First Look at Uber's Co-Founder's Shopping Concierge "Operator" - <AUTHOR> http://techcrunch.com/2015/04/22/the-request-network/

<comment><USER2> It's funny how shopping has come full circle since the 1850s.

Back then, you went to the corner general store, you told the shopkeeper what you wanted, he went behind the counter, assembled all your items, and handed them to you. Then department stores came out in the late 1800s; they were revolutionary at the time in letting the customer do their own shopping and only offering assistance if you specifically asked. Department stores begat catalog retail, where there was no human, you just placed an order by mail and it was shipped to you. Catalog retail begat e-commerce, where the catalogs were placed online and the retailers dispensed with stores entirely. E-commerce begat the sharing economy, where _in specific verticals_ you could just plug your search into your phone and a delivery person would appear with your items. Now the sharing economy has generated concierge services, where you tell the shopkeeper what you want, he goes behind the (virtual) counter, assembles your items, and he (or rather some abstracted, unnamed delivery person) hands them to you. All over your mobile phone network, of course.</comment>


In L.A., One Way to Beat Traffic Runs into Backlash - <AUTHOR> http://www.wsj.com/articles/in-l-a-one-way-to-beat-traffic-runs-into-backlash-1447469058 <comment><USER2> I've noticed some of the "Waze shortcuts' making their way into Google maps. Some of these are pretty hairy. For anyone familiar with SF, here's an example:

To get from 8th & Bryant to 3rd & Bryant, Google Maps/Waze wants you to get on I-80 at 8th and exit at 4th. That would be OK but you enter 80 from the left side of the interstate and must exit within a _quarter mile_ to the right side of the interstate. This means crossing 4 lanes to get there. It's actually do- able in bumper-to-bumper gridlock but when traffic is moving it's pretty dangerous. Why not just go down Bryant Street? The "shortcut" can't save more 2 minutes at best and at worst costs 10+ minutes.

Waze used to be good for spotting cops and speed traps. Now it's just a collection of bad "short cuts".

<comment><USER3> A shortcut is supposed to be difficult; if it was easy, it would just be 'the way'.

<comment><USER2> Dangerously so?

</comment></comment></comment><comment><USER4> This problem is solved in Berzerkeley and for cheap. [0]

[0] [https://email@example.com,-122.2652156,3a,75y,...](https://email@example.com,-122.2652156,3a,75y,77.61h,70.47t/data=!3m7!1e1!3m5!1sjqjUFjtnBrzM0np- WUZa-w!2e0!6s%2F%2Fgeo2.ggpht.com%2Fcbk%3Fpanoid%3DjqjUFjtnBrzM0np- WUZa-w%26output%3Dthumbnail%26cb_client%3Dmaps_sv.tactile.gps%26thumb%3D2%26w%3D203%26h%3D100%26yaw%3D191.48755%26pitch%3D0!7i13312!8i6656)

<comment><USER5> This seems to be really common in the Bay Area and was one of the reasons I absolutely hated the city of Berkeley when I was there. You just can't direct traffic like this if your infrastructure can't handle the load to begin with; it's selfish beyond belief.

In Los Angeles, people were using Fullerton Road like this for years. The county finally got funding and actually realigned it to a proper road for people to use to commute on and the original Fullerton Road is back to what it was -- a small residential street.

<comment><USER6> It's called filtered permeability, and is a common retrofit in some countries in Europe. Wealth doesn't come into it — you will find it in some really poor parts of London, as well as the City (financial district) and some very rich neighbourhoods.

The point is that the non-arterial road can't handle the load, so the barrier returns it to its original purpose — the residents of and visitors to that street.

The intention is that the people who were using this route either \- use the main road (slightly increasing the traffic there) \- use public transport or a bicycle instead \- stop making the journey altogether

[https://en.wikipedia.org/wiki/Permeability_(spatial_and_tran...](https://en.wikipedia.org/wiki/Permeability_\(spatial_and_transport_planning\))

</comment></comment></comment><comment><USER7> Add diverters so it's not practical to use a street for through traffic. Portland is starting to do this on certain "neighborhood greenways".

</comment><comment><USER8> LA has always seemed like a terrible quality-of-life city to live in because of the traffic. The amount of time spent commuting makes me wonder why tech people, at least, don't want to move out of there.

<comment><USER9> I wouldn't call it terrible, life is nice in your car compared to say walking around in an east coast city during the winter if you have no car. Especially when it comes to grocery shopping. So I'd call it a trade off. Maybe SF is exempt from this a bit, but city living in a city that has some real weather (my experience was on the east coast) always struck me as very hard on it's human inhabitants compared to the car centric LA lifestyle.

</comment></comment><comment><USER10> Bollards. Give residents proximity sensors which allow them and only them access thru the bollards. Piggy backing will happen but they'll be waiting a log time.

Not saying place them everywhere just make it so the open streets are more mazelike so when friends need to visit there is a way in, it just happens to be byzantine, frustrating interlopers who want to cut through.

<comment><USER11> That's called a gated community and you _don 't_ get to fund them with taxpayer money. If you don't want to deal with plebeians on your roads, then you need to pay a developer to build private roads.

LA streets do not belong to the neighborhoods, they belong to the city. If neighbors are concerned about congestion, perhaps they should support policy that promotes density and mass transit.

<comment><USER12> > That's called a gated community and you _don 't_ get to fund them with > taxpayer money.

Sure you do. All you need is to make up a majority of the local voters. Won't work in LA; might work in, say, Long Beach.

Residents pass traffic ordinances screwing over drivers for practically no gain to themselves all the time. You're only allowed to vote on policies for where you _live_ , not where you drive.

<comment><USER11> The city is the functional unit for making that distinction, though, not the neighborhood. LA could vote to exclude non-LA residents, but a specific neighborhood or block could not vote to exclude other city residents.

<comment><USER13> But isn't that exactly how neighborhood parking permits work?

<comment><USER11> Neighborhoods (and universities) that reserve space for permit-holding affiliates usually have some paid street or garage parking for visitors. Or street parking is allowed to visitors for a few hours, or for a fee, etc.

Entirely denying _passage_ to outsiders (or charging a toll) is much more extreme. A better analogy might be the Seventeen Mile Drive in Monterey.

</comment></comment></comment></comment></comment></comment><comment><USER14> Apps that change their users' behavior can have massive public policy effects. Whether you think this change in traffic patterns is okay or not, it was not made with the public's interests in mind, nor with the input of democratically-elected representatives.

<comment><USER4> "nor with the input of democratic..."

Really? The public and elected officials never decided to build and open public streets that everyone has a right to travel on?

A republic isn't a place where every new decision and idea requires government approval -- that's a totalitarian dictatorship. A republic is where we elect people to set and enforce the rules for us and then we work within the rules absolutely any way we please to fulfill our own individual visions without asking permission from anyone.

<comment><USER15> What if you phrased it differently: "the roads were designed under different assumptions"?

In the past it was often assumed that most people would stay on major roads because only locals memorized chains of streets and even the people who planned routes (Thomas Brothers maps were a hallmark of the SoCal commuter, after all) would chain a few routes together but generally still kept it to what a human could remember since you couldn't safely read a map while driving.

Now that that has completely changed, it's probably true to say that the majority of local roads and traffic flows need to be reconsidered to see whether the signage or structure should change to enforce the way it was previously assumed they'd be used.

</comment></comment></comment><comment><USER16> Congested streets are the result of them being managed by the government, they aren't caused by poor road design.

All roads should be privatized, and consumers should pay for them like every other good and service they use.

How do popular restaurants, sports stadiums, and every other aspect of the economy deal with massive demand and limited supply?

Raising prices, and in the long-term making capital investments to increase supply.

Street congestion should be the quintessential textbook example in Econ 101 to explain the concepts of economic shortages.

Can you imagine any other good or service whose price never changes based on demand NOT having shortages?

Imagine a concert hall that charged the same price for seats whether the Rolling Stones or Vanilla Ice is playing?

The experiment with public streets has been a massive failure, and it's time to be ended.

<comment><USER16> Why down votes? At least explain why you're down voting.</comment></comment>


Vivaldi Webmail - <AUTHOR> https://vivaldi.com/webmail/ <comment><USER2> Trying to check it out but they insist on me giving my phone number. I got some spam issues in the past, so right now sorry, but my phone number is a private detail that I share only with physical people that I want to engage with and with whom I have a certain degree of trust.

I wish we had in Europe something similar to what mintemail.com is to email addresses... (Google Voice is US-only AFAIK)

<comment><USER3> A database with verified phone numbers is worth a lot more than without them.

</comment></comment><comment><USER4> Service creators, please look at your forms from a lay user's point of view, especially if you're a relatively unknown company/name and are venturing into something you're not known for.

On the signup form, there is a checkbox with this text:

 _" I'm planning to use Vivaldi.net Mail and/or Blogs (requires phone verification)."_

What exactly is Vivaldi.net Mail? How is anyone supposed to know what that is? How is it different from Vivaldi Webmail? What exactly is Vivaldi.net Blogs? Is it referring to reading Vivaldi.net's blog (sounds silly) or creating blogs there (how?) or commenting on blogs there? Can I signup for Vivaldi webmail without checking this box?

Also, does Vivaldi Mail support IMAP so that I can have my own copy of the mails and use other standard apps to access it (without having to solely rely on webmail)?

Lots of questions...and concerns!

</comment><comment><USER5> Tangentially: Why do today's startups have the same magenta/purple gradients in design? Literally every contemporary website just reeks of the same cookie cutter magenta and purple aesthetics. From Firefox to Apple advertisements - so much purple. Don't modern designers introspect this trend?

<comment><USER6> I am a founder of software house that was using magenta/purple colors in commercial products even when it was not hip back then in 2007.

