An Early Look At IE9 for Developers - <AUTHOR> http://blogs.msdn.com/ie/archive/2009/11/18/an-early-look-at-ie9-for-developers.aspx <comment><USER2> I like the effect of competition on Microsoft.

<comment><USER3> I'd like it much more if it made them irrelevant, or preferably bankrupt.

<comment><USER3> Yes, saying bad things about Microsoft is frowned upon.

OOXML & bribes, anyone? SCO? Patent threats? Netscape? Holding back the web for 10 years? Countless other acts of evil bullshit?

I guess this is the same kind of denial that makes HN throw a hissy-fit at trying to bring up the very real problem that is Islam (in Europe).

See no evil, hear no evil.. What a wonderful community of very intelligent people we have here, heads firmly lodged in their asses. Let's never talk about anything that really matters in the world.

<comment><USER4> Saying "lololol M$ i hope they die" is frowned upon. Post something with content, support your whining, talk about it.

Microsoft have opened their internal development to the world over the past few years - this blog entry is an example - from all kinds of development teams, we have enormous amounts of insight into many of Microsoft's major products and access to give feedback to people who care.

Don't just focus on the 'evil bullshit' (much of which is probably not 'evil', just the inertia of a huge company).

You can't just drop "Islam is a very real problem" into the middle of a rant about a software company and expect people to think you're not a nutter.

<comment><USER3> _Post something with content, support your whining, talk about it._

Content? I did mention a few examples, didn't I? Well then, would you care to tell me why they're all invalid? I've done this kind of thing before, and every time someone disparages MS here, he's treading on thin ice. There will always be MS-apologists around.

 _Microsoft have opened their internal development to the world over the past few years_

They sure have made a show of being more "open" to please/distract programmers, that's all.

 _You can't just drop "Islam is a very real problem" into the middle of a rant about a software company and expect people to think you're not a nutter._

I realize this is something that people don't want to hear, and can't process without adjusting their conceptions of things, but that doesn't make it any less true.

Want some content? Here's a video of angry muslims in London: <http://www.youtube.com/watch?v=qoMeUcC_M20>. One of the signs they're proudly displaying says "Europe, you will pay. Your annihilation is on its way!!!".

Does that sound a tad threatening to you? That protest is probably related to events in 2004, when they actually killed a Dutch film director, Theo Van Gogh, for releasing this: <http://www.youtube.com/watch?v=1tvH_uowO-0> .. Yes, they _killed_ a man _for making a short movie_.

The average muslim you meet will most likely tell you that Islam is a "religion of peace", but what they don't mention is that if you say otherwise, they'll kill you. If it's such a mellow religion, why is there a protest full of its followers waving signs saying that they'll destroy Europe then?

Western people believe the line about a religion of peace because they want to, because we should all just get along and coexist in peace and harmony. That's just the humane way of life that we as Westerners are wired to like and want, but that's not what muslims have in mind.

\----

Update:

Quick! Someone call PG and get him to delete this thread so no one else will see what I'm saying here!

<comment><USER4> _Content? I did mention a few examples, didn't I? Well then, would you care to tell me why they're all invalid?_

They are invalid in a discussion about IE9 developments because they aren't about IE9. They are valid in a discussion about web development in general... except they are arguing _against_ your citing 'netscape' and 'holding back web development' because this blog is about MS not holding back web development and not destroying a competing browser. In other words, Microsoft has moved on from those (e.g. this page) so those aren't good support for your complaints anymore.

People in this page are saying bad things about Microsoft, about their javascript interpreter speed, their lack of canvas support and rounded corners and font handling and they aren't being voted down. Any guesses why?

I am an MS apologist. I have worked with their stuff for the last six years and find it (mostly) better than I previously thought, and not deserving of quite as much of the mudslinging as actually happens online.

 _Islam_

Don't know anything much about Islam and couldn't give two whoots. Particularly don't want to discuss religion or country/world politics on HN, even more so in a thread about an IT topic. By the way, I also don't want to discuss dishwasher detergent, pie recipes, good books on optical illusions or how to build a canoe.

<comment><USER3> _They are invalid in a discussion about IE9 developments because they aren't about IE9._

Well then, why did you insist that I should "support my whining"? I'm pretty sure my "whining" was just as not related to IE9 as it is now.

Besides, if you squint and look _really_ hard, you'll notice my goal here was not really to discuss the finer points of IE 9. You've obviously got a problem with that, but how much would you surmise I care?

 _They are valid in a discussion about web development in general... except they are arguing against your citing 'netscape' and 'holding back web development' because this blog is about MS not holding back web development and not destroying a competing browser._

I take it that MS discussing IE 9 on a blog means that they actually never did any of the things I listed?

 _People in this page are saying bad things about Microsoft, about their javascript interpreter speed, their lack of canvas support and rounded corners and font handling and they aren't being voted down. Any guesses why?_

Wouldn't this be related to "holding back web development"?

 _I am an MS apologist. I have worked with their stuff for the last six years and find it (mostly) better than I previously thought, and not deserving of quite as much of the mudslinging as actually happens online._

Glad you came clean. Even I realize that they've been working hard to improve the .NET platform. They have to, because their grip on the world is dependent on _developers, developers, developers_.. Did you see what they did to improve IE while they weren't worried? Oh that's right! - _Nothing_.

 _Don't know anything much about Islam and couldn't give two whoots._

See, now that's the exact same problem I'm trying to solve. You should know that there are people following a 1300-year-old sacred manual on how to behave that says "kill everyone who's not a muslim", and it's happening in _2000-fucking-9_.

You don't see Christians going on Crusades anymore, but you do see enraged muslims shouting that they'll destroy Europe. And Europe's collective reaction? -To apologize, look away, and hope that they calm down.

<comment><USER4> _You've obviously got a problem with that, but how much would you surmise I care?_

I guess I'll say the same about your terrorist scaremongering and call it a day then. Nice talking with you.

<comment><USER3> I'm sure you had good counter-arguments for everything I said too.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> Maybe I'm just an optimist but I'm really glad to see that MS is even looking at the Acid3 and SunSpider tests as important metrics.

<comment><USER6> Me too. Not that they have much choice. Even the non-geeks in my office have noticed that they can work faster with Firefox.

As more things move to the web, built on web standards, they can't afford to continue having the worst browser by far.

<comment><USER7> To be far. IE8 is vastly better then IE7 and IE6 but Microsoft is not aggressive about getting it's users to upgrade. Whereas Firefox, Safari and especially Chrome are.

</comment></comment></comment><comment><USER8> Honest question: what does Microsoft stand to gain by doing all this work instead of just using WebKit?

<comment><USER9> Is it still conspiracy theory to suggest that they are the ones with the most to lose from a universally reliable JS and HTML implementation, so they should want to do enough to keep IE competitive, but not enough to make it fully compatible with everyone else?

<comment><USER10> Microsoft walks a fine line between having a browser that's broken enough so that web apps written and tested for it break on other browsers and a browser functional enough not to drive users to move to better products.

</comment></comment></comment><comment> old-gregg Regarding hardware-accelerated drawing of text:

I thought that IE just like any other Windows program is using Windows core APIs like GDI+ to display text. And those APIs, in turn, are hardware- accelerated as much as possible. These days the entire desktop is essentially a "game" running on top of DirectX, no?

Even back in 1995 most of GDI 2D functions were hardware-accelerated, assuming you had a good card with good drivers.

What am I missing? (I haven't done any Windows work in 5 years).

<comment><USER11> The part of the post about the font rendering is BS anyway. The picture is supposed to show "sub-pixel positioning" and it only shows antialiasing (not even sub-pixel antialiasing) which as you've pointed out isn't handled by a browser anyway.

"Sub-pixel positioning" on the other hand would indeed need to be handled inside of the browser, so that the engine knows how much space something takes up so it can position the next item- But the picture accompanying the post is wrong/irrelevant.

<comment><USER12> Not sure I agree - most fonts are cached (as pixels) at a few offsets, so the ability to place a character is constrained by 1-pixel increments (or 1/3-pixel increments in the case of ClearType).

A true vector placement of each character gives you the ability to show type at any subpixel offset and then anti-alias, and I think there's a good chance they're doing this.

See this Loop/Blinn paper for more details: [http://research.microsoft.com/en- us/um/people/cloop/loopblin...](http://research.microsoft.com/en- us/um/people/cloop/loopblinn05.pdf)

</comment></comment></comment><comment><AUTHOR> The most positive thing that came out of that keynote was that they focused on talking about achieving feature and performance parity with competing browsers, not adding useless features like Accelerators and Web Slices.

</comment><comment><USER13> Here is what I want them to do: Release an IE shell that wraps WebKit. Leave all the Trident DLL's there since they're heavily baked in for help file viewers and other OS bits and parts.

No one (except for us nerds) care what rendering engine they use as long as things look ok and work. What people do care about is the UI the use to get to content. So the IE can go balls to the wall crazy with whatever UI they think users will enjoy, but just leave the heavy lifting to a way more capable machine (this is essentially what Google did with Chrome).

<comment><USER14> Problem is, a lot of custom software depends on ActiveX controls and other plugins that work in IE but not anywhere else.

Until WebKit or Gecko start wrapping activex (not likely and doesn't seem like something they should be spending time on anyway), IE will continue to have significant usage - at least within companies.

Also, there's the pride issue of dropping their own rendering engine for one sponsored by Apple.

<comment><USER13> Right, thats why I'm saying leave all the IE rendering engine bits and pieces, but the IE UI itself is built on webkit. Didn't they lift some BSD networking code for NT back in the day? So clearly they have no problem with doing it :-) (indeed its encouraged by the license). And developers the world over would celebrate!

</comment></comment></comment><comment><USER15> Canvas or GTFO.

</comment><comment><USER11> > "perceiving the differences may be difficult on real-world sites"

Geee, I wonder why?

