The most popular links posted by developers to Stack Overflow - <AUTHOR> http://linkedlists.net/

<comment><USER2> Nice work.

This would take some work (more on the server's part than yours), but I think it would be more accurate if you tested the links for 301 redirects and consolidated the results accordingly. For example, in the ASP.NET tag one of my pages has 112 links to an older URL ([http://encosia.com/2008/05/29/using- jquery-to-directly-call-...](http://encosia.com/2008/05/29/using-jquery-to- directly-call-aspnet-ajax-page-methods/)) that 301 redirects to a newer URL ([http://encosia.com/using-jquery-to-directly-call-aspnet- ajax...](http://encosia.com/using-jquery-to-directly-call-aspnet-ajax-page- methods/)) which has 129 links itself. It would be interesting to see only the latter URL show up in the list with 241 links.

<comment><AUTHOR> Thanks. Re the redirects, yea I have a lot of work to do on my crawler, my current solution is hand rolled and only has limited capabilities. But if anybody knows of a good open source project let me know, i have been looking at using the common crawl but that's not a complete solution either.

</comment></comment><comment><USER3> I'd be interested in seeing what happens when you bucket citations by domain instead of URL. Google Analytics counts over a thousand unique referring SO pages to Cocoa Controls (<http://www.cocoacontrols.com>) this year alone. But, of course, most of the links back to my site are long tail.

<comment><AUTHOR> Great idea, will try and look at that next.

<comment><USER4> Another good reason to do this is for example the android tag. Most of the top results are Android documentation for basic classes like ASyncTask and Activity. If I could filter out google domains I'd be left with interesting links related to Android.

</comment></comment></comment><comment><USER5> The top python link, which should direct to <http://www.crummy.com/software/BeautifulSoup/> instead directs to <http://www.crummy.com/software/beautifulsoup/> \--which causes crummy.com to throw a 404 error at you.

<comment><USER6> You learn something every day. I was sure URLs are not case sensitive until now.

 _While domain names are not case-sensitive, the rest of the URL might be. In our example, this would be everything that follows ".com" as in wisegeek.com/are-urls-case-sensitive.htm._

<comment><USER2> Somewhat related, it took me an embarrassingly long time to realize that browsers treat assets with different URL casing as different assets for purposes of caching. Three image elements that reference Foo.jpg, foo,jpg, and foo.JPG all require a separate request and space in the cache, even if the web server you're using is case-insensitive and all three URLs resolve to the same image.

<comment><USER7> I always add:

        CheckSpelling off

To my dev (but not production) server so that I catch things like that. This won't help with a case insensitive web server though.

</comment></comment></comment></comment><comment><USER8> Looking at the results for C++, it looks like the text santizing you're doing on link titles is losing the "++". All the titles seem to have C instead of C++, e.g. "Boost C Libraries" should be "Boost C++ Libraries". You're also losing the # in C# and the dot in .NET, and probably others.

<comment><AUTHOR> Thanks for the heads up, will modify the parser, again if anybody knows of a good open source crawler let me know. I rolled my own very quickly but would love it if i could find a 3rd party solution. Another option i have explored is pulling in the titles and descriptions provided by search engines but currently only DuckDuckGo offers anything useful and even then its coverage of some of these low ranking programming pages isn't great. Bing offers a pay per use access to its index but the costing structure really doesn't fit with my use case.

</comment></comment><comment><AUTHOR> Thanks for the comments and votes. By the way if anybody is interested this was presented as part of the mining challenge at MSR2013 <http://2013.msrconf.org/challenge.php> and here is the paper [http://thechiselgroup.org/2013/03/27/a-study-of- innovation-d...](http://thechiselgroup.org/2013/03/27/a-study-of-innovation- diffusion-through-link-sharing-on-stack-overflow/)

<comment><USER9> I was just about to ask this question! I read that paper and found it quite interesting.

</comment></comment><comment><USER10> The most popular link for Android answers is AsyncTask. It makes sense, one of the biggest complaint about Android is that it isn't always perfectly smooth and people notice the jerkiness in the UI. I would say a large majority of the time it is because an Android app developer is running slow code on the UI thread instead of doing it correctly.

<comment><AUTHOR> Interesting in c# the second most popular link is for the BackgroundWorker class, not entirely the same use case but i guess similar motivations. [http://msdn.microsoft.com/en- us/library/system.componentmode...](http://msdn.microsoft.com/en- us/library/system.componentmodel.backgroundworker.aspx)

</comment></comment><comment><USER11> The javascript entry doubles as a Table of Contents for the jQuery API. Totally unsurprising

<comment><USER12> looks like the android entry then.

</comment></comment><comment><USER13> Nice! Nitpick: converting entities (such as '—'es) to their actual representation ('—') in the titles would be nice, currently they show up as 'mdash'

<comment><AUTHOR> Thanks, yea we will have to do some work on cleaning up our title and description parser. Will add to the bug list.

<comment><USER13> Cool. Also, props for the pun, that's a fine name you found here :)

</comment></comment></comment><comment><USER14> How different could be the results from linked_lists tool compared with Google results for a specific topic? Are they more close to what a developer needs?

<comment><AUTHOR> Ah, you guessed my next paper :) I have done a little informal analysis on the top 10 results from linked_lists vs the top 10 for that tag used as a Google query. They are quite different, almost totally different actually. But this is not really surprising if you think of the developers curating the links posted on Stack Overflow. I know there was an attempt a few years back to build a search engine based on the SO data set, don't know what happened to that.

</comment></comment><comment><USER15> Very cool I like it! I like that it adds whatever tag you clicked on to the top, but maybe you should save that between sessions. Also, a lot of the more popular languages will reflect what everyone here has already seen and worked with - which is cool because it does what you advertise, but the usefulness is somewhat limited for us folk. It would be cool to have a year/month/week filter to see what has been linked to the most lately (I just saw that was suggested earlier). Things like node would benefit from that since it's growing so fast, but everyone knows about express. A simple thing to enable a bit more usefulness would be to link to the actual Stack Overflow posts so we can look at the comments. Cool stuff though!

<comment><AUTHOR> Thanks for the support. Yes to everything above :) We are currently mining the post history data to be able to do those kinds of time range queries. Cant wait to get that out there it should be very cool indeed, also want to allow users to search by their SO id and to filter their links by tag. (As an aside when we do mine the history we will be able to get more accuracy on which users actually posted which links rather than just the post owner.)

</comment></comment><comment><USER16> This is nicely done, but so far isn't returning anything interesting for me. All the results are very basic (Django docs, PHP docs, etc), which makes sense, the most often cited will be the most general.

What about a change in algorithm to try and add some discovery here. What if you look at votes for answers vs cites? So things that have a high average vote:cite ratio rank?

<comment><AUTHOR> Thanks. Yea i agree our initial use case was to provide an interface to the dataset and to allow us to explore what kinds of things developers were sharing on SO. For the next version we are working on new ranking metrics that will improve the discover aspect, vote:cite and view:cite are 2 we are looking at.

<comment><USER16> Looking forward to v2!

</comment></comment></comment><comment><USER17> Here's the same but for Hacker News <http://www.hnstore.co/42.html>

<comment><AUTHOR> Wow, that's really cool, have to admit i didn't see that before. Let me know if your interested in sharing data, we are doing a lot of research in this area and the more data the better!

</comment></comment><comment><USER18> This is very cool! This only a minor quibble but when you've selected e.g. C and then C++, the 'x' to remove one or other tag from the search results is nearly invisible. I only found it because I've used a similar 'x' box before on a different site to remove results.

<comment><AUTHOR> Thanks, will update.

</comment></comment><comment><USER19> It would be interesting to weight the links by the score of the corresponding comment.

<comment><AUTHOR> I actually had that in an earlier version and took it out just to simplify the design but i am actually looking at this again to produce a better sorting experience. Also the number of views a post receives may be a good metric also.

</comment></comment><comment><USER20> This is an awesome idea! Is there any way to create a randomized list weighted with popularity (so for a given tag you can refresh to find new links, but still ones likely to be interesting)?

<comment><AUTHOR> Thanks for the support, really encouraged by the feedback here on Hacker News. You guys are great.

To your question, yes I am currently testing some ideas for a magic ranking system. One option is as you say a kind of random select amounts popular or trending links. Another is a smart weighted sort when filtering by multiple tags. One problem is that right now if you add jQuery to your filter, the javascript results are going to just dominate everything else.

</comment></comment><comment><USER21> Doesn't work on an iPad. I type in my search term, press enter, and nothing happens. Furthermore, when I enter my search term, the "Filter by tag (e.g. javascript)" text doesn't disappear.

<comment><AUTHOR> Wow - ok looking into that now. What version of ios?

<comment><USER21> The latest, iOS 6.1.3

</comment></comment></comment><comment><USER22> Great work. I am sure this would be useful if there was a filter on official documentation sites like jquery or php.net etc.

In the spirit of HN, how does it work and what powers it? :)

<comment><AUTHOR> Thanks. Yes the domain filter is a great idea, will go to the top of the feature request list.

The site is c#, asp.net mvc, with a javascript front end, backed with sql server 2012. And running on AWS.

</comment></comment><comment><USER23> Top Objective-C link points to ASIHTTPRequest, an obsolete networking library that is no longer supported (and even its developer recommends against using it).

<comment> SG- Right but there's a lot of people still maintaining code that has it implemented and also a lot of tutorials that people are using that likely use that framework.