The main signals behind those colors: out of the box, above and beyond, useful, pretty much reliable while being somewhat playful and comfortable.

Had a few supercilious looks when I presented the products and corresponding logos to my peers back then, but it all played well in commercial terms. Customers loved the aesthetics.

Regarding goliath companies using the same guerrilla design: they are mostly dishonest. But any mass design is somewhat dishonest, so I cannot blame them here.

</comment></comment><comment><USER7> It's just RoundCube?

<comment><USER8> How do you figure? If it's just from the interface, they could be using a fork.

<comment><USER9> The screenshots looks like vanilla Roundcube to me, and most (all?) of the features advertised are available in Roundcube itself or an included plugin.

That said, a hosted version of Roundcube is not necessarily a bad thing, but I do wish they'd put their own spin on it and add some unique features.

<comment><USER10> What's interesting is that it specifically looks like pre 1.4.0 Roundcube with the Larry skin, and not the shinier Elastic skin.

</comment></comment></comment></comment><comment><USER11> I noticed in their help page ([https://help.vivaldi.com/article/vivaldi-net- and-its-webmail...](https://help.vivaldi.com/article/vivaldi-net-and-its- webmail/)) mentions a 5 GB storage limit and 20 MB attachment limit.

My guess is there'll be a "pro" or similar version to fund the project, similar to what things like ProtonMail have. It would have been nice if they'd been explicit about how they're able to offer it free and without ads.

</comment><comment><USER12> How does Vivaldi aim to monetise this? Why is it free with no strings attached? Plenty of other questions that need to be answered.

<comment><USER13> I have no affiliation with Vivaldi, but they don't receive any revenue from webmail and I don't think they plan to.

Vivaldi monetizes the browser. Specifically, they receive money from search engine providers by including them in the browser by default, like DDG, Bing, Ecosia, etc. (except Google; they don't receive any money from Google, but include it anyway due to popularity). They also receive money from the default bookmarks/favorites that are included in a fresh install, like eBay, Amazon, Kayak, etc.

[https://vivaldi.com/blog/vivaldi-business- model/](https://vivaldi.com/blog/vivaldi-business-model/)

</comment></comment><comment><USER14> Not impress with the website security. Will be staying away from that for a while.

</comment><comment><USER15> Was about to signup then that annoying complex password requirment came up.

</comment><comment><USER16> It would be great to see data encryption at rest used in services like this. I like ProtonMail for their innovations in that space.</comment>


Motors Big and Small (1971) [video] - <AUTHOR> https://www.youtube.com/watch?v=oWiYsRi2Dss <comment><USER2> Well, that's delayed me by 20 minutes! I'm not sure whether it's the content (I knew some but not all of that), the presentation style (I've always liked the use of analogy in teaching), or mere nostalgia that made it so engaging, but I found it impossible to stop watching that, and now I want to know more - particularly to see if those developments were applied to the passenger carrying vehicles of today.

I wonder if a video made today would be as straightforward in presentation, and also how it would look to a 45 year old in 2062? (coincidentally this was made in the year of my birth)

</comment><comment><USER3> > "A good engineer knows when to use an analogy, and where it breaks down"

If you learn nothing else, learn this.

I listened to a conversation where a senior person was explaining something with an analogy. The junior person kept having problems with the edges of the analogy, where it breaks down, and the senior person just kept trying to explain the analogy.

Analogies, parables, shortcuts all have breakdown points, you have to know them, or they will bite you.

<comment><USER4> Probably, in Computer Science, the exemplar of unnecessary analogies is the first Paxos paper - [https://www.microsoft.com/en- us/research/publication/part-ti...](https://www.microsoft.com/en- us/research/publication/part-time-parliament/)

</comment></comment><comment><USER5> Holy hell, that's one good piece of video. Full of content and no fluff. I love the presentation style.

Anyone know of more videos like this one?

<comment><USER6> I rather like this one: [https://www.youtube.com/watch?v=yYAw79386WI](https://www.youtube.com/watch?v=yYAw79386WI)

<comment><USER7> This is a favourite of mine. I watch it every once in a while.

</comment></comment></comment><comment><USER8> Huh. His obituary says he retired from IC in 1986, but I _distinctly_ recall him giving an electric motors course in my first year in 1994! I'm doubting my own memory now, but have vivid recollections of a classmate talking about the patents he had, and his ideas for launching to space using a maglev track up the side of a mountain.

<comment><USER9> I think his son still teaches there?

</comment></comment><comment><USER10> "Of course... you can have a lot of fun with this..."

:-D</comment>


"10 people who don't matter" -- 2 years later. - <AUTHOR> http://money.cnn.com/2006/06/21/technology/10dontmatter.biz2/index.htm

<comment><USER2> So I think the jury is still out on Jonathan Schwartz, even with yesterdays disappointing earnings statement. The previous three quarters were profitable for Sun (which was a pretty amazing turnaround--Sun was in _deep_ trouble before Schwartz took the helm).

The thing that a lot of folks haven't realized is that the nerds have recaptured the flag within Sun. And, you know what happens when a bunch of nerds are on a mission. That's right: <http://tinyurl.com/67user>

OK, so maybe putting the nerds in charge isn't a guarantee of success, but it is a prerequisite in a tech company.

Everybody can probably think of one cool thing Sun is doing, because it touches on your specific area...but when you do an aerial survey of the whole Sun "cool stuff" landscape, it looks really impressive:

Zones - A sweet elastic computing solution. More efficient than Xen (due to different model...more like vservers on Linux, but it's actually stable enough to use), allows quite impressive run-time configuration like scaling resources up and down, etc.

JVM for dynamic languages - Sun has drunk the Koolaid on dynamic languages, and is actively contributed to a bunch of them. I think they are beginning to understand that Java is not the important thing to come out of Sun, but the JVM and that huge library is.

Cheap hardware - Really, you can buy Sun boxes for not too much more than equivalent Dell systems. And, Sun boxes are _nice_. They don't have as many low-end options as Dell, of course, but once you get into high end gear where Dell loses its huge quantity advantages, Sun is a viable option.

MySQL - Most popular database in the world. Hard to top that for importance in the industry. During web 1.0 they had to team up with Oracle to offer the whole solution...now they've got the full stack.

Caroline - Utility computing, elastic computing, "App Engine", call it what you will...Sun is building a commodity solution to the problem.

Will all of this make up for years of resting on their laurels? I dunno...but it's too early to count them out, and Schwartz seems to have played an important role in the change.

<comment><USER3>
      call it what you will...Sun is building a commodity solution to the problem

The problem with Sun is precisely that. They are turning everything into a commodity. This is good if your strategy is to make money on a complementary product.

The thing is: they forget to make money from complementary products. They are commoditizing the software, the hardware and everything they do... but where are they going to sit when the dance stops? Where do they intend to make money?

<comment><USER2> I just listened to Schwartz speak at Startup Camp a few hours ago and he discussed just that issue...I was surprised by how many folks were questioning him on the subject from different angles. Basically, "why have you made everything free?" (Because they have...nearly everything Sun builds is Open Source, all the way down to the CPU designs.)

His answer was, "because you [startups] wouldn't use it if we didn't". He went on to explain how startups using Sun means that in a year, maybe two or three, when those startups grow into big companies they will need the kind of infrastructure that only Sun (and maybe a couple of other companies) can provide. It made sense when he said it.

</comment></comment></comment><comment><USER4> I would say that business2.0 doesn't matter, since they went under about 6 months ago.

</comment><comment><USER5> He may be not someone who matters anymore in terms of "money & success", but my bet is on Linus Torvalds -- 100 years later. He is the only one on that list who has created something that is transcendental, wich won't stop after his death because it goes beyond himself and is slowly but surely shaping History, in a virtually unstoppable way.

Oh, and I'm a proud Windows XP user, no fanboyism inside :)

<comment><USER6> I think your argument also works to say that he _doesn't_ matter (by design), in that his project can continue with or without his active participation.

If you read the kernel mailing list, there is sometimes the question of "what happens if Linus gets hit by a bus?" He always says that it shouldn't adversely affect development... :)

<comment><USER7> The ultimate goal of a warrior is to lay down his sword.

</comment></comment></comment><comment><USER8> I think they are 100% wrong about Facebook being an also ran. The author is coming from the perspective of a large corporation type and fails to see that not selling out and not compromising your ideals will win in the long term. The author would have put Craigslist's founder up on that list and a few years ago Larry Page and Sergey Brin for not selling out when they had the chance.

<comment><USER9> Their argument is really that MySpace has already won. There may be some truth to that - MySpace is about 4 times bigger by the numbers, and in most other industries, 80% market share = winner. It's hard for us to see that because we're from the demographic that tends to use FaceBook, but remember that 2/3 of Americans don't even _go_ to college, let alone use a social networking site centered around the college experience.

I can kinda see FaceBook vs. MySpace as being today's Apple vs. Microsoft (or IBM) battle. FaceBook's cultivated a sort of elite brand - "we're better than Myspacers simply because we're on FaceBook". But remember that Microsoft eventually won: the masses, by definition, are far more numerous than the elite.

<comment><USER2> I'm curious where you get the "MySpace is about 4 times bigger" number? My understanding was that Facebook had grown to be larger than MySpace in some foreign markets, and that it was about half the size in the US. It is still firmly in second place--MySpace usage is still growing roughly on pace with Facebook so Zeno gets his revenge--but certainly more than 25% as popular as MySpace.

I'm not saying Facebook is worth 15 billion (that'd be stupid...I'm talking Stave Ballmer level stupid), but one can't say they've lost to MySpace, when the market is still wide open worldwide, and Facebook seems to know how to execute internationally than MySpace.