Could it be because noone can use javascript properly on real world sites because IE6, IE7, IE8 have effing 1/100th the javascript performance as any other major browser????

<comment><USER16> Eh, I don't buy that. I've got a client site that does fade-in/fade-out effects on multiple simultaneous elements, ajaxyness, and horizontally scrolled lists of images. It also uses jquery-like css selectors to target elements, and it intelligently re-renders (in realtime) selected page elements when the page is resized.

I can do all of that in IE 6, 7, or 8, without maxing out a CPU core.

What I _can't_ do, and really would like to do, is offload more of the page rendering to Javascript, and the only reason I can't do that is because of the various noscript users out there.

</comment></comment><comment><USER17> This is nice - I don't think I've seen Microsoft look at themselves this candidly before.

Next thing you know we'll have commercials saying "IE9? That was my idea!"

<comment><USER18> It'll be people dressed up in Firefox, Safari, and Chrome costumes. "One day, I had the idea that browsers should follow web standards. And guess what? 10 years later Microsoft started following them! I'm an open source web rendering engine, and IE 9 was my idea."

</comment></comment><comment><USER19> Microsoft can replace IE8, but can they replace IE6?

<comment><USER20> Nope. See also: [http://blogs.msdn.com/ie/archive/2009/08/10/engineering- pov-...](http://blogs.msdn.com/ie/archive/2009/08/10/engineering-pov-ie6.aspx)

</comment></comment><comment><USER21> I see a (brief) mention of HTML5 compliance; I'm not sure if it's significant that Chrome beta fails many of the tests at <http://samples.msdn.microsoft.com/ietestcenter/html5.htm>

</comment><comment><USER22> Rather condescending from Dean Hachamovitch I think. I blogged more about it here: [http://thedailyt.com/2009/11/one-more-internet-explorer- to-w...](http://thedailyt.com/2009/11/one-more-internet-explorer-to-worry- about/)

</comment><comment><USER23> Border radius!

<comment><USER6> Sweet Moses yes. Rounded corners should be a setting, not a project.

</comment></comment><comment><USER24> The thing that shocked me the most was reading that Direct2D which can be used in place of GDI+. IMO, Microsoft should have made available a hardware- accelerated 2D library a LONG time ago ... before this, you had to use Direct3D to attain hardware acceleration, which was always far too much of a hassle just to render some 2D graphics.

</comment><comment><USER25> 32/100 is a little underwhelming. If it's a focus on standards then it's still dreadful. Am I missing something?

</comment><comment><USER11> :(

still no canvas or svg... jerks.

<comment><USER26> No mention on if they actually, truly, _really_ support transparent PNGs this time around, either.

(If you think they fixed that in IE7, try setting opacity on a transparent PNG....)

<comment><USER27> that's a bug in their implementation of opacity, not of png. they don't support existing alpha in their opacity calculations.

<comment><USER26> Whoops, you're right. I hadn't really read in-depth when I ran into this several months ago, and I was rather peeved at the time regardless.

It doesn't really matter though - the point is, they still have a long way to go before they can earn back the trust they've squandered amongst the web development community.

</comment></comment></comment></comment><comment><USER28> This is good. The end-users/web devs will benefit. We have more options, more competition and hopefully better browsers because of the competition.

</comment><comment><USER29> Summary: still a long way to go.

No announcement yet on @font-face, canvas, video. Basic performance improvements.

<comment><USER30> The @font-face spec doesn't mention a font standard, and Microsoft have already said they won't implement TTF or OTF because the font foundries don't like it.

It's possible that IE will implement the upcoming WOFF (Web Open Font Format) standard in IE9 but I wouldn't rely on it.

<comment><USER29> Sigh.

Thanks a bunch for the info.

</comment></comment></comment><comment><USER31> I wonder when or even if the attitude seen in the comments will spread out to the rest of the computer community. (IE is the devil)</comment>


Kubernetes 1.7 with Tim Hockin [audio] - <AUTHOR> https://www.gcppodcast.com/post/episode-88-kubernetes-1-7-with-tim-hockin/ <comment><USER2> I have nothing to add here but a positive ad-hominem: I went to high school with Tim and he's a super nice, super smart guy. When we were in HS I didn't even know he was such a cool nerd. I only discovered this when I was getting deep into Linux (late 90s/early 2000s), and found out he was the author of an important kernel patch that I needed. Go Tim!

<comment><USER3> Tim is one of the people in the Kubernetes community that makes it an enjoyable place to work.

Building an open source community is hard and building an open source community for a platform that has a ton of orthogonal interests is even harder. But, Tim, along with many of the other leaders, do a solid job of ensuring that the project does its best to listen to all of the various users and stakeholders and then ultimately takes an opinion and heads in a direction that tries to navigate immediate needs without egregious long-term compromise. It is hard work and no one can expect a 100% success rate, but Tim has done a great job and has been pretty close.

In any case, thanks for your dedication to the project Tim.

</comment></comment><comment><USER4> What have people been experiencing with K8s 1.7? For me it's been nothing but RBAC issues everywhere (Granted, I'm upgrading from 1.5 so it's kinda my own damn fault).

<comment><USER5> We took the RBAC "hit" in 1.6. This mostly involved grokking the Role/RoleBinding and ClusterRole/ClusterRoleBinding details first. After that it was primarily a matter of updating a slew of Helm charts. Ones that we maintain for ourselves, and several community charts that had yet to be updated.

<comment><USER4> I think I understand cluster roles and bindings, my biggest thing is that I was using a bunch of off-the-shelf helm charts (for spinnaker, k8s dashboard, and deis workflow especially) and all three stopped working with RBAC. Those have been an...adventure to fix.

</comment></comment></comment><comment><USER6> I'm coming from traditional VM's and want to play around with Kubernetes. What are the best guides/articles to get started with Kubernetes?

I've heard to start with [https://github.com/kubernetes/minikube](https://github.com/kubernetes/minikube) locally, but looking for a solid article to get familiar with all the concepts and best practices.

<comment><USER7> Minikube is a good place to start and the kubernetes.io guide is pretty good: [https://kubernetes.io/docs/tutorials/stateless- application/h...](https://kubernetes.io/docs/tutorials/stateless- application/hello-minikube/)

If you like video, try out this new (free) EdX course: [https://www.edx.org/course/introduction-kubernetes- linuxfoun...](https://www.edx.org/course/introduction-kubernetes- linuxfoundationx-lfs158x)

(Disclosure: I run CNCF and we developed that course.)

</comment></comment><comment><USER8> I completely forgot about this podcast. Thanks for posting this here.</comment>


SSL/TLS and PKI History - <AUTHOR> https://www.feistyduck.com/ssl-tls-and-pki-history/ <comment><USER2> I know this timeline prefers primary sources and tries to avoid blog posts, but Cloudflare's blog post 'Staying on top of TLS attacks' [1] dated July 11, 2013, was a milestone.

It came in the wake of 'Lucky 13' and the demonstration of RC4 biases exploitable in TLS, and showed the awkward situation that existed at the time: essentially all supported ciphersuites were vulnerable to _something_ , and no mainstream browser supported TLSv1.2 yet in which non-vulnerable ciphersuites were present.

Even if a reference isn't made to the blog post, the timeline should somehow reference the aforementioned ciphersuite conundrum.

[1] [https://blog.cloudflare.com/staying-on-top-of-tls- attacks/](https://blog.cloudflare.com/staying-on-top-of-tls-attacks/)

<comment><USER3> I don't think this blog post broke that news: it pretty much follows directly from Lucky 13 and RC4, both of which are documented in the timeline. It would be pretty weird to add a blog post about two other things in the timeline to the timeline itself.

<comment><USER2> I suppose you're right. The timeline avoids editorializing but at the same time tries to inform, and in my opinion it would be valuable to inform that from March 2013 until Chrome shipped TLSv1.2 in August 2013, there was no good cipher to pick that didn't have an exploit.

As it stands now you have to combine different pieces of information, some already included in the timeline (RC4, Lucky 13, Chrome TLSv1.2), some you have to know by knowing what's in TLSv1.1 and what's not (yet) in it.

<comment><USER3> I also don't think it's a great idea to open up the can of worms about whether "no viable TLS ciphersuites" began with Lucky 13 or with RC4 (which depends on whether you think the most recent RC4 paper was the death knell for RC4, or whether the Fluhrer-McGrew biases were).

</comment></comment></comment></comment><comment><USER2> Please add the changes that resulted from Brian Smith's (of Mozilla) blog post 'Proposal to Change the Default TLS Ciphersuites Offered by Browsers' [1] -- the post dates to August 2013.

This was a very impactful proposal that changed the way browsers preferred ciphersuites. But it also removed some lesser-used ciphersuites based off of telemetry [2], including the block cipher Camellia, which was the only other modern block cipher in TLS after AES.

[1] [https://briansmith.org/browser- ciphersuites-01](https://briansmith.org/browser-ciphersuites-01)

[2] [https://bugzilla.mozilla.org/show_bug.cgi?id=1036765](https://bugzilla.mozilla.org/show_bug.cgi?id=1036765)

</comment><comment><USER4> PKI coverage here is quite narrow. Here's Peter Gutmann's PKI tutorial that covers PKI history more widely: [https://www.cs.auckland.ac.nz/~pgut001/pubs/pkitutorial.pdf](https://www.cs.auckland.ac.nz/~pgut001/pubs/pkitutorial.pdf)

</comment><comment><USER5> Note: I can't claim to write anything even close to this timeline about PKI!

Many of these items seem correct to include in "A comprehensive history of the most important events that shaped the SSL/TLS and PKI ecosystem", however it feels very… inconsistent in inclusion.

Dates are given when browser implement protocol support, but not OpenSSL, NSS, etc. (Actually, nothing positive is said about OpenSSL at all.) Also no mention of Nginx, Apache or IIS and their TLS/SPDY support/features?

Brian Smith is mentioned by name working on a Rust crypto library, but no mention of DJB when discussing ChaCha20-Poly1305? (Is Ring actually used by any major projects so far?)

