Server-Side Tagging in Google Tag Manager - <AUTHOR> https://www.simoahava.com/analytics/server-side-tagging-google-tag-manager/ <comment><USER2> > Many of the benefits and concerns are tackled in their respective chapters. > Even so, I want to emphasize that Server-side tagging has the potential to > overturn the current dynamic of data collection and governance for an > organization. You own and have full control over the server-side > environment. You have access to tools and methods to thoroughly vet and > validate the traffic between network sources and your advertising and > analytics endpoints.

Not quite sure what's so revolutionary about this -- isn't this what Segment and other similar products have been offering for the better part of a decade?

<comment><USER3> Not exactly. Although Segment has some backend integrations, most tags still need to be on the client side. Each tag typically tracks its own cookies and uses third-party cookies to learn more about each user. However, as those cookies are starting to go away and privacy is starting to increase, we may see a big shift.

I'm hopeful something like this will take off. I'm tired of adding so many slow third-party tags.</comment></comment>


Show HN: Create Your Personal Life Dashboard with Koalify - <AUTHOR> https://www.koalify.com

<comment><USER2> The link to "try a demo" fails with a server error.

<comment><AUTHOR> Thanks for letting us know - should be back online now</comment></comment>


Electron 4.0.0 - <AUTHOR> https://electronjs.org/blog/electron-4-0 <comment><USER2> I always read about how Electron is very resource-intensive, but I'm curious as to how the performance improves as time goes on?

Does the Electron team have a focus on improving performance? Or is the issue with the developers using electron, should they be optimizing better?

I assume it's some of both, but curious if anyone with more experience in electron can provide any insight as to how the performance changes over time.

<comment><USER3> The issue itself is that Chromium uses a lot of memory. And electron basically just runs Chromium. Except that since each Electron-based app ships its own very isolated copy of Chromium, the following problems occur:

\- The operating system cannot share memory between different Electron processes. Normally if you start many processes of the same binary, the memory is shared and only copied on write. Since each Electron app is a different binary (even though they are 99% identical) they each eat memory.

\- The above applies to disk size as well. Electron apps are usually huge, and 99% of the binary is the same as all your other electron apps.

This is mostly why I'm against electron. If electron worked like the JVM and each app shared a runtime, many issues would be solved, including many electron apps running old, and vulnerable versions of Chromium. Now it's only updated if the developers decide to ship a new version.

<comment><USER4> Why is it that people seem to think using a cross-platform UI toolkit like tkinter, kivy, WxWindows, etc. is like putting their hand in a toilet?

Lately I have been building apps with tkinter/python/asyncio and I can't get over how fast the apps are to load and to use. There is none of this "let's not respond to the mouse for 5 seconds" that is staggeringly common on my mac (particularly for apps like Safari and iTunes that come from Apple) nor the "go for a walk around the block" loading times for Java-based apps on my i7 Windows laptop.

True tk apps are ass-ugly but I find it mind-blowing to use GUI apps that are as responsive as Windows 95 apps were back in the day.

<comment><USER5> > Why is it that people seem to think using a cross-platform UI toolkit like > tkinter, kivy, WxWindows, etc. is like putting their hand in a toilet?

tkinter specifically does not look very pretty without some effort. I would much rather use GTK or QT. The problem is GTK support on windows is limited, and QT has a weird license model.

<comment><USER6> > QT has a weird license model.

Qt is available under LGPL and GPL. What exactly is weird about that?

<comment><USER5> Looks like it's changed since I last looked into it. Probably a good option now.

<comment><USER6> Qt had been available under the LGPL since 2009.

Up until 2005 or so Qt had indeed a relatively complex licensing scheme where the available (i.e. the license of Qt) and compatible (i.e. the license of the application, due to their GPL exception allowing applications to use MIT, BSD, ...) differed by what was then Qt ports (e.g. Qt/X11, Qt/OSX, Qt/Windows). After that they always had a uniform licensing model for Qt, were the licensing was independent of the platform.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> I've been heads down into the Electron internals for 2-4 months now and working on a document manager for PDF and web content: [https://getpolarized.io/](https://getpolarized.io/) (self plug)

The inevitable thing that always gets brought up is memory usage.

It's really not insanely bad if the app is important. I wouldn't use it for a calculator but if it's an important app allocating 150MB of RAM seems worth it.

The biggest change here seems to be the build system and the upgrade to Chrome.

The Chrome updates are what's important here. Since Chrome is evergreen if your behind a few versions the standard libraries in NPM just stop working.

I got bit a while back when when they were a bit behind in releases.

<comment><USER8> Who doesn't have 150MB to spare?

This laptop has 16GB, why are people hemming and hawing over 150MB???

<comment><USER9> > This laptop has 16GB

Okay? Having a lot of memory does not mean a program should be wasteful, nor does it mean everyone has that.

<comment><USER8> Yes, it actually does, because it redefines wasteful, and the availability of many-GB computers means a lot of people _do_ have access.

This isn't 2008, we don't need to care about 150MB like we used to.

<comment><USER10> > because it redefines wasteful

how do people write shit like this and not realize how blatantly user-hostile they are??

<comment><USER8> Because it's not user hostile at all?

</comment></comment></comment></comment></comment></comment><comment><USER11> I have heard a lot of complaints about Electron on various aspects, but one thing it has done well is to open the niche of cross platform Desktop apps to an average regular developer like me.

It can be also used to quickly test an idea before dedicating platform specific resources.

I hope the team adds more features keeps Electron alive.

<comment><USER12> Microsoft adopting Chromium is a big hint that they are going to make some big investments in Electron. I think Electron's future is bright.

My big complaint isn't the resource usage, it's how the applications never feel right on any platform.

<comment><USER13> It's a feature, they feel like a part of the web, which is the more important platform, for the majority of people who spend most of their time using web apps.

<comment><USER14> Ugh, I can't wait til this era of "everything must be a web app" is over.

Web apps are universally worse in their UX than native.

<comment><USER15> For a while I though native mobile web apps had it, but now with PWAs, WebAssembly and the return of mainframe, sorry cloud, I guess they are here to stay.

</comment></comment></comment></comment></comment><comment><USER16> There are always many negative comments regarding Electron apps, so as a developer who has made a couple Electron apps let me briefly illustrate to you what the advantages are:

\- I can use the same UI components that I use for making websites and easily share code between all platforms. Maybe this will change in the future with the advent of WebAssembly, but right now no other stack gives you this.

\- Bundling a cross-platform auto-updating app is wonderful. I just have to configure electron-webpack [1] and everything is taken care of. In the past I've made a password manager with GTK3 + Python, bundling it was a real nightmare and I don't think the situation improved much in the last few years.

\- Sometimes, like when you're going to need a HTML renderer anyway, using basically a browser for rendering the UI can actually be an advantage, a couple of examples:

Example 1. Evernote needs to render their notes, basically arbitrary HTML, and the macOS app uses Safari's engine for this. Now they have to check across all platforms if their notes are always rendered the same, even for rendering a simple note they show you a spinner, and the native UI is arguably ugly anyway. In comparison my soon-to-be-released Electron note-taking app [2] looks more native to me, it's faster, requires less resources, and I get cross-platform support basically for free.

Example 2. I was using Ship [3], an app for managing GitHub issues. The native parts of the UI were written in Objective-C, the issue/comments part were written using web technologies, and their server was written in C#. What you get is an app that doesn't work across platforms and sharing code between all the parts of your application is basically impossible.

\- Lastly I'm by no means an expert on other cross-platform UI toolkits, but some of them try to mimic the native widgets and do an awful job at that, as a result I don't have any Java GUI app installed because they all looked like crap to me, how many do you have installed on your desktop?

[1] [https://github.com/electron-userland/electron- webpack](https://github.com/electron-userland/electron-webpack)

[2] [https://imgur.com/a/ZQd8Vad](https://imgur.com/a/ZQd8Vad)

[3] [https://www.realartists.com/blog/ship-20.html](https://www.realartists.com/blog/ship-20.html)

<comment><USER17> > I can use the same UI components that I use for making websites and easily > share code between all platforms.

I propose that using web components for desktop/mobile applications is _not a good thing_.

<comment><USER18> >I propose that using web components for desktop/mobile applications is not a good thing.

Agree, every platform has it's distinctive look & feel and as a user I expect that my apps follow this for 100%. Recently I checked out Flutter, with the 1.0 release i thought it's worth to play around with it. The first thing i did, was installing their demo app on my iPhone they showed on the release event. Within seconds I noticed that there was something wrong. They tried hard to reimplement the bounce effect during scrolling on iOS, but it just didn't feel 100% right.

I totally understand, that not every user out there has this sharp eye for things like that and that there is definitely a business value going cross platform, but this is not something I would be proud as a developer. It's the cheap root for the developer ending up in a cheap experience for their users. Share your business logic between platforms if appropriate, theme it for your CI if needed, but do the UI as expected.

<comment><USER19> I disagree. I think cumulative hours across the average spectrum of users, they spend far more time on the web / in a web browser / in web tech-based apps than they ever spend (or at least notice they spend) in a "native" app. The web platform has won. It is native toolkits that have to follow web conventions now (hyperlinks, routing, deep linking, system back buttons, etc), and there are users starting to complain when they don't. The platform distinctions are starting to be meaningless to users so long as basic "web" usability is met. (I've met people that switch between Android and iOS regularly based upon whatever was a cheaper device or had a better plan with their carrier. Those sorts of people absolutely don't care about "native" widgets and see the differences in platforms as a silly barrier to the web.)

(Arguably that's a problem with Flutter too because it isn't "native" nor "web", it doesn't entirely meet the expectations of web users currently either.)