</comment></comment><comment><USER24> Ha, the top result for C is the spec. Every other language is a popular library.

I wonder if there are more RTFM-type responses for C than other languages.

<comment><USER25> I suspect it has more to do with the large amount of undefined/unspecified/implementation defined behavior in C. A lot of questions on Stack Overflow can only be answered correctly by referring the the standard.

</comment></comment><comment> SG- Are these links from only 2013? It would be interesting to see what the top links are by year/month or something too.

<comment><AUTHOR> So these are taken from the March 2013 data dump, which includes questions going right back to the start of SO. So some of these links have been collecting citations for a few years. We only mined the actual post content on the date the dump was created, we did not mine the post history. But we are working on that right now, its a lot of data to process :)

</comment></comment><comment><USER26> Interesting. This data may potentially be useful in evaluating framework/library/OSS trends and prominence.

<comment><AUTHOR> Thanks, yes we are actually working on a paper to that effect at the moment.

</comment></comment><comment><USER27> i dunno... 11 of the top 14 links under the "Javascript" tag are about jquery (which has it's own tag). I suppose it's not a flaw in your algorithm, just not really very interesting results.

<comment><AUTHOR> I know javascript and jQuery suffer from their popularity and utility I think in this analysis. There is also the issue of jQuery and javascript tags being used by people as synonyms. jQuery particularly is a 500 pound gorilla over all the dataset, it shows up everywhere. As I mentioned above there was a joke on SO at one point that the answer to nearly every question was jQuery with a link to the site. Apparently it wasn't a joke.

</comment></comment><comment><USER28> Feature idea: add a time filter, e.g. last six months, last year, etc.

<comment><AUTHOR> Thanks, yea second most requested feature after the domain filter. Will hopefully add soon.

</comment></comment><comment><USER29> Does this scrape links from the comments posted to questions as well?

<comment><AUTHOR> No just the post bodies (question and answers) at the moment, but we are working parsing the comments and the post history, those datasets are about 4 times the size of the posts! So there are probably a lot more URLs in there, although we will have to decide if we treat all URLs the same or if we differentiate between URLs in post bodies contained in the dump, URLs in the post history (that may have been removed from the post) and URLs in the comments. Not maybe a concern for the website, but more so for research.

<comment><USER29> You usually see notes or clarification posted to questions in the form of comments first, where the types of links are more introductory, general purpose, than specific as you might find in answers.

Can't wait to see the updated stats.

If you could make "more" load more than just a few more records, though, that'd make it a lot easier to dig deeper.

</comment></comment></comment><comment><USER30> you're _

<comment><USER31> Totally. Fix the bad grammar, and flesh out what cc/sa means for those unfamiliar with it.

<comment><AUTHOR> Thanks, missed that one, will fix.

</comment></comment></comment><comment><USER32> PHP's top result: jQuery...

<comment><AUTHOR> Yea, I know. I think it probably goes back to that SO joke about "Q - I have this programming problem" "A - jQuery"</comment></comment>


Turboname finds the name of your next project - <AUTHOR> https://github.com/megoforce/turboname

<comment><USER2> If anyone wants to register `thermotink.com` or `practucant.com`, now's your chance!

Very cool. Running in the bg right now.

</comment><comment><AUTHOR> just found nilometric.com</comment>


Buku cmdline bookmark manager v3.6 released! - <AUTHOR> https://github.com/jarun/Buku/releases/tag/v3.6 <comment><USER2> > _Buku (after my son 's nickname, meaning close to the heart in my > language)._

Interesting. In Malay or Indonesian, Buku means "Book", which also sounds appropriate for a bookmark manager.

<comment><AUTHOR> Yes, I found that while googling. There are too many links about bukus. :)</comment></comment>


ASK PG: What opportunities do you see in mobile? - <AUTHOR>

<comment><USER2> How about applications involving NFC?

[http://www.fastcompany.com/1795224/2012-the-year-nfc-goes- ma...](http://www.fastcompany.com/1795224/2012-the-year-nfc-goes- mainstreamoutside-the-us)

Not to toot my own horn here, but I've got a good record in being accurate with these predictions so far ;) --<http://news.ycombinator.com/item?id=1448851> (and in conversations with friends I successfully predicted that SRI would be the flagship feature for the next iPhone)

</comment><comment><USER3> Bluetooth Low Energy might end up being a big thing once there are phones out which have a radio for it.

The spec is intended for devices which send small amounts of data with minimal power consumption, so it's well suited to things like environmental sensors and ambient displays which have historically been underutilized outside of research settings.</comment>


Virtual machine used to steal crypto keys from other VM on same server - <AUTHOR> http://arstechnica.com/security/2012/11/crypto-keys-stolen-from-virtual-machine/ <comment><USER2> As much as I heart ArsTechnica, the actual research was posted here on HN when it came out: <http://news.ycombinator.com/item?id=4705147>

EDIT: post was to a cryptoanalyst's dissection of the research, as was pointed out in the comments. I'll take that over a journalist blogger, though!

<comment><USER3> The first post was definitely better than the ArsTechnica coverage. However it was not the actual research, the previously linked post was an analysis by a crypto professor from JHU. The work was done by researchers at UNC, UW and RSA, _the actual paper_ can be found here:

<http://www.cs.unc.edu/~reiter/papers/2012/CCS.pdf>

<comment><USER4> that paper is pretty damn impressive - this was a huge amount of work, both in understanding how to exploit an effective side channel, and in the statistical processing used to extract the results from noisy data.

</comment></comment></comment><comment><USER5> There are definitely security risks added by co-tenant VM, but there are actually security benefits possible for virtualization if you also own the hardware. Don't hate virtualization just because some applications make security worse.

<comment><USER6> I think the point being made is that given an organisation/entity that runs a whole bunch of stuff on a bunch of VM servers then, theoretically, the most important VM on a VM server (with regards to security/encryption) is now only as secure as the least secure VM that runs on that same VM server.

Rather than try and hack the nailed down, up to date with patches, regulary checked/scanned/etc payment processing VM with lots of credit card info directly it's easier to pick off the forgotten about unpatched VM on the same host that someone spun up to do a bit of testing and then promptly forgot about.

IOW, if you're in control of it, don't run really important stuff on VMs shared with a whole bunch of 'other' VMs, or make sure that everything you run on a specific VM host is equally secure.

</comment></comment><comment><USER7> This is one of many reasons I am still wary of VMs and 'cloud' computing more generally.

There's something about running your services on the same physical hardware as a bunch of other, potentially malicious, parties that just gives me the heebie-jeebies.

<comment><USER8> 1\. If a side channel attack in a noisy environment is the best attack, you're way ahead of most of the computing world

2\. This is why cloud providers offer the option of dedicated provisioning where you can use the cloud APIs but ensure that your VMs run on hosts dedicated to your organization.

<comment><USER9> WRT #1, a much simpler attack is to either become an employee or subvert an employee of the VM hosting company, pause the victim VM, and read the keys out of RAM.

<http://xkcd.com/538/>

</comment></comment></comment><comment><USER10> Side channel attacks always strike me as the coolest.

How practicable is this? You've got to be on the same physical machine for this to work. Is that easily engineered for, say, EC2? Even if you can't control whether on you're the same machine, is it possible to get any information on the VMs that you're sharing it with?

<comment><USER11> I don't know how things are today, but in 2009 it was possible. See, for instance, the paper _Hey, You, Get Off of My Cloud: Exploring Information Leakage in Third-Party Compute Clouds_ at <http://cseweb.ucsd.edu/~hovav/dist/cloudsec.pdf>

From the abstract: _Using the Amazon EC2 service as a case study, we show that it is possible to map the internal cloud infrastructure, identify where a particular target VM is likely to reside, and then instantiate new VMs until one is placed co-resident with the target. We explore how such placement can then be used to mount cross-VM side-channel attacks to extract information from a target VM on the same machine._ Scared yet?

</comment></comment><comment><USER12> "One is to avoid co-residency and instead use a separate, "air-gapped" computer for high-security tasks. "

Seriously if you were doing "high-security" task why would you be doing them on a VM which allowed co-residency anyway?

</comment><comment><USER13> This is attack was the natural extension of Ristenpart et al's "prime, trigger and probe" attack [1], which looks like this:

(1) Prime: Read B at s-byte offsets in order to ensure it is cached.

(2) Trigger: Busy-loop until the CPU's cycle counter jumps by a large value. (This means our VM was preempted by the Xen scheduler, hopefully in favor of the sender VM.)

(3) Probe: Measure the time it takes to again read B at s-byte offsets.

The idea is that if the co-resident VM's level of activity will increase the time it takes to read B (because the other VM cleared the CPU cache).

When they first published this, they noted that stealing cryptographic keys in a context like EC2 seemed impractical, saying "In practice, cryptographic cross-VM attacks turn out to be somewhat more difficult to realize due to factors such as core migration, coarser scheduling algorithms, double indirection of memory addresses, and (in the case of EC2) unknown load from other instances and a fortuitous choice of CPU configuration (e.g. no hyperthreading)."

It's really cool to see that they finally successfully implemented it.

[1]<http://cseweb.ucsd.edu/~hovav/dist/cloudsec.pdf> (PDF)

</comment><comment><USER14> I am absolutely amazed that you can actually do something like this. It sounds like something theoretically possible, but too difficult to do in practice because of so many random factors influencing each VM. Props to these guys.

<comment><USER15> This is still very hard to pull off. These guys used a combination of several pretty brilliant techniques, _and_ they picked a relatively easy target.

