ReactOS was selected for Google Summer of Code 2016 - <AUTHOR> http://www.reactos.ru/project-news/reactos-participation-google-summer-code-2016 <comment><USER2> Given Microsoft's recent moves towards a freemium desktop operating system, with its numerous privacy concerns and baked in advertising, it's great to see an actively developed alternative for those who make use of software originally developed for Windows. Lock-in is a terrible thing.

<comment><USER3> > Given Microsoft's recent moves towards a freemium desktop operating system

It's not even free. New computers still pay licenses for windows 10. The "free" upgrade offer ends in July.

<comment><USER2> Oops, yea, I really meant the whole Windows-as-a-service direction. I could see Microsoft extending the free offer, though, since they appear to be aggressively pushing people to enroll in the service.

<comment><USER4> Free shmee. The Win7/8/8.1 license that grants you a free _upgrade_ sure wasn't free.

<comment><USER5> For most end consumers who didn't realize that they paid for a windows license when they bought their computer, it's just a free upgrade, no different than their iPhone updating.

<comment><USER4> Indeed, and I'm definitely not complaining that Win8 SP2 is a free upgrade from Win7+ ;) Still, only holders of existing Windows licenses qualify for it - "Windows for free" is something different, IMNSHO. But you are quite correct that an average consumer would see this distinction as pointless nitpicking.

</comment></comment></comment></comment></comment></comment><comment><USER6> ReactOS is a cool idea. Use WINE to create a Windows compatible FOSS Operating System. They aim for XP/2003 compatibility so it doesn't run a lot of newer stuff. But it is good for legacy Windows apps. With the 0.4.0 release they added more driver support, Wifi support, Audio support, etc. They need more people to work on it, and I hope that Google funds them some money as well to pay people.

So far it is in the alpha stage and needs to go to beta stage soon. It only has a 48M overhead and loads faster than the real Windows. It has EXT file system support as well as FAT support but NTFS is read only.

Someone can make a ReactOS bundle with PHP, MySQL, Apache2 so it can be used as a web server. If someone ports CLRNET or the Dotnet open source programs over to it, it can run ASP.Net stuff as well.

<comment><USER7> You're severely underestimating the massive amount of resources needed to accomplish such target, especially when compared to what the target it.

There isn't much point in throwing a massive amount of resources for building an AMP hosting environment. If somebody needs to start an AMP server from scratch and he really needs to save money, there is LAMP.

The only realistic use case of ReactOS is large-scale deployments of machines which need Windows (driver) compatibility, in which case ReactOS would save large amounts of money.

</comment></comment><comment><USER8> The Project Proposal page has a list of potential items for people to work on. Pretty interesting!

[https://www.reactos.org/wiki/Google_Summer_of_Code_2016_Idea...](https://www.reactos.org/wiki/Google_Summer_of_Code_2016_Ideas)

</comment><comment><USER9> For the love of god, leave scrolling alone.

<comment><USER10> Seconding this. Websites shouldn't push a preference like that on users.

</comment></comment><comment><USER11> The problem with ReactOS is its lack of automatic or semi-automatic OS update.

There is plan to do it, but from what I understand, it's still not available:

[https://www.reactos.org/wiki/ReactOS_Update](https://www.reactos.org/wiki/ReactOS_Update)

Security is another major problem with this OS. They are proud to have produce 9M LoC, but they don't advertise how they assure this code is not full of vulnerabilities.

Do they audit the code ? Do they use static analysis tools ? Do they have specifics security practices and processes ?

I don't see any security advisory on their page. I only see a wishlist on their wiki [https://www.reactos.org/wiki/Security](https://www.reactos.org/wiki/Security)

<comment><USER12> > The problem with ReactOS is its lack of automatic or semi-automatic OS > update.

Among many other reasons why you shouldn't use it as your main OS. But not even the React Devs would suggest that you do, so I'm not sure what your point is. It's clearly still in the development stage and is almost certainly just going to be run in a VM for the time being anyway.

</comment></comment><comment><USER13> Jesus. What kind of "smoothscroll" is applied to that site? It's super annoying.

<comment><USER14> In a recursive fashion, I had to scroll past all of the comments against hijacked scrolling to get to the first comment about the subject matter. This is not the first time on HN I have had to do this. Maybe a single comment, without all of the piled on comments would lessen this distraction? My intent is serious, and I hope not taken the wrong way, but the irony is there.

</comment></comment><comment><USER15> Read this headline and thought, "First React Native, and now ReactOS. What'll they think of next?"

<comment><USER14> Yes, I also have to do a 'double-take' on these names. I know it's not the point of your comment, but ReactOS started first for those who don't know already.

</comment></comment><comment><USER16> Why doesn't Google make a free, compatible Windows clone, for the same reasons Microsoft as well as Google made free, compatible browser clones? I honestly don't understand it.

<comment><USER17> Because that's an enourmous amount of work and likely to attract hostile legal action? They didn't even create their own operating system for their phones.

<comment><USER16> Why then does MS work on Bing? Bing is more likely to infringe on Google's patents than a Windows clone is likely to infringe on MS's patents, not? And Bing is certainly lots of work.

<comment><USER17> There isn't an API issue there though, and it's not required to work in the same way so it's hard to say that it's more likely to infringe patents.

</comment></comment></comment></comment><comment><USER18> note: it's just a complete nitpick, but I just have a question

In the front page of ReactOS[0]:

> 9,000,000+ lines of code

> And growing!

Is the huge and growing codebase a pro or a con?

[0] [http://www.reactos.ru/](http://www.reactos.ru/)

<comment><USER19> I think it implies that the project is active

</comment></comment><comment><USER20> ReactOS has been going at this problem for a loooong time. It's a pretty amazing initiative, and the fact that it's taken so long goes to show how insane a kludge Windows is under the surface.

I wonder if the reason we haven't seen more work on ReactOS compared to Linux development is the commercial backing that Linux development receives from the big guys (Red Hat, IBM, et. al.) I wonder if people are wearisome of funding ReactOS beacuse of Microsoft.

