How Badly Is Google Books Search Broken, and Why? - <AUTHOR> http://sappingattention.blogspot.com/2019/02/how-badly-is-google-books-search-broken.html <comment><USER2> Google tried to make this work, but they were sued; and then they made a deal, and then many, many people objected to the resulting deal. This is the usual process whereby a corporation is first criticised for having too much power, and then when they relinquish power they are criticised for not doing enough.

[https://www.theatlantic.com/technology/archive/2017/04/the-t...](https://www.theatlantic.com/technology/archive/2017/04/the- tragedy-of-google-books/523320/)

The end of that article is a not-so-subtle plea for someone within google to perhaps accidentally anonymously place this material in public.

<comment><USER3> It's fascinating to read that article:

> Page wanted to know how long it would take to scan more than a hundred- > million books, so he started with one that was lying around. Using the > metronome to keep a steady pace, he and Mayer paged through the book cover- > to-cover. It took them 40 minutes.

> Michigan told Page that at the current pace, digitizing their entire > collection—7 million volumes—was going to take about a thousand years. Page, > who'd by now given the problem some thought, replied that he thought Google > could do it in six.

> In just over a decade, after making deals with Michigan, Harvard, Stanford, > Oxford, the New York Public Library, and dozens of other library systems, > the company, outpacing Page's prediction, had scanned about 25 million > books. It cost them an estimated $400 million. It was a feat not just of > technology but of logistics.

> At its peak, the project involved about 50 full-time software engineers. > They developed optical character-recognition software for turning raw images > into text; they wrote de-warping and color-correction and contrast- > adjustment routines to make the images easier to process; they developed > algorithms to detect illustrations and diagrams in books, to extract page > numbers, to turn footnotes into real citations, and, per Brin and Page's > early research, to rank books by relevance.

Doesn't that take you back to an optimistic time when Google was exciting, and we thought that it could do amazing amounts of good for the world? I miss that era.

<comment><USER4> Yeah, it does. It's also not wholly Google's fault, obviously, since ppod clearly illustrated why. No good deed goes unsued.

</comment></comment></comment><comment><USER5> Here's another little-known fact: Every American is entitled to a library card from the Library of Congress (you have to go there in person to get one).

The Library of Congress is a Hathi Trust partner! So if you go get that card, you can download all of the out-of-print books that Google scanned on your own computer. No copyright holders are getting paid (and no one is being harmed), so why all these barriers in-between?

<comment><USER6> I can confirm that the Library of Congress Reader card is all it takes to login. And you don't have to be a US Citizen to get one, but you do need a passport or other US-recognized identification to present and validate in- person in D.C. And you have to do a bit of research on how and where to get it, they don't just hand them out at the front desk as other libraries might. The Library of Congress uses the card to distinguish researchers from one-off tourists and so while the card is easy to get, they have just enough process in place that it's clear it's not a souvenir and you have to traverse a maze of hallways to get it. (Or you had to when I did, at least...) But once you have it, just login online and you'll have access to Hathi Trust here.

<comment><USER7> Thank you and mimixco so much for pointing this out.

If I ever end up visiting DC again, I'm definitely going to do this. I have a new bucket list item!

<comment><USER6> Don't forget to check out some of the amazing reading rooms while there! :) I'd love to go back!

</comment></comment></comment></comment><comment><USER8> > If I worked at Google, I would have implemented a text-based date-prediction > algorithm to flag erroneously classified books. (I have actually done this > and sent a list to the HathiTurst of books they may have erroneously > released into the public domain. It works).

With friends like these, who needs enemies?

</comment><comment><USER9> It isn't surprising, this bit is sad:

 _Google Books has failed to live up to its promise as the company has moved away from its original mission of organizing information for people._

Google was only about organizing all the worlds information while search ads was an unlimited fountain of money. As Google's ability to generate money with search ads has dwindled, their more grand (and not monetizable) projects have been either starved for resources or outright killed.

Sure the lawsuit was a pain. And book publishers are turds for arguing that they still have rights to books that they won't publish ever again. But the courts found that there was nothing wrong with Google having the information[1]. That trove of text could be the worlds greatest source of knowledge but as we all know, people using internet search for work _never_ click on ads and not enough of them are willing to pay a subscription service price to cover the cost of infrastructure. Google hoped that at one time they would make money by printing on demand those books that were out of print but people wanted, but that was shot down by short sighted publishers and agents. Perhaps it will be taken up by Amazon which has the resources to do it.

[1] [https://arstechnica.com/tech-policy/2015/10/appeals-court- ru...](https://arstechnica.com/tech-policy/2015/10/appeals-court-rules-that- google-book-scanning-is-fair-use/)

<comment><USER10> It is sad. But it's not just google books, it's google search, google news, youtube, etc.

There was a time when all of google's properties catered to the users. Their search engine was the best. Google news was the best aggregate site. Youtube recommends used to be amazing to the point you could spend hours following their recommends.

Now google search, google news, youtube, etc are all garbage. It doesn't serve the people. It serves corporate interests. You can thank media companies and the elites who pressured them for that.

<comment><USER9> No need to cast aspersions on 'elites' and 'corporate interests', what is pressuring them is that the ratio of the amount of money coming in to that going out, has to be maintained at a certain level for Google to remain Google. They really have only two choices there, either sell more ads (generally means putting ads on more things, or coming up with new ways to charge for new things like being in the 'shopping' box on product searches) or cut costs which means shutting down projects, reducing staff, Etc. Depending on how you look at it, Google gets something like one 500th of what they used to get for an ad on their web site.

<comment><USER10> Am I cast aspersions or just stating facts? Google changed because of pressure from the elites and corporate interests who used the media to badger them. It certainly isn't in google's interest to make their product worse purely to benefit others.

<comment><USER9> > _Am I cast aspersions or just stating facts?_

Your previous comment was attributing without evidence, actions of malice by descriptive but undefined third parties. That is the definition of "casting aspersions."

"Stating facts" would start with something like, "See this evidence that Google's policies were changed by <corporate entity> or <person or persons>."

Since you are doing the former, and not the latter, I conclude that the answer to your question is that yes, you are casting aspersions.

<comment><USER10> I'd assume you'd already know that media and elite pressure is why google changed since most people here work in the tech industry. Are you new to HN or do you work in a non-tech industry?

This reporter claims that she got youtube to change it's search list.

[https://twitter.com/aprilaser/status/1076215375732174848](https://twitter.com/aprilaser/status/1076215375732174848)

Should we believe her or is she lying?

"Google follows Facebook's lead and removes 39 YouTube channels linked to Iran"

[https://finance.yahoo.com/news/google-follows-facebook- apos-...](https://finance.yahoo.com/news/google-follows-facebook-apos- lead-190836833.html)

These channels had been up for many years. Why do you think all of a sudden google decided to remove them?

Certainly it wasn't corporate, media or elite's pressure. So then who? Aliens? When chinese or russian social media companies remove and change their policies, why do you think that is? Aliens as well?

After 10 years of spectacular success of youtube being "you"tube, why did it suddenly become "corporate"tube? Why did they change their recommends, trending, etc? Must be aliens. It can't possibly be the elites and the media constantly attacking it?

"Facebook and Google are doomed, George Soros says"

[https://www.washingtonpost.com/news/the- switch/wp/2018/01/26...](https://www.washingtonpost.com/news/the- switch/wp/2018/01/26/facebook-and-google-are-doomed-george-soros-says)

</comment></comment></comment></comment></comment></comment><comment><USER11> If you're using HathiTrust seriously and aren't affiliated with a partner library, consider Hathi Download Helper to get complete public domain books archived to local storage. I wrote an earlier command-line version of the tool. Someone else built a GUI and put in the work to keep up with the evolving API.

I often use Google to locate a book, then check Internet Archive and HathiTrust if it's old enough that it should be public domain under US law. I really appreciate HathiTrust putting in the effort to check copyright renewals and make more of their materials fully visible. I _don 't_ appreciate the technical barriers to downloads that they erect, but that's out of the hands of the developers working there. As long as their web viewer shows individual pages you can be sure there will be a way to reassemble full books.

<comment><USER5> Thanks for that tip and for writing the software! I had to play that game of manually assembling PDF pages for an old magazine article lately.

</comment></comment><comment><USER12> Google Books has issues of Billboard magazine dating back to 1942. It used to be valuable for research, but it's become much less so over the years. Currently, search results that return actual magazine issues are limited to the first page. After that, it's just normal Google links. Even searching for something like Elvis or Glenn Miller, both of whom should have been in a crapload of issues, returns only one page of relevant results.

Trying to search by date is very hard. Limiting search to "Glenn Miller October 1942" might return one or two relevant results, or it might not return any. Trying to search by issue date doesn't work at all.

They have an index of Billboard issues which allows you to go to individual issues and read them, but the index stops at 50 pages, and for a weekly magazine, that limits the index to only a handful of years. Using the index, you can't go directly to issues before the 1980s, and with search by issue date useless, that means you're just out of luck if you want to see a particular issue in the 1970s.

<comment><USER13> They do seem to be crippling book search on purpose. Just yesterday I was looking for "PC Mag 1997 january Pentium MMX" and Google refused to return PC Mag 7 Jan 1997 issue results, whats even more weird clicking "browse all issues" returns

        The requested URL /books/serial/ISSN:08888507?rview=1 was not found on this server

but "About this magazine" will happily give you a list of all scanned issues :o and opening january one will let you search it and will return positive results.

</comment></comment><comment><USER14> I completed a Masters in Mathematics back in 2014, involving a lot of historical research into the development of geometry. At the time, the ease with which I could open up books written over a century ago, search them and read them, was a fantastically useful tool.