<comment><USER6> I suppose it's a question of balance; I am trying to include all that's relevant while at the same time keeping the list reasonably small. If I add too many items, the main ones will be lost in the noise. (I have an idea of how I could manage this, but including categories and filters in the future.)

Perhaps the inclusion of ring is a tad premature, but that's because I have very high hopes for this project. Brian is the only one taking a long-term view and doing what we're all supposed to be doing -- minimising the amount of C code we depend upon.

</comment></comment><comment><USER7> The history is incorrect in that it was Netscape 3 that introduced SSLv3 (I actually tested it in a VM).

<comment><USER6> You tested Netscape Navigator 2.01 and SSLv3 isn't supported in it? I'll check myself; in the meantime, I removed that sentence from the timeline. Thanks!</comment></comment>


Railsconf 2008 Videos - <AUTHOR> http://www.railsenvy.com/2008/6/2/Railsconf-videos

<comment><USER2> Does anyone know if the guys from confreaks were there? I really like their method of recording conference videos.

<comment><USER3> As one of the Confreaks owners, here's the lowdown: I attended RailsConf, but unfortunately we were not contracted to record it. Hopefully they will record it next year.

<comment><USER2> Ah that's a shame. There's always hoping for next year though. I always check your site first for conference videos after every conference, keep up the good work!</comment></comment></comment>


Are Pop Lyrics Getting More Repetitive? - <AUTHOR> https://pudding.cool/2017/05/song-repetition/ <comment><USER2> Previous discussion: [https://news.ycombinator.com/item?id=18508243](https://news.ycombinator.com/item?id=18508243)</comment>


SoundShader – Yet another sound visualizer with a simple, but interesting idea - <AUTHOR> https://github.com/soundshader/soundshader.github.io <comment><USER2> Only works in Chrome. On Firefox, captureStream() is missing and mozCaptureStream() behaves differently :(

[https://developer.mozilla.org/en- US/docs/Web/API/HTMLMediaEl...](https://developer.mozilla.org/en- US/docs/Web/API/HTMLMediaElement/captureStream)

<comment><USER3> Oops

</comment></comment><comment><USER4> This is really cool looking. Thanks for sharing</comment>


Watch NASA simulate a Mars landing on Earth to test supersonic parachutes - <AUTHOR> http://www.engadget.com/2014/04/11/nasa-mars-parachute-test/ <comment><USER2> I've long wondered if it would make sense to test Mars-bound hardware at high altitude -- Earth atmospheric pressure at 100,000 to 200,000 feet is similar to Mars surface pressure.

To test a parachute you'd probably pretty much need to launch it on a rocket, so maybe it's not worth the trouble. You might be able to drop an airplane designed for Mars from a balloon, however.</comment>


Rediscovering the First Miracle Drug - <AUTHOR> http://www.nytimes.com/2010/10/05/health/05insulin.html?ref=health

<comment><USER2> The story of penicillin is similar, e.g. it required finding a mold strain that would grow throughout a culture, not just on the surface. That came from a rotten melon a scientist noticed on a street grocer's cart, and it took some convincing by the former for the latter to sell him the "bad" fruit.</comment>


Delegated Types in Rails, handling models with overlapping attributes - <AUTHOR> https://www.blackboxengineering.work/delegated-types-in-rails-handling-models-with-overlapping-attributes <comment><USER2> Whoa, cool feature I hadn't heard about. Good to know!

Another approach to this problem I've used in the past is Postgres views, which basically let you create a third table that's either materialized (constructed in advance) or generated on the fly and has columns based on transforms of the first two tables. So in this case you could create a Post model backed by a view table that pulls in the names and other metadata it needs from the text and video tables and merges them into columns that function as a third table in the eyes of the Post model. But there's no actual duplication / denormalization happening, which keeps things clean..

<comment><USER3> That is an interesting approach. Our of curiosity, how is an engineer made aware of the psql view? For example, the view likely relies on specific columns in specific models. What guard rails are available for preventing this kind of breaking change with the view approach?

<comment><USER2> specs--it's basically the same question as with changing the structure of any db table. How do you know some code doesn't rely on it?

We also use/love this gem [https://github.com/scenic- views/scenic](https://github.com/scenic-views/scenic) to version our views</comment></comment></comment>


Stanford Facebook Class Produces Impressive Results - <AUTHOR> http://www.allfacebook.com/2007/12/stanford-facebook-class-produces-impressive-results/

<comment><USER2> _"If you could teach a class on building "Web 2.0 sites" and produce the same type of results, you could charge any price for the class."_

Facebook is not the internet. And these apps are not businesses.

<comment><USER3> You mean "sending hotness" is not a sustainable business model? :)</comment></comment>


scrypt Password-Based Key Derivation Function Internet Draft - <AUTHOR> http://tools.ietf.org/html/draft-josefsson-scrypt-kdf-00

<comment><USER2> That is an impressively short and simple RFC.</comment>


The best web and mobile fonts of 2012 - <AUTHOR> http://venturebeat.com/2012/12/24/best-mobile-web-fonts/

<comment><USER2> Wow, with the exception of Adobe's Source Code, those fonts are pretty dreadful. I'd say they're worth exactly the price their creators are asking for it.

For lists of good new webfonts, try MyFonts' monthly 'Rising Stars' newsletter: [http://webfonts.info/webfonts-know-how/november-rising- stars...](http://webfonts.info/webfonts-know-how/november-rising-stars- webfonts)

Also, Typographica makes an superb list every January: [http://typographica.org/features/our-favorite-typefaces- of-2...](http://typographica.org/features/our-favorite-typefaces-of-2011/)

And for some inspiration, you can always check the most popular fonts at TypeKit: <https://typekit.com/lists/favorite-fonts>

<comment><AUTHOR> The Typographica link has a great collection too! One more worthy mention would be Behance - <http://www.behance.net/search?search=font>

</comment></comment><comment><USER3> The 'best' mobile font is the one already on the visitors device so they don't have to wait for another to download...

<comment><AUTHOR> Agree on that point. But wouldn't you find that boring if all the websites and apps had a single font?

<comment><USER4> Not necessarily. It's not uncommon (for myself) to disable styles to make the page load faster, or respond faster on my device.

<comment><AUTHOR> Never thought of that. Should try it myself. Did you still like the UI after disabling styles? Won't that look a bit awkward?

</comment></comment></comment></comment><comment><USER5> I guess that might be some of the best _free_ fonts, but even then I don't really like them. Most people using web fonts would have a Typekit account. I'd take most of the fonts on Typekit over this list.

However, I've found that the WebType service actually has the best text fonts for small sizes. Headlines are nice, but what really matters is your <p> text. Their RE (Readability) series is excellent for small text.

<http://www.webtype.com/catalog/?wssmall=829>

I'm personally using Benton Modern RE and Benton Modern Sans RE for smaller sizes, and Benton Modern Display for <h1> headlines.

</comment><comment><USER6> These are so Latin-1 centric fonts, I doubt they are useful for the rest of the world.

<comment><USER7> Even for European languages most fonts stuck. Text looks mostly fine, but any accented chars have a different font ...

</comment></comment><comment><USER8> I always find these best of lists nice, I never think they are actually the "best of" but I do end up finding one or two gems I add to my box of whatever it's the "best of" of. I guess it's a small thing I just don't like the titling of "best" articles.

<comment><AUTHOR> 'Best of articles' do work always! For the blogger/ editor and the reader. I agree with your point I hate the title convention too, cant blame the editors too what can they possibly change it to?

<comment><USER2> _'Random free fonts we ran into while browsing the web'_

<comment><AUTHOR> That's a good one! I would click on that.

</comment></comment></comment></comment><comment><USER9> Hint: Click the font-name above the pictures to get to the source.

They should make that easier to discover.

<comment><AUTHOR> It did take me a few seconds to figure it out for the first time.</comment></comment>


GCHQ planning UK-wide DNS 'firewall' - <AUTHOR> https://thestack.com/security/2016/09/14/gchq-planning-uk-wide-dns-firewall/ <comment><USER2> For privacy concerned netizens, especially UK based ones, I highly recommend checking out DNSCrypt[0]. It securely tunnels all your DNS requests to an endpoint of your choice.

I've used it for about two years and it's very reliable, even on a laptop. I do recommend using it in conjunction with a caching DNS recursor such as Unbound[1] to save bandwidth.

It also works great on OpenWRT if you have that luxury.

For UK residents, please also consider changing to an ISP that cares about your online rights. I only know this one: [http://aaisp.net.uk](http://aaisp.net.uk)

0: [https://dnscrypt.org](https://dnscrypt.org)

1: [https://unbound.net](https://unbound.net)

<comment> mike-cardwell Not happy with only your ISP and government knowing where you're going online? Install DNSCrypt and add some more third parties to the mix.

[edit] From DNSCrypt's own front page:

Please note that DNSCrypt is not a replacement for a VPN, as it only authenticates DNS traffic, and doesn't prevent "DNS leaks", or third-party DNS resolvers from logging your activity. The TLS protocol, as used in HTTPS and HTTP2, also leaks leaks websites host names in plain text, rendering DNSCrypt useless as a way to hide this information.

<comment><USER2> This is true. It's more of a DNS MITM protection rather than privacy fix. There are other uses of DNS than just HTTP(S) traffic though: but I'm sure these mass surveillance entities sit on massive reverse DNS databases anyway, rendering the effort mostly useless.

</comment></comment></comment><comment><USER3> "We're exploring a flagship project on scaling up DNS filtering: what better way of providing automated defences at scale than by the major private providers effectively blocking their customers from coming into contact with known malware and bad addresses?"

Because this definitely isn't a step towards state censorship, no siree!

<comment><USER4> Step towards? This is state-wide censorship.

But isn't the truth that it is already implemented in UK ISP's DNS offerings anyway, and that this is just extending the filter so you can't bypass it by changing to a different DNS server?

