, you will probably have some angry customers.

Additionally, does this automatically hook in to slush's pool or something? Bitcoin mining is practically useless on CPU; even the fastest CPUs out get way, way less than 10mhash. The average length of time to find a block at 9999khash and current difficulty is 1200+ days, so even that estimate is over- optimistic, so this isn't worth anything if your users don't sit on your site for 5 years+, unless it's hooked into a pool or some other contraption to pay on shares instead of blocks.

<comment><USER4> Interestingly, from post #9:

      Chrome13-canary: ~15.2k/s
      FF4: ~6.4k/s
      Safari5: ~6.2k/s
      IE9: ~1.6k/s

So yeah, massively massively slower than regular GPU mining. Anyone know of a way to push WebGL into doing hashing functions, and reading the results out?

<comment><USER5> Cribbing from post #35:

 _And you come to a total of 21,600,000 unique visitors per day that you would need to your website in order to hash the equivalent of a $100 GPU.

Or make about $8 per day according to the bitcoin calculator right now from 21 million unique visitors.... totally not worth it._

So, yeah. Significantly crapping on the user experience of 21M people by reducing their battery life, adding heat, adding fan noise, slowing down other actions - all to substitute for one gpu?

It seems like there must be better ways to ruin your high traffic websites reputation if that's what you're looking to do.

</comment></comment></comment><comment><USER6> Regarding angry visitors, I think it is completely fair if you just inform them of what is going on.

In a way, this is the perfect internet model: I offer my content for free but visitors pay me with cpu cycles. It's superior to the ad-model because it pays according to time spent on the page regardless of who the audience is.

It's too bad that it's infeasible because of the very low rate.

<comment><USER7> Why does time spent on the page matter?

<comment><USER8> It corelates to value derived from the page.

SO the people I deliver the most value to, I extract the most value from. // WIth an added bonus that I recieve more value from the people with more expensive computers (aka the wealthier viewers)

<comment><USER7> I don't see how the time spent on a page correlates to value for the reader. If I read faster or slower than someone else and spend less or more time on the page, it doesn't change the value provided to me by the article.

<comment><USER9> On the other hand, if a site provides more value to a visitor, they are more likely to keep spending more time on the site.

</comment></comment></comment></comment></comment><comment><USER10> Going meta:

I've seen in the last few weeks apparently relevant and polite posts that had been flagged dead[1]. One of these was a post by jashkenas in a CoffeeScrit thread. This one could hardly have been more on topic.

Is there a new moderation policy, or is it a bot with a happy trigger?

[1] In this thread, <http://news.ycombinator.com/item?id=2566826> , a post by jhuckestein, and <http://news.ycombinator.com/item?id=2566797> by csomar.

<comment><USER5> I'd be curious to know the answer to this too - I've seen an increase of "one off" seemingly acceptable posts being flagged dead, and browsing their post history it wasn't cases where they were set to auto-dead.

</comment></comment><comment><USER11> Javascript is way too slow compared to GPU, by at least a factor of 1000 or more. If you have 1M daily unique visitor and you manage to "steal" 10 CPU seconds from each of them, the amount of work would be equivalent to 1e6 * 10 / 1000 = 10000 seconds which is about 2.8 hours of one dedicated GPU-based mining machine.

<comment><USER12> Actually, regular CPU miners are nearly 1,000 times slower than GPU miners. I wouldn't be surprised if a JavaScript miner was several orders of magnitude slower than _that_ (ie. a million times slower than GPU miners).

What about using gamers' excess GPU to mine Bitcoins in an installable massively-multiplayer game? Is anyone trying this?

<comment><USER13> I wonder when will the bitcoin mining viruses appear. If done stealthily they could use spare resources and fall back when other GPU/CPU intensive task is launched. Such virus could be quite profitable if it spread widely enough.

<comment><USER4> And easily detectable by owning a laptop (that burning sensation isn't a UTI) or having fans in your computer (harder to tell if you live near an airport).

</comment></comment></comment></comment><comment><USER14> You need a year's worth of 3ghz dual core cpu power to make 50 bitcoins.

This is some impressive code but not practical.

And I don't think visitors are going to like you maxing out their cpu.

<comment><USER15> I know plenty of women who spends hours a day playing casual games, if you embedded a bitcoin miner into a free facebook game you might be able to generate some decent revenue while they play.

<comment><USER12> Why not embed a Bitcoin miner in a regular, installable MMO game and use their _GPU_? A single gamer's GPU could be worth more than thousands of casual gamers' browsers. Also, MMO gamers can be just as "dedicated". Bonus points for using Bitcoins as an in-game currency.

<comment><USER4> Now _that_ is an idea. Make it a casual game, though, so the GPU use of the game is minimal, maximizing the mining GPU cycles. MMO & other often-graphics- heavy gamers tend to be a bit fussy about framerates.

<comment><USER16> Unfortunately, the people who are going to spend a lot of time playing casual games and the people with chunky GPUs are (in my opinion) not likely to overlap very much.

<comment><USER4> Good point. Though even cheap modern cards have a decent amount of horsepower - the main cost-cutting is shared memory, which doesn't play much of a role in mining. I can mine close to 1/10th of a coin (on Slush's pool) overnight on my laptop; multiply that by a few thousand, accounting for only gaming time, and it's a not-insignificant source of income without even getting very large. 1 block / 50 coins are worth a few hundred US$ right now, and it's entirely passive on the receiving end.

</comment></comment></comment></comment></comment></comment><comment><USER17> Great. So now we will have to start blocking Javascript code from sites we don't trust.

<comment><USER18> I've been doing this for a long time with the Ghostery firefox plugin. It blocks all kinds of trackers and other dubious stuff.

</comment></comment><comment><USER19> Neat! Distributed computing with JS is an awesome tech trick, some friends and I did something similar back during Node Knockout (MapRejuice: <https://github.com/ryanmcgrath/maprejuice>).

Curious to see what you guys think of the ethical side of it though - do you let this run on mobile, etc? This will almost definitely cause extra battery drain on mobile devices, you think it's fine to have this happen without user consent? ;)

<comment><USER20> BitCoin mining could replace banner ads. I have Flash on my mobile, which often uses lots of CPU usage for ads. You could argue this is the same.

<comment><USER19> Yeah, you could argue this... and then we could just point out that Jobs & co are right, and Flash has been a battery hog since the dawn of time. This is a reason why the iPhone can be so performant; you're arguing that it's perfectly acceptable to degrade the otherwise shockingly good performance of a mobile device when it can be avoided entirely.

Flash needs to stay out of this argument, as at the end of the day it's still a real _ethical_ question - how much CPU are you realistically allowed to take and continually use from a user visiting your page?

</comment></comment></comment><comment><USER21> If there is a Bitcoin bubble you can be sure that there will be people doing things like this, regardless of whether it's ethical or not. From the site visitor's point of view they're not getting a cut of the mined coins, so their high CPU usage is purely a waste and annoyance. If widely deployed, this sort of browser based CPU wasting enterprise could bring Bitcoin into disrepute and be an excuse for governments to treat it as a cyber-threat.