But, I think Facebook will lose, in the end, to a few dozen companies that build a better garden without the walls. Each will be smaller than Facebook, but they'll end the reign of Facebook and MySpace with a wholly different process of social networking. (I think a single destination "social portal" is as doomed to failure as the whole web 1.0 "portal" idea turned out to be...portals will always be less interesting than the whole Internet, so when the whole Internet is socially enabled the social portals will falter. The oracle has spoken.)

<comment><USER9> It was based on a userbase of 80 million for MySpace (from the article) and 20 million for FaceBook (which I'd heard as of about spring '07). However, apparently FaceBook has now grown past at least 30 million ([http://www.insidefacebook.com/2007/07/10/facebook-rockets- pa...](http://www.insidefacebook.com/2007/07/10/facebook-rockets- past-30-million-users/)), and may be more now. So it's probably more like a factor of 2 or 3 now. My information was out of date, sorry.

Edit: actually, the MySpace numbers are out of date too, so if they've grown at the same rate, MySpace should _still_ be 4x bigger.

And I agree that the future of social networking is probably something that hasn't been invented yet. The market is maybe 5 years old, which is about the same age as search when Google started kicking ass. My startup is actually in the running, so I've got a vested interest in FaceBook failing, but we've got so far to go that I don't even dare to hope...

</comment></comment></comment></comment><comment><AUTHOR> I love how they put Sony's CEO up there, and now blu-ray has won the format war...

<comment><USER10> I think Ken Kutaragi even in hindsight deserved to be in the list. He's since left Sony and made many major missteps which are likely causes to the PS3 not being the dominant market leader.

<comment><USER11> But the same move that caused the PS3 to not win the console war caused Blu- Ray to win the format war. Which one was more important?</comment></comment></comment>


What Loggly Learned About Scaling with Apache Storm - <AUTHOR> https://www.loggly.com/what-we-learned-about-scaling-with-apache-storm

<comment><USER2> Nice piece and love the "no log left behind" philosophy.

Recognizing every company's use cases are different, we've found Storm has worked quite well for us. We run an always always-on ingestion service with sustained peaks north of 1 million EPS.

We presented a talk at Strata two months ago on the Kafka --> Storm --> Druid architecture that we rely on: [http://youtu.be/kJMYVpnW_AQ](http://youtu.be/kJMYVpnW_AQ) .</comment>


Apply HN:Programmable matter - <AUTHOR> Goal: creation of programmable matter, consisting of many microscopic particles (c-atoms). Which can be manipulated to create a user programmed 3d form.
Achievements. Verified experimentally:
- ways to connect c-atoms with each other;
- the movement of c-atom relative to other c-atoms.
The experiments were conducted with models of c-atoms in the macro scale. The size of c-atoms models was 3 * 4 cm.
Tasks: - development of software capable of managing an array of c-atoms; - repeating experiments in micro-scale with size of c-atoms - less than one millimeter. <comment><USER2> What are the possible commercial applications of this technology?

How will your company make money from this?

<comment><AUTHOR> \- Programmable matter will replace 3d prototyping, which is now carried out by 3d printers. \- Will be used in telecommunications. The effect of presence - Pario. \- The technology will be used in medicine. The surgeon will be able to operate on the patient by manipulating programmable matter, which will be an enlarged, precise, copy of the operated area. \- Toys (gadgets) transformers. The company will make money by selling and renting devices from the programmable matter.</comment></comment>


Optimizing Optimizing HTML - <AUTHOR> http://annevankesteren.nl/2010/01/optimizing-html <comment><AUTHOR> A nice middle finger to Zeldman's horde of cargo-cult followers. Clicking on a _B_ button in a WYSIWYG editor and getting a <STRONG> element always pisses me off. _XHTML does not mean what you think it means_

The <http://id.annevankesteren.nl/> page he references is quite interesting beyond the obvious OpenID and SVG trickery -- he's linking the CSS using this Header in the Response:

      Link:<fancy.css>; rel=stylesheet, <fancy.css>;rel=stylesheet

Not sure why it's doubled up that way, but with just one reference he's saving two bytes over a <link> element -- doesn't need the href, but does need the trailing \r\n.</comment>


Perfect advanced programming language for the productive industrial developer - <AUTHOR> http://lambda-the-ultimate.org/node/3680

<comment><USER2> How often do people that need to write device drivers need to use a high level language? Is there really a lot of demand for this sort of thing?

<comment><USER3> Probably not, but it would be nice if there was one global language thats suitable for all problems... I'm not sure that its realistic though.

<comment><USER4> I really don't like the idea of one language suitable for all problems. I actually like that there are different languages that are better suited to different domains.

<comment><USER3> You're right. Its much easier to have domain specific languages specially built for certain problems. The appeal of a single language, I guess, is that you only need to learn one language and you can work on all problems. Then again, if you have good support for macros and other such "niceties" then you can remold the language to be domain specific anyway, so I think having a single super language isn't so far fetched and is actually not a bad idea really.

<comment><USER4> I can't help but think of Erlang. Erlang is by no means a DSL, but it is very well suited (both in terms of language features and its Virtual Machine) to writing distributed, concurrent applications. Why manipulate a hyopthetical language so that it is functional, has message-passing, allows hot-swapping of code, enforces single assignment etc. when a language with all those features already exists? And once you have manipulated a language to that extent haven't you created another language anyway, eliminating the possible benefits of having a single, malleable language?

<comment><USER3> Well, for this hypothetical scenario, its for the ability to write all your code within the one language, but _tuning_ each code block or abstraction to the particular problem being solved _at that precise time_.

In real life, you're right. It doesn't make sense to try and mash every language together just because. Its also potentially not possible anyway, since theres too many conflicting design decisions - though the ability to mold a language, through powerful abstractions and macros, like Lisp does, does indeed solve a lot of this.</comment></comment></comment></comment></comment></comment>


Operation What.CD: 12 servers seized at OVH and Free - <AUTHOR> http://www.zataz.com/operation-what-cd-12-serveurs-saisis-chez-ovh-free/#axzz4QHlt08UT <comment><AUTHOR> What.CD was probably the single greatest archive of music in existence, hopefully they'll be back up soon.

[https://en.wikipedia.org/wiki/What.CD](https://en.wikipedia.org/wiki/What.CD)

</comment><comment><USER2> Hopefully they backed it all up. The hydra will split.</comment>


America's Chronic Overreaction to Terrorism - <AUTHOR> http://online.wsj.com/article/SB10001424127887324653004578650462392053732.html

<comment><USER2> This is a conversation that we need to continually have as a nation and I am glad to see it being covered in more "mainstream" press.

What are we giving up to gain our freedom and is it worth it in the long run? The intelligence apparatus our nation has constructed only has value as long as we have fear, they are thereby induced to continually keep us in a state of fear whether real or fabricated. My biggest fear is that many of these recent "terrorist incidents", not 9/11, were in fact created by our own agencies...yes a bit of a tin foil hat scenario to be sure but one that is not all together unreasonable given the current revelations.

<comment><USER3> > many of these recent "terrorist incidents", not 9/11, were in fact created > by our own agencies

I don't think they consciously did it. But I do think our policies and heavy- handedness have created more terrorists than we've defeated.

<comment><USER4> While the indirect creation of terrorists is certainly also a factor, the direct method of creating plots that you can then "foil" has been widely documented and analyzed:

[http://www.wenatcheeworld.com/news/2007/may/11/paid-fbi- info...](http://www.wenatcheeworld.com/news/2007/may/11/paid-fbi-informant- egged-on-terror-suspects/)

[http://politicalscience.osu.edu/faculty/jmueller/absisfin.pd...](http://politicalscience.osu.edu/faculty/jmueller/absisfin.pdf)

[http://politicalscience.osu.edu/faculty/jmueller/since.html](http://politicalscience.osu.edu/faculty/jmueller/since.html)

[http://www.techdirt.com/articles/20120917/05193620404/fbi- co...](http://www.techdirt.com/articles/20120917/05193620404/fbi-continues-to- foil-its-own-devised-terrorist-plots.shtml)

</comment></comment></comment><comment><USER5> For the past century or so, America has needed an "enemy" in order to provide an opponent to focus on. For years, it was the Soviets and Communism, but with the quick collapse of the Iron Curtain, we suddenly lacked one. Luckily (!) terrorism stepped up as a replacement, and well, here we are. Victorious, at the cost of our treasure and our morals.

</comment><comment><USER6> You fight terrorism by refusing to be terrorized. America (or at least, its successive governments) failed from the start.

<comment><USER7> So how do I fight pithy one-liners that have no substance?

<comment><USER6> Fight fire with fire they say. You seem to be doing well :)

Snide remark aside, I'll admit that my comment is not very insightful, because it is pretty much common knowledge. That does not make it any less true though.

The aim of a terrorist is to instill terror in the population. I don't delude myself I thinking you can carry on as if nothing happened, but the measures that are taken should be an appropriate response to the threat, not born out of fear or an effort to soothe the population. If you don't let an irrational fear take hold of you, then all the terrorist efforts have been in vain.

That is also more or less the point of the article, I just laid it out more tersely.

</comment></comment></comment><comment><USER8> Seems deliberately deceitful.

After listing historical terrorist events and responses, Mr. Koppel tries to lump in our invasion of Iraq as an over-sized reaction to terrorism from 9/11 which happened eighteen months earlier.

The invasion of Iraq had nothing to do with 9/11, it was about oil, as we all know now, after the propaganda has died down and people have generally gone back to sleep.

The loss of privacy and rights since then, and currently, is our govt misbehaving, and also has nothing whatsoever to do with terrorism.

<comment><USER9> The invasion of Iraq had everything to do with 9/11\. Without 9/11 or something like it, there never would have been enough support for an invasion of Iraq to actually carry it out.