For better and worse, the web is a ubiquitous platform, and I think getting to be just about the only platform that matters today, regardless of the remaining fan wars between the "native" platforms.

<comment><USER20> While they are arguably old, these two quick sources I found seem to indicate quite the opposite:

[https://amp.businessinsider.com/time-spent-mobile- browsing-v...](https://amp.businessinsider.com/time-spent-mobile-browsing-vs- apps-2015-9)

[https://amp.theguardian.com/technology/appsblog/2014/apr/02/...](https://amp.theguardian.com/technology/appsblog/2014/apr/02/apps- more-popular-than-the-mobile-web-data-shows)

Even though they are old, the trend at the time was clear: people are spending more time in apps (most of which are probably native) than on the web. The idea that the web is universal and what most people spend their time on isn't a fact you have established.

Web technologies are loved by developers for their speed and ubiquity. But as a user, I strongly prefer the feel of mobile apps for my day to day interactions. I find the web, particularly on mobile, to be a mess. The interaction models are all unique and confusing and typically not well implemented, while native UI widgets work well and are understood.

<comment><USER19> But your mobile device is also only one device you interact with in a day. Very few people have the same OS across all their devices, even if you allow for the "close cousins" scenarios like people that only use iOS and macOS. Everyone uses the web everywhere, though, it's the one thing guaranteed to tie all of a user's devices/accounts/actions/"digital life" together today.

I don't have numbers to back it up, I have a lot of anecdotal evidence I've seen, but it does look like there seem to be at least as many people that don't care what widgets an app uses, so long as the app works, as there are people such as yourself that even notice native UI widgets and care about them (deeply and vocally, as often the case may be).

<comment><USER20> Perhaps, but I surmise that most people spend a large amount of their personal time and life on their mobile devices while people who are using full computers are generally doing so for work. I have seen it personally in my work that native mobile app usage has surpassed both desktop and mobile web usage.

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> ⌘+F "performance" or "memory" does not show anything :-/

<comment><USER22> At this point, especially after seeing how snappy vscode can be, I've written off slack's performance issues to their codebase.

<comment><USER23> Yup, another good example of this is Hyper vs. Terminus. Both Electron apps, but Terminus is way more performant and less memory hungry. I've taken that (along with Slack vs. pretty much every other Electron app) to mean that yes you're going to get some sort of inherent performance hit going Electron over native, but a huge performance hit can arise from a crappy architecture/implementation. For instance, doesn't Slack use a different webview for each channel?

</comment></comment></comment><comment><USER24> Say what you will about Electron, but congrats to the team on getting 4.0.0 launched!

</comment><comment><USER25> I'd love to see a version that is based on Firefox / SpiderMonkey.

<comment><USER15> It was called XUL, long before the Electron craziness.

<comment><USER26> That's an area where Mozilla could have distinguished itself by being very developer friendly. A few years ago I was looking into embedding a browser and XUL would have been a good fit but it was pretty obvious that it wasn't supported well.

Same for their Javascript engine. Node could be running on Mozilla code instead of V8 if Mozilla had been more developer friendly.

</comment></comment></comment><comment><USER27> I like Electron's features, but I don't like how it runs its own Chromium. I'd really like a small, local server launcher that just runs whatever default browser the user has selected, with a borderless window. No attempt at auto- integrations between client-view and server code, just let me do it like a regular SPA. Bonus points for letting me specify my own server executable, so I can do it in whatever language I want.

EDIT: seriously, it could run its own local server for privileged OS integrations, giving you an IPC API over REST.

<comment><USER28> There was a rumour that with Edge going to chromium MS wants to make the engine available on windows so that electron on windows wouldn't need to ship with a copy of chromium.

<comment><USER29> Given that Microsoft recently acquired the primary Electron developer, GitHub, that concept seems plausible. And I have a difficult time finding fault with it.

You see endless 'concerns' about Electron resource usage. What you don't find are complaints that it's unstable, or that it only works on some desktops, or that it's hard to understand or use. It's solid, it works on all desktops and it's about as easy to use as such a thing can be for contemporary full stack developers.

For better or worse I think the whinging about resource usage isn't going to hinder Electron much.

</comment></comment></comment><comment><USER30> For Chrome users that leave the browser open all the time, is there a reason to choose an Electron based chat-app, that usually sits in the background, over just installing its PWA on the desktop?

Chrome now supports native notifications on Windows/macOS and even apps without full PWA support seem to work fine by just creating a shortcut and setting it to open as a new window without the browser's UI.

<comment> saint-loup For me the reason would be first-class status in the taskbar/dock. I like having some apps only a click away and in its own window, not lost among many open tabs.

For some time you could do that with any web page in Chrome, with "the create a shortcut" option. But now Chrome opens them in a new tab, not in a dedicated window.

<comment><USER30> After adding the new shortcut you can go to chrome://apps and right-click on any app to select "Open as window". This should bring back the desired behavior and these app shortcuts now have their own entry in my taskbar/dock.

<comment> saint-loup Ho nice, thank you. The option used to be in the creation dialog.

</comment></comment></comment></comment><comment><USER31> One major issue with Electron that I don't see talked about much is backwards compatibility. This release states that because Chrome no longer supports Mac OS 10.9, Electron doesn't either.

Resource usage aside, there's far too much control of a given app being given to the Chrome team.

<comment><USER32> Ouch. Thanks for mentioning the issue. I'm still happily using 10.9 on my main laptop and in no rush to change, and I was hoping to look into using Electron for a project, so that's going to be awkward.

<comment><USER33> Does Apple make security updates for 10.9 anymore? Seems like a security risk.

<comment><USER34> Having used all of the subsequent iterations of OS X, now I will be reverting to my Time Machine copy of 10.9 because really, the usability of it has gone downhill from that point on. Or even 10.8, I'm not yet sure.

Who cares if it's secure but sucks so much that I'm not using it anymore?

</comment></comment></comment></comment><comment><USER35> I really want to use Electron for a project I have coming up since it checks all the boxes, but all I ever see are complaints about the performance :(

Is the performance really that bad? Plenty of successful applications are using it. Is there a fix in the horizon?

<comment> jf- The performance really isn't that bad at all in my experience. The complaints you see are _developer complaints_ , where they're talking about resource usage that ordinary users would never notice or question, or UI lag that most users wouldn't care about (I only add this because someone else in this thread claims to have encountered it, but I never have, or have never noticed). If you find web apps running in chrome to be acceptably performant, then electron is fine for your use case. But naturally, a native solution will be faster if you're doing something that really is resource intensive.

VS Code is electron, I use VS Code every day without noticing any issues. I think the complaints about electron are moot.

<comment><USER36> > where they're talking about resource usage that ordinary users would never > notice or question, or UI lag that most users wouldn't care about

But this is such poor logic. We can notice these things, while regular users just suffer not knowing why their battery drains so quickly, unable to pinpoint the problem.

<comment> jf- > But this is such poor logic.

No, it's not. It's at most a trade-off. Some developers will doubtless make this their hill to die on, but I suspect it really has nothing to do with performance or battery life, and it's likely motivated by resistance to web technologies being used on desktop vs what they're used to.

Also I'd like to see some actual battery life benchmarks for electron, because I don't imagine that it's a huge deal, but benchmarks would prove the matter. It also ignores actual desktop users or users who just use mains power all the time.

<comment><USER37> If you're on a Mac, open up activity monitor and watch which apps use the most energy. For me, the energy used by Atom, Slack, and Chrome is vastly higher than the energy used by other apps (inc. Safari loaded with tabs). It's possible to make an energy efficient Electron app — you just need to aggressively shut off event loops when there's nothing to update, which is hard so most app (and site) devs don't bother. (I make complex animations on the web, so I'm hyper attuned to perf and energy use)

<comment><USER38> I'm curious, do you compile anything to asm.js?

<comment><USER37> Not yet, though I'm keeping my eye on WASM and will pursue it if the need arises. The sort of work I do has relatively little overhead from the JS, and is mostly bottlenecked by rendering (SVG, mostly). WASM wouldn't help my load/parse times since I rarely ship more than a few Kb of JS, and it wouldn't help my per-frame times or latency because I'm usually done the JS part of the frame in around 1ms.

</comment></comment></comment></comment></comment></comment></comment><comment><USER39> I use Electron as a quick MVP for basic apps. If the apps become more complex, then we will talk about moving to a native platform if we need to focus on native libraries or performance. Pick the tool for the job at hand.

</comment><comment><USER40> I have high hopes for Electron. In some regards, it feels like the new Java. I remember in the early days, using Eclipse and thinking how bad the performance was, but appreciated all the functionality it brought, despite being written in Java. Now days, I am in love with the JetBrains IDEs, and don't think twice about the fact they are Java. The performance is great, and they look good (IMHO). I suspect that in the future we will feel the same way about Electron apps.

</comment><comment><USER41> So someone should clearly fork it to Firefox. Not me. Not if you want it done right. There has been a lot of talk on HN about Chrome having to big a slice of the pie. Whelp.

</comment><comment><USER42> I've worked with Electron and previously NW.js for over 6 years. Here's what you need to know – if an apps performance is bad 99.9% of the time it's the developers code, not Electron that's the issue.

Sure, the bundle size is large and the memory footprint is ~200Mb but those should not be limiting factors if you have a computer from this decade.

</comment><comment><USER43> A lot of people express concerns about Electrons resource usage. I wonder if people are aware of projects like zserge/webview [1]? It provides a cross platform API on top of the built in platform browsers and thus is very lightweight.