</comment></comment><comment><USER16> This is a big deal, opening up the possibilities for more side channel attacks against VMs located on the same physical hardware sharing CPUs and memory...

</comment><comment><USER17> _The scientists focused specifically on the Xen hypervisor, which is used by services such as EC2._

Are other hypervisors vulnerable to this exploit?

<comment><USER18> They probably all are, since it's really a hardware side channel. Anything that lets two processes run on the same cache.</comment></comment>


Marginal income tax rates for a single California resident (2007) - <AUTHOR> http://dbaron.org/views/taxes-2007.html

<comment><USER2> Here's a similar graph for the UK (but by total tax paid rather than marginal):

[http://upload.wikimedia.org/wikipedia/commons/2/23/UK_tax_NI...](http://upload.wikimedia.org/wikipedia/commons/2/23/UK_tax_NIC_percentages.svg) (or if your browser won't do SVG, this is almost the same: [http://www.reviewmylife.co.uk/data/2008/0901/percentage- of-i...](http://www.reviewmylife.co.uk/data/2008/0901/percentage-of-income-as- tax-08-09.gif))

It's funny that the UK - being European - has a reputation for high taxes and "socialism." There's a lot I don't like about the UK but the taxes are mostly fair (it's the rules for ancillary tax issues that are messed up). The taxes there even include emergency medical expenses.

Mr. Californian earning $50k would be at ~42% on the main post's graph. Mr. Brit earning £34k (roughly equivalent) would be ~26% on the UK graph (or even less if he were self employed!). Hmm.. perhaps sky high gas taxes and 17.5% VAT are a little more bearable for me now.. :-)

[Note: I ballsed up in that last paragraph. The CA chart was marginal, not total like the UK graph. The UK marginal rate at £34k would be 20% for income tax (<http://www.hmrc.gov.uk/rates/it.htm>), 11% for NICs. So 31% vs 42%. However, at £35k the marginal rate would be 40% + 11% NIC == 51%. At £40k, however, the marginal rate would be 40% + 1% NIC == 41%. Who said this was easy??]

<comment><USER3> Wouldn't fair taxes, strictly speaking, be a horizontal line?

<comment><USER4> You've just described a flat tax rate.

<http://en.wikipedia.org/wiki/Flat_tax>

You can count me into the people who support flat tax rates, if for no other reason to stop the pointless millions of hours of productive time wasted trying to rort the system. While people will always cheat, if all income is taxed at a flat rate, at the source, then the incentive to spend money on tax accountants falls.

<comment><USER2> The Negative Income Tax seems like an interesting flat-tax proposal that could even satisfy those in favor of progressive taxation for political reasons: <http://en.wikipedia.org/wiki/Negative_income_tax>

<comment><USER5> See also the Bradley X Tax, which is a value-added tax melded with an income tax. The income tax can be as progressive as you like, and the VAT is equivalent to a flat sales tax.

<http://en.wikipedia.org/wiki/X_tax> <http://www.princeton.edu/~ceps/workingpapers/93bradford.pdf>

</comment></comment></comment></comment></comment><comment><USER6> Interesting to see this on HN a little over 2 years after I wrote it.

My main point wasn't so much about the magnitude of the taxes, but about the shape of the graph. Most of what gives this graph its bizarre shape is a result of the federal laws, not state ones; I just happened to be computing for a California resident because that's where I live, so I had the tax forms in front of me. (And it's also the largest state by population.)

(I'd also note that state-to-state comparisons of taxes aren't really fair without adding local taxes too, since different states have different relationships between the amount of money spent by the state government and local governments. In California, specifically, it's very hard to raise local (property) taxes, so much of education funding comes from the state government. In many states, education would be funded much more by local taxes.)

<comment><USER7> Policy is getting more and more irrational over time. It's hard to discern any rational or ideological motivation behind much of it nowadays. It'll probably get worse before it gets better.

</comment></comment><comment><USER8> It's even worse than this if you're self employed, because you have to pay an additional 6.2% for the employer's portion of social security. Ouch.

Edit: I just moved to CA in 2009, and am now working full time for my own bootstrapped startup. I also happened to get married in 2009, which is an additional tax burden. The taxes are painful. All in all, I feel like there is certainly a negative incentive to work for oneself, especially while bootstrapping and struggling to pull in enough money to pay the bills. We're motivated and are really enjoying it, but I would much rather see tax incentives for founding startups.

<comment><USER9> Hmm, in a relative sense, you're doing it wrong. You should be comparing yourself to the compensation of an employee after adding the employer's portion of the social security and medicare taxes back in. This calculation represents the true cost of the employee's labor to the employer, who is indifferent between whether the money is paid to the employee or to the government. This is why it makes no sense to me to say "the employer's portion" because the employee really bears the burden.

<comment><USER10> On the last point: does that actually happen, though? That's what idealized economic theory would predict, but large corporations' internal structure is quite far from idealized economic theory. My guess would be that if you were able to set up some experiment where one employee cost $100k while somehow having $0 payroll taxes, while another employee cost $90k plus $10k in payroll taxes, the employer would, more often than not, hire the $90k employee.

This happens already, I believe, as regards families. Employees with families cost more in health-insurance benefits than single employees, if the employer offers to subsidize a percentage of health insurance (as most do). But employers don't pay single employees of equal qualifications commensurately more, despite what economics would predict.

<comment><USER11> I don't believe companies can legally discriminate based on family status, either in hiring or pay. However, they can, and do, make people with families pay substantially higher premiums for health care. At my company, a employee w/ family pays 7 times as much out of their paycheck for health insurance than a single employee does.

</comment></comment></comment></comment><comment><USER12> Thought experiment for the economically minded: Labor has a backwards-bending supply curve. Do heavily progressive tax rates flatten out the backwards bend?

(If this comment makes absolutely no sense to you, see [http://en.wikipedia.org/wiki/Backward_bending_supply_curve_o...](http://en.wikipedia.org/wiki/Backward_bending_supply_curve_of_labour) and <http://en.wikipedia.org/wiki/Supply_and_demand> for context).

</comment><comment><USER13> California taxes and business red tape are why we chose Austin over Silicon Valley. Texas just seems a lot more business freindly in many ways.

<comment><USER14> I am definitely looking at Austin and Seattle, and partially-in-Nevada, as options to California.

</comment></comment><comment><USER15> There are few places on earth with the natural, intellectual and creative abundance of California. It's absolutely inexcusable that we are in this situation.

<comment><USER16> I agree. With all the brains, you'd think we wouldn't let the government abuse us so much.

perhaps its just the fact that California is so huge and local control over expenditures is really, really gone. Its much easier to use people when they're far away and not your neighbors. Its a lot harder to see exactly how you're being bled dry when there are 18 layers of obfuscation.

<comment><USER7> It suffers from the same issues that the federal government does: democracy doesn't scale. The larger the task of governing, the harder it is, the more room for graft and waste, rent-seeking and inefficiency.

The US is the largest economy in the world and last I checked California is the 5th. Places like Sweden have higher taxes, but they also have a much more manageable task of governance and more efficient public sectors. You put some tax money into the Swedish government and you might get some valuable services out of it. You give some to Uncle Sam or Uncle Arnold, and it is disappearing in some corporate/union/special interest pocket through some thousand-page bill.

<comment><USER16> exactly. the smaller the country, the better run it seems. I like Switzerland's model.

its impossible for someone to siphon off resources when the democracy consists of 10 people and almost certain to happen when there's 50 million.

Of course, the naysayers will tell you that complex societies are tough to manage and require more government, but that's bunk. It should require less government, as there is far less border per person to defend.

</comment></comment></comment></comment><comment><USER10> Part of the problem leading to the flat curve is that while California's rate is technically progressive, it ramps up very fast and is flat past that: all the brackets are below $45k.

</comment><comment><USER17> I guess this is why only rich people care about tax changes, because the rules are so complex, poor people don't have the time to study them. Rich people don't have the time to study them either, but the differences can be so great, it is worth it for them to hire an expert.

</comment><comment><USER18> I'd be more interested in the new effective tax rate in California or other "high tax" states.

</comment><comment><USER16> ridiculously high. but at least those who work 80 hours a week aren't taxed more per hour than those who work 40. I guess there's some justice in the world.

you'd be surprised at the number of people who think just because you work more, you should pay more. as if one exists for the convenience of others

<comment><USER19> What do you mean about the 80 vs 40 hrs/wk? That working more will (naturally) get you more money, so you pay more taxes? Or some kind of "hard-worker" tax where they tax you based directly on effort? I haven't heard any of these proposals.

<comment><USER16> I was referring to the fact that worker A at Burger King making $5/hour for 40 hours shouldn't have to pay a higher tax rate on the extra hours than on the first 20.

Its simply crazy unfair that if spend the second 20 hours watching tv, you pay less for your government services AND you pay less per hour.

Personally, I'd prefer if we all paid for the government we used, rather than dumping the costs off on people who are more productive or lucky.

We really do not have the right to other people's property, not matter how much they make.

If we want something we haven't earned, we should try an ancient non-violent method of obtaining something. Its called "asking".

</comment></comment></comment><comment><USER20> I'd be interested to see what income minus tax looks like.

It looks like there would be "income traps", where earning a higher base salary would actually leave you less well off. Good to see the USA rewarding hard workers!

<comment><USER10> There are only income traps if the marginal rate's >100% at any point, which it isn't here. Since the marginal rate's never above 44%, it means there's never a case when earning an extra $1 won't gain you at least an extra $0.56 in your pocket.