Yes, among the people at the top who planned it, it was not a reaction to terrorism. But the public support for it absolutely was.

Our democracy is far from perfect, and much of government is corrupt, but the government is still by and large a reflection of the people. The _people 's_ massive overreaction to terrorism allows, even requires, the government to do bad stuff like invade Iraq, wiretap every American phone call, and more.

We need to convince the _people_ to stop overreacting to terrorism so that the _government_ loses that excuse to misbehave.

<comment><USER10> "Without 9/11 or something like it, there never would have been enough support for an invasion of Iraq to actually carry it out."

Why not? It happened before, how could it not happen again? Actually, seen from outside of U.S., the Iraq events that followed the reinstatement of the Bush family appear very naturally, those were like... family policy!

<comment><USER9> Even with 9/11, there was massive public opposition to the invasion. However, 9/11 had caused a massive shift overall, resulting in _much_ greater popular support for the government in general and the administration in particular, and it caused the Democrats to abdicate their role as the "loyal opposition" and instead become rubber stamps. Additionally, 9/11 was used to drum up a great deal of additional support for the invasion by painting it as part of the war on terror. I don't believe it was ever outright stated, but it was heavily implied that Iraq was partially responsible for 9/11, and that the invasion would prevent future attacks.

In a hypothetical world without 9/11, the Bush administration would still want to invade Iraq, no doubt. It's been shown that they started the project of figuring out how to do it well before. But I don't think they'd be able to pull it off. Public opposition would have been _much_ greater, Congressional opposition would have actually happened, and I don't think they would have been able to steamroll over that, or even anywhere close.

Bush more or less came into office as a lame duck. He was the first president in living memory to have won the election while losing the popular vote. He was often thought of as a buffoon, and even his supporters, in my experience, supported him more out of team spirit than because they actually thought he was some brilliant leader. I believe that, in this environment, the default position on a proposed invasion of Iraq would have been a solid "no, why would you even want to do that?"

But mix in 9/11 and the following year and a half of terrorist-related paranoia and fighting, and a lot of people changed their minds to "yes, we must support our leaders in their glorious fight against the al Qaeda menace."

</comment></comment></comment></comment><comment><USER11> I love (not!) the way people who were against domestic surveillance when the previous administration was caught doing it are now strangely quiet after the current administration admits to doing the same.

</comment><comment><USER12> I hope the US is actually doing something smart/tricky. The CIA (or whoever) say this is because of some chatter. Can't they decode the chatter? Maybe they are pretending they can't.

</comment><comment><USER13> I would bet that this particular incident is not like the others. This strikes me as an intentional overreaction by a government trying hard to justify their surveillance programs.

</comment><comment><USER14> Wait, is this a trap article? This is coming from WSJ?

</comment><comment><USER15> It's not an overreaction, it's the agenda.

<comment><USER16> It's both. The news isn't pushing a particular agenda, they'll take anything that pushes people's buttons and grabs their eyeballs, whether it's this or another missing white girl.

<comment><USER15> The news most definitely pushes their funding partner's agenda. Also, they mostly get's their material from well funded sources (with agenda) instead of themselves nowadays.

<comment><USER16> I'd call it "avoids reporting stories that hurt their funding partner" more than "pushing the agenda" personally. Very subjective opinion, though.

</comment></comment></comment></comment><comment><USER17> Everyone who perpetuates the lies of the official narrative of 911 is co- builder of the police state.

When you help build the prison, don't be surprised when you find yourself in it.

<comment><USER15> The downvotes only proves your right.

<comment><USER18> Comment got down votes, not because the commenter was right or wrong, but for the rhetoric commentary that basically does not contribute anything constructive to the discussion. It's sort of an _I told you so_ rhetoric.

<comment><USER19> I'll bet at least some people downvoted him because they believe 9/11 truthers most certainly _are_ wrong.</comment></comment></comment></comment>


Nvidia Responds to F-Bomb From Linus Torvalds - <AUTHOR> http://www.wired.com/wiredenterprise/2012/06/nvidia-linus-torvald/

<comment><USER2> I know it's off topic, but isn't the article wrong when it mentions: > "Torvalds created Linux in 1991 as an open source alternative to Microsoft Windows"

Linus wanted to run Unix on his desktop. I don't think Linus has ever said that "alternative to Windows" was the goal.

<comment><USER3> That's the way I've always understood it. If he had wanted an alternative to Windows then it stands to reason it would look and operate more like Windows. Plus it would probably have been named something like Lindows, which someone eventually did.

<comment><USER2> Also didn't Windows actually start gaining the majority share only after 95 release, I am not sure about it though.

<comment><USER4> Majority share of what?

MS Dos was popular on many desktops. CP/M was used on some weird systems (especially word processing); other forms of dos (PC dos, dr dos) were available but not nearly as popular as MS Dos. ("Dodgy" licensing deals were available then.)

Windows 3.1 was very popular version of Windows. Windows for workgroups introduced some 32bit kludges. Since these are not operating systems I guess they don't count.

But what was competing with them? GEM? Some Norton commander thing?

<comment><USER5> 3.1 was very popular at that time. Macs were also more common, although their popularity was eroding. If you wanted Unix you'd probably run it on a 680x0 or RISC box. We all thought RISC would be the future. Linux started in the 386 era. By then, Microsoft owned the PC space. CP/M was a distant memory.

</comment></comment></comment></comment></comment><comment><USER6> The complete text of the response makes a few good points. <http://www.nvnews.net/vbulletin/showthread.php?t=184564> By using the same binary blob on all platforms, they have Linux support on day one for every update across all their hardware, the same driver version number across all platforms, and all extensions supported on Windows work just the same on Linux. On the other hand, that doesn't excuse their stonewalling of the Nouveau project.

<comment><USER7> Nor does it really explain their inability to support the native mode switching API, or video acceleration framework, or their own hybrid configurations. Windows has that stuff too, and it works "on day one" there.

</comment></comment><comment><USER8> To be fair, Nvidia's "response" is pathetic. Come on Nvidia! Proper response!

</comment><comment><USER9> "While this may not please everyone, it does allow us to provide the most consistent GPU experience to our customers, regardless of platform or operating system."

Consistent is not the same as good.

</comment><comment><USER10> It was a totally expected, prepared, reasonable and truthy response that'll still not make people happy because it's not what _they_ want. People need to stop assuming companies are there to make them happy, they're there to do what makes them happy _and_ makes money.

</comment><comment><USER11> I just wish nvidia would show how to keep the video card from running balls to the wall all the time, without installing their blob which can break for kernel updates. That way I won't have to avoid nvidia cards for laptops. Surely they could do this without enabling their competition to crush them.

</comment><comment><USER12> See the previous discussion from when this was submitted a few days ago: <http://news.ycombinator.com/item?id=4132931>

</comment><comment><USER13> Linus gives the finger at 49:50 but the conversation a minute or so before leads up to it.

</comment><comment><USER14> Linus acted like a petulant child with the fuck you nVidia bit.

<comment><USER15> Linus did lose some credibility in my eyes. Not that one needs to conduct themselves like a suit at all times, but his behaviour seemed counter- productive at best.

<comment><USER16> I don't think his behavior was at all out of the ordinary there for Linus, so if he lost credibility for you I don't understand why this would be only after this event.

We'll see if it ends up being counter-productive after all, or if the public naming of nVidia as a bad actor causes them to shore up support even a tiny bit. His reaction certainly will make me reconsider an nVidia card for my next Linux machine: I didn't realize there was so much ire beyond the frustration that nVidia ships a binary blob. As-is things didn't seem to be going anywhere, and there were no signs that nVidia was at all unhappy with that situation.</comment></comment></comment>


Tim Schafer: Stop laying off your employees once a game is done - <AUTHOR> http://www.gamasutra.com/view/news/179980/Layoff_culture_hurts_the_game_industry_says_Tim_Schafer.php#.UIdv2OR9KlE

<comment><USER2> I think this should be interpreted as "do a better job managing your business by keeping a steady flow of incoming work".</comment>


Seagull – A friendly web UI to monitor a Docker daemon - <AUTHOR> https://github.com/tobegit3hub/seagull

<comment><USER2> Many people don't realize this, but Docker has a pretty good, and very simple JSON API.

Not only can you connect from anywhere with the docker client, but you can also use any other HTTP(s) speaking tool including curl or even your browser directly.

TLS certificate authentication is supported by the docker daemon by default (it's a flag away), and using that is a lot more secure than using an unauthenticated web UI like this, which is dangerously close to giving root access to your server to anyone who can route to your port.

<comment><USER3> > which is dangerously close to giving root access to your server to anyone > who can route to your port

Part of the reason CoreOS says: _" From a security and composability perspective, the Docker process model - where everything runs through a central daemon - is fundamentally flawed ... [Docker is] all compiled into one monolithic binary running primarily as root on your server"_[1]

[1] [https://coreos.com/blog/rocket/](https://coreos.com/blog/rocket/)

<comment><USER4> That makes no sense whatsoever. By default the Docker daemon listens only on a local unix socket only accessible to root (and in some distros a separate root-equivalent group).

The CoreOS model relies on running all containers via another centralized daemon: systemd. Feel free to expose an unauthenticated web UI to manage systemd, and see what happens security-wise.

 _Note: full disclosure, I also downvoted you, not because I disagree with you (that 's what the above rebuttal is for), but because based on your prior comments on this topic, you are being deliberately obtuse and aggressive, and no amount of reasonable debate or explanation seems to change that. I look forward to your response (or seeing this comment and all others by me downvoted exactly once) which will probably demonstrate my point._

<comment><USER3> The beef between us right now is purely over the tactics you choose to employ on HN to perpetuate your product.