Of course, it means you have to deal with cross-browser issues, but I guess webdevelopers are used to this anyway. I'm also aware that these projects don't provide all the APIs that Electron provides, but many apps that are really just a wrapper around a webapp this is totally fine IMO.

[1] [https://github.com/zserge/webview](https://github.com/zserge/webview)

<comment><USER44> That doesn't seem like it would solve anything, unless I'm missing something substantial. Which specific browser engine it uses isn't as important for resource consumption as the fact that it's spinning up an entire browser engine per process.

<comment><USER43> At least the binaries are substantially smaller because they don't actually include the browser.

I can also imagine there's some potential for sharing the same engine across multiple apps, though I'm not sure if they actually do this.

</comment></comment></comment><comment><USER45> Isn't it funny the Palm Pre was in some sense what Electron apps have become? Just an anecdote - I understand all the differences between them but I didn't even think at the time the Pre came out that it was "ahead of it's time" but I suppose it was - then again there was also the iPhone that killed it as well.

</comment><comment><USER46> Discord seems to buck the trend of both Electron and React Native being bloated and slow. How do they do it?

<comment><USER47> The thing about Electron (that is often drowned out in these threads) is that it's a web browser, which means... like any website, there's a litany of weird performance tricks you need to know and be aware of to make a good performant UI that doesn't have performance degrade over time.

Like many websites in tabs in a browser, sometimes... it's easier to just kill the tab or window, and re-open it. Usually a sign you've done something wrong in your UI handling code.

</comment></comment><comment><USER48> One of the less obvious reasons why Electron has become so widely used is that Apple hasn't invested anything meaningful into improving AppKit in the last 5-10 years. If Cocoa was a joy to use I'm sure there would be more native apps.

</comment><comment><USER49> I can't wait to hear about all the new features at ElectronConf... oh... nevermind.

<comment><USER24> I don't get the joke? Is/WAS "ElectronConf" a real thing?

<comment><USER50> It was going to be, but they didn't have enough minorities and woman giving talks, so they cancelled it. Looks like they deleted the announcment, but here is an old reddit post where people are talking about it.

[https://www.reddit.com/r/javascript/comments/6f8u2s/githubs_...](https://www.reddit.com/r/javascript/comments/6f8u2s/githubs_electronconf_postponed_because_all_the/)

<comment><USER51> Surreal.

I guess the good news is that this level of dysfunction should take care of the other Electron issues all by itself if we just wait a little while.

</comment></comment></comment></comment><comment><USER52> I still think that the majority of Electron apps can and should just be PWAs. Most like Discord pretty much just wrap their webapp anyway.

</comment><comment><USER53> I stay away from Electron and JS desktop apps in general because:

\- Huge distribution size. Your code is 1% at most. 99% is redundant. I want 10 meg at worst hello world dist size. \- This is more a problem in JS ecosystem in general: No good enough standardized or not way to do the frontend part of the app. Angular is not good enough, neither is React or anything else. Though it is gradually getting better.

</comment><comment><USER54> > Electron v4.0.0 includes Chromium 69.0.3497.106

Isn't this already outdated by months?

</comment><comment><USER55> Congrats team, looking great!

</comment><comment><USER56> Nice!

Has anyone played around with flutter.io? Is it similar to electron?

<comment> forgot-my-pw Flutter for desktop is still pretty new, but it sounds promising.

[https://medium.com/flutter-community/flutter-on-desktop-a- re...](https://medium.com/flutter-community/flutter-on-desktop-a-real- competitor-to-electron-4f049ea6b061)

</comment></comment><comment><USER57> if only electron vanished from the earth...

<comment><USER58> Think this is bad? Just wait until everyone adopts asm.js. So we can compile C++ code to "fast web apps" which will run in the asm virtual machine, in the javascript DOM sandbox, in the thin webbrowser client, and finally in the OS.

You can laugh, but that day is coming and I fear getting armies of college grad hipster-coders creating unreliable slow layered software until we have nothing but "Material" UI flat buttons and cursor lag when typing simple messages in a simple application. AHHHH

<comment><USER59> You forgot the new OS wars, which happen on top of this "platform". Remember guys, one more layer of abstraction is all we need, then there will be no more problems forever!

<comment><USER58> ROFL, at some point there will be a javascript CPU ([https://twitter.com/steipete/status/1047415826083729408](https://twitter.com/steipete/status/1047415826083729408)) - and the entire OS will be asm.js. Then the cycle will begin anew with web browsers being built for the OS. God help us all D:

<comment><USER59> Buried deep down in the microcode of that CPU will still be an implementation of 8086 real mode, which will still be the default boot state.</comment></comment></comment></comment></comment>


Stanley Black and Decker's game controller for excavators - <AUTHOR> https://arstechnica.com/information-technology/2019/03/firstperson-digger-stanley-black-deckers-game-controller-for-excavators/ <comment><USER2> Anyone wanna bet how long until a vulnerability is found?</comment>


Quantitative analysis of family trees with millions of relatives (2017) [pdf] - <AUTHOR> https://www.biorxiv.org/content/biorxiv/early/2017/02/07/106427.1.full.pdf <comment><AUTHOR> And, of course, the most important result of the paper is 13 million degrees of Kevin Bacon:

"The largest family tree in the processed data spanned 13 million individuals who were connected by shared ancestry and marriage (Fig. 1C). The tree included public figures such as Kevin Bacon..."

</comment><comment><USER2> Better to link the final version - [http://sci- hub.la/10.1126/science.aam9309](http://sci-hub.la/10.1126/science.aam9309)</comment>


Legal Checklist for Startups - <AUTHOR> http://walkercorporatelaw.com/startup-issues/legal-checklist-for-startups/

<comment><USER2> I think the LLC advice is questionable.

1\. It's true that institutional VC isn't going to invest in an LLC. It's also part of the C.W. that institutional VC isn't going to invest in your C Corporation either; there's going to be thousands of dollars spent in restructuring your corporation one way or the other. It's probably _not true_ that having an LLC is going to prevent you from getting an investment. If you're worth a VC round, you'll get a VC round; it's just a question of how much of that round will go to legal fees.

2\. The tax issues for LLCs aren't particularly complex. In fact, tax simplicity is one of the reasons LLCs exist. If your LLC is paying you --- you're post-revenue --- _you need an accountant_. Don't DIY your taxes. I've done dumb things with taxes before. Learn from my errors: it's not worth the heartache to blow off your taxes. Just get an accountant.

3\. There are common constructs used to grant equity to LLC employees (I believe they're formally "restricted stock units", but, ask your lawyer --- who you certainly needed to engage if you were building a C Corp). The bigger issue to my mind is the fact that the founders of an LLC, formally "principals", "owners", or "partners", technically aren't supposed to take W2 income, which makes taxes trickier.

Against all of this complexity just note that an LLC is _way_ easier to set up than a C Corporation, and if it's between an LLC now and a C Corporation "sometime soon but not quite yet", please remember that the benefits of incorporating are significant:

* You are unlikely to lose your house in a contract dispute.

* You can invoice and be invoiced.

* Big companies will have a harder time rolling you into letting them withhold taxes for you when they pay you.

<comment><USER3> You can always organize as an LLC and "check the box" (make an entity classification election) within 75 days to have the LLC treated as a corporation for tax purposes.

<comment><USER2> I'm pretty sure you can elect for S Corporation treatment any time (I don't know if it costs more later on, I just know that we did it only within the last few years).

</comment></comment></comment><comment><USER4> Curious on the Delaware part, that's the first I've heard that "all investors" are going to "require" a Delaware formation.

<comment><USER5> This not strictly true: they are not going to _require_ it. But many of them will be _so_ much more more happy with you.

</comment></comment><comment><USER6> Legal Checklist for _American_ Startups.

ftfy.</comment>


A subsystem to restrict programs into a "reduced feature operating model" - <AUTHOR> https://marc.info/?l=openbsd-tech&m=143725996614627&w=2 <comment><USER3> This doesn't seem particularly better than Linux's seccomp-bpf or OS X's seatbelt. In particular, I don't really understand the complaint about not wanting to write a program, then turning around and writing a _system call_ , running with full privilege on the system, that hardcodes all sorts of things about userspace.

I wish he'd acknowledge and discuss prior, effective work in this space instead of saying things "showed up" and they're "insane". For instance, a direct comparison to either seatbelt or seccomp-bpf would make it clear that the distinction between initialization vs. steady state is well-explored in production systems using this (like sandboxed Chrome renderers) and not novel.

<comment><USER4> The implementation is better than OS X, because OS X has a _ton_ of kernel API surface available to userland and much of it can't even be sandboxed, while tame starts with one syscall and works its way up.

I agree it's not better than seccomp-bpf plus a library to supply these kinds of common policies in userland, with the caveat that I don't know of any such library in common use on Linux.

<comment><USER3> Yeah, seatbelt is not that compelling in practice, but that's true of the OS X kernel/userspace boundary in general. :/ But the design of it seems to match what's wanted here, exactly: you can enable restrictions during the running of a process, and OS X ships with a handful of standard seatbelt profiles.

pcwalton's gaol, which has both seccomp-bpf and seatbelt backends, has a concept of "profiles," which I think matches the general idea here:

[https://github.com/pcwalton/gaol](https://github.com/pcwalton/gaol)

To be fair I wouldn't use it in production yet, but it's quite a bit more reviewed than tame(2) is right now.

</comment></comment></comment><comment><USER5> So, do I have it right that this is effectively a way of a program being able to declare to the operating system "I shouldn't ever do <x>"?

Because, if so, that makes a whole lot of sense. (Adding security "for free" generally does).