<comment><USER21> The numbers cited in the post (as he points out) do not take into account all the antipoverty programs we have. When you take those into account you get a graph like this:

[http://4.bp.blogspot.com/_djgssszshgM/SvtscpywvOI/AAAAAAAABD...](http://4.bp.blogspot.com/_djgssszshgM/SvtscpywvOI/AAAAAAAABDg/dBO8WC5e4wU/s1600-h/implicit+tax+rates+2.png)

There actually _is_ a dead zone. Which is horrible.

<comment><USER10> Part of the difference is also that he's looking at single people, while your linked graph is for a family of three, and there are much more generous grants/transfers for families.

There has been some effort to get rid of dead zones by changing thresholds into phase-out zones, but not everything's been changed, and some programs probably need more gradual phase-outs, especially if you consider their impact when taken together. There's an issue though that gradual phase-outs are hard to structure in a way that's politically popular: most people seem to have a mental phase-out that's fairly steep, so it's popular to give food stamps to a family of 4 making, say, $18k, but unpopular to give food stamps to a family of 4 making, say, $30k. But if you phase them out from 100% to 0% within a $12k range, you produce a significant implied tax over that range. Either the phase-out has to start so low that genuinely poor people get <100%, or it has to go up high enough that people who no longer really qualify as poor get some low but non-zero amount.

</comment></comment></comment></comment><comment><USER22> _I probably made a whole bunch of mistakes here, never mind the major pieces I omitted_

Harms credibility.</comment>


Ask HN: Can Whatsapp read my messages, e.g. when including a URL? - <AUTHOR> <comment><USER2> According to their FAQ, "WhatsApp's end-to-end encryption ensures only you and the person you're communicating with can read what is sent, and nobody in between, not even WhatsApp ... End-to-end encryption is always activated, provided all parties are using the latest version of WhatsApp. There is no way to turn off end-to-end encryption."

<comment><USER3> So it essentially boils down to "do you blindly trust WhatsApp to do what they promise...and to do it without technical errors which would compromise this?" Now, is there a way to somehow verify that claim, or at least falsify it? ( [https://en.wikipedia.org/wiki/Falsifiability](https://en.wikipedia.org/wiki/Falsifiability) )

<comment><AUTHOR> i wonder whether there has been an official review of the encryption mechanism by any trustworthy 3rd-party..

<comment><USER2> [https://threatpost.com/signal-audit-reveals-protocol- cryptog...](https://threatpost.com/signal-audit-reveals-protocol- cryptographically-sound/121892/)

They provide the links of their audit of the Signal Protocol there saying that it is cryptographically sound.</comment></comment></comment></comment>


Ask HN: What is the stigma against Wikipedia as an official reference - <AUTHOR> I mean the same things that people fault about Wikipedia can be said about scientific papers, anyone can write a paper and have it peer reviewed and approved. Isn't Wikipedia better cause it has a much larger audience that can call bullshit on articles of questionable factuality? Why do educational and research institutions frown against quoting Wikipedia as a reference? I mean some people even find information on Wikipedia and quote somewhere else just to avoid this. <comment><USER2> During my university studies, a few classmates decided to edit a Wikipedia page for a niche technique in our field - changing the article to state it was invented by a rather boisterous member of our group.

The year following our graduation, my classmate heard from the tutor who runs the related course -- asking why the hell his students were claiming he invented such-and-such technique! Several students had cited Wikipedia without checking sources.

To answer your question, Wikipedia is a lower quality source than scientific journals for the same reason direct democracy isn't usually as good as representative democracy. We delegate trust in matters to an authority. Sometimes there are problems with the quality of the authority but at least there is a framework to work within.

</comment><comment><USER3> It prevents circular referencing. For example, Wikipedia might be referencing Legitimate Science Page, which references Science R Us, which references Science Experts Coalition, which references Wikipedia.

</comment><comment><USER4> It's because Wikipedia is edited by anonymous people. sources is not to say "this is true because this is written in this source" but "this is true because someone _with authority_ said so". Citing sources is is a form of argument from authority. It is a a fallacy if the source has no authority but a completely valid argument if the source does. Wikipedia has no authority because of its anonymous nature. There's no one to hold responsible and no one who'll lose credibility by publishing bullshit on Wikipedia.

Also, most Wikipedia articles worth citing contain really bad factual errors. Since most readers aren't topic experts they don't notice such errors. But they are there and they are really bad. I only have some math education but I've found lots of mistakes in proofs on Wikipedia. Imagine how bad it is for higher-level math that is beyond the reach of most visitors to the site.

</comment><comment><USER5> Either the Wikipedia article has a citation for the reference you should use instead, or it needs one and you shouldn't be referencing it.

</comment><comment><USER6> You shouldn't cite encyclopedias to begin with. I remember learning this in 6th grade, do they not still teach this? Research 101.

</comment><comment><USER7> > and have it peer reviewed and approved

That's the part that matters.

<comment><AUTHOR> It could be argued that wikipedia has better reviews cause it has a much wider audience of reviewers

<comment><USER7> Maybe, but my experience editing there is that the very vast majority of edits do not get reviewed at all, let alone by people with any background in the subject at hand.

</comment></comment></comment><comment><USER8> On overall I agree that having a larger audience is better for WP.

But most WP users are quite passive, and unfortunately a very few are extraordinarily active, so the quality of the WP they patrol, depends heavily of their biases. As they are few, there is no natural moderation.

But having a quality article is not enough, it is also important to have quality articles on a reasonable range of topics, and this is not true for some WP (French WP for example)

Same article since 2012 about cancer vaccines, only 42 words! [https://fr.wikipedia.org/wiki/Vaccin_contre_le_cancer](https://fr.wikipedia.org/wiki/Vaccin_contre_le_cancer)

<comment><AUTHOR> This is interesting, couldn't they just get away with translating the english articles?</comment></comment>


Does register selection matter to performance on x86 CPUs? - <AUTHOR> https://fiigii.com/2020/02/16/Does-register-selection-matter-to-performance-on-x86-CPUs/ <comment><USER2> I wonder about whether there are differences in performance when it comes to encoding as well. For example, I discovered in the early 90's that you could tell the difference between Borland and Microsoft compiled binaries by how they encoded things like ADD AX,BX.

I made a list of all such opcodes and made an encryption engine that simply used XOR to switch between encodings so each encryptor looked different. But I never did any timing or other performance tests on it to see if there were other differences than just the binary representation.

</comment><comment><USER3> Whoops, this is a dupe of [https://news.ycombinator.com/item?id=22372847](https://news.ycombinator.com/item?id=22372847)</comment>


On Joining Microsoft Edge and Moving to Seattle - <AUTHOR> https://nolanlawson.com/2016/06/09/on-joining-microsoft-edge-and-moving-to-seattle/ <comment><USER2> Oh, the person writing this blog post hasn't actually STARTED yet.

He sounds very bright-eyed and bushy-tailed optimistic eager to improve their software. "I'm going to make Edge as good as Chrome/Firefox!"

The people who join Microsoft going in with THAT kind of attitude are the ones whose souls are crushed the most by its oppressive culture.

<comment><AUTHOR> Yay, thanks for your comment! :) I look forward to proving you wrong. _wags bushy tail, bats bright eyes_</comment></comment>


Samsung Printer firmware contains a backdoor administrator account - <AUTHOR> http://www.kb.cert.org/vuls/id/281284 <comment><USER2> Reminds me of the Cold War when the CIA planted camera's inside XEROX copiers and was stealing everyone's secrets for decades. <http://www.editinternational.com/read.php?id=47ddf19823b89>

</comment><comment><USER3> If you want some details about it: [http://l8security.com/post/36715280176/uv-281284-samsung- pri...](http://l8security.com/post/36715280176/uv-281284-samsung-printer-snmp- backdoor)

</comment><comment><USER4> When I read about that kind of backdoors it makes me wonder how nobody ever ends up in prison for it.

<comment><USER5> Because there is no law that says 'if you as a manufacturer of some device install a backdoor then that will come with a fine of 'x' or a jail sentence of 'y''.

If you feel that this sort of thing warrants a jail term then you should lobby for it to become a crime. As it is manufacturers are completely in the clear if they do things like this, the only way to put pressure on them is to vote with your feet.

<comment><USER6> I think it would fall under some sort of wire fraud or hacking, except that you probably have to agree to it in the EULA so it was "allowed".

<comment><USER7> You can not sign away legal protection in a EULA. This is why EULA's normally say's something like "we forbid everything, and leave you with no rights what so ever, _except_ what ever rights the law guaranties that you have".

</comment></comment></comment></comment><comment><USER8> Will Samsung receive more stringent investigations and sanctions than Huawei had, given that Samsung is caught red-handed?

</comment><comment><USER9> I don't know why people buy Samsung stuff. As pg once said, they make everything look like a microwave.

<comment><USER10> Nice microwave. [https://en.wikipedia.org/wiki/File:Galaxy_Nexus_smartphone.j...](https://en.wikipedia.org/wiki/File:Galaxy_Nexus_smartphone.jpg)

<comment><USER9> Too cook your ears I guess ;)</comment></comment></comment>


Go Data Structures: Interfaces - <AUTHOR> http://research.swtch.com/2009/12/go-data-structures-interfaces.html <comment><AUTHOR> I can't believe nobody finds this interesting. :(</comment>


Cultural history captured in 5-minute film - <AUTHOR> http://www.nature.com/news/humanity-s-cultural-history-captured-in-5-minute-film-1.15650

<comment><USER2> There is such an obvious bias in the data to Western Europeans and North Americans that I wonder at the hubris displayed in titling this as "Humanity's cultural history".