We've covered them over and over in other posts, as have others. Yet, you continue to blaze ahead with no change.

You've made no fewer than 3 posts and 1 submission today about Docker, one of which you felt the title and actual content didn't suffice to the extent that you followed it up with a comment "clarifying" the content. Scrolling back through your account, I find it difficult to locate a single conversation you have participated in that is not container and/or Docker related.

Here's a short list of things that bother me regarding your aggressive and often disingenuous tactics:

1) You double speak a lot - You routinely are caught telling people Docker _is_ or _is not_ something _today_ based on _future_ promises that are not realized yet.

2) Your comments are often belittling - Just like your comment above about " _that makes no sense whatsoever_ " \-- " _and see what happens security-wise_ ", you routinely belittle your users when they disagree with you about anything.

3) Your comments are often backhandedly condescending - You far too often backhandedly make comments that users should commit fixes or shut-up/stop- complaining. As I've pointed out before, not all of your users are engineers -- that does not mean you should ignore and completely disregard their input. In fact, if you had listened to their input, you would have seen CoreOS' announcement coming from a mile away.

4) You inject yourself into every single conversation about containers and Docker - Sometimes it's best to let the community just discuss things. I feel you inject yourself (and often other Docker employees) into the conversation in attempt to take control and steer the conversation into a Docker-beneficial direction. This is both manipulative and disingenuous.

These are just the things off the top of my head. Anyone looking for explicit examples of each should have no problem doing so by browsing through previous comments... they are prevalent.

<comment><USER4> I must say I expected a less elaborate response, so thanks for that.

 _EDIT: I initially left a long response that explained why I think your accusations are unfounded. But, on second thought, I think we should spare everyone else and discuss this 1-on-1. My email is firstname.lastname@example.com, if you contact me I will send you my comment there and we can discuss._

I will simply note here that you have not addressed my initial comment: specifically, that your comment doesn't make sense, and contradicts the technical reality of how Docker and CoreOS work.

</comment></comment></comment></comment></comment><comment><USER5> Surely that's not a live instance you're demoing?

</comment><comment><USER6> Is there a roadmap for Braille support?

<comment><USER7> Do you mean supporting authentication? We add it in our issue list and have no exact date to implement it.

Please participate in the community and help us to improve it.</comment></comment>


Download EtherPad for Your Own Server - <AUTHOR> http://etherpad.com/ep/about/pricing-eepnet <comment><USER4> Etherpad rocks. Just today I was thinking that it would be great to be able to use it as a platform - e.g. imagine a real time wiki.

</comment><comment><USER5> Ouch. Bummer it's Java.

As a plain old lamp kinda guy, I wouldn't know the first about servicing Java requests. (Not just running a simple server like the docs recommend.) How hard is it?

<comment><USER6> To run EtherPad, why would you need to do more than their suggested command line:

      root@localhost$  java -Xmx512M -jar enterprise-etherpad-1.0b4.jar

???

As a LAMP guy, you could surely use mod_rewrite to map that EtherPad server to whatever other urlspace you'd like.

<comment><USER7> You'll need mod_proxy as well to forward the request from a LAMP stack

</comment></comment></comment><comment><USER8> why pay for something like this when you can download MoonEdit for free ( <http://moonedit.com> )

just saying.

<comment><USER9> Because it's better (using it has fewer steps, the interface is like other web apps, it doesn't require you to pick one of the desktop PCs as a server and tell people the IP address, and it saves as you go so anyone closing their browser will not lose work).

just saying.

</comment></comment><comment><USER10> Java - <USER3>

"Enterprise" in the binary's name - <USER3>

:)</comment>


Lenovo's Response to Its Dangerous Adware Is Astonishingly Clueless - <AUTHOR> http://www.wired.com/2015/02/lenovo-superfish/ <comment><USER2> Microsoft is currently doing Lenovo's work for them: [https://twitter.com/FiloSottile/status/568800260111388672](https://twitter.com/FiloSottile/status/568800260111388672)

The latest version of Windows Defender is actively removing the Superfish software _and_ the cert.

The text of the definition is here: [http://pastebin.com/raw.php?i=us7iXvkn](http://pastebin.com/raw.php?i=us7iXvkn)

<comment><USER3> 15 years ago this would have led to rioting on slashdot and Usenet. How dare Microsoft remove someone else's software?

I'm generally in favor of MS doing this specific thing, but there is potential for abuse here.

<comment><USER4> No 15 years ago Microsoft would have been the ones installing it.

I think Microsoft went from being a hated software giant to sort of an underdog vis-a-vis Google, Facebook, Amazon and Apple.

They are very big and strong no doubt, but I think the attitude they are projecting since switching CEO recently, their open source efforts, and such make them look pretty good PR-wise among the tech crowd.

<comment><USER5> Microsoft has done some shady things, but at no time in Microsoft's history would they have installed this.

<comment><USER6> NSAKEY ...

Though I believe virtually all preloads were OEM actions, not Microsoft's directly.

<comment><USER7> NSAKEY don't count either.

<comment><USER6> I've never been fully convinced by arguments on either side of that discussion. Always struck me as suspicious though.

Hell of a name, you've got to admit.

Bruce Schneier's discussion at the time:

[http://web.archive.org/web/20011005071623/http://www.counter...](http://web.archive.org/web/20011005071623/http://www.counterpane.com/crypto- gram-9909.html#NSAKeyinMicrosoftCryptoAPI)

One of his speculations:

 _it is actually an NSA key. If the NSA is going to use Microsoft products for classified traffic, they 're going to install their own cryptography. They're not going to want to show it to anyone, not even Microsoft. They are going to want to sign their own modules. So the backup key could also be an NSA internal key, so that they could install strong cryptography on Microsoft products for their own internal use._

Though given alternative methods of bypassing any Microsoft security, not really necessary.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> It tickles me that Superfish is a DFJ-funded [1] start-up based out of Palo Alto. Reporters are focussing on Lenovo's Chinese lineage. Yet this bubbled up out of our backyard, from our own lack of diligence (or scruples).

[1] Edit: Draper Fisher Jurvetson, the $4 billion Menlo Park VC firm that backed Baidu, Hotmail, Tesla, SpaceX and Twitter.

<comment><USER9> What is DFJ?

<comment><USER10> [http://en.wikipedia.org/wiki/Draper_Fisher_Jurvetson](http://en.wikipedia.org/wiki/Draper_Fisher_Jurvetson)

</comment></comment></comment><comment><USER11> How on earth can Lenovo/Superfish state:

"But Superfish tells us it stands by Lenovo's assessment. "Superfish is completely transparent in what our software does and at no time were consumers vulnerable—we stand by this today." a company spokeswoman said. "Lenovo will be releasing a statement later today with all of the specifics that clarify that there has been no wrong doing on our end."

Now that an official CERT announcement has been released:

[https://www.us-cert.gov/ncas/alerts/TA15-051A](https://www.us- cert.gov/ncas/alerts/TA15-051A)

I think their misleading comments are going to come back and bite them more than they have already.

[EDIT - Looks like they are back peddling a little on: [http://news.lenovo.com/article_display.cfm?article_id=1929](http://news.lenovo.com/article_display.cfm?article_id=1929)

 _" Finally, we are working directly with Superfish and with other industry partners to ensure we address any possible security issues now and in the future. "_

 _" By the end of this month, we will announce a plan to help lead Lenovo and our industry forward with deeper knowledge, more understanding and even greater focus on issues surrounding adware, pre-installs and security. We are eager to be held accountable for our products, your experience and the results of this new effort"_

And on: [http://support.lenovo.com/us/en/product_security/superfish](http://support.lenovo.com/us/en/product_security/superfish)

 _" Vulnerabilities have been identified with the software, which include installation of a self-signed root certificate in the local trusted CA store. ... Superfish intercept HTTP(S) traffic using a self-signed root certificate. This is stored in the local certificate store and provides a security concern. "_

]

<comment><USER12> > back peddling

Just because I've been seeing this mistake a lot lately: peddling is selling. Pedaling is the thing you do with your feet.

</comment></comment><comment><USER13> I warned all my friends and colleagues who use Lenovos, and their answers were all the same. "Who'd be crazy enough to use the default install? First thing I did was (a fresh reinstall of Windows|install Linux)."

(Edit: Obviously this is not representative of the general population, and I didn't mean to suggest it was. I was just noting that my efforts to warn people about the untrustworthiness of Lenovo were thwarted because none of them trusted Lenovo to begin with, not for software at least, and that seemed interesting.)

<comment><USER14> This is repeatedly recommended, but I think it's overlooking that not all manufacturer customization is entirely evil. You then to hunt down all the drivers for bits of the motherboard. Are you sure your power consumption settings etc are optimal after you've done this? Have you installed all the drivers "manually" via their inf files? (e.g. Nvidia drivers come with their own pile of bloatware)

<comment><USER15> Lenovo does this for you with their system updater. It downloads and updates all drivers for your system, including bios updates and configuration tweaks that affect power and stability. It will install on a fresh install from Microsoft media - ie there is no need to keep what was preinstalled on the system. [http://support.lenovo.com/us/en/documents/ht080136](http://support.lenovo.com/us/en/documents/ht080136)

<comment><USER16> I don't use those because i don't trust the manufacturer-provided "system updater" to only download drivers. What's to prevent them from surreptitiously installing their add-on garbage.

Even if it currently does not do that, I just don't trust it to not do that in general.

<comment><USER15> The Lenovo one is a continuation of the IBM one. You get to tick what you want, they show what the existing installed version is, as well as changelogs. There has never been any misrepresentation. I believe corporate types use the system updater too, and pissing them off by installing garbage would quickly annoy valuable customers.