This should be a textbook case on how to achieve censorship. Start by having it "optional", but not an option a user opts into explicitly, just implicitly in a way they don't understand (by "choosing" their ISP).

Then when 99% of people are already covered, roll it out in a compulsory way across everywhere because "This won't affect most people, just a small number of people".

No debate needed.

<comment><USER5> > and that this is just extending the filter so you can't bypass it by > changing to a different DNS server?

No, many people will just use VPNs

Then the government will find a need to ban VPNs for the safety of its citizens.

</comment></comment></comment><comment><USER6> I think it is safe to say that by 2020 the Internet as we know it today will not exists. All we will have is a bunch of walled gardens, under full surveillance from both the government and corporations. And most people will not even notice or care.

<comment><USER7> I think it's safe to say you're exaggerating, and while there will be local pockets of utter confusion (North Korea, some US ISPs) on the whole it will be fine.

That's not to say we don't need to fight for rights, to keep this sort of thing from happening, but that I have confidence that we _can_ and will fight these things successfully.

Australia, as one example, has tried on many occasions to put up very restrictive firewalls and has mostly failed. [https://en.wikipedia.org/wiki/Internet_censorship_in_Austral...](https://en.wikipedia.org/wiki/Internet_censorship_in_Australia)

Stay vigilant, stay informed, and you can control the future.

<comment><USER8> If in 2010 I told you the next presidential candidate for the USA was retweeting 4chan memes, you'd have probably said I was exaggerating. All I'm saying is things are changing quicker than we can imagine.

<comment><USER7> 4chan's track record of getting people elected is pretty terrible. See also: Ron Paul.

<comment><USER8> Probably for the best, really. Ron Paul was more of a Reddit thing, anyway.

</comment></comment></comment></comment></comment><comment><USER9> Weren't GCHQ caught illegally spying on pretty much everyone at a similar level to the NSA?

Trustworthy guys to put in charge of something like this.

<comment><USER10> Sometimes you just need to give in on these little things to get on with your life. For example, my friends complain about spam, but ever since I switched my email to 419.ng, it has been a thing of the past for me. I'm sure letting a malicious government institution fully merge its traffic and monitoring into your traffic will simplify your life too.

–---

419.ng freemail, exceptional service for fr33!

Dear sir or madam the crown prince of Contantanople is having trouble transferring his considerable fortune..

email@example.com

</comment></comment><comment><USER11> _" what better way of providing automated defences at scale than by the major private providers effectively blocking their customers from coming into contact with known malware and bad addresses?"_

By designing a system for distributing filter rulesets to the endpoints. Works fairly well for in-browser malware blocking and adblocking. And if users can retrieve rulesets from configurable sources, it allows them to tune how aggressive their filtering is, and avoids turning every rule into a potential national censorship row.

By comparison, making ISPs do DNS filtering is of middling effectiveness and screams of "just give me all the control and trust me to sort it all out."

</comment><comment><USER12> This means they'll be able to collect statistics information only to be stored onto your household web history list. This is just another attempt at mass data collection.

It's not like it wasn't being done before by intercepting DNS requests but this way its legal.

This also paves the way to ISP 's requiring to conform and building an infrastructure to associate an subscriber id to a given DNS request.

</comment><comment><USER13> "We have always been at war with Eastasia."

</comment><comment><USER14> Tell me again why it's a good idea to put all our TLS keys in the DNS?

<comment> dane-pgp Because we can avoid registering a .co.uk domain, but we can't stop a foreign government forcing a Certificate Authority to issue a certificate for our domain.

If the US government were to force the root zone key holders into issuing a false update for the .is top level domain, for example, that should rightly be treated as an act of war, and be detected before it could be used. Such an expensive attack could only be used once, and would achieve nothing.

Do you have a different threat model in mind?

<comment><USER14> I've answered this totally bogus argument so many times, I'm going to take a different tack this time and put _you_ on the spot.

Tell me: what's the TLD you'd choose for your new site if protection from governments was your goal? We already know: it's not .IO, which is is controlled by GCHQ. Which one is it? Are we all getting .IS names in your bright DNSSEC future?

<comment> dane-pgp I trust the Icelandic government more than the least trustworthy of all the CAs trusted by my browser (plus the least trustworthy of all the governments that have power over any of the CAs trusted by my browser).

Alternatively I could (in theory) set up my own generic TLD, like Apple has done. Here is their DNSSEC practice statement:

[https://www.apple.com/legal/intellectual- property/tld/dps/](https://www.apple.com/legal/intellectual-property/tld/dps/)

It's still not clear why you think that being able to choose your trust path is strictly worse than being at the mercy of all CAs in the world.

<comment><USER14> But if your site is hosted under a .COM, .ORG, .NET, .US, .CO.UK, .ORG.UK, or .IO name, or, for that matter, under a generic TLD _managed by any company domiciled in the US, UK, Canada, or Australia_ , your feeling is: it's just fine that the NSA gets to swap in its own TLS keys for your own whenever it wants.

Do you have another TLD besides .IS you might "trust more than the least trustworthy CA in your browser"? Could you name it?

<comment> dane-pgp If you are relying on the CA system to secure your website, it is equally insecure no matter what TLD your site is under. DNSSEC at least gives you the possibility of moving away from .COM, .ORG, etc to a top-level you trust.

You still haven't said what your threat model is, though. The fact you mentioned "protection from governments" earlier suggests that the threat model you are envisaging is "I am trying to run a website that will be attacked by every country in the world". If that's your threat model, I would be interested to know what technology you suggest to counter that threat.

Alternatively, if your threat model only includes "US, UK, Canada, or Australia" then there are various other TLDs that are more trustworthy than the Turkish or Chinese governments (no disrespect to those countries). For example, the TLDs of .ch, .dk, .li and .lu. Even .de and .fr should be managed in ways that are independent from the 5 Eyes.

<comment><USER14> I can't believe anyone thinks this is the Internet we should be forklifting the DNS out to build. The one where we have to decide which spy agency is going to escrow our TLS keys when we pick a domain name. It's the same day as the announcement of the Snowden pardon appeal drive, and we're saying "fuck it, all of .COM's TLS keys should just go straight to NSA".

No. No no no.

<comment> dane-pgp Why are you so focused on "all of .COM's TLS keys" when, under the current CA system, all TLS keys for all domains go straight to NSA and any government that controls a CA (e.g. Turkey and China, etc.)?

A situation where people can avoid the governments they don't trust is strictly better than this, but you seem to be arguing that it is strictly worse.

<comment><USER14> Because:

(a) They do not (go ahead and try to get a Google Mail cert).

(b) They need not (CA's can be --- and have been --- and will probably within a few weeks be again --- untrusted by browsers)

(c) It is insane --- as in, "definition of insanity" insane --- to double down on a hierarchical PKI controlled by governments as a response to problems with the CA system. It is literally the opposite of the direction we should (and are!) going in.

I note: in no exchange we have ever had about this issue have you ever so much as _rebutted_ my contention that adopting DNSSEC+DANE would escrow .COM TLS keys with the US government. That's unsurprising, because my contention is true. But I'd like to point it out anyways.

<comment> dane-pgp (a) The fact that I can't (or won't) get a fake cert for Google Mail doesn't really prove anything. I am not the NSA. I assume you wouldn't accept the challenge if I asked you to produce a fake (but cryptographically valid) DNSSEC response for mail.google.com.

(b) Waiting a few months after an attack for a CA to be shut down is not as much comfort as being able to choose in advance which ccTLD or gTLD you are under. As I keep saying, with DNSSEC, the malfeasance of a third party trust source has no effect on your security, unlike the existing case with CAs.

(c) Switching from a "chain is as strong as its weakest link" model to one where you can be free from any subset of governments you choose is a strict improvement and very much the right direction to be going in.

In response to your note: you have made many claims on this site, and I have rebutted those made in discussions I have been involved in, but I don't remember you making the "escrow" claim in one of the discussions I was involved in. I do remember seeing it recently, though, and laughing to myself about it, trying to work out what was going through your mind when you made that claim. Eventually I realised that by "escrow" you mean "The US government could force Verisign to issue a fake DNSSEC response for a website under .COM", i.e. a situation which is strictly better than "The US government could force Verisign to issue a fake TLS certificate for any website with any domain name." Presumably you would call that key escrow too.

I hope I have understood you correctly, and that this counts as a rebuttal, but it's 03:30 here so I'll have to leave this interesting discussion for the night. I look forward to hearing what you have to say in this or another thread soon.

<comment><USER14> In a DANE world, every TLS certificate for a site under .COM is validated through the DNS, and the USG, which controls the DNS for .COM, can silently swap in its own identity for that of any of those sites.

They don't get the bits of your private key exponent. They don't need them; the DNSSEC key escrow system is subtle enough to let people think their secret keys matter.

<comment> dane-pgp In a CA world, every TLS certificate for a site under . is validated through trusting the CA, and the USG, which controls various CAs capable of issuing certificates for any site, can silently swap in its own identity for that of any of those sites.

They don't get the bits of your private key exponent. They don't need them; the CA key escrow system is subtle enough to let people think their secret keys matter.

<comment><USER14> And? The CA system is already deployed. DNSSEC is not. Why would we deploy _another_ compromised PKI, one that can't be separated from governments, one that would force most huge sites to abandon their current domains to avoid USG spying, when we could spend a fraction of that energy getting CT deployed?

<comment> dane-pgp I readily accept that we need Certificate Transparency deployed, not least to deter malfeasance in the DNS (which is a more tractable problem as the list of TLDs is relatively small and well known in advance). Hopefully you also accept that DNSSEC (or something very similar to it) is needed to ensure the integrity of DNS responses (and to give us authenticated denial of existence, and so on).

The question then becomes "Is the amount of work to use DANE on top of DNSSEC (and potentially changing the TLD of my domains, depending on my threat model) too great to justify the extra security of being insulated from malfeasance by unrelated third parties (i.e. any of the CAs in the world)?"