This could conflict with on-the-fly upgrades, though. If it turns out that some later version of your program does in fact require <x>, then you'll have to kill and restart the process as opposed to upgrading on-the-fly. Perhaps not the end of the world, but worth noting.

<comment><USER6> It can also be used by a parent process to limit the functionality of a child process, by calling tame() after fork() and before exec(). I can imagine this being used with some a "tame" command in the shell to run untrusted programs. Of course I don't know how thorough the sandboxing is, and I wouldn't trust it to make unsafe programs completely safe.

<comment><USER7> > I can imagine this being used with some a "tame" command in the shell to run > untrusted programs.

This might not be useful in practice. The inspiration behind tame() is the observation that a program usually needs many more rights at initialisation- time than in its main-loop. Thus, tame()ing a program before it even starts is unlikely to be practical - if you give it enough permissions to successfully start (including whatever is needed for dynamic linking), you may not have reduced its capabilities much.

</comment></comment></comment><comment><USER8> This is pretty brilliant/obvious in hindsight. In addition to the sandboxing protection, you also have a really good inventory of what privileges the application requires. Looking over the diffs in the applications - most of them are two or three lines - a #include <sys/tame.h> followed by something simple like tame(TAME_STDIO | TAME_DNS | TAME_INET);

What I really like about a lot of the OpenBSD initiatives, is they don't overthink their solutions - they make them as simple as possible, but no simpler. Signify, which avoided the entire web-of-trust/PKI complication is another example.

<comment><USER9> Yeah, it's a basic dynamic role/coeffect system, which goes a long way toward enforcing correctness and safety, much as types do (whether static or dynamic).

</comment></comment><comment><USER10> Having fine-grained capabilities and the ability to turn them off is always useful. The usual problem is that some component needs to, say, open a file, so all code gets "open file" privileges.

There's a tool like this for Android phones. It not only can turn privileges off for an application, but also offers the option to provide apps fake info for things they don't need. You can, for example, deny address book access; if the app tries to access the address book, it gets a fake empty one. You can deny camera access; the app gets some canned image. This allows you to run overreaching apps while keeping them from overreaching.

<comment><USER11> Yeah, for 'open file' kind of stuff it would be better to have a real sandbox (I think Windows began doing something like this, not sure if in Vista or 7, that if programs wanted to write to certain restricted places they can - <USER2> this is written to their sandbox, so if they read it later they can get the files but with no effect on the system files)

<comment><USER12> Vista did that as a compatibility workaround. Older Windows apps from the 9x and XP era were used to being run as Administrator and being able to write directly to Program Files and the like. In order to make some of these work on Vista without running them as Administrator, the solution was to lie to the applications and make their writes go through to sandboxes instead.

The sandboxing was flawed, though. It causes problems for some applications. For example, Gang Garrison 2, a game I have worked on, fails to update itself if stuck in Program Files and not run as admin.

</comment></comment></comment><comment> vezzy-fnord For another example of a similarly beautiful interface that echoes "difficult solution made stupidly simple to use", checkpointing under DragonFly BSD: [http://leaf.dragonflybsd.org/cgi/web- man?command=sys_checkpo...](http://leaf.dragonflybsd.org/cgi/web- man?command=sys_checkpoint&section=2)

On an unrelated note, I've always had respect for how Theo de Raadt is both the project leader of a complete BSD system, yet also an active hacker. Contrast to Linus Torvalds, who's mostly a manager nowadays.

<comment><USER5> On an unrelated note, but tangential to your link, why can I not save and restore processes? It seems like something that would be relatively easy to do - suspend all threads, save the thread control blocks, mark all pages as fault-on-write, resume threads, and start saving pages, unmarking them once they are saved. If/when a thread faults, copy (or save immediately) that page and then resume that thread. (Or potentially don't resume the threads until after you save everything, although that may cause problems...) You need to deal with file handles / etc, but that can be done too.

Not really different than hibernation.

<comment><USER13> You've tickled on the problem but not quite nailed it.

> You need to deal with file handles / etc, but that can be done too.

That's actually the hard part. To get a real image of that process in time, you need to snapshot the full filesystem state, too. Or it could change out from beneath your program. Even more complicated: network state.

<comment><USER14> Why is network more complicated? I would think network doesn't have any atomic/uninterruptible states filesystem might?

<comment><USER15> It's easy to re-open a file (assuming it's still there), but with sockets your IP may have changed, the remote IP may have changed (which you may have stored in your working memory that got checkpointed), DNS may point you to a different service entirely, you could have had to do some kind of port knocking or something to get that connection open in the first place.

I know this kind of stuff is being worked on so VMs/containers/namespaces can be moved around but it seems to be one of those things that gets really complicated when you try to do it transparently for userspace.

<comment><USER14> IPs, DNS settings change on running programs all the time, that doesn't seem as unusual as re-opening a file that's actually not there. A unix socket is an interesting mixed case :)

</comment></comment></comment></comment></comment></comment><comment><USER16> See also, Solaris' Role-Based Access Control and Privileges models.

Privileges (seems to fit the post): [https://blogs.oracle.com/casper/entry/solaris_privileges](https://blogs.oracle.com/casper/entry/solaris_privileges)

[http://www.c0t0d0s0.org/archives/4075-Less-known-Solaris- fea...](http://www.c0t0d0s0.org/archives/4075-Less-known-Solaris-features- RBAC-and-Privileges-Part-3-Privileges.html)

Programming with Privileges Example: [http://docs.oracle.com/cd/E23824_01/html/819-2145/ch3priv-25...](http://docs.oracle.com/cd/E23824_01/html/819-2145/ch3priv-25082.html#priv-12)

Overview: [http://www.c0t0d0s0.org/archives/4077-Less-known-Solaris- fea...](http://www.c0t0d0s0.org/archives/4077-Less-known-Solaris-features- RBAC-and-Privileges.html)

In particular, the Solaris privileges model allows a program to gracefully degrade functionality and drop and reinstate privileges at different points of execution.

</comment><comment><USER17> This is an interesting idea, but something about having various "behaviours" baked into the logic concerns me. I'm certain that Theo has thought about this and understands the implications better than I do though.

For example, if your process has TAME_GETPW opening /var/run/ypbind.lock enables TAME_INET. The reasoning behind this makes sense, but now it means that yp always has to open that file before it can do its thing. The behaviour of yp always opening that file before accessing the network is now required by the kernel.

The saving grace is that OpenBSD (and the other BSDs) are developed as a unified system, so if yp ever changes to no longer use that file, that change will only come as part of a version upgrade that includes the kernel, etc.

</comment><comment><USER18> Windows 8 has an equivalent of this, using a "mitigation policy" called ProcessSystemCallDisablePolicy, which is set using SetProcessMitigationPolicy().

Chrome uses this for their sandbox of rendering processes.

<comment><USER19> It looks like you can only disable GUI calls with it (the very sparse documentation seems to contradict itself a bit though). Also, a model in which you specify which calls you want to enable (and everything else gets disabled) is stronger than one in which you specify which ones you want to disable.

<comment><USER20> Indeed, it's the whole whitelist vs blacklist [1] debate. Whitelists are radically safer.

[1] - [https://farm9.staticflickr.com/8669/16418068728_b8dd8aa200_c...](https://farm9.staticflickr.com/8669/16418068728_b8dd8aa200_c.jpg)

</comment></comment></comment><comment><USER21> I recently asked for exactly this on StackOverflow, but for Linux[0]. Is anyone aware of an interface to seccomp-bpf on Linux that is as easy to use as this tame() syscall?

If not, does anyone want to join forces to create one? An ultra-simple library that provides tame()-like functionality on all capable platforms should make writing secure software a lot easier.

[0] [https://stackoverflow.com/questions/31373203/drop- privileges...](https://stackoverflow.com/questions/31373203/drop-privileges- as-regular-non-root-user-for-sandboxing/31373324#31373324) if anyone's curious

<comment><USER22> I would look into the Chrome/Chromium sandbox code, as they seem to have at least some facility for parsing simple profiles.

This page has some details:

[http://www.chromium.org/chromium-os/developer- guide/chromium...](http://www.chromium.org/chromium-os/developer- guide/chromium-os-sandboxing)

</comment></comment><comment><USER23> The kernel pieces of tame(2) have just been committed:

[http://marc.info/?l=openbsd- cvs&m=143727335416513&w=2](http://marc.info/?l=openbsd- cvs&m=143727335416513&w=2)

</comment><comment><USER24> I can't see where in this patch forked children inherit the `ps_tame` from the parent process. I don't know this kernel at all but it seems like something like this should be in sys/kern/kern_fork.c

        pr->ps_tame = parent->ps_tame

Otherwise tamed processes could just fork a process to do things they've declared that they won't do.

<comment><USER23> A tamed process cannot even call fork(2) unless the _TAME_PROC_ flag is passed, in which case I'd assume the child process would then inherit a copy from the parent as part of a normal fork(2) operation. It can be later revoked by the child, but it may want to keep it for kill(2).

<comment><USER24> I'm `cvs get`ting as fast as I can to read the rest of sys_fork.c to sate my curiosity, but CVS incredibly slow. I'm spoiled by how git packs the repo.

<comment><USER24> turned out to be way faster just to grab [http://mirrors.sonic.net/pub/OpenBSD/5.7/sys.tar.gz](http://mirrors.sonic.net/pub/OpenBSD/5.7/sys.tar.gz) , if anybody else wants to poke around and doesn't want to wait for cvs.

<comment> glass- You can also view the source on the cvs web mirror: [http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/](http://cvsweb.openbsd.org/cgi- bin/cvsweb/src/)

</comment></comment></comment></comment></comment><comment><USER25> This won't work for programs that allow for plugins, which are arguably those that need the most protection. Programs don't generally know what permissions plugins when they are compiled.