<comment><USER22> banner ads are also, on the whole, a waste and annoyance; so not much of a change there

It is probably fair to say most people don't care all that much provided their user experience is not noticeably impacted, but it looks like this work is failing to deliver in that respect. If they manage to throttle CPU usage effectively then this is at least a semi-feasible alternative to "monetizing" traffic.. I find that quite interesting conceptually, even if it doesn't work in practice at the moment.

<comment><USER21> I suppose it's a question of degree. If not too much CPU resource is consumed then perhaps it is an acceptable way to monetize web sites - although this would only work for high traffic sites, and would become less lucrative over time. There is a bit of a moral hazard though, in that it would be in the interest of the host to consume as much client CPU resource as possible, without rendering their browsing experience too unpleasant.

</comment></comment></comment><comment><USER23> Idea for browser extension: display warning icon if tab uses all cpu.

<comment><USER24> So what you're saying is that my FF has being doing this for the last 7 years ...

</comment></comment><comment><USER25> The source of their miner: <http://dpaste.com/hold/544515/>

It actually starts up a web worker with the exact same file and communicates with itself back and forth, the browser version to the worker version. Not the first time this technique has been used but it's still pretty new.

</comment><comment><USER26> Cute, but this is hardly worthwhile unless you have a massive number of users, in which case you probably don't want to piss them off by wasting their CPUs.

I'm getting about 13K hashes/sec with this JavaScript miner. For comparison, my GPU gives me _100M hashes/sec_ , and even my 12 CPU cores give me 10M hashes/sec with the official Bitcoin client.

So you'd need about 1000 concurrent users at all times to match a single machine. EngineYard SHA1 contestants who used this approach had the same problem.

Now, if Native Client was widely deployed, or you could somehow rig up WebGL...

<comment><USER27> Which GPU do you have?

</comment></comment><comment><USER28> PluraProcessing.com pays site owners to farm out computations to their clients. According to PP, site owners can make about $2.60/month/user. The major catch is that the system only works well when visitors have long visit durations (e.g. web-based video games). I presume PP necessitates long visit- durations because short visits won't yield enough computational resources to make computations economical.

</comment><comment><USER29> Very interested to see if this could actually be an alternative to ad revenue.

<comment><USER30> Using <http://www.alloscomp.com/bitcoin/calculator.php> :

On my computer (netbook running Chrome in Ubuntu), bitp.it clocks at 2.2khash/sec. Using this, I'll give 2000hash/sec/user as a conservative estimate.

If you had 1M daily visits, averaging about 1 minute of interaction (high, but assuming you have long-form content), you'd have 12000Mhash/day, or about 2.77Mhash/sec.

Plugging this in with current rates, this ends up being $0.08/day. For 1M views. This is about 3 orders of magnitude lower than just AdWords.

<comment><USER31> Perhaps this means that bitcoin is currently undervalued by three orders of magnitude.

<comment><USER32> Or that AdWords is three times as good as bitcoin for revenue generation.

</comment></comment></comment></comment><comment><USER33> So why does the bitcoin economy reward spending processing power?

I guess our economy does too (quant finance)

<comment><USER34> Because you need some way to inject new coins into the system initially. Bitcoin chose to do this by allowing early users to "mine" the currency.

The traditional approach is to have a central bank which does the minting and printing, and then the regular banks can borrow that money. Those banks then lend that money to their customers, possibly creating more virtual currency by fractional reserve banking.

Bitcoin obviously can't do that because it is a decentralized system. The traditional approach also has the disadvantage that all currency in circulation is ultimately borrowed, so there is always more debt than money unless you allow banks to default. That can only work as long as the economy is growing fast enough.

I think there are even better alternatives, by modeling currency after trust and social capital: <http://ripple-project.org/decentralizedcurrency.pdf>

<comment><USER35> You should know that people have been trying reputation-style digital currencies since at least the early nineties. They require a ton of bootstrapping to get anywhere. That's because you end up with a trading system that's looks like a foreign exchange market with 7 billion different floating currencies. And that's assuming only individuals have them, excluding corporations. You'll notice old cypherpunks have a lot of skepticism toward the fiat-currency arguments against bitcoin. We've been trying to make fiat- currencies work. Keeping the rep net up to date is at least as expensive as mining bitcoins, but with none of the hard-crypto backing to the algorithms. And it's way more opaque. That's ideal if you're trying to soften shocks across a national economy. It's less ideal if you've got more self-serving interests than eyes.

Bitcoin isn't perfect. But we can test it, and if it breaks, we'll see quickly. Broken rep-net economies are like building markets on pyramid schemes: people have an incentive to pretend it still works until the damage is orders of magnitude larger than the economy proper.

And I encourage you to investigate what fractional reserve banking looked like in the days of specie-backed-currency. Banks still made loans and kept less than the entire value of their demand accounts on hand. It'll be weird, but there will be an M2 and an M1 in bitcoin, we aren't technically limited to an M0 money supply.

</comment></comment></comment><comment><USER36> Anyone care to calculate the actual expected revenue you could get from this?

<comment><USER37> If you have an average consumer box and leave this running during the day, a few USD a year at current exchange rates.

<comment><USER13> Not even that much. On my old laptop I get a little more than 1000 hash. Assuming that average computer is twice as fast as mine we get 2 khash/s. Inserting it in the calculator [1] shows that it would take 6068212 days on average to calculate one block of 50 bitcoins. That is 332.5 years per bitcoin. At current rate it means $0.02 per year.

[1] <http://www.alloscomp.com/bitcoin/old_calculator.php>

<comment><USER37> I stand corrected, thanks.

</comment></comment></comment></comment><comment><USER38> on the ethics of this thing - most people seem to think that using a users cpu without permission is unethical.

My browser is often brought to it's knees by badly written flash ads - <USER2> there a difference?

<comment><USER39> There is no difference. That's why people who want to retain their sanity disallow Flash. And it's really fucking close that I don't disable all JS too.

</comment></comment><comment><USER20> Someone could make a URL shortening service that frames sites, including the mining JS. Users could sign up and get a % from the mined coins on links that they share.

As many people are pointing out that GPUs are faster for mining that CPUs, would you be able to make use of a GPU with WebGL (or GPU-accelerated Flash)? I guess the GPU computations don't fall in the spec of WebGL though.

<comment><USER40> I think a bitcoin browser plugin would be the sanest choice

<comment><USER35> We thought so too! But then we realized that if you're going to download and install a miner, you probably want one that's actually fast. Browser plugins, which are almost all javascript these days, are basically the worst of both worlds from that perspective: slow and require manual installation.

</comment></comment></comment><comment><USER41> If this gets more people to install noscirpt, I'll consider it a good thing.

<comment><USER35> I hadn't heard of that! I'll be sure to mention it on our opt-out page, along with adblock.

</comment></comment><comment><USER42> Idea: Screensavers with a bitcoin miner. Like SETI@home. Bitcoin@home!

<comment><USER43> But who would get the coin?

<comment><USER4> I'd imagine a particularly good screensaver would be profit-sharing, but everyone else would run a free one and get all the mining income. Solo-mining is not really an option any more, and it'd be easy to cheat (detect wins & claim for yourself), so it'd have to be pool-based to be useful.