I think that reasonable people can disagree about both the amount of work and the amount of extra security, and it is probably a different balance for each domain being considered. I don't think it is reasonable, though, to say that DANE as a technology shouldn't exist and be available to people who would benefit from it.

<comment><USER14> No, I do not accept that something like DNSSEC is needed. I do not think the DNS needs integrity. I think the CA system needs to be repaired, and then we need to stop pretending that the DNS is more important than it actually is. After all, we don't have plans to create "ARPSEC" or "DHCPSEC", either.

Nobody benefits from DANE. DANE takes the existing broken CA system we have now, _retains it_ , because a large fraction of the deployed base of browsers can't actually handle DANE lookup queries, and then adds a new hierarchical PKI that is suborned by governments from the very beginning.

There is no amount of extra work we should spend to deploy DANE or DNSSEC. In fact: the potential deployment of DANE merits some work _to prevent it from happening_.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> Some the UK web blocking initiatives already reach 99% coverage [https://en.wikipedia.org/wiki/Web_blocking_in_the_United_Kin...](https://en.wikipedia.org/wiki/Web_blocking_in_the_United_Kingdom)

</comment><comment><USER16> How would a legitimate plan look like?

I think it's part of the state's mandate to provide security to the citizens, offline and online. Unfortunately I haven't really seen alternative plans that don't give the state more power at the same time.

It doesn't matter the "real" reasons behind this kind of decision, unless people are presented with a sane alternative.

<comment><USER17> "Don't censor" is a valid alternative. Just don't.</comment></comment>


Does anyone have a medical marijuana card in SF? - <AUTHOR>

Hey, I'm going to be in town for the startup school weekend (and a couple of weekdays afterwards), and I'd love to talk to owners of dispensaries about kratom. Does anyone have a friend that works at a dispensary? Or a dispensary they are on friendly terms with? Or a hippie/drug paraphernalia store that sells legal drugs that would benefit from having access to the cheapest kratom in the USA?
I think medical marijuana dispensaries would be a good place to sell kratom, since they already operate at the edge of society and kratom is edgy enough that conventional retailers wouldn't touch it.
And if anyone wants some free kratom while I'm in town, just let me know... Ping me if you want to meet up, even if you don't want some kratom. <comment><USER2> I'm going to put it this way.

I have no problems with drugs legal or illegal.

However, Hacker News is NOT Craigslist. this is not a place for you to sell your product. If you were asking a question on what people thought of selling kratom or a site for selling kratom... or anything that didn't sound like 'drug dealing' legal or illegal.

Seriously, how different is this from those messages I get about buying a little blue pill? would I like free samples of that? no thanks.

I don't think any kind of DIRECT marketing is ok on hacker news. Because it's not news it's advertising.

<comment><AUTHOR> I'm looking for a business connection to help move large volumes of kratom. I figured there is no harm in asking here, though I admit it is unlikely I could make such a connection.

I do have the cheapest wholesale kratom in the USA and I know there must be some people interested; I'm just not sure the best way to reach them.

Anyone interested in the business behind this can have a free sample; I promise you that I am really not trying to get people hooked or hoping to make personal sales directly from this post. I have secured a particularly good source for kratom directly from Indonesia and I am looking to move into more of a wholesale business.

<comment><USER2> well this does make you sound more legit than your original post. which sounded like a meetup for drugs. You didn't ask if anyone was interested in getting into the kratom business.

But I'm skeptical. No offense, I don't much like legal drugs.

<comment><AUTHOR> >You didn't ask if anyone was interested in getting into the kratom business.

I wanted to know if anyone has a connection to or knows much about marijuana dispensaries, thinking that they are a likely wholesale buyer of kratom.

</comment></comment></comment></comment><comment><USER2> anyone else feel like this is drug dealing?

<http://en.wikipedia.org/wiki/Kratom>

<comment><USER3> Yes, but I don't really have a problem with drug dealing as long as the dealer isn't doing any of the many shady to downright evil things drug dealers tend to do.

I do feel like this is spam though, and this is not the first time he's spammed news.yc about this product.

<comment><AUTHOR> It's been close to six months since the most recent thread about kratom on this site. That was the second thread I ever submitted about kratom, and I submitted it in response to a "coding while high" post. It turned into an obnoxious flame war, I would rather that doesn't happen here.

As long as the discourse can stay reasonable, I don't understand why this thread would be treated differently than any other threads about someone's business. That's why this site exists. We're allowed to promote ourselves and I suspect that some people on this site may have the type of connection that I am looking to make here.

If you are not personally interested in this thread, I am sorry that I wasted some of your time.

</comment></comment></comment><comment><USER4> i think promoting something on the 'drugs & chemicals of concern' by the DOJ alongside med-pot might be a bit of a hard sell to almost everyone

<comment><AUTHOR> Kratom does make this list, alongside mostly illegal drugs. <http://www.deadiversion.usdoj.gov/drugs_concern/index.html> This list only matters in that people can cite it when talking about kratom; it has no power of its own. The DEA is doing absolutely nothing about kratom right now, though they could start lobbying if they wanted. The catalyst that is making salvia illegal is a kid that killed himself after smoking salvia. I am confident we will not see a similar catalyst for kratom.

Kratom is legal. The feds can't bust you for selling kratom in the way they can for selling medical marijuana. The FDA currently has jurisdiction over kratom and they would need to argue that it was medication being illegally prescribed, or that it was an unregistered nutritional supplement, or a food that wasn't a certified food.

I think a more likely problem is that medical marijuana dispensaries are doing just fine with their revenue streams and don't want to try anything new.</comment></comment>


FTL: Advanced Edition - <AUTHOR> http://www.ftlgame.com/?p=598 <comment><USER3> This is one of the most perfectly balanced games I've ever played. I've come one shot from beating the end boss, but that final kill still evades me.

The great part about the game is that the beginning portion is actually quite strategic despite the battles being very easy. You really need to maximize your wins by either getting in as many battles as possible per sector or by killing opposing crews without destroying their ship. Your first 5 or so sectors really set the pace for the later game.

<comment><USER4> The trick to beating the final boss is to have maxed teleport and cloaking. This lets you avoid all missile volleys, by cloaking just before the first few would hit and boarding the missile weapon system to disable it. Also you should murder all but one of the crew during the first battle (this is tricky, but you can take your time), so you can disable systems quickly in the second and third battles without them being repaired.

Cloaking and teleporters are great early investments, too. Cloaking saves tons of resources that would have been spent on repairs, and killing the enemy crew gives better rewards compared to blowing up the ship.

<comment><USER5> Oddly enough, I only ever made it to the final boss twice. The first time was with the stealth cruiser, which had maxed stealth and teleporting, and I got annihilated by missile volleys and those combat boarding drones.

The second time was with the Engi cruiser, and I handily beat him. I had only EMP weapons, a level 2 defense drone, and a level 2 attack drone (probably also a repair drone). I just played damage control and set the EMP weapons to autofire at the shield room. When they eventually disable it, the level 2 attack drone shredded him.

Haven't played since then (figured I'd quit while I was ahead), but this may get me back in.

<comment><USER6> How did you get that far with the stealth cruiser? I love playing the ship but I never survive past sector 3. I have logged hundreds of hours on FTL and never once beaten it with my favorite ships :(

<comment><USER5> The stealth cruiser is definitely hard to work with, and requires very precision timing on the part of the player. It's a tough ship to win fights with if it doesn't have the ability to outright destroy or cripple it's enemy as it comes out of stealth, which is why I had trouble in the final encounter.

First and foremost, it is tempting to get shields working early on, but I actually had better luck upgrading stealth first and then shields - <USER2> encounters can be destroyed before they fire at you if your weapons loadout is good. But be sure to upgrade to full shielding before getting to the end.

Basic idea for me was to charge all my weapons to full, fire if I had an opportunity to before the biggest enemy weapon, and wait for the largest enemy weapon to fire (usually a missile). As it fired, engage stealth. This gives you a really absurdly high dodge chance, and the weapons fire almost always misses.

Immediately drop stealth and fire all weapons. If the ship has a lot of shields, target shields, otherwise target weapons (none or low shields means you will hurt bad if they fire back). Generally this can cripple the enemy ship, making it so they can't effectively engage you - this is pretty vital to keeping the stealth cruiser alive. If it starts to go bad for you, stealth away, and consider leaving the engagement.

For what it's worth, my best loadout consisted of a large missile system for punching through shields to disable the shield system, an EMP bomb system for disabling defensive drones (or other systems), and a fire beam weapon I used to try and hit shields and weapons at the same time, all on an alpha strike after coming out of stealth. I also had a teleportation rig set up with two of the insectoid crew that could take the fight to the enemy - this was _really_ useful at keeping them busy, and keeping the ship alive. Also good for when I ran out of missiles - could send them in to disable shields and / or weapons and get out.

I still got torn up by the drones sent in by the final boss though, so a good drone defense system would have been invaluable - if you stealth, they just hover around until you come out of stealth, then breach. Good luck. :-D

<comment><USER6> I basically did the same thing except my volley out of stealth went for the weapons instead of shields since I wanted to make sure it couldn't hurt me after my cloak wears off. Perhaps I should start running from less than optimal fights, usually I stick out every fight because I want all the scrap.

<comment><USER5> Yeah, targeting weapons is a great idea if the enemy has low enough shields (based on your weapons load) that you can punch through them, disable weapons completely, and then do the same for the shield, while they sit there unable to shoot you, scrambling to repair.

The problem the stealth ship has is when the enemy ship has shields _and_ weapons in abundance (those Zoltan ships are EVIL). In this case, you have to take the harder task (and almost always take damage) and knock out shields first. I loved the long beam weapons because I could drop shields for a moment and burn apart weapons and shields on most ships.