I have some of those sources still on my hard drive in their scanned PDF format. They've now effectively vanished from the open internet. So much, available for such a short window. Our children will never believe us when we tell them what was once right there at our fingertips, and those that do should never forgive us.

<comment><USER15> Consider uploading them to the Internet Archive.

</comment></comment><comment><USER16> Here's an example of an exploration tool built using the content of books: [https://books.archivelab.org/dateviz/](https://books.archivelab.org/dateviz/)

It would be nice if anyone could build such tools, but all of that data is locked up inside of places like Google Books and Hathi Trust. Google isn't even interested in making their metadata available, other than by running searches.

</comment><comment><USER17> This breakage reminds me of similar constrained-search problems with the Google Groups/ Dejanews USENET archive. Once upon a time it was nice to research with.

<comment><USER18> It reminds me of the demise of google's code search and github's woefully inadequate code search. Debian's Code Search is okay, but github allowing it would be great.

</comment></comment><comment><USER5> Here's an easy example... Google Books has many old issues of Popular Mechanics which exist in full downloadable form on the Internet Archive -- yet you can only see individual pages on Google Books and can't download the magazine.

This is because Google Books is acting like _they_ own the copyright (or, at least, they feel the need to police it.)

There are many cases where you can download the entire book from Hathi Trust when you are sitting at a university library, giving you a PDF you can use anywhere. But you cannot even see the entire book or download it from Google Books (which has given its scan to Hathi). This is just stupid.

</comment><comment><USER19> Google Books seems to have major problems. An alternative interested parties should explore is Archive.org. The Internet Archive has a significant collection of scanned books and other materials.

</comment><comment><USER20> Searching within books is broken too. If you search for 'cat', any instance of the word 'cats' will also be returned (and any other word beginning with 'cat'), but with the message, "No preview is available." No link to the page of the result is provided. It seems like the kind of bug that should be straightforward to locate and fix, but it has been this way for years. (My guess is that the tool that builds previews doesn't recognize partial matches.)

<comment><USER5> It's not a bug. It's on purpose. They actively limit previews, full page views, and downloads -- even though you can go to a university and download the same book from Hathi Trust.

Hathi Trust isn't paying the copyright holders, either, so who cares?

</comment></comment><comment><USER21> Using [https://babel.hathitrust.org/cgi/ls?a=srchls&anyall1=all&q1=...](https://babel.hathitrust.org/cgi/ls?a=srchls&anyall1=all&q1=%22set+in++stone%22&field1=ocr&op3=AND&yop=before&pdate_end=2002&facet_lang=&facet_format=)

I get 14,515 results, with 3,115 of them full view.

There is also [https://analytics.hathitrust.org/](https://analytics.hathitrust.org/)

which seems interesting!

<comment><USER5> And _all_ of them are full view if you are physically sitting in a Hathi Trust "partner" university library. These libraries are open to the public and allow downloading and saving of the materials you browse, making the whole point of locking them up completely pointless.

<comment><USER22> Is it then possible for an Aaron Schwartz/ Sci Hub character to then download all of the available books and make them available on the internet?

<comment><USER23> yes and that's theft.

</comment></comment></comment></comment><comment><USER24> I wonder if the date problem is a bug, not a feature?

Is it possible to dump the metadata of a book and check if they have the right date? There should probably be multiple dates for a book -- date written, date copyrighted, date published, date of latest edition, etc.

My guess is that Google does not have a publicly-available issue tracker for Google Books so you can't easily report this problem. Hacker News is a good way to get their attention, though...

</comment><comment><USER5> Based on my experience with research using Google Books and Hathi Trust, this author is correct. Google has purposely broken Google Books so that it doesn't compete with any paid sources for these materials -- even if there aren't any paid sources and the book is out of print!

The TL;DR is that Google Books started out with the goal of digitizing every book ever written. Publishers sued, so they crippled their search and display functions and handed over the full texts they already had to a group called Hathi Trust.

Hathi Trust is seriously crippled on purpose. It only allows access to full texts when you are _sitting in a physical library_ of one its partner universities. That's right... I can drive to a big university, sit in their library, and download a full PDF of any book I like. But if I'm at my house, I can only read one page at a time in a browser. This is ridiculous. Hathi Trust is helping the oil business more than they're helping researchers.

The marriage of Google Books content and Hathi Trust as a distribution platform is a joke. In some cases, you will even have to order an old book from interlibrary loan (see worldcat.org) if you can even get it -- when all the while Google has a scanned copy!

<comment><USER25> If you were an author of a book with active copyright you might want to get paid for it.

<comment><USER26> How?

My grandfather wrote a book in the 1940s that's been out of print since the mid 50s. Every entity associated with the book is dead, including the publisher, which merged into another in the late 50s and is probably an inactive imprint of some successor company. Grandpa died in 1985, and a cousin or I is likely the heir to his rights.

I have a copy of the book, which I bought via Alibris from a bookstore in Wales 15 years ago. If you needed the book for research, you'd probably get it via inter-library loan from a university or a big city library. Whomever the publisher is, they don't have it and aren't selling it. In no scenario does anyone get paid for transacting, other than a reseller or the post office.

<comment><USER27> Stay with me for a second; I'm going to go wildly afield... does intellectual property need an Adverse Possession law, too? [1]

Your grandfather had a book, the rights of which should have been presumably passed down to you. My grandfather had a patented mining claim that has been passed down to me. Where the ownership of your grandfather's book is questionable, for me the physical corners of the property are questionable. A number of them are defined by things like a "4 foot spruce post" or a "12 inch diameter tree trunk" that haven't survived the ravages of time.

But it is important that I patrol my property at least every couple of years because of Adverse Possession. If someone else were to use my property continuously and I don't say anything against it, one day their trespassing suddenly and magically would become ownership. For a land-owner, it is a scary idea that someone can steal my property from me, as has actually happened. [2]

But I can acknowledge that it makes some sense. It comes from the idea that land is meant to be used, and if you aren't using it, maybe the person who _is_ using it should get the rights.

If nobody can stand up for an intellectual property claim, perhaps some kind of adverse possession is in order.

[1] [https://en.wikipedia.org/wiki/Adverse_possession](https://en.wikipedia.org/wiki/Adverse_possession) [2] [http://articles.latimes.com/2007/dec/03/nation/na- land3](http://articles.latimes.com/2007/dec/03/nation/na-land3)

<comment><USER28> Counter-argument: Adverse possession is justified by the scarcity of real property. Which does not apply to IP.

\- Real property (i.e. land) is a scarce and limited resource. If a party is making productive use of the land, they should hold title. (There is only so much arable land. If someone raises crops, let them.)

\- Intellectual property (particularly copyright) is not a scarce or limited resource. (Create your own copyrightable work if you wish to own the rights.)

<comment><USER28> Of course, adverse possession presumes that land _ought_ to be made "useful." (Haven't thought yet about how these critiques of real property theory map to IP.)

Much of real property theory arose from the assumption that the government should recognize and encourage the "highest and best use" of real property. Traditionally, the highest and best use of land is the use that can most profit from the land's resources; often mining, grazing, farming, logging.

This is problematic.

\- This view justifies colonization, and taking land from original inhabitants who don't use the land to extract resource value.

\- This view does not recognize preservation of an ecosystem as a valuable use.

\- This view does not account for externalities from use of the land's resources.

<comment><USER29> This is a very interesting argument .

I think it's worth noting that you can calculate an estimate of the externalities and remove that from the profit to achieve a more balanced justification. Though unfortunately, unless you counted the loss of culture as an externality then you could still trivially justify the removal of land from those less productive/ technologically advanced than you.

Furthermore, even though I'm not personally supportive of the removal of land at the individual's loss I do have to ask if the removal could account for a net gain overall; improving many people's lives. Perhaps profit isn't the best measure of improvement to the collective but it is at least indicative.

</comment></comment></comment></comment></comment></comment></comment><comment><USER30> What would be a scientific approach to compare search results? Let's say I do a search on DDG and on Google, how do I determine which engine provided the most accurate results?

<comment><USER31> I think if you have a population of people doing the same search, split randomly across the two sites, things like how long it takes to leave your site through a search result, how far down that result is, and how often people come back to rephrase their search are all good metrics.

Not sure there's an answer for a single search for a single individual though.

</comment></comment><comment><USER32> I thought google search (without "books") is broken... why is the books search being broken a surprise?</comment>


Docker and Security [pdf] - <AUTHOR> https://www.ernw.de/download/ERNW_Stocard_Docker-Devops-Security_fbarth-mluft.pdf <comment><USER2> "You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes."

\-- Theo de Raadt (on the statement "Virtualization seems to have a lot of security benefits")

<comment><USER3> Theo is wrong with respect to Xen. You might enjoy section 3.1 and 3.2 from the Qubes Architecture document: [https://www.qubes- os.org/attachment/wiki/QubesArchitecture/a...](https://www.qubes- os.org/attachment/wiki/QubesArchitecture/arch-spec-0.3.pdf)

The attack surface of Xen is much smaller than a traditional kernel like linux. I'm guessing the same can be said for OpenBSD after looking at the number of system calls.

<comment><USER4> Xen has had it's fair share of vulnerabilities, and the author of the document you linked also had this to say: [http://lists.xen.org/archives/html/xen- devel/2015-11/msg0060...](http://lists.xen.org/archives/html/xen- devel/2015-11/msg00601.html) (follow the links)

<comment><USER3> Absolutely. It should also be mentioned that many of the Xen vulnerabilities are actually due to qemu and that emulation can mostly be avoided by using PV/PVH.