<comment><USER21> Why does the fact that it's taken so long show how insane a kludge Windows is, rather than indicating that there is simply a lot of work to recreate?

<comment><USER22> While I'd love to throw poop at Microsoft, I think this is correct. If someone had to create an operating system that accepted GNU/Linux binaries without the benefit of looking at internal communication or the source code, I bet it would take many years as well.

<comment><USER23> Accepting binaries is relatively easy, you can often stub features and have the thing mostly work. See Wine project. Accepting drivers is super hard and this is the main part of ReactOS - the kernel.

</comment></comment></comment></comment><comment><USER24> Sorry, but the scrolling of the page is just confusing.

Even if it was done with a good and helpful intend. For a lot of people it's pure pain if you take control of the scrolling.

<comment><USER25> I hate to bikeshed, but the amount of wasted vertical screen space [1] makes me almost a little angry. Web designers: if you think it's a good idea to reimplement basic browser functionality (scrolling), or to emulate the UX of HTML frames, please think again.

[1] [http://i.imgur.com/IUEqFj7.jpg](http://i.imgur.com/IUEqFj7.jpg)

<comment><USER26> So many mobile sites implement this same unpleasant UI control where the header follows your scrolling and stubbornly takes a portion of the screen without adding any useful functionality, that I wonder if people know it's possible to scroll to the top of any page and see the header there...

<comment><USER27> I tried to explain the retardedness of this to management, before it was implemented. They were like "but people share more when the widgets are always visible, we A/B tested this!" It's like talking to a rock sometimes.

<comment><USER28> Who is the rock?

<comment><USER29> The more responsive and thoughtful of the two, it appears.

</comment></comment></comment></comment></comment></comment><comment><USER30> From their webpage: "Nearly ten years ago the ReactOS Project released version 0.3.0. Today we are proud to announce the formal release of version 0.4.0. ".

This is the problem. Going from 0.3 to 0.4 in TEN years means that you cannot be commercially successful.

As much as I admire ReactOS' contributors and their efforts, I have little faith in their ability to make a dent in the market.

<comment><USER30> I really don't understand why the downvotes. Can someone explain?

<comment><USER31> As outworlder pointed out being commercially successful does not seem to be a requirement to be accepted for GSOC.</comment></comment></comment>


How to debug live AWS Lambda functions - <AUTHOR> https://techcrunch.com/2018/06/04/rookout-releases-serveless-debugging-tool-for-aws-lambda/ <comment><USER2> Why aren't tools like this just available from the cloud provider? I get the sense serverless is really useful but it's developed so fast that it's suffering from a lack of native tools.

<comment><AUTHOR> Really good question. I guess it's just really hard to do.

</comment></comment><comment><USER3> Amazing it took so long to accomplish.

</comment><comment><USER4> What language are supported?

<comment><AUTHOR> Python, NodeJs, and JVM (Java, Scala, etc.) :)</comment></comment>


Nintendo is making games for smartphones - <AUTHOR> http://www.latimes.com/business/technology/la-fi-tn-nintendo-dena-20150317-story.html

<comment><USER2> >This doesn't mean we'll be seeing the original "Super Mario Bros." leaping onto smartphones anytime soon, though

Super Mario is already on phones. One can download it from Google Play. The game provides same game play and same mission and it looks perfectly optimized for smartphones.</comment>


Show HN: Artificial Intelligence Based Drug Discovery Toolkit - <AUTHOR> https://www.producthunt.com/r/2886430edfe4f7 <comment><USER2> As someone who writes a lot of software for "old-school pharma", I'll point out a few things.

1) "Old-school pharma" includes AI - we were developing AI-based software products for drug discovery back in the 1990s - so what makes this anything new?

2) Clustering chemical compounds dates from the 1980s. Interactive 2D/3D clustering are of course newer, but still ... what makes this new?

3) "tons of molecular data" in this case is appears to be [https://www.drugbank.ca/](https://www.drugbank.ca/) . That is, "the license of our data-provider" links to that page. Quoting from that page:

> The latest release of DrugBank (version 5.1.3, released 2019-04-02) contains > 13,339 drug entries including 2,594 approved small molecule drugs, 1,289 > approved biotech (protein/peptide) drugs, 130 nutraceuticals and over 6,304 > experimental drugs.

That's tiny. ChEMBL contains 1.8 million entries, most pharmas have much more than that.

So, what justifies the use of "tons of molecular data"?

4) "If a drug candidate is in the neighborhood of another molecule, there is an extremely high chance that they are related!"

How was that quantified? It's trivial to have a high true positive rate. For example, graph edit measures like in SmallWorld can make that guarantee.

But as the cluster boundary decreases, it's less and less true.</comment>


Avoiding Null Checks In Java - <AUTHOR> http://softwaregarden.io/avoiding-null-checks-in-java/

<comment><USER2> I agree, in a perfect world you don't have to check for null values on the business logic layer</comment>


The US Air Force Spent $326,000 Replacing Broken Coffee Cups in the Last 2 Years - <AUTHOR> https://munchies.vice.com/en_us/article/kzjvga/the-us-air-force-has-spent-dollar326000-replacing-broken-coffee-cups-in-the-last-two-years <comment><USER2> Summary (because it'll take a few paragraphs to get past the faux outrage): they are FAA-certified cups that plug into cabin systems, hence the price.

Still, for $1200 a pop, one would think they'd be more durable.

<comment><USER3> ObWestWing: [https://www.youtube.com/watch?v=7R9kH_HOUXM](https://www.youtube.com/watch?v=7R9kH_HOUXM)

<comment><USER4> I think I need to watch this show.

But I can totally get behind the thought pattern of making things that shatter gently into big, dull shards. There's so much thought that goes into these little things.

Although why does a sub need an ashtray. It's not like there should be cigarettes on it.

<comment><USER5> Smoking on subs was only banned at the end of 2010.