</comment></comment></comment><comment><USER44> On my machine with chrome, I had to open it up in 4 separate tabs in order to peg all of my cores. It got pretty warm pretty quickly.

</comment><comment><USER45> How long till Adblock adds a bitcoin-block? Can't be soon enough imo.

<comment><USER35> We're looking into the best way to let adblock users turn us off, as well as a cookie based opt-out.

</comment></comment><comment><USER46> Bored with bitcoin. One technical flaw and your 'currency' vanishes.

<comment><USER35> Fortunately, that's not actually true. If the community agrees when the last valid block is, all the transactions before that will be accepted as trustworthy. The DHT (now moving to freenet) ensures that this transaction history is reliable up to the date of the exploit. Then it's just a social problem of converting into a less flawed system.

But social problems tend not to end up as near the worst case as is often feared. What you're describing is like saying that if we break the crypto underlying git repositories, you can trick the world into thinking you are the original author of linux. Obviously, no one would fall for that. But every git commit after the exploit, or from sources lacking a large consensus, would be of suspect authorship. It's a big problem, but not exactly the way you imply.

</comment></comment><comment><USER47> Just don't end up like this guy who lost $50k USD in Bitcoin earlier today.

<http://helpingmarak.net>

</comment><comment><USER48> I hope this doesn't catch on. BItcoin got many merits against current currencies. This wouldn't be one of them.

That said, it's a nice proof-of-concept. Is there anyway to block this type of use of CPU without blocking JS?

<comment><USER49> Sure. Set noscript to block-by-default, and don't allow script execution from malicious domains.

</comment></comment><comment><USER50> what if a virus or malware or an adware installs a bitcoin miner and starts mining on zombie machines? wouldn't that be productive?

<comment><USER10> It is technically the biggest threat against Bitcoin.

The mining process validates the transactions. Transactions are grouped in blocks. The blocks are chained in one big sequence and the miners validate the block chain.

Even if a rogue miner validates a block that steals coins, his fork of the block chain will not be validated by honest miners. As long as the computing power of the honest miners is above the one of an attacker, the block chain is safe.

A dishonest, big enough botnet could overpower the honest miners, fork the block chain and wreak havoc in the system.

\--

The biggest threat to bitcoin is not technical, though, it is financial. The bitcoin market cap is currently of ~ $50M. If people with deep pockets and trading experience figure that bitcoin is a threat to their deadline, they can easily manipulate the market and crash it.

<comment><USER13> What would a scenario of such financial attack look like? Suppose I had $100M - twice the bitcoin market cap. What would I be able to do to destroy the bitcoin?

I can think of ways to manipulate bitcoin market with large sums of money, but nothing that would make bitcoin unusable.

<comment><USER51> You'd buy as many BTC as you can (probably slowly over time), then sell them all at once for a very low price. Momentum traders would help you by also selling their BTC when the price starts dropping.

<comment><USER13> This is the strategy of cornering the market and according to wikipedia [1] "very few attempts to corner the market have ever succeeded; instead, most of these attempted corners have tended to break themselves spontaneously"

In fact, I think such attack would only create a short term volatility spike but make bitcoin market sturdier in a long term.

In first phase of the attack you would pour in huge amounts of liquidity which would attract more people to bitcoin market.

In the selling phase of the attack you would cause a temporary market panic but only for as long as you sell. And if bitcoin market players managed to find out about what you are doing, they would profit from it.

Finally, when you are out of money, the market would return to its normal course.

[1] <http://en.wikipedia.org/wiki/Cornering_the_market>

</comment></comment></comment></comment></comment><comment><USER50> Just used google's closure compiler <http://closure-compiler.appspot.com/home> on <http://bitp.it/jsMiner.js> and it saved some 4.11%. While compiling on advanced mode i get lot of warnings.

<comment><USER52> If you take the output of the Closure compiler and run it through the compiler again, it will almost always be smaller the second time. However, the second will also likely produce javascript that doesn't work because it renames things that shouldn't have been renamed (and only the original source contains the information necessary to determine what shouldn't be renamed).

The 4.11% reduction you experienced is likely gained at the expense of invalidating the code.

</comment></comment><comment><USER53> This is a neat-trick, and I ♥ Javascript, so even better.

In terms of ramping this up to actually be a viable revenue source... I guess you'd need a browser plugin which was hard-core about making sure you agreed to usage, and verified to the server that you were actually doing the mining you'd agreed to - and that could tap in to the GPU.

But then, if Bitcoins become worth something meaningful, wouldn't we all be using our GPU most of the time to be generating them anyway? In which case, the website starts asking you for the opportunity cost of using your GPU instead, and you know how much that's worth, and boom, micropayments.</comment>


Awesome Command-Line Tools - <AUTHOR> https://www.vimfromscratch.com/articles/awesome-command-line-tools/ <comment><USER2> See also this post from a few days ago:

An Illustrated Guide to Useful Command Line Tools (wezm.net) [https://news.ycombinator.com/item?id=21363121](https://news.ycombinator.com/item?id=21363121)

And these older posts:

Less Commonly Used Unix Commands (danielmiessler.com) [https://news.ycombinator.com/item?id=7252176](https://news.ycombinator.com/item?id=7252176) Seems to be down so here's a Wayback link: [http://web.archive.org/web/20190311200305/https://danielmies...](http://web.archive.org/web/20190311200305/https://danielmiessler.com/blog/collection- of-less-commonly-used-unix-commands/)

Cool, but obscure Unix tools (kkovacs.eu) [https://news.ycombinator.com/item?id=2567186](https://news.ycombinator.com/item?id=2567186)</comment>


Mental Models I Find Repeatedly Useful - <AUTHOR> https://medium.com/@yegg/mental-models-i-find-repeatedly-useful-936f1cc405d <comment><USER2> This is probably the single most useful post that I have ever seen.</comment>


Dual-touch smartphone design concept - <AUTHOR> http://blog.assaflavie.com/touch? <comment><USER2> Ok, try picking up your phone and trying out the movement on the back of the phone that this would require. It doesn't work. If the majority of the phone is touch sensitive how are you supposed to hold it? It makes for really awkward movement of your hand and let's say you figured out how to get the scrolling down, you still have A HUGE issue of UI. The iOS experience nor its apps were made for any kind of cursor or mouse interface.

If you need to reach across the screen without taking up screen real estate, use your other hand. Or use a stylus. Problem solved.

Edit: Also not to mention that for the most part iOS does a pretty good job of letting me be pretty accurate with my bulky fingers. It's not perfect, but it's certainly not terrible.

<comment><USER3> My hand is in contact with the touchpad on my laptop almost constantly, but this rarely causes any unintended interaction.

<comment><USER4> I had to turn off touch to click on my MacBook Air because I often brush the pad with the heel of my hand while typing, causing the OS to refocus on wherever the cursor happened to be.

<comment><USER5> Isn't it off by default?

I like the physical click way better, in any case.

</comment></comment></comment></comment><comment><USER6> Sony has already released a gaming console with this feature, the PS Vita. [http://www.modojo.com/features/playstation_vitas_rear_touch_...](http://www.modojo.com/features/playstation_vitas_rear_touch_pad_putting_it_to_great_use)

<comment><USER7> It's of limited use though.