The Xen attack surface is then reduced to about 20 hypercalls (even less for ARM). [http://xenbits.xen.org/docs/unstable/hypercall/index.html](http://xenbits.xen.org/docs/unstable/hypercall/index.html)

<comment><USER5> The number of hypercalls isn't a good indicator of the attack surface area.

As examples:

There is a full x86 instruction decoder which is technically not part of the hypercall interface. x86 instruction encoding is surprisingly complicated. There was a vulnerability in that code: [http://xenbits.xen.org/xsa/advisory-123.html](http://xenbits.xen.org/xsa/advisory-123.html)

Handling x86 page tables and all of the various feature bits is also surprisingly complicated. This is part of the hypercall interface, but there was also a vulnerability in that code: [http://xenbits.xen.org/xsa/advisory-148.html](http://xenbits.xen.org/xsa/advisory-148.html)

</comment></comment></comment></comment></comment><comment><USER6> I think we'll see more security incidents involving Docker in the future as it becomes more popular. I have worked with it for a few months now and I can already see a few attack vectors that could easily be exploited if the corresponding Docker features are not used properly.

For example, as Docker can by default mount anything that root can mount, running

        docker run -i --volume=/:/data -t ubuntu

will give you complete root access to your file system in the docker container (the talk mentions some Docker features that will mitigate this kind of attacks, notably UID mapping). Of course no one would willingly do that, but if you mount user resources into your containers and the resource name contains something that an external user might control (e.g. his/her username), then injection attacks become possible. Even with UID mapping enabled this can leak sensitive information about your host system into the container. And since people often use containers to run untrusted code (e.g. for CI systems), this can be a large security threat in my opinion.

Personally I really like Docker and I think it (or similar technologies) will change many aspects of IT/Devops/Data Analysis in the future, I just think that maybe they should have some more sensible defaults for security-relevant settings, i.e. only grant network access to containers if you ask for it, restrict default memory usage by default, limit the type of volumes you can mount, etc.

<comment><USER7> My problem with Docker is that although the advise was always not to run images with root, in practice all Docker tools defaults to do precisely that and there are no plans to change the defaults.

At least these days they do provide options to restrict containers so secure usage is possible (--cap-drop=all is a good start), but still the amount of efforts to follow good security practices is high.

<comment><USER8> With 1.10 you can just enable User namespaces, which allows for root in a container to map to a non-privileged user outside the container, that way it's a one-time (per instance) change.

<comment><USER9> While this is a nice security boost once you're in the container, don't you still need to be root (docker group) in order to _start_ the container? It honestly doesn't help me much if I have to give users root in order to start a container, even if they are wrapped inside the container.

<comment><USER10> This is what sudo is for. Give each user access to run their containers (and only their containers) as a member of the docker group in sudoers.

<comment><USER9> This doesn't work when users may need to run arbitrary (or user-defined) containers. You can only sudo so much... But, perhaps you could restrict it to "sudo docker run". I'll have to give that a try. But that would make it extraordinarily more difficult for a user to stop / rm / kill a container. Plus, it's not like docker has the concept of an "owner" for a container - does it?

Nonetheless, you shouldn't need to run anything as root in order to start a container that doesn't require extra privileges .

</comment></comment></comment></comment></comment></comment><comment><USER11> It's curious to me that of the various container options, only lxc/lxd seems to put in the effort required to get truly non-privileged containers working without issues.

Lxc/lxd goes far enough that you can boot a systemd based container, get a sanely partitioned view of /proc, etc. The effort is non-trivial...they had to create cgmanager, lxcfs, etc.

Rkt, runc, etc, are all working on it, but don't seem close to a real solution.

</comment><comment><USER12> Docker also needs to address the hardcoding of the repo

[https://github.com/docker/docker/issues/1988](https://github.com/docker/docker/issues/1988)

<comment><USER13> As someone in the issue mentioned that "local registries don't have authentication", here's a shameless plug for a free software (self-hostable) replacement for the Docker Hub (which has authentication -- even LDAP support, and at SUSE we're working on adding token-based authentication and automated build systems that also rebuild derived images): [https://github.com/SUSE/Portus](https://github.com/SUSE/Portus). The solution of "just prepend the registry you use to your image names" is quite frustrating because it means that pushing and pulling is intertwined with the names of the things you're pushing and pulling. It should've been implemented as a flag in the CLI (or even a flag in the daemon for the "default registry").

</comment></comment><comment><USER8> Good presentation. One thing I'd mention is that they talk about the CIS security guide, but it's currently pretty out of date as it covers 1.6 and therefore misses a lot of Docker features like Content Trust, User Namespaces and Seccomp-BPF.

In general I'd say that Docker security is getting better, although I'm really looking forward to getting a better authentication/authorisation model on the docker engine as right now it's all or nothing, which is a pretty blunt instrument. Also this model causes problems when people do things like mount docker.sock inside a container for introspection as anyone compromising that container can take over the host. A better authorisation model would allow safer introspection...

Also worth noting as it's not in the presentation, one of the key Docker security features, User Namespaces, is not switched on by default, so you need to enable it on the daemon.

</comment><comment><USER14> I will never get the Docker rant.

At the beginning I loved it however the deeper I digged the more I hated it. Actually the only thing I need would be immutable infrastructure and resource isolation. However for most of these things you don't need docker at all. You would've need some sort of container that could be fully isolated with the kernel cgroups and have somehow a way to isolate the network, but docker grows to a extremely fat monolithic approach where everything is put into and still it gets worse every release and the problems will never be fully addressed.

And on top of that the Docker Inc. tries to monetize on that with software that other vendors could do as well. Docker Inc. should focus on Docker and not on everything surrounding that.

Docker should've been easy, but now to make a good use of it your infrastructure will definitly not as easy as you planned at first. The way how you deploy software will change, but I doubt that it's docker who will make the "global" change. Maybe it was docker who gave a first impression how it could look but it's definitely not the end.

</comment><comment><USER15> For your convenience here are the URLs from that broken document:

[http://blog.bofh.it/debian/id_413](http://blog.bofh.it/debian/id_413) [http://reventlov.com/advisories/using-the-docker-command- to-...](http://reventlov.com/advisories/using-the-docker-command-to-root-the- host) [http://events.linuxfoundation.org/sites/events/files/slides/...](http://events.linuxfoundation.org/sites/events/files/slides/Containers,%20Docker,%20and%20Security_%20State%20of%20the%20Union.pdf) [http://opensource.com/business/14/9/security-for- docker](http://opensource.com/business/14/9/security-for-docker) [https://zeltser.com/security-risks-and-benefits-of-docker- ap...](https://zeltser.com/security-risks-and-benefits-of-docker-application/) [https://benchmarks.cisecurity.org/tools2/docker/CIS_Docker_1...](https://benchmarks.cisecurity.org/tools2/docker/CIS_Docker_1.6_Benchmark_v1.0.0.pdf) [https://forums.grsecurity.net/viewtopic.php?f=7&t=2522](https://forums.grsecurity.net/viewtopic.php?f=7&t=2522) [http://xebia.github.io/cd-with-docker/#/](http://xebia.github.io/cd-with- docker/#/) [http://www.schibsted.pl/2015/06/how-we-used-docker-to- deploy...](http://www.schibsted.pl/2015/06/how-we-used-docker-to-deploy- schibsted-pl/) [http://itrevolution.com/the-three-ways-principles- underpinni...](http://itrevolution.com/the-three-ways-principles-underpinning- devops/)

Most of these will be already in your bookmarks, when you are following docker development.

Why was this talk is interesting? Is there a video that shows things that happened that are not reflected in the powerpoint pdf? What was new?

BTW the powerpoint document wins the "most annoying document of the week"\- award. We have better ways to publish URLs in 2016 than powerpoint. Please use reveal or anything else next time, thanks!

</comment><comment><USER16> Yet another reason to favor unikernels instead.

<comment><USER17> And why would those have no security holes?

Let me see:

* MirageOS runs on Xen. If you break into Xen, you own all unikernels.

* OSv runs on Linux. If you break into Linux, you own all unikernels.

<comment><USER16> The fact that Xen is used is just a matter of convenience, nothing forbids MirageOS to run bare metal if the developers would decide to spend effort writing device drivers.

However they rather focus in other more critical areas, for the time being.

</comment></comment></comment><comment><USER18> We're going to need to apply the blockchain to this problem eventually. Someone call me when we're ready.

</comment><comment><USER12> does docker still store credentials in cleartext ?

<comment><USER19> We're working on fixing that in two ways:

1\. Implementing oauth: [https://github.com/docker/distribution/pull/1418](https://github.com/docker/distribution/pull/1418)

2\. Using credential helpers: [https://github.com/docker/docker/pull/20107](https://github.com/docker/docker/pull/20107)

</comment></comment><comment><USER20> We changed the url from [https://www.insinuator.net/2016/03/docker-devops- security/](https://www.insinuator.net/2016/03/docker-devops-security/), which points to this and doesn't seem to have any content of its own.</comment>


Tokyo Court: Bitcoin Not Subject to Ownership - <AUTHOR> http://www.coindesk.com/tokyo-court-bitcoin-not-subject-to-ownership-2

<comment><USER2> Layman's gloss (and you should definitely, definitely not try to file a pro se legal action based on my understanding of Japanese property law):

Hypothetically suppose a corporate entity in Japan has physical possession, but not ownership, of property you own. For example, you might be in the business of renting out computers. Subject to standard contractual arrangements, they should not interfere with your ownership of that property. If they, for example, go into receivership and stop paying the lease, the mere fact of them being in receivership does not expunge your interest in the property. You can demand they restore it to you and, if push comes to shove, the Japanese courts / bankruptcy administrator will enforce your claims. (I think the magic words are 取り戻し権 but ask your friendly neighborhood Japanese lawyer about it.)