Another important thing I would always do is not fire missiles if shields were down unless weapons were still up - you will need every one of those missiles later.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> I think FTL captures the spirit of "Star Fleet Battles" and "Traveller" ship- boarding combat without the extreme crunchiness that the pen-and-paper RPGs were known for.

However nothing beats the Escape Velocity series. The writing, the "asteroids- like" space combat, the trading missions. It's what I wished EVE Online was.

[https://en.wikipedia.org/wiki/Escape_Velocity_%28video_game%...](https://en.wikipedia.org/wiki/Escape_Velocity_%28video_game%29)

<comment><USER8> I loved EV. Especially EV:Override. So many hours invested. I have long thought an online MMO version would be pretty boss.

<comment><USER9> EVE Online is basically that MMO.

</comment></comment></comment><comment><USER10> I love FTL. I can beat it semi-reliably on Easy with a few of the ships, and occasionally on Normal. And that's part of the game's genius - there are quite a few practical ways you can build your ship and crew in preparation for the final boss, and each of the ships (and even layouts) is tailored towards facilitating a particular strategy. So even if you master one strategy, there are plenty more waiting to destroy you through your inexperience or ineptitude.

</comment><comment><USER11> Brilliant game. Super excited for this.

If you haven't played FTL before, don't heed the complaints about the randomness, it's not as difficult or random as it may at first seem. And frankly failing in this game while you are learning the ropes is half the fun.

<comment><USER11> If you have been playing for a while and are still having difficulty check out DarkTwinge's video tutorial for some good tips: [http://www.twitch.tv/darktwinge/c/2609597](http://www.twitch.tv/darktwinge/c/2609597)

</comment></comment><comment><USER12> Not to whine (because this game is pure liquid gold straight into my brain meat), but the one thing I was hoping for was a new endgame as an alternative to the final boss.

<comment><USER13> Yeah, I saw an article somewhere that pointed out what I believe is the problem with the endgame. In the last sector, the feel of the game changes completely. You've just spent seven sectors fleeing before the might of the unstoppable rebel fleet, and you finally get to the Federation base, and they say "OK, now find the biggest, baddest rebel ship and kill it." This jarring shift, combined with the flagship breaking all the rules (e.g. having drones after you've killed their drone systems) and yet still being trivial to defeat using specific gimmicks, really breaks the endgame for experienced players. Like the author of the aforementioned article that I can't seem to find, I only play the first seven sectors now. The final sector is so unenjoyable that I just quit when I get to the final sector and start a new game so I can go back to having fun.

<comment><USER12> I even tried to fly through the sector in reverse to see if I could do something weird like assaulting the rebel homeworld. Not a thing you can actually do.

<comment><USER14> Honestly, an Ender Wiggin moment would actually have been pretty good here. Instead of fighting any of the rebel ships, your goal is to survive until you can jump past each, and when you get to the flagship, survive until you can fire the Super Secret Win Button weapon.

<comment><USER13> You could always play with the federation cruiser and defeat the boss with only the artillery beam.

</comment></comment></comment></comment></comment><comment><USER15> This is a great rogue-like indie game. I highly recommend it. You should know, my recommendation is essentially a guarantee.

<comment><USER16> Stop calling it roguelike. You're doing a disservice to people who know what a roguelike is, because this game is nothing like Rogue. Also I got bored with it after 3 play throughs, there's just not enough variety.

<comment><USER17> So should we call it a roguelikelike? It exhibits many features of a roguelike game including randomized maps/battles, permadeath, and essentially turn based combat. I think it's fair to say that the roguelike genre has evolved passed just being narrowly Rogue-like.

<comment><USER18> I've heard it referred to as a "Rogue-lite".

</comment></comment></comment></comment><comment><USER19> Friends, consider this a warning. If you are working on something important and/or have a deadline - AVOID this game at all costs.

</comment><comment><USER20> I command-F'd for "music" but I see no hits. I think that the music in FTL is great, especially for coding. Here's a link to the FTL soundtrack and other great stuff by the artist, Ben Prunty: [http://benprunty.bandcamp.com/](http://benprunty.bandcamp.com/)

<comment><USER21> See the video on 0:43

> New music by Ben Prunty

> New content by Tom Jubert

> and guest writer Chris Avellone

<comment><USER22> Awesome. I love me some Space Disco.

</comment></comment></comment><comment><USER23> FTL is great, I loved playing it on my computer, and I still love opening it for a game or two from time to time.

Too bad that they aren't releasing it for Android (for now). I would loved to play it on-the-go, and would easily pay again for it.

Still, it's great to see a free expansion. Thanks FTL Team!

<comment><USER24> I'll be surprised if it works out well for tablet, becaue of power consumption issues. It chews through battery on my laptop.

<comment><USER25> You are probably still playing the original Humble Bundle (or launch) version. Update that. A while ago they added a frame rate limit and power use is reasonable.

</comment></comment></comment><comment><USER26> Too bad the unfair, uncontrollable, unmitigateable randomness turns this otherwise excellent game in a poor joke. There is no planning you can do, since every shop is random and there is nothing you can do if the game just decides to spawn precisely the kind of enemy that can kill you right then and there. All the different combat systems and options are good, but given that you have no idea what weapon drops you'll get, you can't do any planning ahead. Additionally, if you start having to run away from battles you fall behind the curve and there's no going back. You can't just scout the sector to find easy enemies to beat, because you have a very tight limit on how much exploring you can do. Once you fall behind the resource curve and have to run away from more and more encounters you're already dead.

I spent 15 hours with this game, did close to 40 attempts and only once got to sector 7. Usually I'd die around sector 4 or 5.

If you already have the game and like it, good for you. I just want to warn other people. My final opinion is: the devs don't understand statistics and randomness; go play nethack, it's easier.

<comment><USER27> Small hints, since you're struggling:

\- Make sure to man your stations, try to keep these operators alive and in the same place

\- Playstyle depends on the ship type you're using, but you need to have something to penetrate shields soon. Ion weapons might help if you have enough/fire fast enough. Rockets/explosives are easier early on, but later defense drones will be very annoying

\- If you're really having trouble: My wife disturbed me during one game and the battle was boring (enemy couldn't penetrate my shields). I went doing whatever she asked for and returned to a decently trained shields engineer :)

\- Intrigued by the above: If you can do the same in an asteroid field... ;-p

Last but not least: I'm sorry that you didn't enjoy the game. Dieing is part of the genre and difficulty might certainly vary, but that's the fun of it. It's mostly about these "Really? THAT encounter when I'm out of missiles?" or the "Whoa, too much hopping around. I sure could use some fuel" moments, right before you're back to square one. For me beating the game isn't the goal and when I beat it, the game failed. :)

<comment><USER26> I have done all of that, except tried different ships. I only played with the starting ship, on hard difficulty, because I wanted to finish the main game before trying the extra modes.

Yes, I have maxed out dodge and shields. I have actually grinded enemies until I had every crew member maxed out on every possible stat. It doesn't help one bit, because you can still get hit 10 or even 20 times in a row, even though you have a 20% evade chance, and 20 hits from anything is pretty much enough to sink you.

It is honestly the most frustrating game I have ever played.

Also, I'm not struggling, I just gave up on it for good. I haven't played it in a year, if not more.

I bought into the hype and bought the game and it turned out to be ... that. I just want to give my perspective so other people don't get it and then feel misled.

<comment><USER28> > I have done all of that, except tried different ships. I only played with > the starting ship, on hard difficulty, because I wanted to finish the main > game before trying the extra modes.

You are playing on hard mode without any experience in handling game strategies and events, this is why you are losing. Try it on the easy mode and get a feel for some different strategies and ships. This game is not difficult, with some experience you can beat most runs in the game with any ship on the hard difficult.

</comment></comment></comment></comment><comment><USER29> I didn't know they had Chris Avellone (main writer on Planescape Torment) on board.

<comment><USER30> Chris appears to be working on everything at present. Planescape, Wasteland, this small FTL gig, plus no doubt Fallout 4 in some capacity. Either indie game writing pays too little or Chris does not know how to say no.

</comment></comment><comment><USER31> And the best part : it's a free expansion !

<comment><USER32> It wasn't mentioned in the page, but I'm assuming the iPad version will need to be re-purchased even if I've already purchased for the PC?

<comment><USER33> I think so too. The App store has only limited functionality to give out licences outside the normal purchasing process (100 free keys, if this information is still correct.)

This is a constant problem for all Kickstarters which produces iOS apps.

(But seeing how I got the original game for 5$ and how much time I've spend with it, I am willing to pay again for it.)

</comment></comment></comment><comment><USER34> One of the very first things I thought when I played this, right when it came out, was "god damn why don't I have this on my iPad?"

I knew in my heart they would come through. Really great game, can't wait to play it again.

</comment><comment><USER35> Is this like Star Command? I like the idea but Star Command was a disappointment. Just the same thing over and over again without any real depth. Unfortunately this looks just as battle focused so I'm skeptical.

<comment><USER36> There's a lot more depth to it than star command and higher replay value

<comment><USER37> IMHO the replay value is way higher than many supposedly-AAA titles. I'm looking at my game time stats from Steam, so I'm not making it up :)

</comment></comment></comment><comment><USER38> Thank god this hasn't come out yet. Easily the most addictive game I've played in years...I've lost whole weekends to it. I don't think my social life can take an upgrade to this game right now

</comment><comment><USER39> +1 for FTL. A challenging game, expect to die a lot at the beginning.

</comment><comment><USER40> I've played this game a thousand times, and I've still never beat it. That's one of the reasons I like some of these games like that.

I remember the first Final Fantasy where, sure, maybe you could sneak your way through to the boss. But he's going to kick your butt.

Same thing with FTL. The journey is only half of the battle. Being prepared after making it through in another game entirely.

</comment><comment><USER41> This is one of the best games ever

</comment><comment><USER42> Advanced edition? This game kicks my ass already!

</comment><comment><USER43> I enjoyed (and highly recommend) FTL, but I don't think that a few new weapons gives me a reason to play it again.