<comment><USER15> Could you provide examples?

The stuff I'm thinking of that would plugin to Firefox or Photoshop probably do things that would already be allowed (read/write files, allocate memory, access network).

Either way this seems like an extremely simple way to lock down all the little command line utilities and small programs that make up a working unix system, so that if someone does get arbitrary command execution by other programs it gets much more difficult to chain exploits.

<comment><USER26> think more like emacs or vim. plugins can add any number of things that isnt just file read/write. they can add new syscalls for a built in debugger (ptrace, strace, etc.) or even add an opengl layer for coding in 3d.

<comment><USER25> That's basically what I meant, thanks for explaining it clearly.

</comment></comment></comment></comment><comment><USER27> This interface makes a system call at run time to reduce privileges. I wonder if there is a way to do this statically and automatically, either with some header file magic, or by analyzing the symbols in the executable: just assume at link time that any system calls it makes (and only those) are allowed.

<comment><USER28> Looking at a program statically and limiting its privileges automatically would be good (autotame?), but it misses the point that tame appears to be trying to solve. Specifically, it is often the case that programs need more privilege once at initialization time, and less privileges later. So at startup, your program needs to open some files, and open listening network sockets, etc., but once initialization is done it just needs CPU. A static analysis would see that the program opens files and listening sockets and stuff, and grant those privileges forever. If you want to capture the reduced privileges required after the one-time initialization then you need to modify the program to use something like tame (or capsicum, etc.).

</comment></comment><comment><AUTHOR> For comparison, the man-page for FreeBSD's capsicum API: [http://mdoc.su/f/capsicum.4](http://mdoc.su/f/capsicum.4).

</comment><comment><USER29> Great to see another attempt at this model. I do like capsicum (seems pretty straightforward), but it seems like it can require some added complexity with things like casperd for dns.

Very interested to see how this works out.

</comment><comment><USER30> Let's say I received a SIGHUP and I need to reload my configuration after I dropped my right for reading /etc/ and all the syscall for provisioning my resources.

How screwed am I?

<comment><USER23> You would have a parent process that retains permissions to read configuration and sends changes to children, i.e: imsg_*(3) on OpenBSD.

[http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD- current/man3/...](http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD- current/man3/ibuf_add.3)

</comment></comment><comment><USER31> This sounds very similar to code access security (CAS) that Microsoft's CLR had from around 2000 (but at the OS level rather than the VM level).

</comment><comment><USER32> It reminds me SELinux.

<comment><USER33> Not really.

</comment></comment><comment><USER34> A simple easy way to keep a lid on privelige escalation is to remove all the files that you computer does not absolutely require to do its job.

Especially the development tools: the Morris worm enabled portability by distributing itself in source code form then building its binary on its target hosts.

My sister once read a novel about some very traditional, strictly religious people who fastened their shirts with string ties as they felt buttons were hooks that the Devil could use to grab hold of you.

I feel much the same way about files. I dont know what tomorrow's zero-day will look like but the chances are quite good that it will depend on a file that is installed by default. Cliff Stoll wrote in "The Cuckoo's Egg" of a subtle bug in a subprogram used by GNU emacs for email. Had the Lawrence Berkeley Laboratory used vi rather than emacs they would not have been vulnerable. ;-D

Yes it is a step in the right direction not to run daemons or windows services you dont need but its even better to remove them.

In 1990 I wrote an A/UX 2.0 remote root exploit to drive home my objection to one single file having incorrect permissions. Its source was about a dozen lines. That particular file was required but our default installs have many files we dont really need.

Also if you can read - not just execute - the binary to any program or library then your malware can load it into its memory then execute it. We have no way of knowing who is going to do that tomorrow but we do know there are many binaroies we do not really need.

If you develop code for your server, install the same distro in a vm on your desktop box then compile it there.

<comment><USER35> > A simple easy way to keep a lid on privelige escalation is to remove all the > files that you computer does not absolutely require to do its job.

Taken to its logical conclusion, you sort of end up with a unikernel system, like Mirage OS[1]: only the code necessary for the execution of the service is compiled into the kernel. These systems don't even have a shell.

[1] [https://mirage.io](https://mirage.io)

<comment><USER34> Many embedded systems are that way.

While it is helpful that hardware memory management will protect against erroneous and malicious code, even better is for the code to be correct and ethical.

This because the MMU hardware takes up power, it costs money, generates heat and uses real estate. Also the software is complex and uses a lot of memory for page tables and complex allocation schemes.

The Oxford Semiconductor 911, 912 and 922 didnt even have a kernel nor did they have dynamic memory allocation, just stack and static memory with an infinite loop operating a state machine. A huge PITA to debug but the memory and flash were quite cheap because there werent very much of either.

</comment></comment></comment><comment><USER20> So when is OpenBSD getting rewritten in Rust?</comment>


Top Must Have Android Apps for Daily Use - <AUTHOR> http://www.hackpundit.com/top-android-apps-which-make-your-daily-life-easy/ <comment><AUTHOR> Android Apps which will save a lot of time on daily basis. 7 top apps has been filtered for daily life use and compiled into one list.</comment>


Google Plans to Launch a Censored Search Engine in China - <AUTHOR> https://www.bloomberg.com/news/articles/2018-08-01/google-plans-a-censored-search-app-for-china-intercept-says <comment><USER2> Already on the front page, active discussion here: [https://news.ycombinator.com/item?id=17660872](https://news.ycombinator.com/item?id=17660872)</comment>


A Dark Room - minimalist text-based game - <AUTHOR> http://adarkroom.doublespeakgames.com/ <comment><USER5> The style of a minimalist interface that starts sprouting things, somewhat ASCII-game-ish yet also rather dynamic, reminds me a bit of Candy Box: [http://candies.aniwey.net/](http://candies.aniwey.net/) . It's an interesting UI and 'reveal' style for a game, and glad to see another one using it. Feels somewhat refreshing.

edit: Ah ok, if you view-source it mentions Candy Box as an inspiration.

<comment><USER6> And Frog Fractions is worth checking out if you like Candy Box.

<comment><USER7> Frog Fractions is worth checking out, full stop.

<comment><USER8> Jesus, this is amazing.

</comment></comment></comment></comment><comment><USER9> This reminds me less of parser-based text games and more of the 1990s hyperfiction like _Afternoon, a story_ [1], _Victory Garden_ [2] or _253_ [3] and net.art like _My boyfriend came back from the war_ [4]. Give those a look if you liked this. The hypertext novel _253_ , which looks in the life of every passenger on a London Underground train, is probably the best starting point.

Edit: Oh, and also _Fallen London_ [5] and other StoryNexus games. In fact, in terms of mechanics _A Dark Room_ is probably the closest to Fallen London of all the games of which I can think.

[1] Sadly, the HTML sample at [http://www.wwnorton.com/college/english/pmaf/hypertext/aft/](http://www.wwnorton.com/college/english/pmaf/hypertext/aft/) appears to not work in modern browsers. It was created in a pre-HTML hypertext system called Storyspace; you can see what it is supposed to look like on its native platform at [https://www.youtube.com/watch?v=djIrHF8S6-Q](https://www.youtube.com/watch?v=djIrHF8S6-Q).

[2] [http://www.eastgate.com/VG/VGStart.html](http://www.eastgate.com/VG/VGStart.html)

[3] [http://www.ryman-novel.com/](http://www.ryman-novel.com/)

[4] [http://www.teleportacia.org/war/](http://www.teleportacia.org/war/)

[5] [http://fallenlondon.storynexus.com/](http://fallenlondon.storynexus.com/)

<comment><USER9> s/looks in/looks into/

By the way, and if you're at all interested in the history of hypertext fiction do watch this video: [http://vimeo.com/15561443](http://vimeo.com/15561443). The speaker in the video talks about a fascinating parallel culture of hypertext writers and readers who paradoxically seem to resist the idea of putting their creations on the Web. Instead, some of the authors choose to disseminate their works on physical media: floppy disks, CD-ROMs and now flash drives.

</comment></comment><comment><USER10> Here's something I consider a problem:

If you're in the cave, and something attacks you, at the end if you press "eat meat", sometimes, exactly at the point when you want to click it, the buttons become "leave cave" instead, and you accidently press that. Then, a next fight may begin, and you're at low health.

Please provide some consistent way to heal yourself before a next fight.

<comment><USER11> If the combat dialog and the post-combat dialog were spatially distinct, it would alleviate the primary problem. "stabslashstabslashstabslashstabslashleave.... nooooooooooooo!"

If the combat action buttons didn't self organize, but rather sat in the same spot (perhaps in order of discovery?), then combat frantic clicking could be consistent.

Also, sometimes the tooltip that shows the cost of a "shoot" hangs over the "eat meat" button, leading to unclickable death if you're almost dead. Clicking the tooltip doesn't shoot, nor does it yield increased health. Either behavior would be preferable to nothing.

<comment><USER12> This... so much... I've died a couple times from this, actually...

</comment></comment></comment><comment><USER13> I progressed with a rather slow pace but after the Egyptians came and asked me whether I wanted to help build a new pyramid for their current Pharaoh - <USER2> apparently I was a top architect known far-and-wide - things became interesting very quickly. With the gold I earned I could buy my own workers and I am now comfortably running a rivaling empire battling the Pharaoh which employed me earlier. I do seem to have trouble with foreign spies passing on weaponry I research. Guess I have to raise the bounty for those who turn in traitors.