This generally applies to identifiable, movable real property as opposed to e.g. money or IP. The court found that, since BTC are commingled by nature, it isn't feasible to say that the plaintiff has a cognizable ownership interest in any particular BTC residing on Gox's systems. The plaintiff has to seek recovery through some other legal strategy, most of which will probably come to the conclusion "OK, you get a claim against the bankrupt entity -- welcome to the line and enjoy your pro-rata."

Fun quirk of Japanese bankrupt law: if Gox had loaned _you_ a computer, you'd presently be legally enjoined from giving it back to them even if a Gox officer were to demand the surrender of the computer. You're supposed to hold onto property of theirs until given instructions from the bankruptcy court as to its disposition.</comment>


SSL considered bloated - <AUTHOR> http://www.naughtycomputer.uk/ssl_considered_bloated.html <comment><USER2> I was really expecting a serious discussion about useless and dangerous flags, outdated encryption, expensive and dangerous renegotiations... I got a one line complaint about "network traffic" (take a read about latency and bandwidth difference!), caching, and bad tooling (go learn some better tooling, it's out there).

There are plenty of things to complain about in TLS, but the article touches none of them. What a bummer.

<comment><USER3> I'm personally still trying to figure out where the hordes of new users that just install Apache are. In these times, if you can install Apache 2 on a computer permanently connected to the internet you can probably also install Caddy or Certbot.

</comment></comment><comment><USER4> I really hope I'm not the only person who mentally groans whenever I see yet another "X considered Y" clickbait title. It's the tech equivalent of "this one weird trick" or "X Happened And You Won't Believe What Happened Next".

<comment><USER5> What's clickbaitish about the title? If the article is aligned with title, then the title is fine.

<comment><USER4> clickbait (google search): "(on the Internet) content, especially that of a sensational or provocative nature, whose main purpose is to attract attention and draw visitors to a particular web page."

I think this safely fits under the sensational/provocative attention-grabbing umbrella.

</comment></comment></comment><comment><USER6> The problem with this argument is that there are _very_ high-security pages on the Internet --- things that protect people's bank accounts or most sensitive personal information --- and they're not going away. The junction, at the protocol level, between insecure web sites and secure ones is a major design weakness; we would have fewer attack vectors in the long run if we could count on uniform encryption across the web.

<comment><USER7> This is precisely my thought on SSL. I'm no expert (correct me if I'm wrong), but if I understand the technology correctly: if your http website connects to an https login page, who is to stop someone from spoofing a link to a fake login page on the http website.

<comment><USER5> EV certificates help.

<comment><USER8> EV certificates may improve a user's awareness of a spoofed page, but cannot do anything to make it more technically difficult to execute.

Providing an HTTPS login with an otherwise HTTP site is vulnerable to redirection to HTTP or to another site.

There is lots of evidence that suggests that in this configuration, cookies are often not set up properly (secure only) and can therefore be transmitted and stolen over HTTP.

<comment><USER5> > EV certificates may improve a user's awareness of a spoofed page, but cannot > do anything to make it more technically difficult to execute.

This is what I meant, this is why I used "may". Obviously the user must know the details of how ssl works which is not many of them.

</comment></comment></comment></comment></comment><comment><USER9> > Seems to me a bit like equipping everyone with armour to make shooting them > more difficult. Solving the problem the wrong way?

I don't know, making humans immune to bullets would be an elegant solution to the gun control debate which doesn't involve disagreements over the second amendment, and would make everyone win.

<comment><USER5> Just move to autralia/europe.

<comment><USER10> > Just move to autralia/europe.

Being in Europe doesn't seem to have helped the editors of Charlie Hebdo …

<comment><USER5> Rare cases vs daily gun deaths.

</comment></comment></comment></comment><comment><USER11> The problem with SSL/TLS is that it is binary. There's currently very strong pro-binary movement in the ranks of Internet infrastructure engineers, probably originated in Google. Yes, binary protocols are marginally more efficient, but they are inherently harder to understand, debug, and generally see what's happening, especially in high-stress conditions when something fails in production. Binary protocols are more complex than text protocols, and more complexity leads to negligence and security problems (e.g. recent OpenSSL bugs). Secure systems are simple systems (OpenBSD gets it right).

Text-based protocols are the greatest thing that UNIX brought to the world. There should be more of them, especially in security sensitive areas.

<comment><USER12> Text-based protocols are simple for humans to read, but anything requiring parsing is a security smell.

Even if you are sure your buffer handling is free of bugs (reasonable in new languages, but the known-size of binary fields has been a security strength for them), the ambiguity of text is dangerous.

Interpreting as text easily corrupts binary embeds if you aren't careful, and escaping bloats the size of what's already the largest part of your message.

Many security bugs have been triggered by implementations disagreeing about when they interpret UTF-8 and when they don't. UTF-8-encoded ASCII characters, for example, may cause one parser to recognize a keyword that another ignores; nevermind different sets of accepted whitespace characters.

You could define a very-strict encoding and delimination scheme, but at that point you can't trust text editors to edit it- making it effectively a needlessly-complicated binary protocol.

<comment><USER11> Also, some sort of "parsing" (normalizing) is always required even for binary messages. Endianness, alignment conventions, etc. — just mapping the network bytes onto memory is inviting trouble.

(btw, network byte order is big-endian).

<comment><USER12> Point, though binary normalization is easier to define in a manner everybody will consistently implement as opposed to, say, SMTP headers.

...I guess it's abominations like SMTP that I mainly think of when I hear "text-based protocol".

JSON and bencode are probably safe enough.

(Canonicalization is not useful from a security perspective, since an attacker is under no obligation to canonicalize their message.)

</comment></comment></comment></comment><comment><USER13> amusingly, the "one-line" server is not only "not really one line", but also contains a number of errors and other incongruities:

1\. there's no reason to put : at the start

2\. z=aa is the same length as z=$r

3\. there are double quotes where there shouldn't be and none where there should

4\. the sed quoting is wrong and only works since file names cannot be empty

5\. useless use of subshells

6\. won't work on echos which don't parse escape sequences or don't accept -e

7\. parsing ls

but most importantly, the whole first part can easily use TLS with "openssl req -x509 -newkey rsa:4096 -nodes -subj /CN=localhost -keyout server.pem -out server.pem; openssl s_server".

</comment><comment><USER14> There are several other very important reasons missing from this article, which I think invalidate part of the argument.

One is widespread use of open wifi networks. I know many people don't bother to redirect traffic through a VPN when on open wifi, which means anyone on the network can monitor their traffic. This might be mostly innocuous, but at the worst, they can steal login credentials and personal info.

The second is ad/analytics tracking networks. By using SSL, you force your trackers to be SSL as well. Small comfort for those who despise this anyway, but it's better than these networks moving plain text identifiers and info about you around, allowing it to be monitored as you surf around the web.

I believe the third is widespread government surveillance/mass spying. By using SSL you do two things: prevent (or at least complicate) the 3rd party interception of data, and also decrease the signal-to-noise ratio (making it less likely that any given encrypted stream is actually something valuable and worth breaking).

</comment><comment><USER15> Hopefully the argument about back/forth traffic in SSL will soon be obsolete if Zero-RTT handshakes are implemented in TLS1.3. Surely this would then be comparable to standard HTTP requests?

<comment><USER6> Zero-RTT addresses latency, but not "bloat"; the same amount of data is exchanged, but application data can piggyback on the handshake messages.

</comment></comment><comment><USER16> Total clickbait. More like websites with black backgrounds and bright green monospace fonts considered unreadable.

No major browser will be supporting the insecure mode of http/2\. I don't think I'm alone in thinking that is a good thing. I like to know that the page I'm interacting with hasn't been tampered with, whatever website I'm on. Nefarious certificate authorities aside, TLS is the way to do that.

Besides, connections (especially mobile) are getting faster all the time. I'd say encouraging better connectivity is a more worthwhile pursuit than allowing everyone to turn off TLS.

</comment><comment><USER17> A counter to the author's "webserver in 1 line of code" \- [https://gist.github.com/denji/12b3a568f092ab951456#simple- go...](https://gist.github.com/denji/12b3a568f092ab951456#simple-golang- httpstls-server)

I prefer proxying of SSL (and automatic generations of LetsEncrypt certificates) using containers so that my web servers don't have to worry about that aspect of configuration.

</comment><comment><USER18> This post focuses only on the technical costs of TLS. The reality that we currently live in contains a hostile network where unarmoured packets are the easiest of targets. The movement to put TLS on everything is a reaction to the hostility and is overwhelmingly driven by #1: A legitimate interest in security.

</comment><comment><USER19> Considered by you ... And you explanation is not that convincing.

</comment><comment><USER20> SSL/TLS is bloated but that's not a reason _not_ to use it.

Rather it's a reason we need some TLSv2 that just removes the crap and focuses only on three encryption/authentication modes:

* Desktop: High throughput, lots of CPU, minimal latency * IoT: small throughput, very little CPU, latency acceptable * Mobile: small to medium throughput, some CPU, minimize latency

A lot of bloated protocols are still good, they're bloated because backwards compatibility and everyone and their kitchensink needs to be able to decode it.

<comment><USER21> It seems to make more sense to just have _ONE_ that can accommodate all those scenarios in a secure way. One doesn't solve bloat by introducing more bloat.