The only game as far as I'm aware that properly makes use of it is Tearaway, but even then it only appears in a few places and was kind of awkward to control properly.

<comment><USER8> The Little Big Planet games use it too, in a more limited manner.

It is in fact awkward to use, IMO, and not just because of the software or Sony's implementation.

There are at least two big problems with it:

One is that it is really difficult to do Wacom-pen style hovering of a "cursor" on a capacitive surface with finger input in a way that works well universally for everyone without a lengthy and awkward calibration. And because of the non-direct method of interaction using your fingers on the back gives you, you really need some sort of non-action hovering indicator for this setup to work well.

The other is this: Put your hands in the positions shown in the original article. Now try moving your your index and middle fingers around as if touching the back surface of a device and try not to move your thumbs (and wrists) all over the place involuntarily. For most people this is difficult. When you are tightly gripping a device this becomes less of a problem but still contributes to the whole thing feeling very uncomfortable and unstable.

I'm nearly positive that various companies like Apple must have tested something like this out (either before/after the PS Vita) for a phone and just found it to be a poor solution when implemented in a real-world prototype.

</comment></comment></comment><comment><USER9> "LucidTouch: A See-Through Mobile Device" by Daniel Wigdor, Clifton Forlines, Patrick Baudisch, John Barnwell, Chia Shen. Published at UIST 2007.

paper: [http://www.cliftonforlines.com/papers/2007_wigdor_lucidtouch...](http://www.cliftonforlines.com/papers/2007_wigdor_lucidtouch.pdf)

video: [https://www.youtube.com/watch?v=qbMQ7urAvuc](https://www.youtube.com/watch?v=qbMQ7urAvuc)

<comment><USER10> And more on this topic: "Back-of-device Interaction allows creating very small touch devices" by Patrick Baudisch, Gerry Chu (CHI 2009):

[http://patrickbaudisch.com/projects/nanotouch/](http://patrickbaudisch.com/projects/nanotouch/)

</comment></comment><comment><USER11> As I understand it, the PlayStation Vita has a rear touchpad. I've never used one, does anyone who has care to comment on how well it works?

<comment><USER12> I have a Vita, but the only game I've played that uses it is Tearaway. This game doesn't use it for precision navigation or selection, so it's hard to say how well a rear touchpad would work for that. Tearaway employs the rear touchpad for tapping to jump and pushing objects around. For that, it's surprisingly effective and adds a fun--if gimmicky--element to the gameplay. The Vita is quite a bit larger than most smartphones, and I could see problems with differing hand sizes requiring people to adjust their grips to use its entire surface--probably not as much of a problem on a phone. The Vita is played two-handed. I think a one-handed grip while using the rear touchpad on a smartphone would be more difficult as your finger's range of motion is limited. The OP article seems to anticipate this by focusing on small gestures rather than ones that would take your finger across a large surface.

On a tangent [Tearaway Spoiler Alert]...when beginning the game, Tearaway asks you to select your skin tone from a few presets. Knowing nothing about the game at that point, I thought that was really strange. I recall thinking, "I don't really care whether my character has my skin tone...and it's really odd that they'd presume that I would." But it turns out, that's not what the skin tone selection was for. In Tearaway, you use the rear touchpad to punch your fingers through the paper backdrops of the game to manipulate things. The first time I did this and they showed "my" fingers in the game, I was startled for a split second and then laughed out loud. Screenshot of the effect: [http://media.officialplaystationmagazine.co.uk/files/2013/11...](http://media.officialplaystationmagazine.co.uk/files/2013/11/20131101-tearaway- review-20.png)

It's more magical live as your virtual in-game fingers track the position and angle (angle presumably by extrapolating based upon the current finger position and average hand size/grip) of your actual fingers surprisingly well.

</comment></comment><comment><USER13> The Notion Ink tablet originally had this back in 2010. It was disabled and eventually removed entirely. There were rumors that it was squashed by an apple patient, but I cannot find anything more substantial.

The whole NI tablet debacle made me quite jaded towards miracle tech. I'm lucky it predated kickstarter, because I would have most likely backed it up to 50% over retail. It's probably why I don't own a 1st gen pebble.

Here is a good overview of the concept's rise and fall: [http://www.engadget.com/tag/NotionInk/](http://www.engadget.com/tag/NotionInk/)

<comment><USER14> it is one of those things that seem perfect on paper. and may even be good for the power user. but everyone knows that power user and consumer hardware are not a good match.

you are right about the apple patent. Apple bought fingerWorks in 2005 and killed ALL the loved product lines (of note, one keyboard that was in its entire area, a touchpad). apple sit on top of the company's IP assets and used it for nothing but suing people. ...and people still wonder why i avoid any apple product..

anyway, eventually the touch screen tech made it to the iphones. or so they say. but if you compare the fingerworks tech on the few shipped keyboards and the iphone resistive touchscreen, they have little in common. apple was just trolling everyone with the patents and killing innovation all around.

but since fingerworks was dead since 2005 thanks to apple, several other companies with employees that probably never even heard of finger works developed this idea... nokia as you mention. sony with psp. motorola with the backflip (which being one of the first AT&T exclusive android phones suffered of having the worst crap of custom android ROM that ever saw the light of day). And more recently the Oppo N1 already have the very same implementation idea mentioned in the article, and is in production. but you don't see anyone rushing to the stores.

</comment></comment><comment><USER15> as others have mentioned it's not a new idea. i think the reason you don't see it in Apple products at least is because it is a step backwards in terms of metaphor. the iPhone's core metaphor is direct manipulation. this requires that your brain visually connects the motion of your finger with the objects on screen. if you manipulated things via the back touchpad, this illusion would be broken and it would feel more like interfacing with a traditional computer and less like direct manipulation.

<comment><USER16> That sounds like the reason Apple refused to use a hardware button to trigger the camera shutter, but thankfully they caved on that one and I can take a photo without having to guess where I'm tapping the screen.

I'd rather see companies trying out ideas that might work instead of just sticking to their metaphorical guns.

<comment><USER15> Well every design change is a trade off. Breaking metaphors, all other things being equal, is bad. The fact that the author here identifies an on screen cursor as a use case probably is enough to strike fear in any apple designer that this would lead to a regression in ux.

</comment></comment></comment><comment><USER17> How about instead of a 1:1 touchpad on the back, which could have problems, Put a trackpad on the back of the phone, but have it just be a small square. So it wouldn't be a "full-fledged" touchscreen, but a small touch sensistive section. You could also have a discrete capacitance detecting sliver on the side of the phone so that it's only active if you're physically holding the phone. Clicks would happen using a button.

<comment><USER18> Why does it have to be on the back? Some old Android phones had a trackball (or an optical sensor like on a mouse) to be used as a sort of cursor. The Palm Pre had a small touch sensitive area below the screen that could be used for OS specific gestures (much better integrated than what Android used the trackball for IMHO).

All of these ideas are pointing to the issues in the use of a touchscreen as input (imprecise, blocks screen during use, etc), yet for some reason they keep getting used (and even taking over regular buttons).

I hope that this decision is being tested by the companies HCI departments, but I worry that marketing is deciding that changing the input would be too much of a risk (or cause fragmentation).