<comment> Al-Khwarizmi I totally believed this comment, completed the game and liked it, but am slightly disappointed about not having built pyramids and fought pharaohs :)

</comment></comment><comment><USER14> This highlights the importance of game mechanics. I was hooked for about six or seven hours on gameplay alone, even without graphics or sound.

</comment><comment><USER15> Seems to use the psychological technique of intermittent rewards to encourage continued clicking of "stoke the fire." Unfortunately after about 4 stokings with no new developments in the game, I got bored and quit.

<comment><USER16> In this and candy box you're not really supposed to pay attention to the window for the first couple minutes. There is literally nothing to do.

Then later once you're maybe 10 minutes in you can switch away for extended times if you want to wait for the continuous income, no need to press buttons, no 'intermittent rewards'.

It could be changed but it's not actually depending on any kind of psychological tricks. The delays are just a minor throttle at the start.

Edit: Actually, to be precise, you only have to stoke the fire once. It's just a deliberately paced cutscene. No psychology there.

<comment><USER17> > In this and candy box you're not really supposed to pay attention to the > window for the first couple minutes. There is literally nothing to do.

Yeah, interesting call, that. When I played Candybox, I was told "before you dismiss So what it, wait until you get 60 candies, then shit gets _real_ ".

So, what does a self-respecting hacker do, when faced with 60 seconds of "literally nothing to do" ... except the challenge of opening the JS Console to see if I can make that counter run faster, preferably in less than 60 seconds? ;-)

(answer: yes, it was in fact fairly easy)

</comment></comment></comment><comment><USER18> In case anyone wants to accelerate the game slightly, but still play it as intended, set this in the Chrome console.

window.Engine._incomeTimeout = setTimeout(Engine.collectIncome, 500) // default 1000

IMO it's not a cheat, because it just shortens somewhat tedious waiting early in the game, but doesn't alter it otherwise.

<comment><USER19> I ran this in console. just to automate gathering wood and trap checking, since forgetting to switch between panels is easy to do:

function pushButtons(){if(!$("#gatherButton,#trapsButton").hasClass('disabled')){$("#gatherButton,#trapsButton").trigger('click');}}setInterval(pushButtons, 1000);

<comment><USER20> $('#roomPanel').width(350);

See inside and outside at the same time

<comment><USER21> Here's a way to check traps, gather wood, and stoke the fire separately:

var stoke = function(){if(!$('#stokeButton').hasClass('disabled')){$('#stokeButton').trigger('click')}}

var check = function(){if(!$("#trapsButton").hasClass('disabled')){$("#trapsButton").trigger('click')}}

var gather = function(){if(!$("#gatherButton").hasClass('disabled')){$("#gatherButton").trigger('click')}}

g = setInterval(gather, 1000) c = setInterval(check, 1000) s = setInterval(stoke, 60000)

<comment><USER22> Was getting undefined errors with that..

This works:

function pushGather(){if(!$("#gatherButton").hasClass('disabled')){$("#gatherButton").trigger('click');}}setInterval(pushGather, 1000);

function pushCheck(){if(!$("#trapsButton").hasClass('disabled')){$("#trapsButton").trigger('click');}}setInterval(pushCheck, 1000);

function pushStoke(){if(!$("#stokeButton").hasClass('disabled')){$("#stokeButton").trigger('click');}}setInterval(pushStoke, 60000);

</comment></comment></comment></comment></comment><comment><USER23> Warning: while the first part of the game works fine in a touch-based interface, a later section requires a keyboard. You'll be annoyingly unable to proceed on a touchscreen.

<comment><USER24> Just spent an hour before I hit this wall. So frustrating.

Even though it was surprisingly mostly playable on mobile (except: small buttons, tooltips)

</comment></comment><comment><USER25> This is pretty damned cool, and it looks like there is a lot of thought out content backing it....I thought I'd look at it and move on, but I've been playing it for awhile

</comment><comment><USER11> Perhaps "Embark" should be "Explore"? I thought I would leave my town forever. Didn't leave until I'd maxed out every property of armor etc.

<comment><USER26> How were you able to do this without finding the mines?

<comment><USER11> Maxed out -> leather armor. It was the maximum available attribute at the time.

</comment></comment></comment><comment><USER27> Fighting is funny - it's beneficial to keep all old weapons with you, then you can attack with 2 swords, shoot rifle and laser and use bayonet before the first sword timout finishes.

Very addictive game.

<comment><USER28> How did you get a bayonet? I never found one.

<comment><USER27> A veteran had it I think, it was on a battlefield 1/4 of the screen to the right from the village, IIRC.

</comment></comment></comment><comment><USER29> I really like the source code for this game! It's quite readable and good fun to look over :-) Now I remember this was my original reason why I was interested in programming - wanted to figure out these mysterious listings for test-based adventures on Atari. I really like how all the possibilities are encoded there, but you can't entirely picture the game until you actually play it :-)

</comment><comment><USER30> I played this to completion a week ago. It can feel a little tedious st times, but this is usually because I missed something, and is ultimately well written at all stages. Keep with it and you won't be disappointed!

<comment><USER31> How does it end. I have the spaceship, but I need to go to bed.

<comment><USER28> you're nearly done, you just want to upgrade it with the alien alloy you found in the bore sites

</comment></comment></comment><comment><USER32> Stuck in an empty office expanding a RAID. This will do nicely :)

</comment><comment><USER33> I have been spending more time than I care to admit playing this. Seriously. Hours on end. Possibly the most addictive game I've played since Tiny Wings. No idea why.

<comment><USER34> Likewise - just lost my entire weekend to it. I _think_ I finished it - <USER3> the ending isn't completely clear on the topic.

</comment></comment><comment><USER14> This is probably a simple question, but I'm new to JavaScript: How did you create the side-scrolling animation effect that happens when you switch between locations?

<comment><USER35> jQuery is your friend.

<comment><USER36> I need to get into this, I'm trying to learn how to make UI more smooth and modern, and this game really does it well :)

</comment></comment></comment><comment><USER37> I'm having a serious problem later on in the game when I have four different options on the screen during a fight. The hover resource-display obscures the action button and reduces the clickable area to a tiny sliver. I'm losing battles that I should be winning, a lot.

<comment><USER38> Yes, this was annoying enough that I eventually stopped. Two suggestions:

1) Add keyboard shortcuts, make them discoverable via an underlined character

2) increase the amount of space between the buttons so the tooltips appear over whitespace.

That said, I played for hours before giving up! Had tons of fun, thanks for making this!

<comment><USER37> Keyboard shortcuts would probably make the game too easy. But I agree, any game that keeps me going for hours has to be great!

<comment><USER38> I found it frustrating to play with a touchpad. I often accidentally started a click-drag or highlight instead of clicking a button.

It would probably be ok with a mouse instead.

</comment></comment></comment></comment><comment><USER39> Is there any other way to share the game state than copying the local storage? Even though I use Chromium with linked Google accounts between Windows and Ubuntu, it does not save local storage data. And that is not even possible on an iPad, for an example.

</comment><comment><USER40> I got eaten by a grue.

<comment><USER41> Or did the grue perhaps stoke a fire?

</comment></comment><comment><USER42> Interesting game, but I'm surprised it doesn't work better on phones - <USER4> seems like a perfect game for the medium.

</comment><comment><USER43> I've been at it nearly an hour. Very good indeed.

Love the minimalist interface.

</comment><comment><USER44> I just bought a compass, and entered "A barren world" on my iPad... And I'm stuck. What are the controls for this part of the game?

<comment><USER45> arrow keys

<comment><USER44> Darn, guess I'll have to start all over again on my PC.

Seems like there'd be a use for a way to "save" games by emailing a parameterized URL to yourself... Or just an alternative to arrow keys for all of those tablet users out there.

Still a great game, though! Next time I'm feeling like procrastinating on a 2007 vintage netbook, I'll know where to look :)

<comment><USER46> No reason you can't "save" and transfer your game by moving your cookie. You just need to get at your iPad cookies.

<comment><USER44> I think it's actually using local storage, which is a bit harder to get at. But I ended up surpassing my iPad game within 15 minutes anyway... Good fun :)

</comment></comment></comment></comment></comment><comment><USER47> This is a very cool use of html as a medium to tell a story and keep the player involved. Defiantly want to see more games in a similar style!

</comment><comment><USER48> This is pretty awesome.

</comment><comment><USER49> This game is highly addictive, and I thoroughly enjoyed it!

Some usability issues from memory for the next iteration (some that others have pointed out):

\- The 'up' and 'down' arrows when allocating workers have a much-too-small clickable area. Compounding this was a slight offset between the arrow image and the clickable area

\- Allocating workers & allocating the spoils after a battle both shared the problem of only being able to increment by one unit at a time. Lots of annoying clicking.

\- When you hover over the worker allocation button when there are no workers allocated it doesn't indicate whether the various resources will be consumed or produced. You have to allocate at least one worker to find out this info.

\- It took me ages to figure out that the 'gather wood' button is independent of the villagers gathering wood. I still don't really understand the relationship between 'check traps' and bait and allocating extra hunters/trappers.

\- as mentioned elsewhere here, there's a popdown over buttons showing what resources are required by the button. This is incredibly annoying when it obscures another click target, especially during a fight.

\- (As Aardwolf pointed out) When gathering the spoils or as an enemy denies, the layout changes and the buttons jump around, meaning it's very easy to unintentionally click on e.g. 'leave city'

\- It's a bit annoying to have to switch between the 'raucous village' and 'small room' tabs to figure out which resources are low and how to allocate workers

\- When you find fur etc. in the traps it should say how much fur is found

\- It's kind of hard to figure out what resources are going where. Maybe each message from the stream of messages down the right hand could be positioned as a callout bubble beside the resource or item that is affected.