I'd say more can be won by removing e.g. ASN.1 and X.509 for certificate handling and encoding that are a very difficult (impossible?) to get right and switch to something simple that solves the 99% use case of current TLS.

<comment><USER20> I agree with ASN.1 and X.509.

Those two are part of my plaintext-offenders list, like SMTP. They make life equally painful for both man and machine.

</comment></comment></comment><comment><USER22> I didn't check the link, but I bet that "HTTP server in one line of code" doesn't include a TCP stack.

<comment> liviu- The "one-line" server is just multiple commands separated by ';' and joined into one line. At best a pointless exercise, and at worst a deceiving one.

<comment><USER23> Did you know you can rewrite jQuery in just 4 lines of code? [https://code.jquery.com/jquery-2.2.4.min.js](https://code.jquery.com/jquery-2.2.4.min.js)

</comment></comment></comment><comment><USER10> In my perfect world, you'd receive a certificate from your ISP when it assigns you one of the IP addresses it was itself assigned, and you'd receive a certificate from your registrar when you purchase a domain name. The former certificate would be good for the duration of your IP assignment; the latter for the duration of your domain ownership.

The IP-level certificate would be used for IPsec; the DNS-level certificate would be used for HTTP and other protocols; if you needed some other, stronger sort of identity verification then you'd need to take other measures.

This would solve the accessibility problem.

As for proxying, I think that HTTP had a really interesting idea with proxying, but it just doesn't work in practice. Proxies are untrustworthy, so it doesn't make sense to use them.

As for speed, I don't think SSL is noticeably slow from a modern phone.

</comment><comment><USER24> The author lists legitmate motivations for why people want to see 100% SSL adoption.

The CA system also began with such good intentions. But motivations for profit enveloped good intentions. Certificates became a business, and the quality of the software became an afterthought.

The same may be or is happening with SSL/TLS deployment. With a function such as encryption, one cannot ignore software quality. Poor quality can defeat the whole purpose of the software. There is no point in using bad encryption software.

One of the good intentions the author cites is that people want ubiquitous encryption. Is encryption synonymous with SSL? Why? SSL is not the only system ever written to encrypt internet traffic. And it is probably far from the best one that could be written.

Nothing wrong with the good intentions. But is SSL is an asset or a liability? There is a cost to taking on SSL's baggage of complexity and maybe it's only worth it if the benefit achieved is real and not illusory.

If SSL can so easily be exploited, then the false sense of security it's name inspires may cause more problems than SSL solves. But that's only for users. Others with purely commmercial goals stand to profit immensely from SSL adoption, the same way businesses did from CA certificates.

SSL was not created with the intent to protect non-commercial communications. It was created in the 1990's by Mozilla to allow for "e-commerce" using their Netscape browser. It served it purpose.

SSL is old and people are attempting to retrofit it with "improvements". Such as being able to host multiple sites with one wildcard certificate on one IP address. This is a hack. It's called SNI and it breaks a lot of software. People should consider why such a "feature" even needs to be implemented. Is it for the benefit of the user? The CA business has become nothing more than an impediment for many people.

Costs vs benefits. Not just for business but for users.

</comment><comment><USER25> Missed the biggest point which is cognitive overhead. HTTP is simple to understand and it has thrived because of this. What a pain it is to get Wireshark to decode TLS traffic, which is not just cognitive overhead but debugging overhead too.

</comment><comment><USER26> Trusted (ie, no warnings) HTTPS localhost for Mac requires about 10 mins to set up. After that:

        https-server

Will give you: [https://certsimple.com/images/blog/localhost-ssl- fix/trusted...](https://certsimple.com/images/blog/localhost-ssl-fix/trusted- localhost.png)

Details: [https://certsimple.com/blog/localhost-ssl- fix](https://certsimple.com/blog/localhost-ssl-fix)

</comment><comment><USER27> > It stops proxies from caching responses between different clients. There is > no way to fix this.

There is, at least in corp environments. We have, via proxy.pac, a couple of ordinary proxies which act as regular cachers with low TTL, and additionally a _huge_ (read: multiple TB storage) proxy which caches with extremely high TTL the auto-updaters from Apple, MS, Debian, Ubuntu as well as the media CDNs of some major newspapers.

It works because our machines have its CA certificate locally installed.

</comment><comment><USER28> Somewhat related: I went to check something on my home router for the first time in months and learned that:

a) it uses an old version of SSL to serve up its admin page

b) all modern browsers refuse to load that page and no longer offer an override

I had to dig up and load an old unpatched browser so I could turn off SSL completely on my router so I can continue to administer it. Am I more secure now? I'm not sure.

<comment><USER29> A better option would have been to use something like sslstrip/sslsplit/mitmproxy to strip/bump the SSL connection. Admittedly the situation is bit unfortunate, but there aren't really many good solutions when dealing with broken crypto.

</comment></comment><comment><USER30> As a compromise between SSL and plain http, wouldn't it be enough for most of the content to be signed? E.g. background images don't necessarily have to be encrypted. They can be sent in plain sight with a signature which ensures that the image hasn't been modified. The signature has to be computed only once so that the overhead can be neglected.

</comment><comment><USER31> The point he makes is valid... but the action item here should be "Make SSL better" not "Stop using SSL".

</comment><comment><USER32> I just want to point out that TLS verification is extremely fast in HTTP2 to the point where speed is arguably a non-issue.

</comment><comment><USER33> "I think [SSL on all websites] is motivated by: ... A desire to make traffic shaping and censorship more difficult."

Eh?</comment>


Google's Annual Letter - <AUTHOR> http://graemethickins.typepad.com/graeme_blogs_here/2008/03/googles-annual.html

<comment><USER2> Some interesting things in the letter: \- 17,000 employees in 20 countries

\- 1/3 of employees work on search

\- 1/3 on ads

\- search & ads are hard problems, i.e. _there are many opportunities in this space_

\- 70-20-10: 70% resources on search & ads, 20% on apps (gmail), 10% on areas that are farther afield but have huge potential, such as Android.

\- YouTube is a largely independent operating structure, with YouTube remaining in a separate office in San Bruno, about 25 miles from the main Googleplex

\- Every week, I(Larry Page) approve a Google spreadsheet with a summary of every single hire we are making worldwide

\- Instant messaging within Gmail- which works right inside your browser with no installation-has been a big hit

\- Our goal is to generate a gigawatt (roughly enough to power San Francisco) of clean, cheap energy in years, not decades. If we are successful, we will not only help the world, but also make substantial profits \</comment><comment></comment><comment></comment><comment></comment><comment>-- Good read, clearly Larry & Sergey are continuing Warren Buffet's Annual letter tradition.

<comment><USER3> If they can pull off renewable<coal, they're going to be the biggest company of all time...

Anyone want to put odds on them doing it in 5 years?</comment></comment>


U.S. Internet Advertising to Double to $42 Billion Over Next Four Years - <AUTHOR> http://www.techcrunch.com/2007/11/07/data-us-internet-advertising-to-double-to-42-billion-over-next-four-years/

<comment><USER2> To play devil's advocate, here's some short-term gloom on this topic: [http://www.alleyinsider.com/2007/11/ad- forecast-08-cautious-...](http://www.alleyinsider.com/2007/11/ad- forecast-08-cautious-maybe-gloomy.html)

</comment><comment><USER3> I want a very large portion of that $42 billion. Should I set my login to procrast for getting kicked off?

</comment><comment><USER4> is that mostly from inflation?</comment>


Outrageous success - genius or hard work ? Malcolm Gladwell analyses. - <AUTHOR> http://www.guardian.co.uk/books/2008/nov/15/malcolm-gladwell-outliers-extract An extract from Malcolm Gladwell's forthcoming new book, "Outliers: The Story Of Success". Looks at Bill Gates, Mozart, Rockefeller and the Beatles. <comment><USER2> On a related note, if you find this line of thought interesting, you'd probably enjoy Steve Martin's _Born Standing Up_.

It's a beautifully written memoir in which he tells the story of how he became one of the most successful stand-up comedians ever. I'm not much of a reader, but for what it's worth, it's probably the best thing I've read this year. And, yes, it reinforces the idea that "genius" is often the result of years of hard work and trial and error.

<comment><USER3> Seconded. And it's completely BS-free. He uses very few adjectives and writes almost entirely in declarative sentences. The book's astonishingly unembellished and plain, relying on the facts as he remembers them. Totally readable in four hours or so.

</comment></comment><comment><USER4> old definition of genius: exceedingly rare brain abnormality that confers exceptional intelligence.

gladwell definition of genius: exceedingly rare brain abnormality that confers drive to devote 10,000 hours to a random task.

forgive me if i don't feel inspired by this paradigm shift.

<comment><USER5> You seem to miss the point which is rather clear. Genius is not Inate, It is man made. Basically he is saying that it is nurture which makes genius and not nature.

So just to explain it more clearly, it is the environmental circumstances which make a genius and not his genes.

<comment><USER6> Thank you for your contribution. Is it really impossible that a genetic difference accounts for some of a person's willingness and/or ability to devote the huge amount of effort that's required to become a 'genius' in any pursuit? I propose we extend your theory: the total inability to grasp complexity is also attributable entirely to environmental circumstances.</comment></comment></comment>


The agency model is broken: Why we sell teams, not projects - <AUTHOR> http://myplanetdigital.com/article/agency-model-broken-why-we-sell-teams-not-projects

<comment><USER2> We tried that. The clients that went with it loved it (and we loved working for them).

But the business reality is the most clients want to know what the whole product, not just the "Minimum Desirable Product" is going to cost them. Hell, so would I for most work, like re-modelling my house, and most people don't understand why software should be any different. (Unfortunately they do understand the "soft" part, as in "changeable".)