</comment></comment><comment><USER19> Apple, Google, and others have patented concepts around this. No clue whether they're working on them...

[http://www.slashgear.com/google-patents-rear-touch- controls-...](http://www.slashgear.com/google-patents-rear-touch- controls-6-years-after-apple-09273179/)

[http://appft1.uspto.gov/netacgi/nph- Parser?Sect1=PTO1&Sect2=...](http://appft1.uspto.gov/netacgi/nph- Parser?Sect1=PTO1&Sect2=HITOFF&d=PG01&p=1&u=%2Fnetahtml%2FPTO%2Fsrchnum.html&r=1&f=G&l=50&s1=%2220070103454%22.PGNR.&OS=DN/20070103454&RS=DN/20070103454)

</comment><comment><USER20> I suspect that Apple, Samsung, etc. have thought of this, so why aren't they doing it? (After all, the PS Vita has had a back touchpad for a while.) The first thing that comes to mind is that people hold their phones with the back. Accidental clicks would be very difficult to avoid. In contrast, the PS Vita is larger, held with both hands and has non-touchpad areas of the back where you can grip it, as I understand.

I'd still like to see someone try it.

<comment><USER21> People also use their phone with a case

</comment></comment><comment><USER22> Sony put this into the Playstation Vita and it's awful. Few games use it, and it's clumsy in the games that do. It's possible that a company like Apple could make it good somehow, through sheer will and hardware/software expertise, but I suspect it's just not a good idea in practice even if it's good on paper.

Based on my limited experience, some potential issues:

Not having the user's fingers obscuring the view of the screen may in fact increase the perceived latency, since they're focused on the screen and don't have the motion of their fingers to distract them.

The latency issue would be twice as bad if you want to render a 'ghost' of your hands on the screen as described in this design concept.

Interacting with onscreen elements is _more_ difficult when using your hands on the rear of a device, even with a 1-1 mapping. I don't really know why this is, but even with a cursor onscreen, I have found it to be true.

Accidental interaction is 5 times worse with a rear touch panel. Apps on the Vita that use it extensively are a huge pain in terms of accidental swipes and touches, especially if you try to lay the device down on a surface for a moment, or set it on your knee to use the front touch panel.

The core problem with virtual buttons/joysticks/gamepads is that you have no physical feedback about where your fingers are, and as a result you lose your 'centering' and your inputs end up being misinterpreted or not landing. Moving your fingers to the rear of the device makes this worse, because you can no longer look at your fingers to figure out where they are.

</comment><comment><USER23> I don't know anything about how well this works or how well it was made:

DOOGEE DG800 : sub $120 smartphone with dual touch : [http://www.pandawill.com/doogee-valencia-dg800-smartphone- cr...](http://www.pandawill.com/doogee-valencia-dg800-smartphone-creative- back-touch-android-44-mtk6582-45-inch-otg-p89140.html)

</comment><comment><USER24> The first thing that came to mind was the Nokia Gem concept from around 2011:

[http://conversations.nokia.com/2011/11/10/nokia-gem-what- sor...](http://conversations.nokia.com/2011/11/10/nokia-gem-what-sort-of- phone-do-you-want-today/)

The whole thing was a touch screen.

Here's an Engadget article on the Nokia concept with a fair amount of comments:

[http://www.engadget.com/2011/11/11/nokia-gem-concept- dazzles...](http://www.engadget.com/2011/11/11/nokia-gem-concept-dazzles-with- excessive-customization-options/)

</comment><comment><USER25> Sensus ([http://sensusxp.com/](http://sensusxp.com/)) is working on something similar as an external case for the iPhone. Dislaimer: I have a dev kit.

</comment><comment><USER26> > "The biggest problems is that your fingers are not transparent. They obscure > the screen."

I've _never_ realized this was even a problem, much less the biggest one.

<comment><USER27> Yeah, my biggest issue with touch screens by far is the lack of precision. This point seems a bit silly as your fingers typically move fast enough to allow your memory to recall the image.

 _Maybe_ in games this is more of an issue, especially where you need to leave your fingers in the same position and the design of the game does a poor job of taking this into account. But those are mostly edge cases.

<comment><USER28> The problem with precision _is_ one of visibility. In my experience, the problem us that I can't see the exact spot where the device thinks my finger is because my finger is on top of it. This is at least the case with text selection.

</comment></comment></comment><comment><USER29> The Motorola Charm had a trackpad on the back of the phone. I know it could be used for scrolling, not sure if it worked in the same capacity as the dual- touch design concept. [http://www.oneprice.in/wp- content/uploads/2011/10/Motorola-C...](http://www.oneprice.in/wp- content/uploads/2011/10/Motorola-Charm-MB502-1-Optimized.jpg)

</comment><comment><USER30> The Motorola Backflip ([http://www.gsmarena.com/motorola_backflip-3079.php](http://www.gsmarena.com/motorola_backflip-3079.php)) actually had a touch pad in the back that could be used in the same way trackballs were used on Blackberries. It was pretty awful to use, though that might have been because it ran Android 1.6

</comment><comment><USER31> Makes more sense to use the front camera as an eye tracking device. Then you get a screen without obstruction. Maybe Apple is already on it:

[http://www.patentlyapple.com/patently-apple/2013/10/apple- fi...](http://www.patentlyapple.com/patently-apple/2013/10/apple-files-eye- tracking-system-with-advanced-gaze-controls.html)

</comment><comment><USER32> I think the future of smartphones are foldable either in the middle like a foldable sheet of paper or expandable flexible oled displays formed like Chinese hand fans or origami.

Further more the cell phone of the future will be able to borrow any big screen in its vicinity. Something like NFC from the large display/computer monitor and built in AppleTV, Google Chrome MiraCast functionality. You will also be able to borrow local keyboards for better input, but without the bluetooth hassles of setting it up. So the cafe, workplaces of the future will have wireless chargers and screens that you can borrow for your mobile device.

So you will carry your device around but borrow larger displays and keyboards. The device will be powerful enough todo your everyday computing. No need to drag a big laptop around if you do not want to.

These devices will also be user serviceable like Google/Motorola Project Ara. It is simply not good for the environment to throw away a whole phone just because the display, battery is bad or because you want to upgrade the radio components. So in the future devices will be made to be recyclable, this trend will be driven by the scarcity of rare earth metals. It will simply not be good enough to buy and throw devices and not think about the recycling of rare metals and the environment.

The future is bright.

</comment><comment><USER33> Now that @assaflavie has written about it, does it constitute as 'prior art' and nobody can patent it?

<comment><USER34> Exactly that. You cannot invent (patent) something that has already been invented. Now you could go ahead and invent (patent) something that builds on his ideas, as long as those ideas are a novel addition (not an obvious next step).

<comment><USER35> Isn't it first to file nowadays, not first to invent? Not that there aren't shipping phones and other devices with this already anyway.

</comment></comment></comment><comment><USER36> ... "The samples will be missing lots of implicit information such as how to install the necessary libraries and how to deal with missing dependencies and version conflicts." ..