[http://edition.cnn.com/2010/US/04/09/navy.smoking.subs/index...](http://edition.cnn.com/2010/US/04/09/navy.smoking.subs/index.html)

Apparently there were "smoking rooms" on (at least some) subs.

[https://tobaccocontrol.bmj.com/content/14/4/221.1](https://tobaccocontrol.bmj.com/content/14/4/221.1)

</comment></comment></comment></comment><comment><USER6> I can't look at that square handle and not think "that was by design", also.. it seems obvious that it was designed to break at that point if it fell..

[https://www.zerohedge.com/sites/default/files/styles/inline_...](https://www.zerohedge.com/sites/default/files/styles/inline_image_desktop/public/inline- images/AFcup2.jpg)

</comment><comment><USER7> [https://en.wikipedia.org/wiki/Black_budget](https://en.wikipedia.org/wiki/Black_budget)

<comment><USER8> "The black budget can be complicated to calculate, but in the United States it has been estimated to be over US$50 billion a year – a greater figure than current United States expenditure for education."

Imagine cutting the black budget in half and more than doubling the education budget with that money. Suddenly free community college for all is doable. And you still have 25B for your hidden activities!

<comment><USER9> Medicare is $702bln/yr or $12,300 per recipient. Canada spends $3,000USD per capita and provides healthcare to everyone.

Think of what we could do with the $526.5bln that would be saved if US healthcare costs were brought back inline with other advanced economies.

</comment></comment></comment><comment><USER10> The reason these things are crazy expensive is that the spec for the cups is written by the same government that writes the form you use to do your taxes.

The government is not smart enough to have a housing dollar pot that locks in place and then use cheap cups.

Dumb.

</comment><comment><USER11> And there I thought Yeti cups were expensive!!!</comment>


Did Facebook Just Build a Kickstarter Competitor? - <AUTHOR> http://techcrunch.com/2015/11/18/facestarter/ <comment><USER2> This is not a Kickstarter competitor if it only serves non-profits. But, it does not mean they will not be a competitor in the future. Look at Paul Graham's tactics section about 'Want to start a startup' [4].

4\. [http://www.paulgraham.com/ambitious.html](http://www.paulgraham.com/ambitious.html)

<comment><USER3> I would be interested to see a follow-up to that post. It looks like 3, 4, and 7 are well underway in a number of companies.

What are the current batch of insanely ambitious ideas?

<comment><USER2> I can't find the fellowship list anywhere. I've been trying to find them since they started giving the grants.

Anyways, thanks for asking. I wanted to see the batches as well so here are the links

1\. [http://ycuniverse.com/ycombinator- companies](http://ycuniverse.com/ycombinator-companies) 2\. [http://techcrunch.com/2015/08/19/here-are-the-52-startups- th...](http://techcrunch.com/2015/08/19/here-are-the-52-startups-that- launched-at-y-combinator-summer-2015-demo-day-2/) 3\. [https://triplebyte.com/ycombinator- startups#q=&page=0&refine...](https://triplebyte.com/ycombinator- startups#q=&page=0&refinements=%5B%5D&ts=1447933710)

</comment></comment></comment><comment><USER4> I find headlines that ask a question very grating.

<comment><USER5> See Betteridge's law of headlines.

[http://en.wikipedia.org/wiki/Betteridge%27s_Law_of_Headlines](http://en.wikipedia.org/wiki/Betteridge%27s_Law_of_Headlines)

<comment><USER6> Hacker News's law of Betteridge's law is even more accurate:

"Any submission that ends in a question mark will contain at least one comment referring to Betteridge's law."

<comment><USER5> Ha. I suppose there's a meta-law for referring to this law, too.

</comment></comment></comment></comment><comment><USER7> I think this could be abused horribly, the campaign and payment information appearing inline with facebook content may make a fraudulent page appear far more legitimate than they are.

<comment><USER8> It's Facebook's responsibility to manage that. If it becomes a problem, users will stop trusting Facebook and it will damage their brand. Facebook is assuming the risk and reward of building this.

</comment></comment><comment><USER9> I'm not entirely sure with the outcome of this possible evolution in crowdfunding, should it be succesfull. The crowdfunding business would get more saturated with 1000's of copycat / flavor of the month crowdfund setups or any random flavor of the month "i need money for XYZ, please fund me" crowdfund page. In addition, as the article states, the possibility of scams would rise as well on such a massive platform. I do get that facebook is a great platform on which to introduce your product on, but in the long run shifting the crowdfunding platform to facebook would harm the quality of innovation.

<comment><USER10> I don't think Facebook, or their userbase, care. :/

</comment></comment><comment><USER11> I've always thought FB with its massive userbase has a tremendous opportunity to enter most any business it wants with a huge advantage - kicking myself for not buying shares, time will probably show it is even cheap now.

</comment><comment><USER12> The .gif shows that fb already knows your CC number.

I'm curious about how many people have given fb such information? None of the people I know have done that.

<comment><USER13> From [https://www.facebook.com/help/414383411931263](https://www.facebook.com/help/414383411931263)

If you've ever paid for an in-game purchase, donated to charity, sent payment to a friend, bought an item through their groups - they'll have your details.

I've never done any of those - but I'd wager several of my friends (and yours) have done so.

</comment></comment><comment><USER14> Moving forward it could transform into a Patreon competitor, and it would make sense to do that. Since social networks help creative personnel capture a lot of eyeballs, they might aswell help them raise funds.

<comment><USER15> This. I think this is much more in line with the recurring donation model they have already launched. The next logical step is simply to say "Hey you know all those non-profits there? They will now be accompanied by your favorite personalities, publications, podcasters, apps etc that you're already sharing here."

Facebook being Facebook, it could morph still further to become Kickstarter and even an investment platform (AngelList) eventually, but patronage is the more natural fit.