<comment><USER3> The most shocking was when they said that the important people in 17th century Japan were all missionaries... surely some of the least important people in the country at that time!

</comment></comment><comment><USER4> American historians strike again!

</comment><comment><USER5> Url changed from [http://thecreatorsproject.vice.com/blog/watch-2600-years- of-...](http://thecreatorsproject.vice.com/blog/watch-2600-years-of-culture- grow-and-die), which points to this.</comment>


Show HN: Phishero – phishing simulation SaaS for organizations (beta) - <AUTHOR> http://phishero.com <comment><AUTHOR> Thanks for looking - I made this in my spare time after seeing how difficult it was to get pricing from some of the bigger competitors in this space. Additionally, a lot of the competition focuses on training where I really just needed a diagnostic tool. I'm releasing it today as an open beta with a 50% price reduction. Let me know if you have any questions.

I'm still working on the documentation, but it can be found here: docs.phishero.com

Thanks.</comment>


Boycotts or buycotts? The role of corporate activism - <AUTHOR> https://phys.org/news/2020-08-boycotts-buycotts-role-corporate.html <comment><AUTHOR> Corporate Sociopolitical Activism and Firm Value,

The Journal of Marketing,

[https://journals.sagepub.com/doi/10.1177/0022242920937000](https://journals.sagepub.com/doi/10.1177/0022242920937000)</comment>


Spencer Perceval, The Forgotten Prime Minister - <AUTHOR> https://medium.com/lapsed-historian/the-forgotten-prime-minister-148c64ffb5b6 <comment><USER2> can someone with edit privilege edit the title to "British Prime Minister"?

Weird to click on the link just to find out which country they are talking about

</comment><comment><USER3> I loved this, thank you. I never knew how the abolitionists managed to pass the slave trade act until now.

<comment><AUTHOR> Yeah, this seems like a part of history that should really be highlighted. It's relevant to nearly the entire world. And it's results are still important today.

</comment></comment><comment><USER4> Reminds me of the iLikeTrains track: [https://www.youtube.com/watch?v=ei- YcXjlglI](https://www.youtube.com/watch?v=ei-YcXjlglI)

</comment><comment><AUTHOR> Lapsed Historian has a lot of great long forms, many of which have been discussed here on HN.</comment>


Awesome Math - <AUTHOR> https://github.com/rossant/awesome-math <comment><USER2> Ah, I love the awesome lists. So much good stuff in there.

<comment><AUTHOR> then you'll love this one! [https://github.com/sindresorhus/awesome](https://github.com/sindresorhus/awesome)

<comment><USER2> Of course! That's the best one!</comment></comment></comment>


Ask HN: What is/are your favorite quote(s)? - <AUTHOR> <comment><USER2> "Sometimes magic is just someone spending more time on something than anyone else might reasonably expect." — Teller

I don't know if Teller intended it, but his observation applies to much more than stage magic. The quote is from Esquire's feature of the mononymous magician.[1] IMO, the whole article is worth a read.

1\. [http://www.esquire.com/entertainment/interviews/a15810/telle...](http://www.esquire.com/entertainment/interviews/a15810/teller- magician-interview-1012/)

<comment><USER3> Great quote and article.

I have always admired Teller in particular. He's on a show currently called Fool Us where he and Penn have to work out how performers' tricks work and the respect and wonder on his face after each trick is great to see. I hope I have that kind of ongoing love for my passions after decades pursuing them.

</comment></comment><comment><USER4> A few of my favorites on various topics:

I won't be able to answer all your questions. Rather, I can show you how to be lost productively, and how to become comfortable not knowing things and teaching yourself. -- David Humphrey, Mozilla developer

The most exciting phrase to hear in science, the one that heralds new discoveries, is not 'Eureka!', but 'That's funny ...' \-- Isaac Asimov

There are better ways to earn a living than to prevent other people from making use of one's contributions to computer science. -- Donald E. Knuth

"If you have an apple and I have an apple and we exchange apples then you and I will still each have one apple. But if you have an idea and I have an idea and we exchange these ideas, then each of us will have two ideas." \-- George Bernard Shaw

I don't want to achieve immortality through my work; I want to achieve immortality through not dying. -- Woody Allen

<comment><USER5> Thanks, these are great!

</comment></comment><comment><USER6> "To love. To be loved. To never forget your own insignificance. To never get used to the unspeakable violence and the vulgar disparity of life around you. To seek joy in the saddest places. To pursue beauty to its lair. To never simplify what is complicated or complicate what is simple. To respect strength, never power. Above all, to watch. To try and understand. To never look away. And never, never to forget."

― Arundhati Roy, The Cost of Living

</comment><comment><USER7> Times of stress throughout my life have led me to turn, or return, to the physical sciences, a world where there is no life, but also no death --- Oliver Sacks

Each one of here today will at one time in our lives look upon a loved one who is in need and ask the same question: We are willing help, Lord, but what, if anything, is needed? For it is true we can seldom help those closest to us. Either we don't know what part of ourselves to give or, more often than not, the part we have to give is not wanted. And so it those we live with and should know who elude us. But we can still love them - we can love completely without complete understanding --- A River Runs Through It

Even though you can't expect to defeat the absurdity of the world, you must make that attempt. That's morality, that's religion. That's art. That's life --- (read somewhere)

On education ---

"And this I believe: that the free, exploring mind of the individual human is the most valuable thing in the world. And this I would fight for: the freedom of the mind to take any direction it wishes, undirected. And this I must fight against: any idea, religion, or government which limits or destroys the individual. This is what I am and what I am about."

"Education either functions as an instrument which is used to facilitate integration of the younger generation into the logic of the present system and bring about conformity or it becomes the practice of freedom, the means by which men and women deal critically and creatively with reality and discover how to participate in the transformation of their world"

</comment><comment><USER8> Can you imagine that a rocky, watery planet could have a soul, and that such a soul could be released by a spent body? Can you imagine that the youthful soul of the planet Mars might be dwelling elsewhere, re-establishing its essence on more fertile soil? Souls, like seeds, blow on the winds. The chemistry of spirit is not as restricted as flesh and blood.

Think of a sci-fi scenario where earth was shortly to be struck by a giant comet. Comprehending a collision course, the people of earth could calculate their extinction, and then make a radio appeal to all Universal stations to accept the souls of earth. Each galactic station could put the case before their government asking, "Do we want those beings here as refugees? Are they worthy to be among us? Shall we send a travel beam to receive them or shall we let them be cast adrift?" Would it be an easy decision, or would the soul seeds of earth be turned away? Who would be taken? Who would not? Would it be a collective agreement? What would be the terms? This metaphor should make you think about who your are in a cosmic sense, and what your relationship to the garden of earth might be.

</comment><comment><USER9> "Coding in CoffeeScript is like having sex with a Lady-boy, from one side it's kind of like the real thing, but from the other you're still sucking dick."

— Anonymous CTO

</comment><comment><USER10> "There are only two tragedies in life. One is not getting what one wants and the other is...

.. getting it!"

~ Oscar Wilde

<comment><USER11> Wilde must have the best ratio in 'famous quotes / lines written on paper'.

</comment></comment><comment><USER12> "Nature is the great visible engine against which all other creative efforts are measured. And creativity in nature has a curious distribution. It's something which accumulates through time." ~ Terrence McKenna

</comment><comment><USER13> "It's not that I'm so smart, it's just that I stay with problems longer." Albert Einstein

</comment><comment><USER14> It is difficult to get a man to understand something when his salary depends upon his not understanding it.

Upton Sinclair

</comment><comment><USER15> "All parts of the human body get tired eventually - except the tongue." \- Konrad Adenauer

</comment><comment><AUTHOR> Mine is:

The history of the world is the sum total of things that could have been avoided.

<comment><USER15> That quote is from - Konrad Adenauer

Good one!

</comment></comment><comment><USER16> "Things lead to their opposites"

</comment><comment><USER17> What one man can do, another man can do.

</comment><comment><AUTHOR> Wow. I love this. Thanks everyone.</comment>


Data Mining the 17 Most Interesting Facts on Reddit - <AUTHOR> http://priceonomics.com/today-i-learned-the-17-most-interesting-facts-in/ <comment><USER2> The submitted title is blatantly misleading. There is no "data mining" at all.

This a listicle with no insight at all.

<comment><USER3> "So our data crawling team built a simple algorithm that would crawl through the Today I Learned subreddit and count how many times a given article was submitted."</comment></comment>


The failed economics of our software commons and what to do about it - <AUTHOR> http://pchiusano.github.io/2014-12-08/failed-software-economics <comment><USER3> To paraphrase the problem: 'Lots of people are relying on volunteer created code running for free. How do we fund the development of useful tools and software collectively?'

I'm not sure what the best mechanism is, but making some group pledge on a website probably isn't it. I can't envision that any substantial fraction of people would contribute regardless if other people are helping.

Instead lets restate the problem a little: '$Billions in value is built partially relying on the use of these tools. How do convince the whales that they make money by contributing?'

I wonder if people from the operational side of the house could start this conversation. Business will already do something similar with legacy systems. I.E. Vendor disappears and management finds one of the developers formerly employed at the vendor and cuts them a check for help. When X critical system is at risk everyone gets their checkbook out. We need to connect the operational risk from things like heartbleed with a cost that business people will understand. I like the free software/paid support model, but clearly there could be something better.