Also, managing expectations about that minimum desirable product is very, very hard since it's very difficult for clients to imagine clearly what that product will be like.

In the end we decided that clients we could do our best work for were too few and far between, and that as long as clients don't understand software better the agency model will remain broken because that's the only model for which there is enough of a market.

And since we wanted to make great software for happy clients and not deal with that 50% broken projects anymore, we pivoted to a (semi-)SaaS model and focused on a specific niche we were already building a name for ourselves in.

Being an agency in an immature market was just too frustrating.

<comment><AUTHOR> It is frustrating sometimes, but I think with the increasing popularity of books like The Lean Startup and an overall broader understanding of how startups actually work, people are more willing to try new engagement models.</comment></comment>


The evolution of the 37signals home page - <AUTHOR> http://www.37signals.com/svn/posts/1648-the-evolution-of-the-37signals-home-page

<comment><USER2> One thing that's interesting to me is that they clearly view each of their changes as being an improvement, but do they have empirical data to back that up? According to this copyblogger article, it doesn't sound like they had any metrics for the first few iterations at least...perhaps things have changed.

[http://www.copyblogger.com/the-37-signals-approach-to- copywr...](http://www.copyblogger.com/the-37-signals-approach-to-copywriting/)

<comment><USER3> If you want to use metrics, that's fine. If not: well, whatever works for you, works for you. Obviously 37signals is a success, and they design on impulse. They make things that "feel good". That is a perfectly fine way to design, especially if you have experience with designing.

Copyblogger is everything that's wrong with blogging. They take something that should be intricate and personal and try to turn it into a generic "writing copy" style. Is there any blogger worth anything at all that ever got advice from Copyblogger? Because when I read blogs, I go for the ones that _don't_ sound like they're working from a stencil.

<comment><USER2> _If you want to use metrics, that's fine. If not: well, whatever works for you, works for you. Obviously 37signals is a success, and they design on impulse._

Is 37signals a success because they design on impulse, or in spite of it? I'm sorry, but I have yet to hear a solid argument that ignoring easy-to-capture metrics is better business. I'm not talking about anything esoteric, I'm talking about core business metrics, like the number of people who sign up for your service.

If you implement a new design "on impulse" and your signups drop by 90%, your impulse was wrong, no matter how much you like the design or how good it feels to you. Even if you're still profitable after the drop (and thus "a success"), that doesn't mean that you made the right decision.

<comment><USER3> _I'm sorry, but I have yet to hear a solid argument that ignoring easy-to- capture metrics is better business. I'm not talking about anything esoteric, I'm talking about core business metrics, like the number of people who sign up for your service._

That's because a lot of people, namely the intuitive sort, don't track that stuff enough for there to be a good counterargument.

That said: intuition has long been a part of design. Architects don't design buildings according to a numbers game: there's a part of the process that's wholly creative. Obviously, artists don't rely on metrics. They go with their gut. Numbers can show some things, but not always. Would you say that Rotten Tomatoes, by being fair and balanced, is really showing us the best movies? Is Toy Story 2 the best movie ever made? According to their reviews it is. According to ticket sales Titanic is the best movie ever. Are either of those metrics true? If I make a movie expressly intending to score better numbers than those movies, am I doing justice to a movie?

Get rid of this "right decision" argument. Past a very basic point, that's all subjective. There is certainly an objective layer design, but past that it's a matter of "like" and "don't like." The argument is like the Mac versus Linux argument, where one side says they "feel" better and the other side brings up numbers. The numbers are accurate, but to assume that the other side has no argument merely because they base opinions on intuition is stupid.

(By the way: there's more to a business than number of users. I'd rather have a site that had a very bright, small userbase than a site with a lot of users that I personally didn't like. Hacker News versus Digg, for instance.)

<comment><USER4> Hacker News isn't a business. It's a site. A business has to make a profit.

<comment><USER3> But 37signals _is_ making a profit. Quite a lot of a profit. So after they're making money, isn't it their choice whether or not to follow their gut? Obviously the results are working for them.

<comment><USER2> Of course it's their choice. That doesn't mean it's the optimal choice or one to be admired.

<comment><USER3> Yeah, I get that. The problem is that "optimal" is misleading, because making money isn't the only goal of opening a business.

Would you say that David Lynch is a suboptimal director? His movies aren't enormous hits. He hasn't won for Best Movie. But those aren't his goals. Similarly, sometimes the people developing a site have more at stake than maximizing profits. Sometimes they want to make gorgeous web pages or gorgeous processes. And there's no optimal procedure for that.

Some people look at it another way. The 37s team obviously treats design as a sort of art rather than an exercise in optimization. As it happens, they make better products (in my opinion) than the people who go the other route. So they serve as a sort of inspiration.

That's my point. The argument is not entirely meaningful, because there are two things happening at once, and you can measure the one but not the other.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> "Remember the eight-second rule. Consumers have eight seconds worth of patience while waiting for your pages to load. This is especially true for home pages. It's like the restaurant business mantra: Don't keep them waiting, or they'll leave and never return." \- 37s manifesto.

Wow. Now for Google a 500ms -- half a second-- lag for twice as many results per page means a 20% drop in traffic.

</comment><comment><USER6> Loving the new design - the last one looked like a giant advert and I was always worried that I'd hit a placeholder page.

<comment><USER3> Agreed. The old design was _ugly_ \- memorable, but it felt so cheap and sloppy. The new design is terrific - I love how many different styled sections they have to convey their information. It isn't at all repetitive.</comment></comment>


Mike Bloomberg's proposed Wall Street transaction tax explained - <AUTHOR> https://www.cnbc.com/2020/02/18/mike-bloombergs-transaction-tax-would-levy-0point1percent-from-stocks-trades.html <comment><USER2> The article explains _what_ it is, but not _why_ it's supposed to be good. Except perhaps that the proceeds of the tax could be used for welfare payments.

As explained at the bottom, such a tax is likely to cost holders of retirements account money.

A more important effect might be slowing the giant vacuum sucking bright technical people needed elsewhere into Wall Street. Bloomberg could help with that by not hiring so many himself.

</comment><comment><USER3> How is this 'Mike Bloomberg's' and not 'Bernie Sanders'? Bernie had it in his manifesto before Bloomberg adopted it.</comment>


Ask HN: Who is running a profitable productized service business? - <AUTHOR> Hey guys,
I am a non-technical entrepreneur interested in building startups.
During my studies I grew a profitable, $250k/year productized service business (an online letting agency for international students) and I am now doing the same but for design services ($12.5k/month in revenue currently)
I was wondering if any other HN'ers are running a productized service business or if you know any examples. In addition, I would love to hear your thoughts on the future of productized service business in the era of automation / AI and whether we have a chance of serving on the long term!
Thanks! <comment><USER2> I run IdeaCheck.io [0] where we try to validate startup ideas by running a survey within the target audience and develop a report based on the results. We've automated everything that we were able to automate so that we can spend our energy on the 'important' bits that provide the most value to our clients.

Especially in design, I think that there will continue to be a market for both, automation and individualized services. Customers who don't want to spend a lot of money are happy with self-service automated tools like Canva or Logojoy, but I believe that creativity (coming up with a "clever" logo that stands out) will be one of the last areas to be automated away.

[0] [https://ideacheck.io](https://ideacheck.io)

</comment><comment><USER3> Well done. Would you mind sharing details for your design-related productized service?

<comment><AUTHOR> Sure! My service is called Manypixels ([https://www.manypixels.co](https://www.manypixels.co))

</comment></comment><comment><USER4> I am running stock trading robots in the cloud and they are fully automated and AI based in the decision making...

Essentially it is a productized service business with only one client - myself... and the future is great!

<comment><USER5> could you share more? what kind of stocks do you trade, do you trade crypto etc? Of course, as much as you are willing to share without giving away your secret sauce, that is

<comment><USER4> Sure, it would work perfectly for crypto, because of the constant volatility, but there is no way in hell I am going to transfer quarter or half a million to one of those exchanges, where it can be hacked, stolen, etc and there is not government protection to get my money back...

That's why I focus on on high quality / volume stocks traded on the major stock exchanges and I am using the APIs (provided by the well know discount brokers), been doing it for years and the compounding is what makes it worth while...

<comment><USER6> How have you performed against the market the last year? Let's just say a well-balanced portfolio, maybe a little risky, returned ~11% last year.

A portfolio with just equities in varying sectors, I think a good number is probably around 20% return for 2017. Not extremely high-risk assets, but a reasonable amount in small cap, em, and international equities.

Did you return greater than 20% last year? If so, that is quite remarkable in my opinion!

<comment><USER4> On average my returns have been in the double digits and much better than the market 20%, even with back to back losing years - for some reason I am losing money at the bottom of the market cycles, when the market starts to rebound...

I find it easier to have those kind of returns with small account (less than 5M/10M lets say), more than this and you are starting to move the market when placing trades, so it is much harder and cannot be back tested properly...

<comment><USER6> I'll be honest and say I don't believe you, because there's only three likely scenarios in my mind if you're telling the truth:

1) You are extremely smart, much more brilliant than people working at larger funds

2) You got extremely lucky with your strategy

3) Neither of these, it's actually "just that easy" to make money with these trading strategies

None of these even approach the likelihood of it not being true... sorry. I don't mean to be negative, it's just, to me seems very dangerous to preach "you can make money in the market, too!" and anyone, in my experience, who says that has something to sell :)

<comment><USER4> Frankly I don't care, because I am not looking for customers, investors or employees :-)

And I truly believe everyone can be a doctor, professional athlete, successful entrepreneur or stock market speculator, you just have to put the work required...