</comment></comment><comment><USER16> just a small observation: it is interesting that they use vimeo instead of facebook video player on newsroom.fb.com specifically in this case here [http://newsroom.fb.com/news/2015/11/introducing-new-tools- fo...](http://newsroom.fb.com/news/2015/11/introducing-new-tools-for- nonprofits/)</comment>


Agile development not suitable for UK government projects - <AUTHOR> http://www.computerweekly.com/blogs/public-sector/2011/04/agile-will-fail-govit-says-cor.html <comment><USER2> Seven out of ten government IT projects fail[1]. The last government wasted 26 billion pounds on projects that ran over budget or were scrapped[2]. Government IT procurement is an absolute shambles and I cannot imagine how it could be any worse.

British libel law prevents me from stating an opinion about Mr Maughan or his work. The defence of fair comment is so weakened as to be useless. As such, I will not state any opinion on the quality of this article. Fortunately, a comment which is merely abusive is not libellous, so I can call him a fuckwit.

[1][http://www.silicon.com/management/public- sector/2007/05/18/f...](http://www.silicon.com/management/public- sector/2007/05/18/failed-seven-out-of-10-gov-it-projects-39167189/) [2][http://www.v3.co.uk/v3-uk/news/2001612/labour-accused- wastin...](http://www.v3.co.uk/v3-uk/news/2001612/labour-accused-wasting- gbp26bn-failed-it-projects)

</comment><comment><USER3> "Under Agile projects, you pay a given amount of money for a set amount of effort. But you can't guarantee a specified outcome for a specific price."

You always run this risk when writing software. The only difference with waterfall is that you can pretend that you won't have cost overruns.

If you want a guaranteed price for something, don't use custom code.</comment>


6.912 - MIT Pokerbot Competition - <AUTHOR> http://pokerbots.mit.edu/

<comment><USER3> I'm one of the guys behind this. I realize it's MIT students only right now (we have a special 1-month term in January with no classes for competitions like this) but if there's enough interest we would love to hold an open tournament in the next few months.

We're also looking at opening our scrimmage server up to the public this month if there are enough people who want the intellectual fulfillment of competing :)

Edit: Created a small mailing list. Feel free to sign up if you want to be updated when we decide to launch an open tournament (towards the end of the month, most likely).

<http://mitpokerbots.com/interest>

<comment><USER4> Thanks for setting this up - it sounds really awesome. Could you set up a mailing list or something where we can subscribe to updates?

<comment><USER3> Yep, on it right now. Will post the link in a few minutes.

Edit: It's up, see my above comment.

<comment><USER5> Will we get a chance to compete against MIT students?

That's mostly what I'm interested in; I'll either get schooled by MIT, or school MIT. Yes this is a counterchallenge. ;)

</comment></comment></comment></comment><comment><USER4> Really interested to hear more about the details, especially the format - <USER2> it be a single tournament or a cash game with thousands of hands? Since it's all bots playing, I assume they'll play through enough hands/tables to diminish/negate the role of luck.

Will the bots adopt to patterns in the other bots' playing styles? Most interestingly, will a bot come out of this that can go head-to-head with the likes of Tom Dwan, Phil Ivey and other poker pros? Most bots I've heard of in online poker just follow a set of rules for what to do with certain hands in different positions and scenarios. A bot that can adapt/pick up on betting patterns from the other player (over the course of thousands or tens of thousands of hands) would be really cool.

<comment><USER6> I would expect most competitors will attempt to design a simplified GTO/balanced (un-exploitable) strategy, with some base assumptions what's considered as "good poker". The only way I can see teams approaching a more exploitive strategy is if the tournament was filled with lots of very weak 'house bots' with highly exploitive strategies (like the previous rock- sissors-paper bot competion that was filled with lots of non-GTO house bots that could be predicted and exploited).

No known bots have come close to playing competitively heads up or ring in big-bet games (such as no-limit or PLO) above the micro/lowstakes. However bots already exist that are very strong at limit heads up.

<comment><USER5> With enough number of hands played and space for storage of history it should be possible to exploit each other, or at least the opportunity is there.

<comment><USER6> Certainly possible, and teams can utilise off-the-shelf analytics tools to aid in the analysis (if that's allowed); however using this information beyond very simple adjustments (such as preflop) is very difficult. Also any deviation from a balanced strategy will open up the bot to counter- exploitation.

As I say if dummy players are in there (playing easily exploitable passive or maniacal strategy) then I think there's good reason to implement an exploitive strat; otherwise the effort probably won't have the payoff amongst other static-strategy players.

</comment></comment></comment></comment><comment><USER7> Another, potentially more relevant to HN MIT IAP this year is the web app security Capture the Flag: <http://mitctf2011.wikispaces.com/IAP+Announcement></comment>


Why I banned a book: How censorship can impact a learning community - <AUTHOR> http://crln.acrl.org/content/74/7/368.full

<comment><USER2> Book banning used to be scary when printed books were the only way of conveying long-form information to the public. Now authors can release the contents on the internet, which isn't perfect (less pleasant to read, no royalties) but good enough to protect freedom of speech.

After hundreds of years of the tyranny of book burners, technology has routed around the problem.

<comment><USER3> In locales where access to higher technology is limited, I imagine that book banning could still be quite effective.

<comment><USER4> In the Middle East, forbidden literature is best distributed digitally. It's far easier to conceal, transmit, and even produce. There are some Arabic book clubs online that have more materials than most physical libraries. Two great examples are the atheist and Marxist communities. Neither could have thrived so much without the internet.

</comment></comment></comment><comment><USER5> This reminds me of what many popular websites did during the SOPA and PIPA discussion. Though most sites simply displayed some mock warning or announcement stating "This is what you could see if SOPA was passed".

Instead of or in addition to fighting NSA surveillance operations and requests I wonder if sites could instead display a message or page detailing what the NSA would be provided with if they ever came asking for your information.

records maintained on your account: search: "Funny pictures of cats" IP: 192.168.0.1 account: email@example.com date: 01/01/2013 12:00:00.000 referrer: www.example.com

etc . . .