<comment><USER4> The basic difficulty inherent in monetizing digital goods is affecting all reaches of the software industry, in a bad way. From websites being forced to rely on advertising to system software developers being forced to rely on donations or patronage--the digital goods economy is here, and frankly it's pretty disappointing.

I'm not sure what the solution is, but the first step I think is to admit that you've got a problem. Supply chains in the physical goods world aren't a piece of cake by any means, but at least they are predictable. If you make an SSD, you buy flash from Micron and a controller form Marvell, etc. You just _buy_ it. That simple "money for product" transaction allows the incentives to line up. If it was possible to make money selling SSL libraries the same way it's possible to make money selling flash controllers, the world might be a better place.

<comment><USER5> Honestly I think the answer is micropayments. Large companies should get together to fund the creation and running of a centralized payment system with no fees. They could move tiny sums of money around to developers. Apps could charge $0.05/month to $1/month to monetize themselves. The user would be given a trial period and then asked to pay.

The way I see it, Google, Amazon, Walmart and others would create a small firm of about 10 people. The central processing system could probably handle real traffic with as little as 20 production servers. All tolled, the company would cost probably 10 mill a year. The benefit is that the founding companies would save in transaction fees their contribution to the new monetary commons. If Amazon didn't lose 3% to credit card purchases, they would save billions a year. At that point what is 10 mill to keep that going? Hell, if I'm off by an order of magnitude, 100 mill a year is still cheaper than the fees.

<comment><USER6> That's basically what the author is pushing. Snowdrift.coop[1] is a platform for making small payments to open source projects, with the additional twist of a matching donation mechanism. It's like Patreon with a twist. They plan to fun the platform as a project on the platform, rather than charging a percentage of each transaction like KickStarter does.

I like the idea. If something like this caught on, it would give corporations a centralized place to support open source tools they rely on.

[1] [https://snowdrift.coop/p/snowdrift/w/en/intro](https://snowdrift.coop/p/snowdrift/w/en/intro)

</comment></comment></comment></comment><comment><USER7> An alternative solution could be to innovate in licenses.

I think a lot of the problem is the idea that MIT/BSD-licensing is the ideal solution because it promotes freedom the most. Clearly, using restrictively licensed components under currently existing restrictive licenses often isn't practical for businesses, but that doesn't mean that having everything be MIT/BSD is the end stage in the evolution of open source licensing.

MIT/BSD-licensing promotes freedom for businesses, but hurts open source developers by requiring them to trust that they can be adequately compensated for their work by a reputation economy that's subordinate to a corporate system that we don't ultimately control.

What if the open source community adopted a norm of dual-licensing open source libraries with the choice of a restrictive non-commercial open source license (basically, AGPL with an added non-commercial restriction) or a license that permits commercial use if you pay?

The key would be that this dual-license would require that any derivative software also be licensed under the same dual-license.

Wouldn't that preserve freedom as in free, while ensuring that open source developers are compensated for their work at levels that ensure and incentivize an optimally robust open source software base?

The devil would be in the details but I bet there's a way to do this that preserves everything that's good about FOSS now and incentivizes better software.

<comment><USER8> Having spent some time on the problem I agree generally with your approach, but the problem is it doesn't appreciate the history and context in which the current system has arisen and continues to exist.

There are basically 3 cases of successful FOSS projects:

1\. Ideologically-driven, e.g. Emacs, GNU, etc. These tend to have licenses in the copyleft family

2\. Commercially-driven, e.g. WebKit, Docker, etc. These are projects that are strategically important to one or several companies. They tend to have licenses in the MIT/Apache family

3\. "Lone Wolf" or "indie developer". While a lot of FOSS is this by volume, what you discover is that by the time projects become popular they have generally evolved into one of the first two types, although they often preserve their creation story as part of the marketing material

The problem with charging money for code is that it's really a bad deal for the first two types. The ideology camp doesn't want non-commercial licenses because it's a "restriction on a field of use" which they have a philosophical objection about that you can google. In the second camp, the corporate masters derive some kind of strategic advantage from having a popular open-source project and charging money necessarily means the project would be less popular and so of less strategic value.

What this necessarily means is that if there's any legs to this plan, positioning it as "open source" or to the "open source community" is exactly the wrong approach, because basically all the people who are successful in that community will find it a nonstarter. Instead you have to hypothesize that there's some completely different set of people that can benefit from this system, writing completely new software (or releasing pre-written software that isn't currently considered 'open source', e.g., proprietary software). So your positioning needs to be something like "proprietary 2.0" or even "third way" rather than being connected with open source.

The real problem with this system is that I'm not sure there's a market on the buying side. Developers are used to getting things for free, and even if somebody wrote a source-visible-but-pay-$1k-to-use-it high-quality TLS library I'm not convinced that people wouldn't just keep wrestling with OpenSSL because it's free.

I have a whole blog post I'm drafting on this topic, if anyone reading this comment is interested, give me a shout and I'll give you a preprint.

<comment><USER9> This kind of situation where there is a common need for something, but there isn't a reasonable way to pay for it in individual transactions has a traditional solution: make the project publicly funded.

As an example, a military is a useful thing to have for protection, but paying for it as some sort of subscription or "per-invasion" billing is obviously not a realistic solution. So we fun it publicly, as a tax, which generally works[1]. Similarly, it might be useful to make a publicly-funded service that is charged with creating software infrastructure such as TLS or even libc that are difficult to fund directly.

There are a few advantages to using public funds: unlike traditional Free Software, as it uses public funds, the output would be _public domain_ , and usable by anybody, commercial uses included. Also, as it doesn't have to worry about VC money drying up or "maximizing shareholder value", it would be easier to stick to a mandate that emphasizes quality instead of time-to-market.

On the other hand, problems with this idea would be the general concerns about corruption due to political meddling, and how to keep the NSA from pulling a BULLRUN on it like they did to NIST.

<speculation> Perhaps a "dept. of software infrastructure" could take over the "defense" side that the NSA seems to be neglecting recently. Moving all industry interaction (and trust) over to the new, open group so the NSA was known as spying-only might improve the relationship a bit... </speculation>

I'm not sure if this is a particularly good solution to the problem, but it's worth considering.

[1] Of course, there are details to argue over and bugs in the system to fix, just like any complicated project.

<comment><USER10> There's a free-rider problem if the funding is from a national funding body. Since software is generally useful globally, the funding body would have to be international.

<comment><USER9> Some sort of international version would be a good idea, if some reasonable plan could be created.

Regarding "free-riders", consider compatibility and interoperability. Some amount of "free riding" may be _desired_ if it means you don't have to spend as much time and effort making things work together. These benefits may not be as important at the application level, but for infrastructure, these can be very important features.

</comment></comment></comment></comment></comment><comment><USER11> The bigger problem is open source software as a business model incentivises making the software over complicated, as if it just worked properly there would be no need for value added services. This is what lies at the core of the Docker/Rocket fiasco. (And possibly systemd too).

This means that good open source projects almost by definition rely on being produced in someone's free time, or as a side effect of something else (such as Rails), because any company funding something they don't directly use will have some extraction motive which will eventually lead the project into a quagmire.

<comment><USER12> This is also a problem with commercial software and maintenance contracts, not to mention "certified engineers" in the adjacent ecosystem.

<comment><USER13> Very much the case - look at Oracle or Cisco.

</comment></comment></comment><comment><USER14> Looks like a system to setup up assurance contracts for funding software. Glad to see more people trying to make this sort of thing work.

What's interesting is that you can actually make pledging a dominant strategy, if you find someone willing to put up enough capital. Roughly speaking, dominant assurance contracts work along the lines of "Everyone who pledges will receive X amount of money if the fundraising fails to hit the appropriate threshold." For anyone who would stand to gain from public good, the outcomes are now "Pledge: either the project will be funded or I will get money vs Don't Pledge: either the project will be funded or I will get no money"

[http://mason.gmu.edu/~atabarro/PrivateProvision.pdf](http://mason.gmu.edu/~atabarro/PrivateProvision.pdf)

<comment><USER13> That's not quite right - it's "Pledge: either the project is funded and I spend money, or I get money", vs the "Don't Pledge" you give.

It's still interesting, to be sure.

</comment></comment><comment><USER15> I think this is a badly needed capability. But the SSL bug (which is highlighted) and the Netflix bug, really brought home an interesting question, "Who is writing your software?"

A company has a whole stable full of developers, but if they are all using the average of 8.9 open source "components" in their stacks, really there is a huge software development "organization" that is essential to their business, larger than their paid employee base, that is both absent from the building and outside of their control.

Think about that. Its bad enough when your middle managers don't know how the sausage is made, what about your engineers? And what are you paying the engineers for anyway? And why are they getting paid essentially to put into action stuff that other people wrote? Its a very interesting question for me to think about.

<comment><USER16> > why are they getting paid essentially to put into action stuff that other > people wrote

Isn't that true of almost every tool in a modern economy with division of labour, including something as simple as a pencil[1] that you use to jot down notes?

[1] [http://en.wikipedia.org/wiki/I,_Pencil](http://en.wikipedia.org/wiki/I,_Pencil)

<comment><USER17> I may not know how to make a pencil, but I know precisely how a pencil works. I can be reasonably confident that it is not going to start writing in ink one day, because an upstream maintainer thought it would be a cool feature.