Don't remember saying it was "easy", but for sure it is one hell of rewarding hobby and not hard to start, get some data, small linux system and start testing...

<comment><USER6> I've built a few algo trading bots. There are a lot of challenging problems and it's very rewarding, just no direct financial reward.

I was focusing on pure technical analysis, so maybe I was doing something wrong, but there weren't any strategies that I saw would work. No statistical analysis that I could do of the data could give me any insight. Testing out theories did not work, either!

I didn't use ML or anything, research I did there didn't seem like it made sense to look into.

<comment><USER4> Welcome to my world :-)

I was like you and took me few years to realize the technical analysis and candle shticks simply do not work... All those books, online trading courses and coaches are simply charlatans making money from teaching and not from trading... Maybe it did work in ancient Japan, but today even if you find someone crazy enough to sell you a working trading strategy, it will be quickly arbitraged by all the people using it... One advice: first focus on risk management; even with marginal trading strategy, with good risk management, you can still make constantly money in the stock market...

<comment><USER6> Risk management barely answers the question. I can sell when I go below a threshold, but how do I buy back in?

<comment><USER4> Obviously you need a strategy, otherwise the whole exercise is pointless...

<comment><USER6> Well, yes. But then that brings us back to the question, how to determine a strategy?

<comment><USER4> OK, this is how I did it: I went and back tested any trading strategy I could find, of course they all failed, but it gave me the feel for the market and I started having my own ideas and this is basically how I found my edge...

Always remember what my good friend from high school Mark Twain once said: "The harder I work, the luckier I get." ;-)

<comment><USER6> People also just get flat lucky, all the time!</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


Ask HN: Moving off of Google products - <AUTHOR>

TL;DR: what are good replacements for various google products?  I don't place a high value on integration, and I'm willing to use a service of lesser quality in my rebellion against Big G.
Ever since I had to add a public Google+ profile to my work Google Apps account (which we pay for) just to use Google Hangouts with more than one person, I have found it increasingly hard to remain a user of Google products.  I should have seen it coming from the forced YouTube/Google+ upgrade, but for me the last straw was when Chrome installed a Desktop Notification menu bar icon in OS X without asking me, with no way to remove it, and no way to disable notifications for Google products.  The very aggressive way that Google is shoving its ecosystem down my throat is no longer palatable, and I no longer want to participate or give them my data.
I've switched off of Chrome to Firefox/Safari, and although they're buggy or act in ways that are confusing (open 30 tabs in Safari and figure out the rightmost tab's behavior), they're fine as my daily browser.
Harder for me was to make the switch to DuckDuckGo as my search engine of choice, but except for Google Images or some trending news topic I'm mostly fine with DDG, especially now that I'm discovering lots of neat tips and tricks.
Tonight I'm having trouble switching off of Gmail to FastMail because Google is flagging FastMail's IMAP migration login attempts as "suspicious activity," but I already think I'll be fine with using FastMail as my new personal email provider (I don't use my personal email that much).
But there are other services that I'm not sure how to replace.  Google Image search,  YouTube, and Google Docs are harder for me to go off of, mostly because all-the-things are already in there and nowhere else.  Any recommendations?  What about replacements for other Google products? <comment><USER2> I don't think you should actually replace all the products, just make sure you're not signed in with any of the google's products and you'll be fine.

</comment><comment><USER3> Try Pinboard for bookmarks [https://pinboard.in/](https://pinboard.in/)</comment>


Twitter explains why developers shouldn't build new clients - <AUTHOR> http://thenextweb.com/twitter/2011/03/14/twitter-explains-why-developers-shouldnt-build-new-clients/

<comment><USER2> Seems the signals are mixed about what is ok and what is not ok, and people are going back and forth on that.

More importantly, what happens when something is not "ok", and for what level of ok-ness?

        1. A client that spams people's Twitter streams without asking? Obviously not
        ok, loss of API token.

        2. A client that alters people's stream to include affiliate links? Presumably
        not ok, loss of API token? (Questionable)

        3. A client which "enhances" people's stream by making semantic clarifications
        to content? Example: Imagine if http://twitter.com/english50cent could be
        programmatically generated from @50cent. Is this not ok? It's certainly
        innovative. What are the consequences? Where is the line?

        4. A client that displays the Twitter stream verbatim but comes up with a new
        visualization? Sounds like this is not ok too, since it might "confuse"
        consumers? Do you lose your API token for this?

        5. Generally, someone builds something that Twitter didn't think of and gains
        mainstream usage, what is the consequence? What is the risk of Twitter making a
        policy against it and shutting it down due to inconvenience to them?

The Twitter team invented the medium — 140 character limited messages with a very specific style of graph-based visibility.

The rest of Twitter's mechanics were invented by third parties. @replies were not invented by the Twitter team, nor RT's, nor hashtags, nor search.twitter.com (acquired), neither was the Twitter iPhone app (acquired), neither were url-shorteners (t.co copied tinyurl, bit.ly, etc).

Many of these mechanics came specifically from third-party consumer clients. Someone came along and made a client where words prefixed with a hash were searchable on Summarize, and now Twitter's entire business model seems to be based around that.

What would have happened if Twitter said "don't make any more clients, we got this" before all this happened?

What's going to happen if Twitter says this now, before who-knows-what happens?

Twitter's greatest strength has been in recognizing value and innovation created by the community of users, but suddenly this changed. I really hope Twitter reverts their policy/suggestion, and apologizes to the community. Right now it comes off as very arrogant, presumptuous, and stifling to innovation and further progress.

<comment><USER3> I agree with what you write with one little correction

Twitter didn't invent the 140 character medium. It was a legacy from Twitter originally being very SMS focused.

<comment><USER2> Fair point. Yet another example of the original Twitter team being able to find value and capitalize on a constraint that today would probably be ignored or even frowned upon.

</comment></comment></comment><comment><USER4> > There are much bigger opportunities.

Except for the fact that Twitter has a track record of screwing over developers who find said opportunities.

<comment><USER5> Really? They paid off the Tweetie guy nicely, and now they've driven a bunch of new users to Echofon with the iOS Twitter app interface changes.

<comment><USER6> Is he the only developer around??

</comment></comment></comment><comment><USER7> I'm still not completely clear on what's ok and what isn't.

They seem to be saying that special-purpose clients would still be ok. For example, a SXSW iphone app that filtered and ONLY showed tweets with the #sxsw tag, and perhaps appended the tag to your own tweet. Not a path to riches, but you can see why such an app may be of use in certain situations. It seems to be allowed under these rules, but I'm not 100% sure.

What they've done is introduce uncertainty, which is worse for the ecosystem than anything else.

<comment><AUTHOR> Well, based on this article, anything is allowed. It's just a matter of can you monetize it, knowing that Twitter is focusing on its own client as a core product. An SXSW app doesn't seem too monetizable to begin with, but no reason why you can't make it.

Having said that, I am confused as to what happens if you do make a new competing client. Is this really just friendly advice to developers to not compete against Twitter, or will Twitter block your API access?

<comment><USER8> Not at all. This sounds more like friendly advice to developers making it clear that _they_ plan to compete in this area. Because theirs have the benefit of being the official apps, you may have a harder time gaining traction.

The writing was on the wall with the Tweetie acquisition and newtwitter, but now there's a blinking neon sign there.

<comment><USER9> _This sounds more like friendly advice to developers_

I would agree with you if they had not changed their terms of service, to make it illegal for you to do <unclear> things.

A simple warning saying: "we intend to compete in the client space" would have been fair.

</comment></comment></comment></comment><comment><USER10> 90% of users are already on the official client (see the link to the announcement in the article) so the "fragmentation" argument doesn't hold water. I'm guessing this is the nice letter asking devs to stop developing competing client apps and the next letter will be more forceful.

Reading between the lines here it looks like their official client is going to be making them money in some capacity so they don't want people using 3rd party clients that might bypass that mechanism (whatever it is: ads, selling click data, whatever). That's just a guess.

Also notice their TOS is getting stricter. You cannot display data from alternate services alongside data from Twitter's API. Again, that only seems to make sense from an advertising perspective. Future restrictions are hinted at, too.

I used to wonder why the hell companies like Twitter would operate without any solid plans for making a profit, incurring huge costs and just taking on a massive amount of users. In hindsight it looks like you create an awesome free site to get a bazillion users and then once everyone is entrenched you can start to make it suck more in order to get paid.

<comment><USER11> >Also notice their TOS is getting stricter. You cannot display data from alternate services alongside data from Twitter's API.

I read it a couple of days ago, but isn't that limited to not being able to provide alternatives for the suggestions for who to follow, alternative trending topics, etc?

</comment></comment><comment><USER12> I'm curious if Twitter would allow a third party smartphone client that displayed 3rd party ads in a format that looked like the dickbar.

</comment><comment><USER13> Can anyone explain why Twitter even matters beyond app discovery?

If I create an app that posts to Twitter so that someone else can consume that data, why not just cut out the middleman after the initial announcement?

<comment><USER14> Are you suggesting that the important tweets are the automated tweets by non- twitter-specific applications? This is bizarre to me, because I typically only follow people that are tweeting interesting things per se. Discovering apps almost never happens; to the contrary, people sending a lot of automated tweets get unfollowed by me rather quickly.

<comment><USER13> I dunno. It may be that I can derive more from a longer blog post, with more information, than an SMS that imparts nothing useful to me. For in-depth information, it's nearly useless and I, for one, don't need/am not interested in a running train of thought.

I do think it would make a great discovery aggregator, now that it's up and running.