<comment><USER6> That's a clever idea, but I think that most users would be disconcerted by the sheer amount of information that's collected by most web sites already. It would raise the question, "why do you need to collect all that?" before anything else. Which is a good question to be sure, but probably not the one that most companies want to be answering.

<comment><USER5> You're probably right about the web site getting the wrong kind of attention from this. I can almost see a government organization doing this instead, either as a public service or after some open information law is passed in reaction to public opinion on NSA surveillance.

The U.S. government might just be bureaucratic and fractured enough.

</comment></comment></comment><comment><USER7> >...on a campus of 3,000, only eight people actually asked for a meeting with me to discuss the reasons I banned the book

I think this is really the most interesting part of the story- people are willing to complain but not take reasonable actions to remedy the situation. I think this is a symptom of a deeper problem in our society.

<comment><USER8> YES! +1k.

> Some used Facebook as a forum to make rude comments from the relatively safe > distance social media provides. This is the sole purpose of facebook, as far > as I can tell. Give a loudmouth a microphone and then try to ignore them as > they shout as loudly as possible.

... and I reference the "Facebook experiment" article a while back: [https://news.ycombinator.com/item?id=5811564](https://news.ycombinator.com/item?id=5811564)

</comment></comment><comment><USER9> And the favorite lists and references to Godwin's law ensue:

      * Steal This Book
      * Anarchist Cookbook
      * Uncle Tom's Cabin
      * Mein Kampf
      * Das Kapital
      * The Satanic Verses
      * Captain Underpants (for the kids, obviously)

Feel free to criticize or bust out some better titles. :)

<comment><USER10> The AC wasn't really a "book" per-se, but a collected volume of snippets, wasn't it? I'd hardly call that a "banned" book though. I mean, it contained illegal activities which would have been verboten in most places.

When I was in high school, there were kids who would frequent online forums (and a myriad of ad-heavy free hosts including GEOCITIES!!!!) that would put up The AC, using the library computers.

They used Websense to filter content, which was about as effective as a sieve since they hadn't contemplated open proxies. 10 - 20 New ones which would pop up from time to time and the IPs would get traded on those forums.

From the copies that got passed around on floppies (aaah, floppies. Remember those?) I'd say The AC was a collection of (mostly bad) texts assembled from various authors who posted these on Usenet and the like previously. I remember there were multiple versions; nothing really "official" since many were edited and compiled by independent authors and all are guaranteed to get you in hospital or jail.

I think a couple of idiots in our school accomplished both.

<comment><USER11> [http://en.wikipedia.org/wiki/Anarchist_cookbook](http://en.wikipedia.org/wiki/Anarchist_cookbook)

No, it was a book, published in hard copy. And it's probably older than you are.

The best story I've read on the Internet about the Anarchist cookbook was a guy who claimed that he accidentally blew up his middle school with home made dynamite in Ireland, and only got away with it because the government blamed it on the IRA. (I can't seem to find it right now though.)

The fastest way to falsify that story is if the recipe for dynamite in the Anarchist cookbook is wrong. (Which it may very well be, as the book is full of wrong information IIRC.)

<comment> Tuna-Fish I googled for it and found a "anarchist cookbook v2000". It contains recipes for dynamite and nitroglycerin that are correct, but stupendously dangerous to do.

</comment></comment></comment></comment><comment><USER12> Librarian activists use the word 'ban' differently than everyone else. To most people, to ban something is to prohibit it. To librarians, to ban a book is to keep it out of stock. This may still be morally wrong in some situations, but it is dishonest of these activists to conflate such an action with book burnings and other more radical forms of information suppression.

</comment><comment><USER13> The modern way to ban books is steganography-like: hide them in a sea of information.

<comment><USER14> Imagine this: services like amazon take over all the dead-tree book market. The government cracks down on piracy, and eliminates that way of getting books. A few big players end up controlling all the books on drm'd electronic devices.

The future could be an easy place to ban books.

<comment><USER11> "The hardcore flying saucer cultist, on the other hand, is a very special personality who has thus far escaped close scrutiny by the scientific community. Contrary to Buckner's finding, a poll of 250 hardcore "ufologists" in the United States in 1969 determined their median age to be 31. Teen-agers and house-wives constitute the most active groups, collecting clippings of sightings and issuing amateur newsletters and magazines, usually mimeographed. The classic search for identity plays an important role. The teen-aged ufologist is most often isolated on a farm, or separated from his peers because of his eccentric personality." _The Flying Saucer Subculture_ , John Keel (1973)

[http://en.wikipedia.org/wiki/Mimeograph](http://en.wikipedia.org/wiki/Mimeograph)

I'd always wondered how you produced a zine before personal computers.

</comment></comment></comment><comment><USER15> Scary still and somewhat related is: instead of banning books, just change the content to fit your needs. Like Nineteen eighty-four.

Oh, and like this: [http://www.independent.co.uk/arts- entertainment/books/news/t...](http://www.independent.co.uk/arts- entertainment/books/news/twains-classic-loses-the-nword-for-modern- age-2177172.html)

</comment><comment><USER16> Is there something about this post that got it killed automatically, or did I just get banned or something?

[https://news.ycombinator.com/item?id=6069755](https://news.ycombinator.com/item?id=6069755)

edit: Oooh, I'm guessing the reference to H a ckaday?

</comment><comment><USER17> > _Our unorthodox (okay, heretical) experiment was very successful in > highlighting how a simple bureaucratic decision can curb our freedom to > read._

Huh? Isn't the lesson more like, "People react very badly when a bureaucracy tells them what they _cannot_ do"?

Or, as Oscar Wilde put it: "There is only one thing in life worse than being talked about, and that is not being talked about."...or, in the OP's case: "Better to be censored than to be ignored"

Did anyone else in junior high/high school actively seek out the books on the Banned books list just to see what the hell was so interesting about them?

\----

A more relevant experiment would be to just hide certain books for a year and see if anyone notices. However, the percentage of a community that will read any one book in a year is so small that you wouldn't be able to discern any overall negative effect from hiding it.