<comment><USER44> New events? New sectors? New systems and subsystems?

New content from Chris Avellone?

<comment><USER43> Based on my reading of the announcement, the content and story are still largely unchanged. I'm sure the content is worthwhile, but since I already know in broad strokes what's going to happen to my crew, I think I'd enjoy spending the time elsewhere.

</comment></comment></comment><comment><USER45> Great news. I'm absolutely abysmal at FTL, but I have fun every time I start it up.

</comment><comment><USER35> So should I play this or the vanilla version?

<comment><USER46> I haven't played the new version yet, but you might consider playing the vanilla version 'til you start to get bored, then upgrading for some new experiences.

</comment></comment><comment><USER47> So eh, what's interesting about this? Did they get funding? Are they using an interesting business model? Are they using a cool new technology? Is there something we can learn from them?

All I see is the announcement of a sequel to a modern popular game, what's going on?

<comment><USER48> "Modern popular game", which so happens to be developed by two guys, who got their funding on kickstarter.

There are lots of interesting things going on, pick one.</comment></comment>


Uber will provide Portland with driver data - <AUTHOR> http://www.wweek.com/portland/article-23752-drive.html

<comment><USER2> _Uber's refusal to share data with governmental authorities is about evading public scrutiny._

Replace 'Uber' with 'Google' and see if that still makes sense.

I support requiring Uber to share exactly as much data as the existing taxi companies share with the city. I don't think they should share more just because they have more data.

</comment><comment><USER3> I'm not surprised Portland would be interested in trip data from Uber. The city recently licensed data from a fitness app company apparently to help better understand cyclist habits [1].

I'm just glad Uber and Portland were able to work something out. Both sides were able to save face and hopefully the city can enact some sane ridesharing regulations. Portland has fantastic public transportation compared to cities of comparable size, but completely disallowing ridesharing companies from operating would have been a big step backward.

[1] [http://www.theverge.com/2014/10/8/6938041/portland- enlists-b...](http://www.theverge.com/2014/10/8/6938041/portland-enlists-big- data-to-make-biking-safer)</comment>


HTML5 Scorecard: Chrome for Android Beta - <AUTHOR> http://www.sencha.com/blog/html5-scorecard-chrome-mobile-beta/

<comment><USER2> "This item cannot be installed in your device's country."

Whoever did that - I'd deny them access to any cafe or restaurant not located on their home street, because you know, it's not on their home street!

APK download links from the XDA forum (I've installed from the first one): <http://dl.dropbox.com/u/22987550/com.android.chrome-1.apk> [https://dl.dropbox.com/0/view/h01lx63elymar7i/com.android.ch...](https://dl.dropbox.com/0/view/h01lx63elymar7i/com.android.chrome-1.apk.zip)

<comment><USER3> Very strange that they did that. Any one care to guess why they only allowed it in some countries? Is it just because the developers forgot to check all the country boxes?

</comment></comment><comment><USER4> Doesn't look it supports server sent events, a pity as they're much nicer to deal with than websockets (which it does support unlike the native browser). Still going to be a long time until we can depend on these technologies for android as uptake on chrome is going to be slow.

</comment><comment><USER5> "Happily, the very new -webkit-overflow-scrolling: touch property, which debuted in iOS 5, is also now available in Chrome for Android. It's smooth and fast. (Nice job Chrome team!)"

vendor prefix glorification :`(

<comment><USER6> Many good things in CSS3 started out as a vendor prefix. Don't be silly.</comment></comment>


A new storage engine for MySQL: PostgreSQL - <AUTHOR> http://www.pinaraf.info/2013/03/my-post-engine-a-postgres-engine-for-mysql/ Code here: https://gitorious.org/my-post-engine/my-post-engine/trees/master<p>Seems a way off production. Still, as someone who loves Postgres, and shudders at the memory of MySQL, it makes me smile. <comment><AUTHOR> Code here: [https://gitorious.org/my-post-engine/my-post- engine/trees/ma...](https://gitorious.org/my-post-engine/my-post- engine/trees/master)

Seems a way off production. Still, as someone who loves Postgres, and shudders at the memory of MySQL, it makes me smile. :)

</comment><comment><USER2> Finally, a decent storage engine for MySQL.</comment>


NASA's Mars 2020 mission scheduled for 30 July 2020 - <AUTHOR> https://mars.nasa.gov/mars2020/ <comment><AUTHOR> NASA is scheduled to launch a mission to Mars at the end of this month. It will carry the Perseverance rover to the red planet, where it will search for signs of extraterrestrial life. The launch is currently scheduled for 7:50 AM EDT, but the launch window extends to 15 August.</comment>


Show HN: A decent cms for .Net (in development) - <AUTHOR> https://github.com/piranhacms/piranha.vnext/wiki

<comment><USER2> I have never tried this but had my fair share of Umbraco. How does this CMS compare to Umbraco?</comment>


Ask HN: How much do you earn from Google Adsense? - <AUTHOR>

So, I'm setting up Google adsense and planning on implementing it on a few websites in order to improve on reoccuring monthly income.<p>How much do you guys typically earn from websites with Adsense?  What's the most you've ever got? <comment><USER2> Trend:

People who claiming $10,000+/mo from Adsense for some reason never share traffic stats or even website URLs.

<comment><USER3> There's a good reason for that. If someone's found a profitable niche, there's no incentive for them to reveal information which might attract competitors.

</comment></comment><comment><USER4> $150-400 a month from my blog [0]. The highest I earned was $2100 in a month, when the traffic was much higher (~2 years ago).

[0] [http://blog.sudobits.com](http://blog.sudobits.com)

</comment><comment><USER5> $108 YTD, $29.72 best month this year

Not much weight without proof: [http://imgur.com/YiyEke0](http://imgur.com/YiyEke0)

Most of mine has come from a single post about uses for a Raspberry Pi[1].

I've done a lot wrong when trying to build site traffic (multiple domain/url scheme changes, etc) so I think I would be doing much better if I had focused more in the past.

1\. [http://magnatecha.com/things-i-do-with-my-raspberry- pi/](http://magnatecha.com/things-i-do-with-my-raspberry-pi/)

</comment><comment><USER6> These numbers are from my blog, [http://foodconstrued.com](http://foodconstrued.com)

I have one sidebar ad, and usually one ad at the bottom of each entry.

Last month (September) I had 4873 page views and 25 clicks. This resulted in $8.75.

My best month was back in July. That month 4016 page views and 25 clicks resulted in $9.49

<comment><USER7> That's a low CTR for that amount of PV. Try putting a large ad right under the headline and lose all the share buttons there since you've got them in 3 other places, it should incrase your CTR quite a bit. [http://i.imgur.com/71d9E4U.png](http://i.imgur.com/71d9E4U.png)

<comment><USER6> Thanks! I'll give it a try.

</comment></comment></comment><comment><USER8> The highest I earned was $20000/month. Now making $10000 - $15000 each month. It varies significantly month to month.

<comment><USER9> Awesome! Could you please tell us your site and your monthly traffic? Just for referring! Thanks a lot!

</comment></comment><comment><USER10> Historically, I got a payout once a year of something over $100. This year, I am still way short of hitting a payout.

But I would really like more info on traffic, content, etc from the guys reporting serious dough from this.

</comment><comment><USER11> The only site I have Adsense running on does $50-60 a month. That covers the hosting bill. There were a couple of months that the site was doing between $100-120 but that was only for like 3 or 4 months after the launch.

</comment><comment><USER12> I set it up on a website a long time ago, but my traffic was pathetic.

Made maybe about $0.10 a month?

The website is now long gone by the way, so not making anything currently.

</comment><comment><USER13> Six figures a year, going for seven (long way away) and compete head on with the industry leaders (they do eight figures). Long time bootstrapped/passive.

<comment><AUTHOR> What's your site?

</comment></comment><comment><USER14> I have a site that I started about 6 months ago that gets about 30-50 uniques a day, and Im generating about $15 per month.

</comment><comment><USER15> This month: $57.33 from 8294 page views (228 ad clicks)

Last month: $33.14 from 4338 page views (90 clicks)

</comment><comment><USER16> 15,000$-20,0000$</comment>


Time to Ditch Your PC for a Hot-E? - <AUTHOR> http://bits.blogs.nytimes.com/2008/10/13/time-to-ditch-your-pc-for-a-hot-e/

<comment><AUTHOR> BTW, here's the $99 link. >> <http://www.thinlinx.com/store#store_early></comment>


Microservices with Docker, Flask, and React – Part 5 (Docker Hub, AWS ECS and RDS) - <AUTHOR> http://testdriven.io/part-five-intro <comment><USER2> Good comprehensive description of steps involved in deploying to ECS.

One thing that I did not see was information about the required IAM setup. It might be helpful to identify specific AWS IAM policies that need to be granted to the AWS user for working with ECS.</comment>


Ask HN: SaaS companies, what do you use for user documentation? - <AUTHOR> Do you use an existing solution or have you created your own?<p>How do you like the solutions you have tried? <comment><USER2> It depends on so many factors, such as the company, open source or not, the scale, the range of products, size of the doc team, whether you want developer/API and user documentation. It also depends how you define user!

You could use something like GitHub markdown/GitHub pages. You could use something like Markdown and a custom script like I do for my website (source code in my GitHub). There are solutions like Sphinx (as used by Python) or Jekyll for building a static docs site. You could also use Hugo static site generator etc. etc. - there are many tools out there. These are simple solutions but it ranges up to heavy weight tools like DITA/DocBook (not that I am recommending those in this case).

Also take a look at readthedocs.org.

If you are documenting a SaaS REST API Swagger has become something of a standard.

</comment><comment><USER3> Zendesk has a decent Knowledge base system. Intercom is slick, but expensive if you're trying to be frugal. Discourse is the best forum on the OSS market.