Even people who grasp code pretty well loading up some code(stable library) needed by tutorial might get tripped up by a wrong advice such as library that was fixed for some security vulnerability that broke a number of thing that current examples need to work and failing code just misbehaves in a number of ways, one remarkable - blaming general implementation of examples that they are trying breaking security standards and not give any alternative to do otherwise. that is unless you find a reference somewhere on some obscure blog that says that you have to load specific version pre-alpha/HEAD^3 because HEAD is broken so many subtle ways that it will cause you even more pain. This happened not once and not only to me I bet. I know I could've patched my code but with the deadline and fact that I don't know much about cryptography that would not be a sane option.

<comment><USER37> Perhaps you meant to post this here?

[https://news.ycombinator.com/item?id=7760790](https://news.ycombinator.com/item?id=7760790)

</comment></comment><comment><USER38> That's a good idea and all, but you know what would be better than two touch panels? A button to turn them off!

With screens bigger than your hands and accidental touch detection being as bad as ever, a simple button to turn off the digitizer would make a lot of people happy...

</comment><comment><USER39> This seems particularly useful for very small touch screens, assuming you can comfortably hold the device without miss-clicks.

Perhaps a smart watch could even have its screen on one side of your wrist, and a "touchpad" on the other.

</comment><comment><USER40> The Notion Ink Adam tablet, from a year or two ago was going to have this feature.

</comment><comment><USER41> There was something like this at the CES (consumer electronics show). They had it with an iPad. Not sure if this is the most practical idea.

</comment><comment><USER42> The oppo n1 has a small rear touch pad.

[http://en.oppo.com/products/n1/](http://en.oppo.com/products/n1/)

</comment><comment><USER43> what about everyone who has a custom case of some sort on their phone? pretty much negates that...

<comment><USER44> Then don't put a cover on your phone? What a strange criticism: "If I make this thing not work it won't work".

</comment></comment><comment><USER45> This is the sort of content I intend to find on Hacker News. This is why I am here.

</comment><comment><USER46> The best thing touch screens have going for them, though, is direct interaction.

</comment><comment><USER47> It's impossible - until it's done. Patent it! ;-)

</comment><comment><USER48> for scrolling maybe

for gaming, most likely uncomfortable users are used to using thumbs to play rather than using their index fingers

i rather be waiting for those kind of panel-less screen

</comment><comment><USER49> Would be pretty useless if the phone has a case.

</comment><comment><USER50> Apple was working on it at some point! so as Google!

</comment><comment><USER51> Sony called, they want their PS Vita back</comment>


Ask HN: Practical formula for being relentlessly resourceful? - <AUTHOR> Paul Graham wrote that good founders are relentlessly resourceful.[1]
I am starting a startup[2], so I am wondering:
Can you make a conscious effort to get better at it? Are there conscious ways for being relentlessly resourceful?
So far I've come up with one promising technique: try to think of new clever ideas/hacks assuming their cost of failure is zero. It seems to work. It allows you to see ideas you would otherwise miss because of some sort of block(though I am not 100% sure it's not an illusion -- I've been using this technique for only a couple of days).
Also, I suspect it should work better for social stuff(talking to users, acquiring users) than for programming.
HN, can you please share your own hacks/algorithms/techniques/methods, even small ones?
[1] «A couple days ago I finally got being a good startup founder down to two words: relentlessly resourceful»  www.paulgraham.com/relres.html [2] In case anyone is interested: http://perunity.com (yes, we want your feedback) <comment><USER2> Your first question is "can you make a conscious effort to get better at [being resourceful]?" The answer is almost certainly yes.

Techniques for being resourceful are very specific to the individual, so what works for one person may not for another. That being said...

The first thing I would do is meditate. It is becoming trendy, but I think for a good reason. By complete coincidence, [http://www.entrepreneur.com/article/237313](http://www.entrepreneur.com/article/237313) is a news article that showed up this morning. I think if a man like Steve Jobs arranges for a book on meditation (and self-actualization) to be given to the attendees of his own funeral, that is a powerful sign.

Talk to other people about challenges you face. This sounds simple, but it is effective. Another way of saying "I need a creative solution" is "I need a solution that I wouldn't have come up with". To me, that sounds like "I need a solution someone else came up with". Every successful business leader has advisors. So should you.

There is a talk by Charlie Munger (of Berkshire Hathaway fame) about decision making. It tends to focus on mistakes, but if you know what mistakes to avoid, it can help you find the right answer. [https://www.youtube.com/watch?v=pqzcCfUglws](https://www.youtube.com/watch?v=pqzcCfUglws)

Tell me what you think about these.

<comment><USER3> Great suggestion!

</comment></comment><comment><USER4> Google the description of everything you need if you don't already have it. If a web search turns up nothing, post an Ask HN or similar. Ask your friends. Don't remake anything that already exists.

Try not to make anything that _doesn 't_ already exist unless you _really can 't do what you need to_ with what already does. To make sure that you do _really need to do it_ , ask [Five Whys] of your motivations. If any answers come up "I don't know any other way to do it", start thinking / looking / asking for other ways to do it.

[Five Whys]: [http://en.wikipedia.org/wiki/5_Whys](http://en.wikipedia.org/wiki/5_Whys)

Other ways to add to your toolbelt of resources:

Follow the maintainers of your favorite projects on GitHub. You'll be notified when they star something they find interesting- if they think it's useful, you'll probably find it useful too.

Read Hacker News, obviously.

</comment><comment><USER5> I doubt if this is all of it, but one suggestion I would make is constantly challenge assumptions/conventional wisdom.

Them: We can't do X

You: Why not?

Them: We asked them once before and they said [stuff]

You: But what if I ask them and say [new stuff]

etc etc. When people say stuff can't be done, keep digging into why not until you hit bottom. They might be right, or you might smash through another roadblock.

</comment><comment><USER6> 1) Nothing will die if you can't kill it. Be like cockroach. 2) Take advantage of everything you can get ahold of. Dont ask for permission, but forgiveness. 3) Don't spend a dime until you're forced to. This means contractors sometimes, unfortunately. 4) (S)He who knows the most, wins. Its an infowar out there, so never stop reading/learning. Use triggers/web svcs to make the internet work for you. 5) [https://diy.soylent.me/recipes](https://diy.soylent.me/recipes) and/or join a coworking space

If you follow this 5 step program, you too can be relentlessly resourceful... and lose a lot of weight :)

</comment><comment><USER7> Relentlessly resourceful only makes sense/sounds good in hindsight.

Before that there is simply "relentless" and "resourceful"\--which are straight forward enought.

The "problem" is there is a tension/contradiction between the two: relentless meants "stopping at nothing". And resourceful means working within a set constraint (ie, an externally-imposed limit).

Needless to say, bringing/finding hidder or non-obvious resources to bear on problems with obvious/unavoidable constraints is the general gist of this problem.

"Never bring a knife to a gunfight" is also another take on it, although a bit more from the perspective of a negative proof.

</comment><comment><USER8> I know it will sound like a cliche. Exercise, eat well, rest and have happy moments. You will be relentlessly resourceful this way since it seems that you have really set your mind on it.

<comment><USER4> That sounds more like a generic tip on how (in your opinion) to be successful/happy, with no real focus on resourcefulness (or relentlessness).

<comment><USER8> first of all being relentlessly resourceful is very different from being relentless. secondly, this advice is sound for being sharp, think creatively and being able to withstand stressful situations.