<comment><USER18> I guess the "very successful" part was really the 8 people trying to understand the reason the book got banned, and the (few ?) other constructive responses to the announcement.

Especially if the other years' banned book weeks got no measurable reaction at all. People on facebook reacting shallowly to some announcement should not be news.

<comment><USER19> > banned book weeks

The problem here is that it isn't 'banned' books, it's 'banned _and challenged_ ' books, which means 'any book anyone has complained about', which means Harry Potter qualifies.

You cannot tell me with a straight face that Harry Potter has been meaningfully banned in the Western world.

It's a pious lie which reduces an important topic to a laundry list of things the most extreme prigs got uptight over in the course of the past year or so. It trivializes the whole issue.

<comment><USER20> > You cannot tell me with a straight face that Harry Potter has been > meaningfully banned in the Western world.

The only effect of a library banning Harry Potter was increased sales at the local Wal-Mart.

</comment></comment></comment></comment><comment><USER21> This reminds me of a similar story about how creative messaging can make people appreciate books and free speech: [http://vimeo.com/35758683](http://vimeo.com/35758683)

</comment><comment><USER22> It's a great experiment. Sometimes you have to shake things up to keep the importance of an issue alive. Of course things take a life of their own on the internet and Facebook.

</comment><comment><USER23> that's funny... it looked to me like one of the better promotions you could have had for the banned book in question. In fact, the whole thing seemed, well, like an unsubtle advertisement, unsubtle to the point where it became less effective.</comment>


Utilize Tech Conferences for Launching Startups? - <AUTHOR>

Anybody have any experience with launching an application in or at the same time as a tech conference?  Which ones have you done or are planning?  How are you getting in there and into the PR? <comment><USER2> I don't recommend it. Conferences happen on fixed days. It's very unlikely you'd otherwise launch on that exact day. So you'd either be launching late or early, both of which are dangerous. You'd either sit on something launchable and risk having a competitor launch first, or launch something incomplete that users disliked.

<comment><USER3> You should distinguish between a product push and media push.

You'll find that you can say you're launching even if the functionality has already launched a few days before hand.

This has been the case for some iterative launches for me, so maybe it's different for a site launch.

We launched Tipjoy at a publishing conference. It wasn't a good idea, as TechCrunch posted a story a bit early while we were on a flight. I think my exact thought at the time was: "fuck!"

If I were to do it again, I would have an open-to-anyone site for a few days before "launching" at the conference. I fixed more bugs in the first 24 hours of launch than the previous week of development. (and keep in mind this dev time was mid YC push)

<comment><AUTHOR> Thank you both (pg and ivan) for the suggestions! I will definitely lean towards distinguishing between the product and media pushes.

And when you were coordinating the conference push, was it actually integrated or announced at the conference? Or just alongside the buzz with some other form of PR on the same day?</comment></comment></comment>


The coming death of paper for information storage - <AUTHOR> http://www.readwriteweb.com/archives/the_coming_death_of_paper.php

<comment><USER2> Is this a PR hit?

From the article: Leave a comment or trackback on ReadWriteWeb and be in to win a $30 Amazon voucher - courtesy of our competition sponsors AdaptiveBlue and their Netflix Queue Widget.

<comment><USER3> _"... Is this a PR hit? ..."_

I'd say yes. I had a quick peek at the types of stories on RRW and they follow the familiar pattern

\- subject

\- mild discussion of article

\- quick summary

\- plug

Also if you check the founders about page [0] you can see there is a link to a IR marketing company, nooked. So there is a fair chance the articles are mostly _suggested_ themes from editorial to the writers directly from paying client. Of course this is all conjecture but it looks like a money trail of sorts - reader to article, article to writer, writer to founder - founder to marketing company.

[0] About ~ <http://www.readwriteweb.com/about_readwriteweb.php>

<comment><USER2> Thank you. I only asked because it didn't follow the usual format of user, user, expert, expert, client with money.</comment></comment></comment>


iOS 'iBoot' source code posted online, Apple issues DMCA takedown notice - <AUTHOR> https://nakedsecurity.sophos.com/2018/02/08/ios-iboot-source-code-posted-online-apple-issues-dmca-takedown-notice/ <comment><USER2> Streisand Effect in 3...2...1...

 _Perhaps the concern should be how this code leaked into the public domain in the first place._

Maybe not everyone who works at Apple completely toes the line (as evidenced by all the schematics that leak...), and some are starting to get disillusioned about the whole "security" thing and realise what they're really building. IMHO this is a good thing. "Eat enough apples and you'll find a worm inside one", as the saying goes...</comment>


Senators ask if Facebook 'really' lets users opt out of location tracking - <AUTHOR> https://arstechnica.com/tech-policy/2019/11/senators-ask-if-facebook-really-lets-users-opt-out-of-location-tracking/ <comment><USER2> I applaud the scrutiny but it's way too slow. By today Google and Facebook and Amazon combined likely have the physical and virtual movements, geographical residencies, the geographical key places, and the personal and commercial interests of most, if not all, of the people connected to the internet.

The hammer needs to be quicker and hit much harder (north of 20% revenue, for example) if we want any measures to be effective. With that tempo the current internet won't exist until the lawmakers wake up to the realities of the big internet corporations.

<comment><USER3> Useless or useful(at your own taste), but it would be nice if they have to wipe out that kind of data from time to time. Your life evolves your data should evolve with you too(if you want to). You really don't remember everything from your past, but this characteristic is being externalized to third parties. I understand the government should retain some of this data, but why a private company should retain it too.

<comment><USER4> I really like it when facebook shows me random pictures of my kids from 5 years ago. This data is far more valuable to me than if I kept it, if only because looking at those pictures becomes a bigger event - thus one I do less often.

<comment><USER5> Things like Apple's Photos do this too but without the accompanying privacy risks.

</comment></comment></comment></comment><comment><USER6> Facebook doesn't let you opt out of anything. Consent isn't a term they understand

<comment><USER7> I would prefer to not pretend that they can't understand the ethically reprehensible decisions they make.