</comment></comment></comment><comment><USER18> So, some things that stand in the way of OSS:

In some companies, using OSS or even commercial tools that solve problems is frowned on if it seems like a better idea to roll a tool in-house. NIH is _huge_ in many sectors (fighting against this myself at work), and a lot of the same folks who are reluctant to let other people's code into their work are also reluctant to give back to the community from which it came.

In certain places, using OSS is a colossal pain in the neck. Certain enterprise problems are completely unaddressed in various ecosystems, and when they _are addressed_ (say, Ruby's support of Kerberos and LDAP) they are usually just addressing the one or two pain points that that dev had at the time. People are usually not willing to _properly_ solve a problem given limited time and resources.

Even if they _are_ willing to exert effort, many ecosystems can be completely unhelpful and unwilling to give people with domain expertise the support they need to make meaningful contributions. As an example of this, working on a small math library for the new language Elixir, I had at least one person (in an otherwise amazing and friendly IRC channel) continually asking "Wait, why are you doing any type of numerical stuff in Elixir?". Now, imagine that kind of reaction to enterprise features ( _much_ harder to get right!) in a different language, and you start to see why things are the way they are.

I don't know if there are any ways of _fixing_ this other than just doing it for the sheer joy of helping other programmers and knowing that, someday somewhere in some ledger, your effort will be rewarded--or at least marked as legacy some other sod has to work around. :)

<comment><USER19> > People are usually not willing to properly solve a problem given limited > time and resources.

They are solving their own problems. It is bad enough when people are shoveling snow for everyone else for free, to think they would do it while their car is not stuck would be ludicrous.

In that context, the _only_ incentive that works is compensation for ones labors. If they want Rubys support of authentication protocols to improve, they have to do it themselves, or pledge some money and hope enough companies do it to pay for it to be done.

> imagine that kind of reaction to enterprise features

At least in the context of numericals, I think it is more "dont make a new snowdrift where there isn't one already, and we have already mostly gotten rid of a similar one in the numpy ecosystem". When free software developer resources are already incredibly scarce, them being wasted on project duplication sucks. Albeit, implementing features for certain programming languages is one of the least bad duplicated efforts.

> someday somewhere in some ledger, your effort will be rewarded

The whole point of the article is that being listed in the contributors file is not enough for 99% of developers and the 1% that do volunteer like that are being (voluntarily) exploited for their labor as a result, and software a a whole cannot sustain like that.

</comment></comment><comment><USER20> It always seemed to me like the academic-style sabbatical was a nice solution to this. Instead of trying to convince a bunch of people that what you're going to do is going to be worthwhile, you develop a culture where capable people are regularly given time to work on whatever they think is important.

Clojure's a nice example: it's been hugely successful, but I have a hard time imagining anyone raising two years' worth of salary up front to work on their idea for an idiosyncratic Lisp implementation. It looks like he had to fund that work himself; how much more innovation would you see if this kind of extended project was common?

<comment><USER21> Perhaps a basic income would be a more general solution than Snowdrift.

<comment><USER22> Absolutely! Implementing a Basic Income takes more political power than starting a webite though.

<comment><USER13> I think there's actually room for Snowdrift even with a Basic Income - particularly if it's not a crazy high Basic Income.

</comment></comment></comment></comment><comment><USER23> tldr: matching pledges to fund FOSS at [https://snowdrift.coop/p/snowdrift/w/en/intro](https://snowdrift.coop/p/snowdrift/w/en/intro). "Snowdrift" is a reference to a game theoretic game similar to the prisoner's dilemma.

My take: solid idea, terrible name and URL, and also it won't succeed unless some big, respected FOSS names endorse it.

<comment><USER13> What don't you like about the name?

I think it 1) invokes "things piling up", 2) references relevant game theory in two ways, and 3) draws attention to the fact we're organized as a cooperative. All of which seem a good fit for what we're doing.

</comment></comment><comment><USER24> To offer a contrary view:

I think the economics of software commons has been stunningly successful. It's substantially lowered the bar of entry for a large class of businesses and non-profit organisations.

It's great that people are experimenting with financial reward systems that are between free and fully commercial. The more the better as it's not at all obvious which ones will stick. I think it has the propensity to increase the number of people actively involved in this work.

Even better it may open up new types of activity e.g. independent open source software auditing.

But I don't feel that Heartbleed etc demonstrate a systemic failure in economics. The seismic shifting in attitudes to privacy/security that have happened over the last few years appear to be largely orthogonal to the funding models.

<comment><USER25> I find it rewarding to volunteer at one of the big open source software foundations because the time I put in working on project governance, licensing, policy and so on ripples out through hundreds of projects and into the broader FOSS ecosystem. We're way better at what we do than we were even a few years ago, and one result is that there are far more people getting paid to work on FOSS.

Expertise on the administrative aspects of open source also makes me more valuable as an employee, because I can help my employer to consume and contribute to FOSS safely and efficiently. I recommend that anyone with the knack get involved.

</comment></comment><comment><USER26> Asking why popular software isn't well funded is backwards. The question is, why is underfunded software popular?

Lots of under- and unfunded software is of poor quality and is ignored. Why is some of it (like OpenSSL) not ignored?

I don't even think there is a market argument here, it's much more pedestrian: a lot of people, based on social proof, use OpenSSL – which, short of becoming a crypto expert oneself, is entirely reasonable.

</comment><comment><USER27> This is the same economic problem that affects basic research. Open source software is a 'public good' \- its usefulness is not diminished when it is used by others, and you can't prevent others from using it.

The longstanding solution to this problem is government support. This might not be a sexy solution on HN, but it is the obvious one.

<comment><USER28> I agree it would make sense, but is the real problem not how to allocate that money?

Who decides how much the Postgres guys get, or if its worth to support yet another NoSQL store? Involving politics seems like a surefire way into mediocrity. How to get around that?

<comment><USER6> Maybe the government could provide the funding as a Tax Credit for donations to platforms like snowdrift.coop, just like donating to other non-profits works. Companies / Individuals would make their own decisions about what to support, and the government would foot the bill through them.

Obviously the government would create a class of acceptable organizations to donate too, rather than designating a single platform / portal. In this way it would be just like the new crowd equity system.

<comment><USER28> I like that idea, power to the people.

If there was a way to do so without complicating my tax filings, that would be even better.

</comment></comment></comment></comment><comment><USER29> It's tough for companies to fund individual open source developers using "contribution" kinds of models, because now they are essentially paying someone for services in such a way that is entirely outside the bounds of the usual employment agreements, either at-will, full time employment or via a contractor agreement. It opens them up for a variety of legal liabilities.

This is why the bigger projects start up complicated 501c organizations, which from my research appear to be quite burdensome to administer and also place restrictions on the project itself as to what circumstances money can be accepted.

</comment><comment><USER30> A thought occurs to me that maybe public software could be funded by the public, via taxation. I don't think that would be any kind of panacea, because you can see what happens with other publicly funded things, but it's worth consideration - especially if public software is considered vital to the rest of the economy.

<comment><USER31> Great idea in theory, but as you fear I think this would quickly be bastardized into more private military-industrial complex funding.

I would expect a tax-funded OpenSSL to be developed mostly in secret, in cooperation with the NSA, to be extremely expensive to develop/maintain, and to most definitely have backdoors.

<comment><USER30> Yes, I think you're right. It is probably better for most public software to be independently produced, outside of the context of companies or governments.

Another way to tackle the problem might be to ensure that people who want to make public software have the time to do so, because that's usually the main limiting factor with any sort of volunteering.

</comment></comment></comment><comment><USER32> I don't believe we have failed. We have simply not yet succeeded. It's not like things used to be great, and then got screwed up. The tools and libraries we have now are so much better than they were ten years ago, and infinitely better than they were twenty years ago. We have been making steady progress and will continue to do so.

Sure, it could be going faster if someone threw more money at the problem. But right now there are thousands of top-tier developers working on tooling for the rest of us. Intel, Redhat, Apple, Microsoft, Google, and many others pay full time developers to work on important open source projects. Things are looking pretty good, we just need more time.

</comment><comment><USER33> I'd get out and shovel simply because it's more interesting than sitting in the car, bored and getting cold.

Also, I contribute to open source because I intensely enjoy it - far more than writing software I was paid to write.

<comment><USER22> Indeed, and everyone thanks you for it, but others enjoy freeriding. I think the actual game-theory is clearly simplistic. You could think of it more as being at home and having work to do rather than go shovel, so it costs you in other ways. It's not just shovel or be passive and wait.

</comment></comment><comment><USER34> This is cool. You can then phrase your plea for donations as something like: "Every 10 dollars you pledge makes others give us up to $100, your donation has 10x power!"

Also you could use with the fact that at the beginning of a campaign, your pledge doesn't have much multiplicative power but doesn't cost you much while at the end it costs you the full amount but you get huge multiplicative power.

</comment><comment><USER35> I had this idea earlier this year and investigating how to seriously pursue it was in my 2015 todo list. Great to see other people moving on this.

</comment><comment><USER36> I think it would be great for both Snowdrift and Wikipedia if Wikipedia endorses Snowdrift and attempts using the platform to raise funds.

</comment><comment><USER37> I think this is the beginning of an interesting idea, however, the specific funding aspect seems like we could end up with the same dilemma, where people fund flashiness instead of the boring infrastructure projects. I'd rather see effort made for a sort of United Way for open source, where you give money, and their accountants audit projects, and give to groups based on need and value to the community.