</comment></comment></comment><comment><USER9> Have less scruples than the next guy. Being free of moral bindings allows you greater range to maneuver.

Understand social proof and signaling. Practice dropping positive signals and social proof in all your stories; have a rehearsed story showing vulnerability to have when you need to make yourself appear more personable. Practice mirroring as people like those similar to themselves. If you're an well educated white male, you're already halfway there.

<comment><USER2> I don't recommend the "have less scruples than the next guy" game. This is the sort of nonsense that was passed around in the 80s -- "business is war". There is an important difference between business and war: if you lose in war, you die. No second chances.

In business, if you are a tough but fair player, and you lose, you will be offered the chance to play again. If you compete in bad faith, you won't.

<comment><USER9> You're reframing. "Tough but fair" is how you treat coworkers, employees, investors, and others who you interact with regularly. But it doesn't give you an edge in becoming relentlessly effective.

What do you do when your competitor is willing to break rules that you are not? Tread moral and legal grey areas that you do not? Take advantage of Facebook API's to spam users? How about spamming Craigslist? Submitting thousands of fake car requests to bog down your service and drivers?

Do you avoid all this low hanging fruit? Or do you take advantage of these growth opportunities and hope that you're so successful these shady tactics become afterthoughts?

</comment></comment></comment><comment><USER10> Create artificial limitations.

<comment><USER4> And be aware when you do so.</comment></comment>


Nobel Laureate Ivar Giaever – Global Warming Revisited (2015) - <AUTHOR> https://www.mediatheque.lindau-nobel.org/videos/34729/ivar-giaever-global-warming-revisited/meeting-2015 <comment><USER2> Wikipedia gives some context at [https://en.wikipedia.org/wiki/Ivar_Giaever#Global_warming](https://en.wikipedia.org/wiki/Ivar_Giaever#Global_warming) .

> "nothing in science is incontrovertible"

Except for all those scientists who use "incontrovertible." Eg, a quick Google Scholar search for "incontrovertible physics" finds:

\- [https://www.nature.com/articles/453866a](https://www.nature.com/articles/453866a) using the phrase "They also both observed the incontrovertible signature for Anderson localization..."

\- [https://www.semanticscholar.org/paper/Laser- Physics%3A-Quant...](https://www.semanticscholar.org/paper/Laser- Physics%3A-Quantum-Controversy-in-Action-Lamb- Schleich/0a460adbf03f997640fe50fbc76d21e7e55a956b) with "In particular, thestriking experimental demonstration of interference be-tween two condensates and the time evolution of a condensate provide incontrovertible evidence for BEC."

A search of Science Magazine finds articles like

\- [https://stke.sciencemag.org/content/2006/366/re17](https://stke.sciencemag.org/content/2006/366/re17) "Advancements in techniques for empirically measuring single cells and in corresponding theoretical methods have enabled the rigorous design and interpretation of experiments that provide incontrovertible proof that there are important endogenous sources of stochasticity that drive biological processes at the scale of individual organisms."

\- [https://stm.sciencemag.org/content/7/294/294ra106](https://stm.sciencemag.org/content/7/294/294ra106) (full text available at [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6731024/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6731024/) ) "Moreover, seeing exactly the same DNA base pair mutated recurrently across patients has been taken as incontrovertible proof that the mutation must be under functional selection for contributing to tumor fitness (3)."

> "Second: the "measured" average temperature increase in 100 years or so, is > 0.8 Kelvin."

The current average anomaly is 0.8 K. Relative to 1915 (100 years before 2015) it's risen 1.1 K. [https://climate.nasa.gov/vital-signs/global- temperature/](https://climate.nasa.gov/vital-signs/global-temperature/) .

> "Forth: the maximum average temperature ever measured was in 1998, 17 years > ago"

The average anomaly in 1998 was 0.62 K, and that statement no longer holds. Same source.</comment>


Apple boss Tim Cook 'to donate millions' to charity - <AUTHOR> http://www.bbc.com/news/world-us-canada-32098615

<comment><USER2> "Mr Cook's base salaray" I always wonder how sites like the bbc still miss spelling errors.

Good for him though.</comment>


This guy wants to row across the Pacific Ocean - <AUTHOR> http://www.youtube.com/watch?v=LmYRJJ-ed14

<comment><AUTHOR> The video is pretty dodgy, but the he has a lot of genuine passion. I hope he gets to the start line in 2015.</comment>


Jason Calacanis' Backup Plan For Replacing Content: Steal It From Wikipedia - <AUTHOR> http://smackdown.blogsblogsblogs.com/2010/03/11/jason-calacanis-backup-plan-for-replacing-content-steal-it-from-wikipedia/ <comment><USER3> Calacanis' fantasy all along was to own Wikipedia but fill it full of ads. He used to rant endlessly about how much money they'd make if they monetized Wikipedia. Mahalo is his attempt to make a seedier low-brow version of Wikipedia that's ad-laden. This move should not be a surprise. That's just my opinion though.

<comment><USER4> Kinda off topic, but I think he's right about wikipedia serving ads. They have so many page views, they could put up a couple of image or text ads on the side and make it look very tasteful--unlike mahalo and the other ad filled pages of the internet. Expanding on that, maybe they could only serve non- profits, giving them ridiculously low click or view rates. How could Jimmy Wales not be interested in that?

<comment><USER5> It would release a hornet's nest worth of issues. For example advertisers might change articles in which their ads appear in order to influence click- troughs. Then contributors will ask for a cut of the money. Then nobody will donate because they have to look at ads anyway.

Then advertisers will start demanding from their sales people that certain content be changed or taken off "or I will remove my ads."

So it should only be considered as a desperation move if their donations plummet.

<comment><USER6> To really think about it now, it's truly remarkable that such a powerful entity can exist in such a material world, free of spam, ads, etc. I don't think we cherish this great resource as much as we should.

</comment></comment></comment></comment><comment><USER7> We really need to stop putting Calacanis discussions on here.

<comment><USER8> I'm kind of ambivalent on that point. Part of me suspects that bad things happen when good people just stand by and watch.

I also think each of these is another data point in a Google discussion, more than about Jason.

<comment><USER9> I don't understand the "bad thing" which is happening here. Are we supposed to be so thoroughly invested in the quality of Google search results that it's a personal affront when someone games the system?

<comment><USER10> The "bad thing" is the inconsistency with Google letting large sites get away with the shady practices while punishing the little guy.

</comment></comment></comment></comment><comment><USER11> Why should I care about this? Because right now, I don't, and I'm about ready to start flagging any article that mentions Jason Calacanis.

If you hate someone and what they do, don't give them reams of free press! Nobody would ever have heard of him or Mahalo if it hasn't been for people whining about him/it on their blog...

Also, the GFDL, one of Wikipedia's licenses, says you can "copy and distribute the Document in any medium, either commercially or noncommercially".

<comment><USER8> _"Nobody would ever have heard of him or Mahalo if it hasn't been for people whining about him"_

Except maybe people completing a Google search looking for meaningful information, and finding a MFA page with minimal or no content.