<comment><USER8> > _they can 't understand the ethically reprehensible decisions they make_

Selection effect. Those who thought through what they were doing quit. Those remaining are happy to turn a blind eye for a paycheque (out of greed and/or necessity).

</comment></comment></comment><comment><USER9> As long as they store your ip in their logs, they know where you have been.

<comment><USER10> Would it possible to somehow run a local proxy or tor-like program that hides your IP address from internal programs and only provides localhost or some such. And then on the other end I suppose you'd have to connect through some sort of tor node to connect to their actual servers too. Poorly thought out question, but I've never really thought of something like a reverse tor that hides things from your own personal applications.

<comment><USER11> If the app doesn't need internet than blocks its access to the network.

If it needs access use a VPN.

If you're trying to evade cross device fingerprinting then I can get you some info.

If you're trying to evade state sponsored attackers then you're probably already hosed.

</comment></comment></comment><comment><USER12> I'm reminded of the lyrics: You can check out anytime you like but you can never leave.

I suspect even if facebook, google, apple, etc let users "opt out" explicitly, they use other methods to implicitly track users. If all else fails, they can buy data to "fill in the blanks" later on.

</comment><comment><USER13> Why don't laws about installing a gps tracker on a car apply to installing a gps tracker on my person?

Facebook is exactly breaking the law at least in many states.

Its so clearly illegal and _wrong_. I really don't understand why someone doesn't stop them.

Can I form a corporation, employ myself, then act with impunity too?

<comment><USER14> The 4th amendment guarantees protection against unreasonable search and seizure by the government.

Wiretaps can (depending on state) takes hundreds of pages of paperwork, and months of documentation and review, before they get approved. But if you work for a company, and they tell you that they are monitoring phone calls made from company phones, you just have to deal with it.

<comment><USER13> What does the 4th amendment say about non law enforcement persons installing a GPS tracker on my car.

Can I go and buy a gps tracker and install it on your car? If not, why is Facebook or Google or whoever allowed to install one on my phone?

It had nothing to do with the 4th amendment. I can buy a GPS tracker on amazon right now. You don't have to be a cop to install a tracker.

<comment><USER15> Depending on where you are, there may be laws regarding stalking. The problem is that you "consented" (agreed) to the TOS when you signed up.

<comment><USER16> Facebook tracks you even if you don't have a Facebook account though. And if I signed up in 2009 did I really agree to sharing location data on a smart phone in 2019??

Completely aside I'm finding how much data my Android phone shares extremely intrusive.

<comment><USER15> You may have an argument if you never signed up, but if you _did_ , you agreed (when checking the "I agree to the TOS" box) that Facebook can make changes to their TOS and you agree to the new changes. Basically, Facebook can change their terms at any time and there's jack squat you can do about it if you want to keep using the site.</comment></comment></comment></comment></comment></comment>


Skype: Problems with sending messages and sign-in - <AUTHOR> http://heartbeat.skype.com/2017/03/problems_with_sending_messages.html <comment><USER2> I guess this overlaps with The OneDrive Issues I just submitted in another thread:

[https://news.ycombinator.com/item?id=13924823](https://news.ycombinator.com/item?id=13924823)

<comment><USER3> Also Xbox Live! Surprised this isn't bigger news [http://support.xbox.com/en- GB/xbox-live-status](http://support.xbox.com/en-GB/xbox-live-status)

<comment><AUTHOR> Also outlook seems to be down [https://portal.office.com/servicestatus](https://portal.office.com/servicestatus)

Start time: Tuesday, March 21, 2017, at 5:15 PM UTC

</comment></comment></comment><comment><USER4> It looks like the Microsoft Live sign-in is affected, hence Skype, OneDrive and Outlook - all of them are affected.

<comment><USER2> The service status page has been updated with a comment that they're deploying a fix:

 _Current status: We 're deploying a fix to restore service. Users should begin to experience service restoration as the fix is rolled out._</comment></comment>


Facebook Announces a New Design - <AUTHOR> https://www.axios.com/facebook-announces-new-design-09d86ab8-26d3-40ca-be03-371b953c3ccf.html <comment><USER2> The consolidation of social activities (such as the process of dating, dating apps, and the network effects that result) into these walled gardens makes being a conscientious objector of social media more challenging each time they announce a feature like this.

I and others don't want to use Facebook. Please don't leave us with no choice.

<comment><USER3> Coming soon: Facebook banking and insurance. More affordable rates based upon inferences from your data. Facebook will have privatized China's social credit score.</comment></comment>


Apply HN: Sort, email lib and client that sort your emails by due date - <AUTHOR> Hi,
Sort is an email client that let you sort your emails by due date. The sender of an email can set that date using a specific syntax in the email body or you, the receiver can set/change it as well once you get the email in your inbox (by forwarding it to yourself including the due date). You can set an email to done (again, by forwarding it to yourself), and if you never do and it's overdue, it will just keep rising in your inbox.
The idea would be to build maybe an open library first before a web-service. I'm not sure about the details but I would like someone to be able to use the Sort function without using the web-service inbox.
Some nice-to-have in the inbox would be to use colors to indicate how urgent the emails are.
Let me know if you want me to build that for you or if you have any question. <comment><USER2> Hm, interesting idea. I get what you're going for - inbox as to-do list, sorted appropriately.

However, there are a lot of things that make inbox inadequate as a to-do list. The thing that scares me about your idea is the special syntax; people sending me email are very unlikely to want to learn a special syntax.

Mailboxapp had a "reorder inbox manually" feature at one point, which seemed like a simpler way to achieve something similar. Have you considered whether that's suitable?