</comment></comment></comment><comment><USER15> Just yesterday I was unable to access twitter from my university. It blocked me by saying something like 'API calls exceeded'. A university have generally a single IP address and thousand of users. What will twitter do about this ?

<comment><USER16> Rate limit is by IP+username.</comment></comment>


Dear Facebook: Please learn how to design Android apps that don't suck - <AUTHOR> http://blogs.computerworld.com/android/21684/facebook-android-apps

<comment><USER2> Regardless of how good it is, I don't feel comfortable installing it because of the permissions it requires. You don't lose much by visiting fb.com in a browser.

Allows the app to take pictures and videos with the camera. This permission allows the app to use the camera at any time without your confirmation.

Allows the app to read data about your contacts stored on your phone, including the frequency with which you've called, emailed, or communicated in other ways with specific individuals. This permission allows apps to save your contact data, and malicious apps may share contact data without your knowledge.

Allows the app to modify the data about your contacts stored on your phone, including the frequency with which you've called, emailed, or communicated in other ways with specific contacts. This permission allows apps to delete contact data.

Allows the app to access the phone features of the device. This permission allows the app to determine the phone number and device IDs, whether a call is active, and the remote number connected by a call.

<comment><USER3> But is it possible to allow app to take pictures (when you want), import contacts (if you want), sync contacts (again, optional) etc without those permissions?

I'm not an android developer, so someone please correct me if I'm wrong, but usually those permissions sound like you're giving up all your data but in reality it's just used to do something simple as to prevent vibration/ringing/notifications while you're talking on the phone.

<comment><USER4> It is not possible. This is a serious flaw in Android's permissions model IMO. Everything must be asked for up-front in the app's manifest. You cannot ask for more permissions at run time.

[http://developer.android.com/guide/topics/security/permissio...](http://developer.android.com/guide/topics/security/permissions.html)

</comment></comment></comment><comment><USER5> Facebooks engineering seems to have weird priorities. They seem put all their effort into crazy stuff like "Graph Search" whilst ignoring incredibly annoying issues like not having a basic search engine to find your own posts or having two week old posts showing up in the stream approximately 20% of the time. I'm guessing it is a lack of self discipline. Everyone wants to solve the sexy problems but no-one works on debugging the old year race condition that has been bugging everyone.

<comment><USER6> Don't forget that they need to invent a new way to shove "find new friends" down my throat, every second week.

</comment></comment><comment><USER7> I've been "using" the Android Facebook app for over a year, maybe two and it seems to have gotten worse over time, at least in the past year. The "new" version doesn't seem to be any better.

I was at talk trying to check for a message using the app with limited success yesterday, before I finally gave up and used the Android RealVNC app to remote connect to one of my home systems, open a web browser, and connect to Facebook that way.

I'm really unsure what the issue is here. Is it just really hard to make a decent app? Is Facebook not devoting enough resources to development? Is the development team really bad? Do they not know how terrible their app is? Are developers of the needed caliber in too short supply?

<comment><USER8> Err, why use VNC instead of just using a local browser in desktop mode?

<comment><USER7> Mostly because the icon was on the same screen, and I'm already logged in on my home system, and I didn't want to type my email / password in again.

Maybe I should do that in the future.

</comment></comment></comment><comment><USER6> I stopped using the FB app since it was so slow it was painful . It was much faster using FB trough the browser. Then FB released the new FB app in December and I installed it again. It was super, it only took a second or so to display the news feed when you launched it.

But about two weeks ago everything went down hill. Sometimes it took up to a minute to actually display anything and most of the time at least 20 seconds (all over wi-fi). So I uninstalled it again.

What baffles me is that they don't notice this or that they just don't care.

</comment><comment><USER9> They literally have had to force staff to carry android devices to experience it first hand.

They have been shoving dog food down their employees mouths because they are aware of how bad it is.

<comment><USER10> are android devices really that unpopular there? even amongst the people coding the android app?

<comment><USER11> It's like that in most of the Valley. You have (a) early adopters who jumped on the iPhone train in 2007 and can't get off due to lock-in (apps, familiarity), (b) high percentage of Mac users creating a halo effect, and (c) hero-worship of Steve Jobs/Apple. This combines to make the percentage of Android users in the Valley much lower than in the general population.

<comment><USER10> huh. I never noticed that having android was so rare amongst techies in the valley.

</comment></comment></comment></comment><comment><USER12> Facebook is the most popular example of a bad app, but it's far from the only one...

Try the Grindr app sometime. It'll kill your battery life like nothing else, and it has some sort of blocking bug that interrupts music when it is refreshing your location. --I haven't encountered any other app that does that!

</comment><comment><USER13> Facebook's mobile apps have to use the Facebook API, which is notoriously terrible. Facebook have no reason to devote resources to this, as they don't want third party implementations dragging people away from their ad revenue.

Similarly, their mobile app is capable of delivering far less ads than the web page, so they'd rather people sat on that at their desk rather than browsing on their phone.

In relation to lack of decent search and other obviously lacking elements: They're always going to devote far more resources to things which directly or indirectly improve advertising (graph search, friend finding, increasing numbers of likes) rather than things that enhance user experience (since user experience is far more tied to network size rather than feature set, compared to other markets)

<comment><USER14> > Similarly, their mobile app is capable of delivering far less ads than the > web page, so they'd rather people sat on that at their desk rather than > browsing on their phone.

So basically their strategy for accelerating mobile usage is "don't support mobile"?

</comment></comment><comment><USER15> The amazing thing is how much memory the app can take up. Forget the UX issues, it is urgent to fix the outrageous memory usage first. For example, my old phone had just about 100M available for user apps.

Facebook uses about 121M. That's even after disabling all notifications and clearing data. 121M is more than all the rest of my apps combined.

Google+ is also a relative heavyweight at 31M. Android's most used app, Google Maps, uses a svelte 8.9M.

On older phones, just running Facebook alone will make the entire OS experience slow and frustrating. Now with the latest update, it prompts me to sync my contacts _every open_. It is shocking how badly they have managed this.

</comment><comment><USER16> The Skype and Netflix apps are also awful custom homebrewed garbage. Netflix constantly freezes and becomes unresponsive, and Skype doesn't background itself anymore since the recent "Windows 8" overhaul on it. Also, why does Netflix try to download every poster for every movie ever as soon as I open it? I only have 300 KB/s internet, that takes forever!

</comment><comment><USER17> First thing they need to do is to allow the app to be installed to the SD card. The bloatware is now over 25mb in size, and I have a very limited size internal memory on my phone, whereas have a bucket load of space on my SD.

And while we're on the subject, YouTube, GMaps and TweekDeck all need to allow the same thing (every app should). I don't care about the lose of widgets since I never use them. I forced them to SD using Titanium backup, but it's not perfect and there are some glitches.

</comment><comment><USER18> It's pretty bloated and slow, no point using it! i dont need a 40+megs app running all the time with full permissions on the background, makes no sense! the facebook messenger is the same thing! and thats besides the need to "access all my contacts", NO i want facebook contacts on facebook and phone contacts on the phone for all the obvious reasons!

</comment><comment><USER19> I hate those buttons in the top-left corner of the screen that are used for the main navigation. If you use two hands they are ok, but you know there are people that still use phones only with one hand. There is no better place for the main navigation that the top-left corner? Could any recommend a better alternative? What about bottom-left?

<comment><USER20> I suppose the devs all have the latest 10" phones... ><

</comment></comment><comment><USER21> I actually don't think the new version of their app is that bad. Granted I might not be a heavy user of the app, maybe 10 minutes/day, but the feed seems a lot faster than it used to, and I like the ability to swipe through peoples image galleries from the stream, without leaving that view.

</comment><comment><USER22> The Facebook client is getting better, don't forget how bad it was 2 years ago. I even created my own client for that reason. (Shameless plug: <https://play.google.com/store/apps/details?id=com.flipster>)

</comment><comment><USER23> I removed the Facebook app from my iPhone when I heard about the Facebook email scandal in the iOS 6 beta. I realized that they will just keep doing this sort of thing so having their app on my phone was basically like having a latent iPhone virus.

</comment><comment><USER24> I think it's good. It's a bit laggy compared to the iPhone version but otherwise it provides the functionality I need in a good way.

</comment><comment><USER25> the most annoying thing in my opinion is, that fb doesn't clear my notifications if I already seen those in another version e.g. website, tablet. It's frustrating to see all these notifications over and over again.

<comment><USER26> The iPhone version does. The worst offender in this regard is Twitter. I get notifications of direct messages and mentions on (1) the website, (2) the official app on my iPhone and (3) the official app on my iPad.

</comment></comment><comment><USER27> Why would I need a facebook app?

It's a web page and I have a browser....

<comment><USER28> Ill bite.

An app can provide notifications, integration and speed. An app can do a lot more caching than the app, and will never have to reload a version of its own code. There's places were apps are appropriate, and this is one of them.

<comment><USER27> I understand some folks like to recieve fb message notifications as if they were email I guess. Don't feel the need myself.

I guess I'm just questioning the need for an app for all things, when many of the things are just as well served by a decent page in a browser.

<comment><USER29> Facebook is currently the best IM platform in terms of functionality, stability and ubiquity. In that light, notifications are important.

<comment><USER28> They also have the best automatic presence detection, it's miles ahead of iMessage in that (and almost every other) regard. I want to dislike it, but Facebook has done a stellar job making their messaging system bullet-proof.

<comment><USER30> I just downvoted you by accident, sorry. Maybe someone who really disagrees with parent can vote him up instead? :-)</comment></comment></comment></comment></comment></comment>