Hope this is constructive and super job — great originality!

</comment><comment><USER50> How do you avoid the beasts that keep killing your guests?

<comment><USER51> Not totally sure, but I believe it's mostly a matter of keeping the fire going

</comment></comment><comment><USER52> I'm stuck in civilisation where I need steel to make the next set of items. Is there any more efficient way of producing steel than buying it in exchange for scales and teeth? Like a steel mine or a person like a tanner that can convert iron into steel?

<comment><USER53> At one point you can build a steelworks and produce steel from iron and coal.

</comment></comment><comment><USER54> Very good game! I refrained from cheating for a few hours but got bored waiting for furs n things. Poked around JS for unlimited ammo and just completed the game minutes ago. Glad I cheated because otherwise I know I'd be playing it for days on end.

</comment><comment> cupcake-unicorn I really enjoyed this, and it introduced me to Candy Box as well. This is saying something since I suffer from pretty severe issues with concentration and haven't been able to play games for some time. Thank you very much.

</comment><comment><USER55> Speed up the cool down when gathering wood or checking traps. Paste this code into chrome console.

Button.cooldown = function (btn) { var cd = btn.data("cooldown"); if(cd > 0) { $('div.cooldown', btn).stop(true, true).width("100%").animate({width: '0%'}, cd * 10, 'linear', function() { var b = $(this).closest('.button'); b.data('onCooldown', false); if(!b.data('disabled')) { b.removeClass('disabled'); } }); btn.addClass('disabled'); btn.data('onCooldown', true); } }

</comment><comment><USER56> And there went my whole night.

<comment><USER11> Mine too. Took ~5 hours to finish.

</comment></comment><comment><USER57> Any idea what 'charm' does? I haven't found a use for it yet.

<comment><USER58> I think I used it once: I wanted to talk to a man on a swamp and I needed one charm to talk to him.

Be careful about them, since they seem to be finite in supply. Though I don't losing all of them and not being able to talk to that man would make any discernable difference in the long run.

<comment><USER28> Yeah, as far as I could tell, you only used them to talk to the old man in the swamp - you'll find them periodically in your traps, though - I had 8 or 10 by the time I finished the game, so don't worry too much about losing them.

</comment></comment></comment><comment><USER32> Anyone figured out how to explore the "landmarks" on the dusty path. Like I see the caves but I can't enter them, move my guy over them but no matter what key I press he won't enter.

<comment><USER59> you need a torch

</comment></comment><comment><USER60> I feel slightly stuck at some point, because it's too hard to get large quantities or iron to build new things, and fur is worth nothing...

<comment> nappy-doo Have you tried mining iron with villagers?

<comment><USER60> I don't know how I can do that, even though I courageously freed some mine from some monster or thieves (can't remember what it was exactly) a while ago.

<comment><USER61> On your village tab, you can assign tasks to villagers (such as mining).

</comment></comment></comment></comment><comment><USER62> The pace is set reasonably well, but after a while it gets too slow and I have to give up. Mad props for good amount of polish, though!

</comment><comment><USER63> How do I get leather...? I have a tannery, I guess I need a tanner, but I don't know how to get one...

"Tanner: 0", "Hunter: 0", etc, have little icons next to them, but clicking does nothing...

I've maxed out my village etc (and am accumulating huge quantities of wood I can't use for anything anymore), but can't seem to advance until I get some leather!

<comment><USER64> The little diamond to the right is actually an up/down arrow; click the up arrow to reassign gatherers to other jobs.

<comment><USER63> ahhhhhhhhhhhhhhhhhhhhhhhhhhh...... ><

thank you... :)

</comment></comment></comment><comment><USER31> Is there anything cool after getting the spaceship? I can't keep playing, but I will if I can get more of a fix....

<comment><USER65> Seriously... I just completed the spaceship sequence and I'm too mad to even react properly (per HN standards). I knew this was gonna happen and it did happen. Shame on me.

<comment><USER66> Agreed. A minute of dodging, ship goes zoom, and then a game reset. It'd be nice to at least see a summary of my resources, or a score, or anything.

<comment><USER67> I guess you could call it an adventure game? Yeah, the ending was a bit unexpected, but then again so was everything else :D I enjoyed it a lot, and it reminded me how with early games the imagination did most of the work.

Though I found the sudden restart pointless, and I think it took away from the ending a little. Unless the point of course was that you crash, and find yourself in a room with a fire that's nearly gone out... [kinda like that book of the guy who rhymes with Peevin' Ping haha]

<comment><USER65> It was a lot of things. "Stabbing-me-in-the-back" was one of them, but "unexpected" it was not.

The first time I saw that "You're not coming back disclaimer", I knew: "Oh boy, they're not gonna throw me a parade when I get in space, nor generate another level... I'm just gonna get back in a dark room and start again. All this for...this!?"

"TVTropes Will Ruin Your Life"

</comment></comment></comment></comment></comment><comment><USER68> I started playing, stoked the fire twice, realized that this single playing game had a "wait until you can click again" mechanic that was purely there to waste my time (I want to play, not wait. This isnt farmville). So I quit. It is probably a great game somewhere. But design like that puts me off.

</comment><comment><USER10> Pretty neat! I found a bug though. I think all my villagers got eaten by a best :( But it keeps saying "3" next to "gatherer", even though there are 0 people, it gathers 0 wood, it says 0/4 population, and the up arrows to increase other resources don't work. Very confusing.

<comment><USER69> Your builder, who never gets eaten, produces +2 wood every 10 seconds.

</comment></comment><comment><USER70> Similar [http://candies.aniwey.net/](http://candies.aniwey.net/)

</comment><comment><USER71> Got all the way to embarking on my iPad. Now I'm stuck! Wish I could transfer my game to my laptop.

<comment><USER72> You can! I did the same thing.

If you turn on the remote web inspector (in Settings it's under Safari > Advanced), and then open Safari on a Mac, you can copy the game's save state (localStorage.gameState) to an instance of the game running on your computer.

<comment><USER71> Shoot, I use chrome on my iPad, arrrrrrr.

</comment></comment></comment><comment><USER73> Is this point and click adventures for people whose first encounter with computer games was farmville?

</comment><comment><USER74> A very nice game!

Another automatic click script, clicking the buttons only when necessary:

var checkAll = setInterval(function() { var bn = ['stoke','gather','traps']; for (var i=0; i<bn.length;i++) $('#'+bn[i]+'Button:not(.disabled)').click(); }, 500);

</comment><comment><USER32> Hmm, it would nice to know what the items from the workshop do. WTB leather.

</comment><comment><USER75> Lol played through 2 full times hoping it wasn't just in repeat haha

</comment><comment><USER76> is this just some js and jquery or there is more behind it? browser db? angular js? I am not familiar with those technologies so I can't be sure I can recognize them, so please just answer...

<comment><USER77> Have you looked at the source?

      <script src="http://ajax.googleapis.com/ajax/libs/jquery/1.10.1/jquery.min.js"></script>
      <script src="lib/jquery.color-2.1.2.min.js"></script>
      <script src="script/Button.js"></script>
      <script src="script/engine.js"></script>
      <script src="script/header.js"></script>
      <script src="script/notifications.js"></script>
      <script src="script/events.js"></script>
      <script src="script/room.js"></script>
      <script src="script/outside.js"></script>
      <script src="script/world.js"></script>
      <script src="script/path.js"></script>
      <script src="script/ship.js"></script>
      <script src="script/space.js"></script>
      <!-- Event modules -->
      <script src="script/events/global.js"></script>
      <script src="script/events/room.js"></script>
      <script src="script/events/outside.js"></script>
      <script src="script/events/encounters.js"></script>
      <script src="script/events/setpieces.js"></script>

With the exception of the two minimized libraries, none of this code is obfuscated in the least. It even has comments in it!

<comment><USER76> Yes, just looking at the html page source is what I did, but then at first sight I couldn't tell if those other .js where part of a known modular js framework or not, since as I said I am not familiar with those.

<comment><USER76> *were :P

</comment></comment></comment></comment><comment><USER78> Wow.. This is poetic.. It didn't feel like a game but a story I was part of. I'm still stroking the fire, gathering wood, and the checking the traps. Just beautiful. Thank you! :)

</comment><comment><USER79> This seems like it could make for a fairly successful mobile game.

</comment><comment><USER11> Is there a way to pause?

<comment><USER80> It save by itself. So you can close the window and walk away if you'd like. Just don't clear your cookies.

<comment><USER11> It saves, but, especially early on, there's a sense that you might get eaten if you walk away from the computer.

</comment></comment></comment><comment><USER81> I played through the whole game but can't figure out what bait was ever used for. My trapped made it but there didn't seem to be any use for it. Anyone know?

<comment><USER82> Baited traps are "better." I think they attract more animals.

</comment></comment><comment><USER83> Dammit I've been playing this for 2 hours straight...

</comment><comment><USER84> I hate when game makes me wait to click things. That makes me semi-immune to Zynga-type pestilence but makes it hard to find fun thing to play.

</comment><comment><USER85> I started playing on my nexus and now, with over 60 villagers, I'd like to move my game on the pc. Anyway I could export my game state?

<comment><USER86> Copy paste the game state from localstorage.

<comment><USER87> How?

<comment><USER86> If you're in chrome, open up dev tools, then hit resources, find the local storage on the left bar and click on the url. You'll see a gamestate key and the value. Copy the value, that's the entire game state. You can then create that same key on whatever other browser with that value.

<comment><USER88> Pretty sure there is no dev tools on the mobile version of Chrome.