</comment><comment><USER4> I usually just create a FAQ page with questions I would likely ask. For most of my projects, I actually have my sister beta test for me. While she knows how to use a computer, she is not very tech-savvy, so if she questions something, I know I have to redesign it to make it easier.

</comment><comment><USER5> Do you mean for help desk articles about the software? If so, we use Intercom's Educate product and love it.

<comment><AUTHOR> Yup, help desk articles, videos, etc. Anything designed to help users learn and progress through the software and ideally reduce churn.</comment></comment>


Ask HN: Can I visit your SF tech startup? - <AUTHOR>

Hi all
I'm Quentin, the developer of the iOS/Android app TransitTimes. I'm based in Adelaide, Australia and I'll be in San Francisco for the next 6 weeks (May 14 - June 30), for Google I/O and WWDC
I'm travelling alone and would really like to see the startup culture in San Francisco, make some new contacts, swap ideas and advice, and anything else I can soak up while in the US.
If you have a startup or can provide an introduction/referral or any other recommendations I'd really appreciate it!
Thanks
Quentin
Email: qzervaas [at] transittimesapp.com Twitter: @HendX <comment><USER2> You'll be able to meet a ton of people at SFHackerNews.com events. (and other meetups)

try NoiseBridge as well.

Also SFHN is throwing an event on Thursday <http://sfhn-nginx.eventbrite.com/> (edit: just noticed you'll be missing it)

<comment><USER2> There is also this I just ran across: <https://startupstay.com>

</comment></comment><comment><USER3> You should also checkout <http://www.meetup.com/> and try to swing by some meetups that happen around the city. Good way to meet people and see startups</comment>


Seattle to permanently close 20 miles of streets to traffic - <AUTHOR> https://www.cnn.com/travel/article/seattle-streets-closed-stay-healthy-trnd/index.html <comment><USER2> _Only vehicular traffic from delivery drivers, first responders, sanitation crews and residents are allowed access._

So not exactly "closed" – just not suited to through traffic. Lots of neighborhoods do this with speed bumps, 20mph limits, capping roads off, 'Mini Hollands' and other traffic calming measures. All good stuff, but still doesn't quite mean you can let the kids out to play in the street all day, alas.

</comment><comment><USER3> There will be more cars on the road then ever soon. When we start to return to work, most people will avoid mass transit because of COVID19 concerns and start driving again. Only a very tiny percentage of people bike to work. Shutting down streets makes no sense. Seattle city government is a joke.

<comment><USER4> The roads aren't major arteries, they're pedestrian/neighborhood roads. This is to improve safety for the kids that are still out of school while everyone rushes back downtown.

<comment><USER5> If we could just freeze time, then we'd have perfect safety.

</comment></comment></comment><comment><USER6> There seems to be an idea that this will be better for bike commuting. Having done a lot of that, I'm wary. Side streets are already fairly car-free. The catch is that you still have to cross major arteries, and if things aren't set up right, you can end up stopped for a long time waiting for that traffic to clear.</comment>


LOL-At-Once Reiterating - <AUTHOR> http://lolatonce.herokuapp.com

<comment><AUTHOR> The last time I submitted this I got a lot of good feedback and saw some great LOLs created. This time we've made it much easier for people to join each others games by default. We have a bunch of analytics set up as well so it will be interesting to see how the changes will affect our numbers.

Thanks for trying it out!</comment>


Deep Learning Hyperparameter Optimization with Competing Objectives - <AUTHOR> https://devblogs.nvidia.com/parallelforall/sigopt-deep-learning-hyperparameter-optimization/ <comment><AUTHOR> Hi, I'm one of the authors of this post and co-founder of SigOpt (YC W15). I'm happy to answer any questions about the post or SigOpt.

More info on the research behind SigOpt can be found here [1].

[1]: [https://sigopt.com/research](https://sigopt.com/research)

<comment><USER2> Can you provide a tl;dr?

<comment><AUTHOR> Post tl;dr: Sometimes when you are optimizing an ML / AI pipeline you care about multiple things (speed, accuracy, etc). It is often difficult to make these tradeoffs without knowing what is possible, but it is expensive to try different things. Using Bayesian optimization to optimize multiple metrics simultaneously can help solve this problem more than an order of magnitude faster than standard techniques like randomized search. We provide examples tuning TensorFlow and MXnet CNNs with code [1] [2].

SigOpt tl;dr: Parameter optimization-as-a-service. An ensemble of Bayesian optimization techniques behind a simple REST API. Spend more time building your models while we optimally tune them exponentially more efficiently than something like a brute force grid search. Free for academic use [3].

[1]: [https://github.com/sigopt/sigopt- examples/tree/master/multim...](https://github.com/sigopt/sigopt- examples/tree/master/multimetric-timeseries)

[2]: [https://github.com/sigopt/sigopt-examples/tree/master/dnn- tu...](https://github.com/sigopt/sigopt-examples/tree/master/dnn-tuning- nvidia-mxnet)

[3]: [https://sigopt.com/edu](https://sigopt.com/edu)

</comment></comment></comment><comment><USER3> Hello, I'm a coauthor of this post and would be happy to answer any questions.</comment>


Show HN: iskulpt.js – Extending HTML into WordPress components for profit - <AUTHOR> https://www.iskulpt.com <comment><AUTHOR> So I set out to create a theme builder that stays true to the WordPress API and allows you to code and style a theme visually. Why this over all the other 100s if not 1000s of options you might ask? In one word, CONTROL. You can place e.g. a post title, comment count, widget area etc exactly where YOU WANT IT. I found a lot of the builders are great as long as you stick to their templates, the moment you want something slightly different things get hairy very quickly.

At the moment WordPress support is ready for prime time. I built the application in such way that rolling out support for other CMS e.g. Drupla or Joomla will be a fairly straight forward endeavor.

You will find that my pricing is significantly lower than that market average, and the reason for this is simple. My market is theme shops and developers who want to build the themes they envision quickly but add some further customizations and resell to clients.

</comment><comment><USER2> I'm not the target market, but it looks like a lot of work went into this. Just want to say, nice job. I especially like the "layout mode" abstraction.

What's your tech stack look like on the frontend? Any comments on the development process, e.g. how long it took, major challenges?

<comment><AUTHOR> A couple years ago about 2 maybe, I was heavily into Common Lisp and built a similar application for the heck of it. I learnt some pretty important lessons though. No matter how awesome a laungauge is business decisions and the language ecosystem are practicalities you can't get away from. For example, it's already hard enough to find a good developer for a popular langauge, now imagine one for some esoteric one :SMH:

So to your actual question :) Sometime last year I dusted off the original concept and decided to focus on something I think still has room for growth. I redid the entire code base in Javascript. JS in the browser and Node.js at the back. Everything server-side and client-side is written in ES6 so I can use sytantic sugar like ES6 classes. I find the code to look much cleaner this way.

I use Babel to transpile the client-side libraries to ES5 so that the code runs in pretty much all browsers. Setup deployments to AWS ElasticBeanstalk with scaling rules in place to handle traffic spikes etc. Did a fair bit of profiling using Locust ([https://locust.io/](https://locust.io/)) to actually determine the correct parameters I should base my scaling logic on.

For the database I make use of Postgres. Originaly I used MongoDB, seems like a natural fit for JS right? Not really. I can't remember the details, but I had so many technical issues. There was also some issue with transaction sematics etc. Bottom line I got fed up and picked Postgres but made extensive use of the JSON datatype since I built a JSON API.</comment></comment>


Ask HN: is it possible to build large scale systems that are secure? - <AUTHOR>

The huge number of hacks recently seems to be pointing to the possibility that it is not practical to build truly secure systems, especially at any sort of scale.<p>There must be massive opportunities for entrepreneurs who can address parts of this problem. <comment><USER2> I think it is, but I think security has to be architected into the system from the beginning, and you have to be willing to pay the price in flexibility and development time that that introduces. It's not really something solvable by entrepreneurs, other than security consultants (which is a booming but not all that scalable business).

Building secure software means that you have to think carefully _at all levels_ about precisely what inputs may enter your software, and gracefully reject anything that you're not prepared to handle. The flip side is that you can't easily readjust your software when business needs change, because you've built your system to avoid unintended consequences and everything has to be specified out in careful detail.

The reason systems aren't secure isn't because they _can't_ be - some very secure systems were built way back in the 60s (eg. Multics). It's because it's not _economic_ for them to be. Insecurity is a conscious design decision, and for many markets, it's the right choice.

<comment><USER3> So, BDUF?

<comment><USER2> Sorta. You don't need to plan out the whole application in advance. You do need to plan out each component and feature in your application in advance, and follow a very disciplined coding style when implementing it.

</comment></comment></comment><comment><USER4> false. don't hire incompetent coders who don't know what they are doing. Security is easy, don't assume any input is safe, clean and verify before doing anything with it. Be aware of security issues and best practices. Ah yeah, don't let untrusted people access your db.

</comment><comment><USER5> I think a lot of it is short development times and/or lack of code maintenance.</comment>


Ask HN: Indie Android Dev Marketing - <AUTHOR>

I have recently written 3 android games, that are published on the marketplace. Do any of you know of sites that tailor to small apps and games, that I could get in contact with to review my games?
Or do you have any feedback for an indie android developer?
If you yourself are interested you can do a search for my username on the marketplace (dsgraham).
Each game was written completely in less than 48 hours. <comment><USER2> What's the point of asking about this if you are not even mentioning the names of your apps? That would have been Marketing Step 0 ...

<comment><AUTHOR> Fair enough X-Ray - <https://market.android.com/details?id=com.gristmill> aMAZEing - <https://market.android.com/details?id=dsgraham.maze> Chain Reaction - <https://market.android.com/details?id=dsgraham.chainreactor>

<comment><USER3> This list is primarily directed to iOs websites, but when I was going through it for our app I noticed a lot of the sites also had Android review sections. Warning, a few of the links are old.

<http://maniacdev.com/2011/08/ios-app-review-sites/></comment></comment></comment>