<comment><USER12> Fair enough, but if I do a total reversal of my Canadian Socialist morality and play free market advocate, isn't this a problem that the market for search engines can solve? Why can't Bing show off how their search engine ignores mahalo and other wikipedia scraper sites and thus provides a more useful experience?

<comment><USER8> It's a fair point - the consequences won't necessarily be negative - <http://news.ycombinator.com/item?id=1185598>. But is it worth the risk?

</comment></comment></comment></comment><comment><USER13> I am imagining Calacanis as a zombie rummaging through the web, looking for new content to replace the old content, while being hunted by Matt Cutts who wears those peril-sensitive sunglasses from The Hitchhiker's Guide.

In some ways this is hilarious.

<comment><USER14> I think it's pathetic.

And Matt Cutts doesn't seem to be doing much hunting, it wouldn't take more than one 'shot' to take mahalo out of circulation.

<comment><USER13> Which is why I said that he is wearing those peril-sensitive sunglasses: if I remember correctly, they would prevent you from seeing anything that could disturb you.

<comment><USER14> No, they're so that you can maintain your cool attitude in the face of extreme danger. (Because you can't see it).

<comment><USER15> Actually at one point they are described as hiding things that might disturb you too (massive massive hitchikers fan :-))

<comment><USER14> You may be right, I'd have to check, but I thought that was the 'SEP', the somebody-elses's-problem-field.

<comment><USER13> The SEP hides things which don't fit into your worldview, the glasses hide things which might disturb you, which can fit into your worldview or not.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> He seems to follow the wikipedia licence.

<comment><USER14> So does every other wikipedia clone site. But that's besides the point, he claims that mahalo is built with their users' content, clearly that is not the case.

<comment><USER17> Sure, but using Wikipedia content in manner permitted by its license is not 'stealing' it.

<comment><USER14> Fair enough, that's a misleading title. 'Lift' instead of 'Steal' or maybe 'copy' would be better.

<comment><USER11> "Redistribute under the terms of the GFDL."

Let me guess... Linux distributions are "stealing" Firefox? Oh, there isn't some holy war against that, so it's a good thing. Right.

<comment><USER18> Do Linux distributions take Firefox and laden it with advertisements?

<comment><USER19> They'd certainly be within their rights if they did.

<comment><USER20> And it is perfectly within everyone else's rights to frown upon it.

The liberal licensing of Free software/content does not mean every use of those freedoms is a good and positive thing. And nobody is being inconsistent by treating it as a bad thing, while still recognizing it's within one's rights to do.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> I'd be curious to know what the position of Mahalo's investor's are in this debacle? Are they aware of what they're investing in?

(for reference, Mahalo's investors include Mark Moritz, Elon Musk, Mark Cuban and Ted Leonsis)

I'd be willing to setup a scraper site this weekend if they want to give me money too.</sarcasm>

<comment><USER22> as long as it makes money, who cares?

<comment><USER21> Well, I care.

Not for myself, but you have teams of guys out there building legitimate web applications that could have a _meaningful_ impact on the web community and instead, douchebags with scraper sites are getting invested in.

For all we know, we lost the next Youtube (or whatever app you want to talk about) due to Calacanis' antics (I don't personally hate the guy, I just don't approve of his methods)

\---

Lastly, apologies for the tardy reply. I've got maxvisit set to 30 and minaway to 240 mins, so replying won't ever be close to instantaneous.

</comment></comment></comment><comment><USER23> I am disappointed by the degree to which people are piling on here. When you run a user generated content site, it's common to seed it any legal way you can at first. As long as Jason is following the GFDL, I don't see a problem with using Wikipedia content to kickstart his community and get traction.

<comment><USER24> He's not kickstarting it with Wikipedia. Mahalo is not new.

The two main issues with all of these scraped pages is that a) Jason recently boasted how Wikipedia was, in his words, simply a "free for all" (thus leaving the impression that he feels that his site was therefore better, being moderated), and b) that his pages were all UGC built by "his" users, not bots.

<comment><USER23> You've made some valid criticisms of Mahalo in the past, but the content and tenor of this article makes it look like this has gotten personal for you and now you're reaching.

 _He's not kickstarting it with Wikipedia. Mahalo is not new._

This isn't about age, this is about size and activity of user base. Again, I can empathize with anyone trying to bootstrap a UGC business. You practically _have_ to seed it with content.

 _The two main issues with all of these scraped pages is that a) Jason recently boasted how Wikipedia was, in his words, simply a "free for all" (thus leaving the impression that he feels that his site was therefore better, being moderated), and b) that his pages were all UGC built by "his" users, not bots._

While both of these are certainly reasons why you may personally find his use of Wikipedia's content _distasteful_ , neither of them rise to the level of being "stealing," ban-worthy, or even particularly unethical assuming that he's in compliance with the appropriate license.

</comment></comment></comment><comment><USER25> Who is this guy and why do I care?

</comment><comment><USER26> for as much as he rips on Jimmy Wales, I'm sure Jimmy would love to make a spectacle of this

<comment><USER27> If he did, he'd make a fool of himself. Wikipedia _explicitly allows_ this sort of thing, it's one of the founding principles of the site. And I think it's great, IMO it's one of the reasons the site is so successful.

That someone running a shitty recycled content farm is making money off of it doesn't alter a damn thing.

And that's not to say that Calacanis is adding anything of value to the web or anything like that, he's certainly not, as far as I can tell, but I just can't get too worked up when someone actually makes use of the license freedoms that we all fight so strenuously to spread...

WTF re: Google, though, I can't believe for one second that this is not on their radar?

</comment></comment><comment><USER28> Sometimes, I wish the internet had permabans.

</comment><comment><USER29> Seriously, this level of attention doesn't seem to be rational anymore.

The guy is trying to build a business that creates jobs, and hes putting some of his own capital on the line to do it. Thats the most important point here - he's making jobs.

The guy isnt selling blood diamonds or anything, at worst he's gaming a search engine. Sure, he's using some wikipedia content to run some tests. But, haven't the same people on here also run tests on their businesses - <USER2> incomplete features, bugs, overselling, trying to keep up. Thats all part of building something from nothing.

Give him a break - he's trying to create more jobs, but hes from a position where doesn't have to bother.

<comment><USER30> Creating jobs by doing a bad thing to a large number of others is not a net social good. There are plenty of other problems that good software engineers should be working on, rather than spamming up the internet for the benefit of a company that will ultimately funnel a decent percentage of its generated wealth to a professional troll.

If it ever gets to the point where Calacanis gets a big exit, business magazine/blog articles will be written about him and how successful he was and detailing some of what he did to generate that wealth, and some future entrepreneurs will see that, look up to him, and say "Hm, that doesn't sound so hard, I can do that too", and then go off and make their own spam sites for fun and profit.

It's really lose, lose, win (for Calacanis) if we let him get away with that, and as disproportionate internet users, we're the ones that will be hurt the most by search engines becoming more spammy.

No break for Mahalo, please. If Google dropped them and all the other MFA sites, that would be better than 5 Christmases.

<comment><USER31> he will not get the big exit, have you reviewed the long term stats using quantcast of mahalo.com?

Currently he has to revise and update the feature set to create boom bust cycles in visitor upswings..and yet long term they only amount to a few percentage points in growth..</comment></comment></comment>