It does not let you install or update the crapware that comes with systems. It is actually quite difficult to get that stuff other than saving it when you get a new system. BTW IBM/Lenovo have historically had _way_ less crapware than other vendors. I think Lenovo got complacent in this case, hearing "you guys do less crapware than the others" and confusing it with "you are doing a perfect job". Less worse is not the same as doing good.

Someone's useful add-on is someone else's garbage. They have some software called Access Connections which provides more gui and control over networking, such as which access points to connect to based on location profiles and who knows what else. I don't want that since I mostly use Linux, and Windows does a good enough job when I am using it. The system updater has never installed it, nor tricked me in any way.

</comment></comment></comment></comment></comment><comment><USER17> While we're at it, Lenovo's statement that we might enjoy the adware: "The relationship with Superfish is not financially significant; our goal was to enhance the experience for users" is self-evidently bullshit.

<comment><USER18> The key word is _significant_. They're not claiming they didn't preload this software for money, they're just saying it wasn't for very much money. Such a small amount of money that they have no problem ending the relationship now that it's causing them problems.

My wild guess would be they got in the ballpark of $0.25 an install.

<comment><USER19> A different way to frame the comment might be something like: "we were willing to sell out your privacy and security for a mere pittance, 'cause we're cheap whores".

<comment><USER18> I assume they didn't intend to compromise security. I think it's more accurate to say that they stiffed their users with adware that nobody wants in exchange for a little bit of money, and that were so indifferent to security and privacy while doing it that either didn't notice or didn't care that it was a fundamentally bad idea.

<comment><USER20> In my opinion that is worse. Most any clueful technocrat can tell you that injecting traffic into HTTPS sessions is a MITM attack. I am willing to bet that fact most certainly did make it to an executive level (certainly at the fishy company) and a choice was made to not care about that problem.

The road to poor security is paved with indifference.

</comment></comment></comment></comment></comment><comment><USER21> The more they deny this is a problem, the more it damages their reputation.

They should just admit the problem, thank the security experts, and develop an easy fix.

<comment><USER22> They did admit the problem and linked page describing how to remove SuperFish.

> We're sorry. We messed up. We're owning it. And we're making sure it never > happens again. Fully uninstall Superfish: > [http://lnv.gy/182BW8g](http://lnv.gy/182BW8g)

[https://twitter.com/lenovoUS/status/568578319681257472](https://twitter.com/lenovoUS/status/568578319681257472)

<comment><USER4> Only after various rounds of denials followed by backlash against them. Even their "removal" instruction initially failed to fully remove the root certificate. Every single step they made PR-wise was too slow and just reactionary to the backlash. Somebody up there should be fired and replaced.

<comment><USER22> Oh, OK. Was not aware about that.

</comment></comment></comment></comment><comment><USER23> Note that Lenovo has now removed the statement from their article:

"We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns."

<comment><USER24> Looks like they also removed a number of posts in the forum where the discussion started, including a post where a moderator wrote that customers asked Lenovo for this kind of service. The same moderator also pointed out that it was against the community rules to argue with moderators...

</comment></comment><comment><USER25> They changed their statement. Now there is no mention of the issue not being "security concern" ([http://news.lenovo.com/article_display.cfm?article_id=1929](http://news.lenovo.com/article_display.cfm?article_id=1929))

</comment><comment><USER26> Great... I'm the last person in the startup world still using a PC, and it happens to be a Lenovo.

<comment><USER27> Is it a Thinkpad, or a consumer model? The Thinkpads were never involved in this.

<comment><USER28> Well, given that they are morally corrupt enough to do this to their customers, why not expect them to have similar trojans or backdoors on Thinkpads?

If we assume firmware is safe, wipe it and do a clean install from trusted media.

<comment><USER10> Can we assume their firmware is safe though?

<comment><USER29> No. Firmware has been a part of the "trusting trust" conundrum for several years now.

</comment></comment></comment></comment></comment><comment><USER30> I was under the impression that Lenovo supplies a lot of computers to government and enterprise contracts around the world. Was Superfish only installed on consumer oriented devices, like the ones typically found at Best Buy? I realize most large enterprise would re-image their computers before deployment. I'm shocked that Lenovo would release such a statement. The damage to its credibility is significant.

<comment><USER4> Yes, it was only installed on their consumer oriented machines. Their T model Thinkpad don't have it installed.

Now the question is of course what else are they installing and what other yet undiscovered issues we'll find. It sounds like FUD but so far based on their response, they seem either incompetent (stupid) or malicious. And I don't exactly like either...

<comment><USER31> I never quite got this distinction between consumer and non consumer machines, when you can buy high end ThinkPads (but not the blocky T models) at a retailer, and are just as nice as big old blocky good old ThinkPads.

I'm really interested if a high end (but "consumer") ThinkPad like [http://www.microsoftstore.com/store/msusa/en_US/pdp/Lenovo-T...](http://www.microsoftstore.com/store/msusa/en_US/pdp/Lenovo- ThinkPad-Yoga-i7-256GB-Signature-Edition-2-in-1-PC/productID.306276200) that you can buy at a retail store (in this case, a special MSFT Store version that has plain Windows supposedly on it) was infected.

<comment><USER4> I loved (well still do) my T model. It has a strong magnesium case. Very solid. Heck it lasted 7 years. Including travel and other abuse.

It didn't have bloatware crap installed (as say US govt or big companies would not like that). It came with a smart card reader and such. Had a fingerprint scanner (back when there were not common).

Initially also they didn't have all these "consumer" models (Y,G,W,...).

</comment></comment></comment></comment><comment><USER32> Lenovo's response is not astonishingly in the least, its the expected behavior. They made a business decision to include adware in order to raise some extra revenue and then got caught. The default response is to underplay the importance of it, sweeping it under the rug and hope no legal action will happen.

A few months ago there was a HN story about a car manufacturer who had made the decision to use cheaper parts for the ignition. They had the critical internal reports from engineers, and when the deaths started to pile up they did the same thing as lenovo. Act clueless, downplay the issue, make a fix, and silently move on. So long it just customer outrage, it is perfectly fine to do borderline illegal things in order to raise some revenue.

</comment><comment><USER33> Can someone explains to me how Graham claims he can decrypt the intercepted traffic? The proxy communicates securely with the intended website. It's just the browser <-> proxy communication that's vulnerable but that's local on the machine, no ?

<comment><USER34> I'm wondering the same thing. As far as I understand, the proxy is local to the machine, so HTTPS traffic over Wi-Fi should be past the proxy and therefore encrypted using the real certificate.

<comment><USER35> The installed backdoor certificate is trusted as a root certificate. Its private key is contained in the MITM software, and is now known publicly. So anyone can now create phony certs signed by the backdoor cert, and Lenovo machines accept them as valid.

Here is such a page:

[https://badfish.filippo.io/yes.png](https://badfish.filippo.io/yes.png)

That's an image of the word "Yes" signed with the Superfish certificate. If your browser shows that image without warnings about an invalid cert, the backdoor exists.

<comment><USER33> Right but this only means you can decrypt data coming from websites using a starfish cert. It doesn't mean you can decrypt your bank traffic because you have this proxy installed which is what Graham is claiming.

<comment><USER35> Yes, it _does_ mean others can decrypt your bank traffic.

Here's how this type of MITM attack works.

Situation: user is using laptop in public location with WiFi. Between WiFi device and net is a computer with MITM software.

Client laptop requests "[https://www.bigbank.com"](https://www.bigbank.com"). MITM box gets HTTPS request, sees it is for "bigbank.com", and generates a fake cert for that site. It then uses the Superfish root cert to sign the fake cert. MITM box acts as server for that connection and sees the user's traffic in the clear, unencrypted. The Lenovo client laptop sees a valid cert chain descending from the Superfish cert installed by Lenovo. The user sees a green bar and lock icon.

MITM box then opens an HTTPS connection to "[https://www.bigbank.com"](https://www.bigbank.com"), and acts as client for that connection. The two connections are connected together as a proxy, so that the user sees what looks like a valid HTTPS connection. The MITM box can log everything, including bank passwords.

There's even open source software for doing MITM attacks: [https://code.google.com/p/subterfuge/](https://code.google.com/p/subterfuge/)

<comment><USER33> If you have a computer between the user and net, then yes all bets are off because you can generate certs the browser will trust.

<comment><USER35> Only if the root cert store of the user's machine has been tampered with. If you have a valid cert store, you can detect MITM attacks on HTTPS connections.

<comment><USER33> yep. I was referring to superfish's case.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER36> That's one example of management being utterly technologically incompetent, which unfortunately is the case in a lot of Chinese companies.

<comment><USER37> Thankfully American companies _never_ have technologically incompetent managers...

</comment></comment><comment><USER38> komodia.com admits to be undergoing a DDoS attack at 2300hrs UTC (fri 20th Feb 2015)

(komodia is apparently the underlying tech for the superfish thingy)

</comment><comment><USER39> It is not astonishing that a company that would do this would also lie about it. They knew what they were doing.

</comment><comment><USER40> if anyone knows someone who has purchased an infected lenova with superfish, send me an email. My wife is a class action attorney and is conducting an investigation in the matter. Eire1130 (at) gmail (Dot) com

</comment><comment><USER30> Kudos to MS, srsly. lol the amount of positive press that MS has been garnering recently on HN is impressive.

</comment><comment><USER41> "Beijing-based computer maker Lenovo has reportedly been blacklisted for years by spy agencies worldwide, as concerns about government-sanctioned Chinese hacking persist. According to the Australian Financial Review, Australia, the UK, Canada, New Zealand, and the US have all rejected Lenovo machines for their top-secret networks since the mid-2000s, though the computers can be used for lower-security tasks that don't involve sensitive information" [1]

Why buy a laptop from a company that has ties to the Chinese government [2], an authoritarian government that supports dictators in Africa and totalitarian government in Russia, oppressing women and children in those countries?