</comment></comment></comment></comment></comment><comment><USER89> Is there any way of saving the game like Candy Box?

<comment><USER67> It autosaves to cookies every now and then (it flashes "saving" in the top right corner when it does)

</comment></comment><comment><USER90> This game is great, I'm really enjoying it.

</comment><comment><USER91> it seems to have a bug...if you close and revisit the page again, all the timers are reset...so you can gather stuff instantly

<comment><USER92> You can always just do this as well.

State.stores.wood = 99999; State.stores["alien alloy"] = 99999; State.stores["laser rifle"] = 1

World.water = 60; Path.outfit["energy cell"] = 80; Path.outfit["cured meat"] = 40; Path.outfit["grenade"] = 10

</comment></comment><comment><USER93> It seems to run on Chrome but not on Firefox. If that is on purpose, it should be clearly stated as such at the beginning.

<comment><USER94> I've been playing it for a week in Firefox, no problems.

</comment></comment><comment><USER95> Wow - can I have my evening and morning back?

</comment><comment><USER96> I'm hooked.

</comment><comment><USER97> Fun but easily hacked if you change the class in DevTools to not be disabled, then click click clickity.

<comment><USER98> Isn't every javascript game easily hacked?

<comment><USER99> It can be made a decent amount more difficult with some simple changes like obfuscating the source and also encapsulating all the object definitions and state in a closure, instead of putting it all in global variables. Of course I think that would violate the minimal spirit of the game and it's really cool to be able to see its source so easily.

</comment></comment></comment><comment><USER100> took me 3 hrs to finish! but a really great game nonetheless. I enjoyed every part of it. kudos!

</comment><comment><USER101> Amazing game! Thanks for sharing.

</comment><comment><USER102> Well...there went six hours.

</comment><comment><USER103> Played, donated. Thanks!

</comment><comment><USER104> just putting this here :) setInterval(function(){$("#trapsButton,#gatherButton").trigger('click')}, 2000);

</comment><comment><USER105> this game has the timers for activities so long, that I worry that it'll start offering me in-app purchases any time soon

</comment><comment> m-r-r Wow. This game is really addictive.

</comment><comment><USER106> Great game. I'm having fun

</comment><comment><USER107> How can I save for real? :S

<comment><USER107> Nevermind, Im opting to see this out until the end.

</comment></comment><comment><USER108> does anyone know what to do with alien alloy?

<comment><USER26> There's a fourth "area" (Room | Village | Path) you can get after you explore a whole bunch. The alien alloy is used there.

</comment></comment><comment><USER109> refreshing page.. get more stuff..

</comment><comment><USER110> Stroke fire takes too long. After waiting for the first one and getting a second wait, I quit. You should make it faster until you have acclimated the user to the slow pace.

<comment><USER111> Alternatively, you should have an attention span not measured in seconds.

<comment><USER110> Thats mean! I was merely saying the opening needs to first 'earn' the right for my attention. I am surprised that you can get down-voted for suggestions.

<comment><USER98> How would you acclimate a player for a "slow" pace without starting slow?

</comment></comment></comment></comment><comment><USER112> Unfortunately, this game seems to be browser-based and requires javascript to work -- so I'm going to pass.

<comment><USER113> I'm starting to feel like no-javascript-guy is some type of HN novelty account. Seriously man, not a single person here cares that you don't use javascript. Move on.

<comment><USER16> I strongly disagree. Gnosis is being ridiculous here in complaining that something interactive needs code, but it's equally ridiculous for non- interactive pages to need javascript. I've seen pages with the entire content in the html, set to invisible, that needed javascript to turn the text black. That is shameful web development. It shouldn't take 10 billion clock cycles to make the page appear. Html, css, javascript, they each have their own jobs, and it's valid to complain when someone does it wrong.

But again, it's only valid to complain about/mock javascript on non- interactive pages like blogs.

<comment><USER113> > But again, it's only valid to complain about/mock javascript on non- > interactive pages like blogs.

Which is a bit part of the point of this, it is an interactive page. Though again I'll disagree further and say it isn't valid at all to simply complain and mock. A reasonable discussion on usage of javascript, or browser-based applications would be worth having. Just saying "not gonna use it" isn't interesting.

<comment><USER16> Again, you're talking about javascript on application pages. I am perfectly fine with javascript on application pages. My only complaint is when there is no fallback on simple _document_ pages.</comment></comment></comment></comment></comment>


What are the best resources for wannabe startup CEOs? - <AUTHOR>

<comment><USER2> I found sama's class ([http://startupclass.samaltman.com](http://startupclass.samaltman.com)) to be a particularly great collection of knowledge. I remember catching a few almost subtle drops of wisdom that I'd have underappreciated had I not previously known some info I'd already picked up by studying other educational resources on startups. I'm sure there are more that I did not catch. So if this class is one of the early resources you utilize, then I'd suggest you revisit it again later as well.

</comment><comment><USER3> Mummy and Daddys bank account and network. ;)</comment>


Warn HN: 8 GB iPod touch not upgraded to 3G S components (only 32/64 GB) - <AUTHOR>

In case any of you were planning on buying a new iPod touch today, it looks like the $199 8 GB version does not have the upgraded CPU and GPU from  the iPhone 3G S. Only the 32 GB and 64 GB models have the newer internals. (See http://www.apple.com/ipod/compare-ipod-models/) Sorry if you already knew this. <comment><AUTHOR> Link: <http://www.apple.com/ipod/compare-ipod-models/></comment>


Fiverr:  I Offer 5 Dollar - <AUTHOR> http://web-poet.com/2010/03/08/fiverr/

<comment><USER2> "Please submit the original source. If a blog post reports on something they found on another site, submit the latter."

<http://news.ycombinator.com/item?id=1176903></comment>


My Top 6 Honeytokens - <AUTHOR> https://blogs.sans.org/appsecstreetfighter/

<comment><USER2> Not really security-related, but one related "honeytoken" trick I have done in the past (for wikis, blogs, forum software, etc) is making account activation emails send a fake URL first in the body of the email that is clearly marked not to be clicked by humans as a bot trap.

Then the real activation link is down below that, clearly marked as well.

The majority of spambots and exploit worms, etc, just have a simple regex for parsing out the first "right-looking" link in the activation email to get their account activated.

On one forum I dealt with, this caught 100% of the hundreds of spambots hitting the forum each month.

Kind of interesting that bots can have some of the best captcha-guessing algorithms, but change up a little of the expected flow from the most common and you can quickly notice which visitors are bots or otherwise.

<comment><USER3> This works for five minutes until the bot-operator realizes the auto- activation isn't working, and writes 2 lines of code to fix the problem. Now you annoy legitimate users, but don't stop bots. That's good for your competition, but probably not so good for you.

<comment><USER2> Well, it's not what I recommend for major sites or businesses at all, but I can only tell you that this has worked fabulously on forums that get 1 million+ views a month and has been working for more than two years. I didn't expect it to be so effective, either.

As rantfoil said, if you're Yahoo or GMail or some other major site, they'll fix their bot right away. Yet if you're at all below their radar, this is the sort of easy trick that can buy you some time for spam control replanning. This works great for web software that is constantly attacked by generic script kiddie bots. It's a good bit easier than switching entirely to a different system for blogs, forums, wiki, or CMS when your captcha is broken.

</comment></comment></comment><comment><USER2> Is the goal to encourage casual developers to try to hack/probe around your site? Or is the goal to fool/deter legitimate hackers?

I think the former is more likely to happen with the tactics mentioned, and the people who want in are going to just be slowed down a tad trying that path before going another route.

I know a lot of curious people who would try to "probe" around those sorts of fake entrances just because they saw them and not because they really cared anything about attacking the site.

</comment><comment><USER3> Adding unnecessary code in critical-to-security sections of your application, like this article suggests, is not a good way to make it secure. All code is going to have bugs, and the more code you have, the more bugs you are going to have. You don't want those bugs in your session or authentication-handling code, but this article suggests you add more code there... mostly "for fun".

None of these suggestions will help you solve actual security problems that your users will face, like stolen session cookies. Implementing these suggestions might be fun, but it will probably make your app _less_ secure.

</comment><comment><USER4> > 4\. Add "spider loops" ... be nice, and add "NOFOLLOW" tags to not annoy > legit search engines too much.

Honeypots are always dangerous because they can end up ensnaring good visitors & bots with the bad. Yahoo, MSN, and ASK all follow links even if the rel="nofollow" attribute is set. One should at least disallow these loops in the sites's robots.txt file.

[http://en.wikipedia.org/wiki/Nofollow#Interpretation_by_the_...](http://en.wikipedia.org/wiki/Nofollow#Interpretation_by_the_individual_search_engines)

</comment><comment><USER5> If you don't set up sessions for users working with wget, curl, etc., you'll also lock out a lot of legitimate users who want a scriptable interface to your site. This goes double if you don't offer any sort of official API.

Refusing to initialize a session for non-browser UAs just invites abuse via agent masking by malicious users, while locking out innocuous and acceptable uses by your real users.

</comment><comment><USER6> One word of caution about #5 (adding hidden form fields): to the casual developer, this sounds like fabulous advice and, since it's so easy to add to a site, it's often one of the first things added. However, the "gotcha" here is that any form-filling add-on will fill those forms out. Now you are banning/blocking experienced users - not a good thing.

<comment><USER7> As far as I know most auto form-fillers fill the form based on values in the ID and Name attributes. I.E. The field named 'email' gets an email address.

In my experience if your honeypot field has a nonsensical name or is named something like 'do_not_fill_field' then problems are unlikely to be encountered.</comment></comment>