Furthermore, I think this is a place where we need outreach to more than coders. This is a good start, but getting donations, and doing all the bookkeeping can be a pain if you're a non-profit. So having accountants willing to sit down with projects and getting things in order so they can set up as a non profit will make companies more willing to donate because they can write it off on their taxes; being a 501(c)3 from the beginning makes that process a lot easier.

<comment><USER12> See [https://sfconservancy.org](https://sfconservancy.org)

</comment></comment><comment><USER38> Most software that we write depends on one or more 'free' libraries that we embed into our projects (eg. express.js, libopenssl, CocoaLumberjack or jquery). Maybe your project is impossible without a certain library or maybe it saved you weeks or months of work. The fact is, we build on the work of others, who give it away for free. They make our ideas possible.

Concept: The people who developed the libraries are part of my team. Just like the people who contribute code to my project.

If we look at it that way, it becomes a lot easier to determine how OSS should be funded.

If my project gets a donation from a satisfied user or company, wouldn't it be morally correct to 'forward' a slice of that to some of the libraries which make my project possible ? It wouldn't just be morally correct, it would be a great satisfaction to be able to share the user's generosity with them.

</comment><comment><USER39> Snowdrift.coop is an interesting idea but I'm not sure how well it would work in practice. If you consider his example of improving on open SSL I guess you'd get a bunch of companies saying we'll chip in say $10k as long as other companies do too. Then assuming that happens you'd have a money to pay some developers but that might not actually result in a better SSL. Just raising money does not necessarily produce good software.

In practice a lot of stuff seems to get funded by corporate sponsors or corporations just building stuff and making it open. Examples -

Rust - funded by Mozilla and perhaps the project most likely to lead to better SSL and similar?

Go, V8 etc - <USER2>

OpenSSL - contributed to by Nokia, Huawei and others

Maybe Snowdrift can do better? Maybe not?

<comment><USER22> Ongoing donations helps with accountability. But otherwise, funding isn't a guarantee or anything. But if you look at where good software is, _really_ good and robust, you don't find it from totally underfunded projects. Mozilla is way better funded than most other free/open software.

</comment></comment><comment><USER40> I don't think libre or open source is broken. I think some projects are broken. I think other projects are those people simply don't like, don't want to fund, and have to use because there are no other options. With some creativity and planning, open source projects can be self-sustaining, but they have about the same success rate as any other startup. The upside is that all progress doesn't evaporate when an open source project fails, it gets forked or consultants can transition people to new tools.

</comment><comment><USER41> If our society values sharing and condemn selfish behavior everything would be ok. But at the moment our neo liberalism capitalism values none cooperative egoists.

It is our ideas and virtues that have to change.

<comment><USER22> One step at a time. Showing people that others also care is huge. It's easy when isolated to feel helpless. Big corporate multinationals are all connected and have strong business ties and networks and work to actively divide consumers so that we just choose what to buy when we go to the big box store or surf Amazon etc. That's why cooperatives are so important, and we need more of them on a large scale on the internet.

</comment></comment><comment><USER42> IMO the problem isn't that there are less resources dedicated to open source stuff than to commercial projects. The problem is that there is much less effort and especially polish dedicated to any not user facing aspescts of software. Internal libraries are almost certainly even more half-baked and full of shitty code than most open source projects.

</comment><comment><USER43> Ideas like this have been around for a while, but never seemed to take off. Maybe in the era of kickstarter and similar things, it's more likely to succeed.

It's likely to work better for existing projects that need extra work, though, because it's not going to be easy to get people involved in something that doesn't even exist as a proof of concept.

<comment><USER22> Indeed, Snowdrift.coop says it's really for existing projects, not for new initiatives. It's not for Kickstarting.

</comment></comment><comment><USER44> It seems to require technical talent having a conversation with project managers for their company to pay other people to be open source developers.

I think in most cases technical talent that would care about these underlying issues would rather try to become open source developers themselves.

<comment><USER45> Then why wouldn't they have a conversation with project managers for their company to pay _them_ to be open source developers, instead of other people?

</comment></comment><comment><USER46> I don't think I've ever read an opinion piece where I so completely disagree with every single point made or believed the author has completely inversely represented the reality he is trying to change. Interesting. Perhaps when I get home I shall expound on it.

</comment><comment><USER47> I thought the free market was supposed to be the most efficient allocation of resources.

<comment><USER48> It all depends on how you define "efficient." Vague proclamations about the market like this often hold utility in narrow contexts, but abstracted as a general rule rely on circular reasoning.

</comment></comment><comment><USER49> The quadratic growth dynamic for individuals looks dangerous to me. Change the x to x^2 in the exponential growth equation and you get a singularity.

<comment><AUTHOR> I don't think it's quadratic for individuals. Individuals give (base + incr * other_pledgers)... the total donated grows "quadratically", but for the pledgers it's just linear growth based on the number of other donators. Since pledges are bounded per-user, it's subquadratic as the project starts hitting the pledge limits of their users. (Which makes sense since of course all the accounts have to balance and users aren't going to be willing to write blank checks.)

<comment><USER50> Yes, they say that the amount grows "up to the amount you have in your Snowdrift.coop account which you of course control".

</comment></comment></comment><comment><USER51> Not being paid is integral part of open source development. It keeps the incentives to produce quality, lean code straight.

<comment><USER48> Open source isn't entirely a labor of love, there are people that do get paid for their open source development. Unless you're ready to back up your claim with analysis of contribution quality based on employment status I could just as easily point to different properties of the open-source model as the driving factor.

<comment><USER51> No, I don't have statistical data, but I've experienced both sides in person.

The crucial difference is sensitivity to ROI.

When not paid, every hour spent programming is an hour not spent with your family, not spent attending to your hobbies, not spent resting or sleeping. Thus you do your best to keep everything as lean as possible.

When being paid, keeping things lean is still a nice idea, but you don't care that much any more. After all, you are going to spend same amount of hours on the project whether you keep it lean or not.

</comment></comment></comment><comment><USER52> If anybody is interested in exploring anything like a 'gitcoin' please message me.

</comment><comment> Ono-Sendai An alternative: pay for open source software development out of tax revenues.

<comment><USER53> I disagree with this. There are only a handful of OSS projects that are acceptable and I don't trust anyone in government to make a decision on which ones to fund with my tax dollars.

If you need funding for a project, go commercial or have a commercial counterpart. The market will decide which ones get funded and which ones don't.

<comment><USER54> Academic research is funded through taxpayer money, and, as an academic, I can assure you that much of it has a much lower impact than many open source projects.

</comment></comment></comment><comment><USER55> It's a free software problem. Software would be funded if it was paid for.

<comment><USER22> Well, exactly. The entire issue only applies when talking about public goods. Proprietary software is not a public good.

</comment></comment><comment><USER56> There is also gratipay.com (formerly Gittip)

<comment><USER22> Snowdrift.coop discusses Gratipay (which they say mostly supportive things) in their review of all the other crowdfunding sites [https://snowdrift.coop/p/snowdrift/w/en/othercrowdfunding](https://snowdrift.coop/p/snowdrift/w/en/othercrowdfunding)

</comment></comment><comment><USER57> tl;dr Arby's sells horrible roast-beef sandwiches

</comment><comment><USER58> [https://snowdrift.tilt.com/launch-snowdrift- coop/checkout/pa...](https://snowdrift.tilt.com/launch-snowdrift- coop/checkout/payment?amount=100000000000000000000000&reward=0)</comment>


GFS: Evolution on Fast-forward - <AUTHOR> http://queue.acm.org/detail.cfm?id=1594206

<comment><USER2> This article has been discussed before. The last submission is only 20 days old.

<http://news.ycombinator.com/item?id=1191534>

<http://news.ycombinator.com/item?id=757204></comment>


Pragmatic W3C Standards - <AUTHOR> http://blog.bradgessler.com/pragmatic-w3c-standards

<comment><AUTHOR> I heard a few other good reasons for following standards including accessibility and ease of maintenance. I left those out because they really don't matter so much for hackers. My intentions are to inform how following standards can save time building applications.

A lot of the "softer" justifications for building standards compliance websites, like accessibility, are just positive side-effects of following standards for more pragmatic reasons.

<comment><USER2> How is the validator gem used in rails? I'm thinking of starting a rails project and I'd like to validate every single produced page, every time it's produced.

I'd assumed the best way to do it would be cache the output and run the validator 'offline' but I couldn't find any rails or rack projects that do this.

<comment><AUTHOR> I'm not sure, but I can say that it will slow your tests down quite a bit. If you're going to test every page you might just consider making your markup XHTML strict and test to make sure the XML is well formed.

</comment></comment></comment><comment><USER2> I liked the bit about unspecified failure modes in HTML 4. Very important point, though I feel somewhat sad that such persuasion is necessary.

My way of looking at it is: you're trying to produce a certain kind of output that is externally specified and there are available 3rd party tools that can validate it. Why wouldn't you automate testing?</comment>


Fast Inverse Square Root (2003) [pdf] - <AUTHOR> http://www.lomont.org/Math/Papers/2003/InvSqrt.pdf

<comment><USER2> I was just talking about this paper with a coworker on Friday.

One of the best parts about this code is its initial implementation in Quake III. The comments are especially funny. It's on Wikipedia - [https://en.wikipedia.org/wiki/Fast_inverse_square_root](https://en.wikipedia.org/wiki/Fast_inverse_square_root)</comment>