[1] [http://www.theverge.com/2013/7/30/4570780/lenovo- reportedly-...](http://www.theverge.com/2013/7/30/4570780/lenovo-reportedly- banned-by-mi6-cia-over-chinese-hacking-fears) [2] [http://en.wikipedia.org/wiki/Lenovo](http://en.wikipedia.org/wiki/Lenovo)

<comment><USER42> I'd be curious to know what brands or models are considered safe by these agencies.

<comment><USER43> I think it mentions in the article about agencies having Dell and HP on the list of allowed companies.

</comment></comment></comment><comment><USER44> It's kind of hypocritical when USA loads backdoors into hardware that VisualDiscovery relies on.

</comment><comment><USER45> Last night I fired up a brand new HP stream desktop with windows 8.1 (only $179!). It had a Superfish icon on the desktop. When I get home I'll check for the cert.

So maybe Lenovo isn't the only offender.

Edit: Duh. It was snapfish, not superfish. I've been reading about superfish so much that's what I saw.

</comment><comment><USER46> I found this whole Lenovo Adware-gate very hypocritical. Why everyone blames the messenger Lenovo but not the source Superfish? Why? Is it because Lenovo is a Chinese company whereas Superfish is a Iserali-American company based in Silicon Valley?

Before this adware-gate, EVERY PC manufacturer bundles adware, HP, Dell, Acer, Lenovo, Asus to name a few top players(Apple perhaps is the only exception as I don't count them as a PC manufacturer). Did anyone bother to look if there were tons of similar security risks with those?

<comment><USER4> Lenovo had a chance to redeem itself by apologizing, removing the software and quickly distancing itself from the company.

They screwed up by denying there was problem in the first place. Which means they were defending both their decision to install Superfish as well as, by proxy, Superfish itself.

Thus they are seen to be either incompetent (can't trust them) or malicious (also can't trust them).

Also consumers never bought Superfish. They paid for a relatively expensive piece of hardware from Lenovo and got screwed. They are right to blame Lenovo for it.

<comment><USER46> They did. [https://twitter.com/lenovoUS/status/568578319681257472](https://twitter.com/lenovoUS/status/568578319681257472)</comment></comment></comment>


Burnout is an official medical diagnosis, WHO says - alok-g https://www-m.cnn.com/2019/05/27/health/who-burnout-disease-trnd/index.html <comment><AUTHOR> I was desperately scanning down through the article looking for what the cure was. Oh. It's just a diagnosis, it doesn't come with a cure yet.

Oh well - maybe if I can get our sprint velocity even higher this year, I can get a bonus and go on a vacation to /really/ recover!

<comment><USER2> I've heard of a couple, and used them successfully:

1) Learn something.

2) Get a small win after a big loss.

The ideal project to do when you're feeling burnt out is something that is well inside your comfort zone and can be completed in a couple days, but also teaches you something new. Something like learning a new framework, or building a quick new "toy" that isn't really critical to the business but users would find interesting, or doing a refactoring that you totally know how to do but have been putting off for months because other stuff is more important.

I've also had managers put me on projects like this after slaving away for months on a project that gets canceled. In hindsight they knew exactly what they were doing, and the fact that it was kinda fun and not critical to the business was actually a long-term investment.

<comment><USER3> This reminds me of the "make your bed" advice: [https://jamesclear.com/great- speeches/make-your-bed-by-admir...](https://jamesclear.com/great- speeches/make-your-bed-by-admiral-william-h-mcraven)

<comment><USER4> Making your bed is bad advice: [http://news.bbc.co.uk/2/hi/health/4181629.stm](http://news.bbc.co.uk/2/hi/health/4181629.stm)

<comment><USER3> "Brush your teeth" would probably serve a similar purpose, "tidy your room" would be even better if you're the sort of person who wouldn't have it already tidied.

</comment></comment></comment></comment></comment><comment><USER5> Burnout and clinical depression are extremely similar, and I think most people who self-diagnose as burned out actually are clinically depressed, though maybe mildly.

But I can see that diagnosis and treatment would be more difficult and less standard when there are no clear signs of depression or other disorders. And there would be a two-phase treatment: First phase is getting out of burnout mode. Second phase is preventing the relapse. Confusing the two phases will only result in frustration.

<comment><USER6> I agree that a connection is likely, though perhaps more like burnout may lead to depression. This is definitely the experience I had - first work was daunting, then everything. Both require a lot of care to get out of in a healthy way.

<comment><USER5> I'd say you are describing a temporal connection. Identifying causes for mental health conditions is problematic and not very fruitful. Depression can happen virtually on its own, as far as doctors or patients are concerned.

<comment><USER7> > Depression can happen virtually on its own

Given that CBT is the first-line treatment for chronic depression and has a really good success factor, we can see that what you are saying is technically correct (it can happen) but the assumption you make earlier:

> Identifying causes for mental health conditions is problematic and not very > fruitful

Is, while also technically true in some cases (it is a broad statement that applies to more than depression), as connected to depression plainly false.

You've constructed a compelling argument that seems to check out based on only a tenuous relation between different true statements.

I hope that this is just a prejudice and not something you believe as someone suffering from depression. If this is in fact the case, know that in a lot of the cases causes _can_ be discerned and you can with treatment in fact be able to live a lot better. In the small minority of cases where you are depressed because of a biological limitation (yes, this also happens - it's just not the most usual trajectory), that's when you treat it with a (hopefully life-long) line of antidepressants that work for you.

</comment></comment></comment></comment><comment><USER8> This has existed for 16 years, from ICD-10 v2003: [http://apps.who.int/classifications/apps/icd/icd10online2003...](http://apps.who.int/classifications/apps/icd/icd10online2003/fr- icd.htm) (code is Z73.0)

</comment><comment><USER9> Are there good resources online for strategies for dealing with knowledge worker burnout? It seems to be a different animal than other types of burnout (compassion fatigue, pure overwork, body breaking down, etc)

<comment><USER10> I think do less is pretty much the answer I consistently see. The worse the burnout the less you need to do and for longer.

Many times the reasons why it's hard to do less are mental hangups(like fear of failure, perfectionism, the Ides that you're worthless as a coder if you're not coding 24/7) that prevent people from doing less and a therapist would help with that.

Of course sometimes what is preventing someone from doing less is their financial situation in which case you unfortunately have a lot fewer options.

For me it was quitting my job and starting a consulting company with a couple of friends. I make less money and work more but I have a way better time doing it and that has allowed me to recover.

</comment></comment><comment><USER11> I always thought burnout was IT lingo for work induced stress.

Don't get me wrong, it's serious, but it always seemed to me akin to "shellshock" vs "PTSD". Shellshock just carries a lot of weight as a word on its own. It sounds serious and traumatizing and you don't really need to know what it means in order to respect the diagnosis.

<comment><USER5> Burnout is also used as a socially-acceptable reason for mental health problems.

"I work so hard that I get sick" is more acceptable than "I get sick because I'm crazy/mentally ill". Which is in itself a false choice.

</comment></comment><comment><USER12> Every year the WHO adds and subtracts medical conditions depending on the milieu of the year. Hopefully at least one person is helped.

<comment><USER13> Last year or so they classified "gaming disorders" for people who spent too much time playing video games. FWIW

<comment><USER14> Putting a name on things helps.

There is little reason to doubt that problem-gaming exists, sure, it is a manifestation of something more general (à la Behavioral-Addiction/OCD) but having a name for it helps to talk about it more precisely, and being able to talk about a problem is the first step to finding a solution or way out.

<comment><USER12> Not sure if that is true. Sometimes adding a label simply adds unlimited anxiety.

</comment></comment></comment></comment><comment><USER15> My wife is a therapist and has so many clients who say they have a "small burnout" or something similar.

People fight to not have the label "depression" over them. It is really sad in my opinion. It's your health, it is time to put the pride away and don't care about terminology and do whatever you can to get better.

<comment><USER16> Except this goes in your permanent record and increases insurance fees from then on. At least that is how it works in Germany. The only way to avoid this is to pay in cash. It's probably also a good idea to not bring your phone, so that there is no location tracking of you.

<comment><USER7> With the exceptionally low amount of real detail in this post, I am left with the most salient question: How can it be on a permanent record at a company when all involved parties (except for you of course) are sworn to secrecy?

Given this critical center concern, your closing thought of location tracking (while relevant for a nation-state actor) pushes the whole thought process a bit over the line of sounding reasonable.

<comment><USER16> Pretty simple, if you visit a psychiatrist/psychotherapist you have to pay them somehow. One way of doing so is by using your medical insurance. So you hand over your medical insurance card, and now they know you've visited a psychotherapist. If at any later point in time you want to get work disability insurance or switch to private health insurance you have to disclose any preexisting medical conditions, since there is a record of you going to a therapist, they could otherwise retroactively find out that you got treated for depression and deny your claim if you have burn out.

</comment></comment></comment></comment><comment><USER17> What are the implications of this? Will insurers cover time off due to burnout?

<comment><USER18> It's guidance for diagnosis. Doctors can already diagnose whatever they want. This is just a step toward agreement on what "burnout" means.

<comment><USER19> I'm in Quebec, so it can be different, but when my SO had a burnout, all the doctors we saw said that there was no diagnosis for "burnout" and they had to declare it as a clinical depression. I guess it's different here because the government insurance is involved, but that was an issue for us.

Maybe she did have a depression though, it was quite a bit of work just to get a work leave for her, we had to see so many doctors. We didn't push to further afterwards and now that she no longer work at the same place, she is much better.

</comment></comment></comment><comment><USER20> I feel it everyday. In addition to other comments, the following have been helpful. \- Manage expectations. \- Work for yourself. Learning time that sets you up for goodness a year down the line is good. But same repetitive work getting to burnout is not. I am taking objectives to be in the former. \- Manage my time. I should not cry burnout if spending hours of time just browsing without objective. So far, been a failure at managing time, but successful at self-realization that I need to manage my time well. For example, I should not be here on hacker news instead of sleeping.

</comment><comment><USER21> From the article:

> According to the handbook, doctors can diagnose someone with burnout if they > meet the following symptoms:

> 1\. feelings of energy depletion or exhaustion > 2\. increased mental > distance from one's job, or feelings of negativism or cynicism related to > one's job > 3\. reduced professional efficacy

Is there _anyone_ here who hasn't had this ? I have this constantly, for almost a dozen years now. How is calling this a medical problem even remotely reasonable ? You're paid for your job, because it takes energy to do it ...

<comment><USER22> I think there are severity levels.

I think everyone's typical week has at least a couple of "OMG I hate this place!" moments that are related to a particularly difficult commute, a technical problem that crops up at a particularly frustrating time, repeated runins with a difficult coworker that you usually only have to deal with once a month, etc. But you're able to "talk yourself down" within a few minutes.

But when it's every day much of the day, it's a problem.

So where do you draw the line is the question.

<comment><USER23> At my last job, I was getting paid $45k/yr and was expected to work 80-100 hours per week, on top of a 1.5 hour round-trip commute, because the other people on the team for the project were pulled to do other things that were deemed "more important", but the timeline for the project didn't shift at all, because it was also "vital".

There's a really great Usenix talk about burnout I stumbled across, and it so perfectly described what I was feeling, even down to the fact that I found myself drinking more and more each night just to be functional.

On paper, I took a pay cut at my next job, but I earned enough in overtime to more than make up for it, and I've gotten significant raises since then.

<comment><USER21> I find this sort of thing really destresses me. That may sound stupid, but stressfull is when your managers asks 90%, or 110%, 120%. You know, vaguely realistic. Just a tiny bit less, or more than you can realistically do. So that it really matters how you feel. An unpredictable illness (you or kids, or ...) can easily make the difference between delivering or failing. You start worrying if your breaks are too long.

When your manager asks 200%, there's zero stress. It's like someone pointing a gun at you demanding you lasso the moon. It's funny. Because you see, whether you get shot or not does NOT depend on whether you try. Therefore it's a sunk cost. There's no point worrying about it. In fact, there's very good reasons to be very easy going about it. No point shortening any break.

The same with your manager. He asks the impossible, and of course you won't deliver. So whatever will happen, has already happened. It does NOT depend on your level of effort. Whether you get blamed ... is already determined at that point. Whether you get fired ... is a done deal. No point worrying about it, as the decision is made. Find an online course, or watch some esports on Youtube. Put in the hours, but ...

It's no more worrying than the idea that an asteroid might be (in fact almost certainly is) on a collision course with the earth right now.

</comment></comment></comment></comment><comment><USER24> Is this true, though? Looking at the ICD-11 draft [0], burnout appears in chapter 24 which lists "factors influencing health status or contact with health services" but no proper disorders. This has already been the case since the release of ICD-10 [1]. So there doesn't appear to be a change.

[0] [https://icd.who.int/browse11](https://icd.who.int/browse11) [1] [https://icd.who.int/browse10/2016/en#/Z73.0](https://icd.who.int/browse10/2016/en#/Z73.0)

</comment><comment><USER25> Isn't burnout depression?

</comment><comment><USER26> What about Bore-out?</comment>


What do you think? - <AUTHOR> https://conocto.com/action/ <comment><AUTHOR> Please tell me your thoughts. I like the concept.</comment>


The Most Dangerous Stuff in the Universe – Strange Stars Explained - <AUTHOR> https://m.youtube.com/watch?v=p_8yK2kmxoo <comment><USER2> The presentation is nice, most of the parts are true, but the core part of the argument is dubious, closer to crackpotology than to science.

* _The environment in the core of a neutros star is weird._ : Yes

* _There may be strange matter in the core of a neutron star(i.e. matter with a lot of strange quarks)._ : Looks like a posible assumptions. It make sense to avoid the Pauli exclusion principle transforming some down quarks to strange quarks.

* _Strange matter is stable outside the core of a neutron star._ : Very dubious. The calculation with quarks are very difficult, borderline imposible. We barely can calculate some properties of a proton or neutron or other particles with 2 or 3 quarks. I strongly think that without the high pressure it decays to normal matter.

* _Strange matter is contagious and will convert normal matter to strange matter._ : Very dubious, as before.

* _Does saying "But then again, may be not." at 6:23 allows you to present a very dubious theory like settle science in an alarmist video?_: No. It's important to distinguish clearly what parts have a overwhelming experimental and theoretical result, and what parts are almost baseless speculations. Mixing them is bad for science popularization.

<comment><USER3> As a person with at least basic knowledge of physics and computer simulations I find it odd that even basic atoms are so difficult to simulate. Maybe this just shows my ignorace on the topic :)

<comment><USER2> If you want to simulate an Hydrogen atom (assuming that the proton is a single particle), it's not so difficult. There is a proton, an electron, and they have electromagnetic charge that is quite weak, so you only have to consider a few photons that travel between the proton and the electron. Also, the photon don't have charge, so one photon don't interact with other photons. (There are some small corrections here and there ...)

To simulate the inner part of a proton or a neutron, you have to consider the tree quarks. The quarks have color, that is unrelated to the usual color, it's just the name of the "charge" of the strong force. Instead of photons, they interact with gluons. But gluons have color, they are "charged", so you now must consider not only the quark-quark interactions, but also the gluon-quark interactions, and the gluon-gluon interactions. All these interactions use more gluons. And the strong force is strong, so there is a lot of energy floating around, that can create pair of virtual quarks and antiquarks. And now you have to add the interaction of the virtual quarks, that creates a soup of more gluons and more virtual quarks. And the strong force is strong, so all this soup of interaction has big affect, it's not a small correction to the easy model.

Some data:

* IIRC In a fast moving proton/neutron, half of the energy and momentum is carried by the quarks (real or virtual) and half by the gluons

* IIRC the three original quarks only are 10% of the mass of the proton/neutron.

I couldn't find a good link, but at least you can start with [https://en.wikipedia.org/wiki/Strong_interaction](https://en.wikipedia.org/wiki/Strong_interaction)

</comment></comment></comment><comment><USER4> Isn't that how league of legends works?

<comment><AUTHOR> Care to elaborate? Never played such games (or any lol)

<comment><USER4> League of Legends produces a data stream that can be replayed later on. You can save the record of your game and look at it later, share it with people, etc.</comment></comment></comment>


Reining in CEO compensation and curbing the rise of inequality - <AUTHOR> https://www.epi.org/publication/reining-in-ceo-compensation-and-curbing-the-rise-of-inequality/ <comment><USER2> "To boost the power of shareholders, fundamental changes to corporate governance have to be made. One key example of such a fundamental change would be to provide worker representation on corporate boards."

Let's be honest, this isn't going to happen any time soon. Any serious effort to get inequality in corporate pay under control at this point either needs to come from taxation on the government side or significant worker & customer preference on the labor side (i.e. young workers need to vocally stop trying to work for companies with lopsided pay scales). That last one is also unlikely, though, since everyone likes to think they're just a few years away from being a big corporate exec themselves.</comment>


Show HN: BakManager.io, keep an eye on your backups - <AUTHOR> https://bakmanager.io

<comment><AUTHOR> The app is in early stage, so any feedback is greatly appreciated, thanks !</comment>


Justin.tv Fingerprinting Technology Goes Live this Week - <AUTHOR> http://newteevee.com/2009/11/11/justin-tv-live-fingerprinting-goes-live-this-week/

<comment><USER2> I'm assuming it's half assed or else there will be little content left that's worth watching. Looking at the most watched content it's almost all copyrighted.

</comment><comment><USER3> Justin.tv is a great startup, but this is going to kill their traffic.</comment>


RouteMap, a new open source client/server-side JavaScript URL Mapping Library - <AUTHOR> https://github.com/OpenGamma/RouteMap

<comment><USER2> One thing to make clear: simply using #! does not make your app crawlable. Your server-side app needs to also handle URLs that contain _escaped_fragment_, per Google's specification:

[http://code.google.com/web/ajaxcrawling/docs/getting- started...](http://code.google.com/web/ajaxcrawling/docs/getting-started.html)

<comment><USER3> Yes, thanks for pointing that out. This is only one side of the coin. The other side is a server that will answer all of those requests.

</comment></comment><comment><USER4> Would it be possible to use pushState as the main mechanism on the client, and use a #! as a fallback? You would end up with two different possible URLs, but if the same library handles the calls then it would be fairly straightforward to move from one to the other.

<comment><USER3> Yes, this is possible.

If you do capability detection by checking to see if window.history.pushState exists, then you can configure RouteMap.handler to be tied to history events. Otherwise, you can set the prefix by calling RouteMap.prefix('!').

EDIT: I re-read your question, and I think that I misunderstood. I do think what you're asking is possible, and what I stated above is a piece of what you'd need to do. Basically, instead of simply binding RouteMap.handler to either onhashchange or onpopstate, you'd probably have to write an event listener for both of those methods + a window onload handler all of which send their respective portions of the URL that you care about to RouteMap.handler.

</comment></comment><comment><USER5> Not to be overly pedantic, but a piece of core functionality like this seems like it would really need some basic automated tests, even if they were just running the API through it's paces.

The thorough documentation is awesome though!

<comment><USER3> Thanks for the suggestion. We haven't actually decided on the larger project's testing scheme, but once we do, we'll definitely be adding tests to RouteMap as well.</comment></comment>