To comment on the overall vision: Recently I've been having to-do problems, and looking for a new answer, but I'm very confident that email integration is NOT the solution - for me, anyway. Most emails shouldn't be treated as todo items, they should be treated as distractions to ignore. So I would not be inclined to use a product which increased the primacy of email generated todos. Because of my experience I fear that the world is moving away from the direction of your vision.</comment>


Notebooks about everything - <AUTHOR> http://vserver1.cscs.lsa.umich.edu/~crshalizi/notabene/

<comment><USER2> most amusing to me is the change in quantity over time. There is a sizeable gap of notebook authoring from 1998 until 2003. Being curious, I had to wonder why. I looked up this fellows CV. Sure enough: this was his time spent getting a PHD @ UW-Madison, then post-doc stuff I suppose.

Not sure why, but I enjoy seeing peoples personal lives show up in funny ways like this. Maybe it makes me feel more normal. My own periphery output has drastically shrunk due to life, and always wondered if it was detectable to the outside world.</comment>


Peg/leg - recursive-descent parser generators for C - <AUTHOR> http://piumarta.com/software/peg/ <comment><USER2> If you're interested in PEGs, packrat parsers, etc., also check out Roberto Ierusalimschy's LPEG (<http://www.inf.puc-rio.br/~roberto/lpeg/lpeg.html>). It's a PEG vm for Lua, written in C, and with some tuning for better space performance.

There's an _excellent_ paper about it here -- <http://www.inf.puc- rio.br/~roberto/docs/peg.pdf>

</comment><comment><USER3> Similar: <http://treetop.rubyforge.org>

Topic hijack: Does anyone know of a parser generator lib for javascript? I can't find one on Google.

<comment><USER3> Answer: <http://code.google.com/p/antlr-javascript/>

</comment></comment><comment><USER4> Excellent link. Thanks!</comment>


Disrupt Music (Again) and Fashion Industries Through Technology - <AUTHOR> The disruption will use technology to put artists on top and technology at the bottom.<p>I'm looking for a partner preferable in the Los Angeles area with music and/or fashion industry experience. <comment><AUTHOR> Artists and customers at the top.</comment>


Ask HN: VPS management for the absolute beginner - <AUTHOR>

I have a new site that I want to build, something that I as a programmer wish existed. While there is no way this site would ever reach StackOverflow levels of success, I do hope that it will have a broad appeal and become decently successful - I'm optimistic, anyway.
I'm going to start with a shared host, possibly sticking with the company which hosts my blog since I know them well enough, but I don't think shared hosting is a good long term solution.
As such, I've been checking out Slicehost as a good "next-stage" host. The problem is that I would be completely out of my element with a VPS. I only have limited experience with Linux (I've tried it a few times on my laptop, but always ran into issues that made me give up on it - usually wireless issues), and while I'm pretty sure I could get the basics setup, I worry that I'd leave things horribly insecure or that I just couldn't handle maintenance issues.
Obviously, my idea may flop entirely, but I'd rather not get caught with my pants down if I ever got to the stage where a VPS becomes a necessity.
So, are there any good tutorials / (e-)books / articles describing how to get to know your VPS, or any other issues I should be concerned with.
An ounce of prevention, etc.
Thanks! <comment><USER2> I was in a similar position about nine months ago. I was on a shared server, and now I'm rocking a VPS with a pretty good confidence level. Here's what I did.

First, I picked a Linux distribution. I went with Ubuntu because of ease of use.

Second, I ordered a copy of "The Official Ubuntu Server Book" ([http://www.amazon.com/Official-Ubuntu-Server- Book-2nd/dp/013...](http://www.amazon.com/Official-Ubuntu-Server- Book-2nd/dp/0137081332/ref=sr_1_1?ie=UTF8&s=books&qid=1280639886&sr=8-1)) and read it from cover to cover. In some cases, I had to read chapters several times to completely understand it, but because I did that and took copious notes, I feel pretty good about things now. P.S. If you do read a book, take notes. I refer to them almost everyday.

Finally, I picked a VPS provider. I tried Slicehost, VPS.net, and Dreamhost, but finally settled on Linode. I picked them because I heard great things about them, and they haven't let me down. Back then, it was something like 386mb of RAM for $19.95. Now, they're even better. They offer 512mb for the same price! With Slicehost, you only get 256mb for that price. At VPS.net, it's 376mb. So Linode is the best deal, hands down.

Oh and Linode has an excellent user library with how-to articles on doing EVERYTHING. <http://library.linode.com/>

Hope that helps some!

<comment><AUTHOR> Thanks for the recommendations. I hadn't really looked a lot into which VPS to use yet; I saw a post recently which linked me to Slicehost, so I checked it out without really having yet had the chance to do much comparison yet.

I just skimmed over the linode library that you linked, and I am impressed. I was going to ask you for more information about installing _and securing_ Apache (nothing against ngenix; I just have more experience with Apache), MySQL, and PHP, but it seems they've beaten me to the punch. Though, if you do have recommendations for any of that, please do pass that along. More information is always appreciated.

<comment><USER2> I do! A killer tip too.

The Linode tutorials teach you one way of installing Apache, PHP, and MySQL... but there is another.

If you're using Ubuntu and you run the command "sudo tasksel", that'll launch a program that lets you pick from a bunch of preconfigured options. Need a LAMP server? Just "sudo tasksel" and select LAMP. Need a mail server? Same thing. Need an SSH server? Well, you get the idea.

In the past, I've had problems getting Apache, PHP, and MySQL to play nicely when installed manually, so this can sometimes be helpful.

As far as security tips: 1\. Use password-protected SSH keys to login as opposed to just using a password. SSH is the protocol you will use to manage your VPS. It is also what you should use (instead of FTP, which is insecure) to transfer files. 2\. Use UFW (it's short for uncomplicated firewall) to block all traffic by default and allow only necessary ports (80 for HTTP, 22 for SSH, etc). UFW is one GREAT reason to use Ubuntu. With other distributions, you have to use iptables to setup a firewall, which is incredibly complicated. UFW is easy as pie. 3\. Run the command "sudo mysql_secure_installation" to secure your MySQL server 4\. Keep the software on your VPS up to date. Run the commands "sudo aptitude update" and "sudo aptitude safe-upgrade" to do this.

<comment><USER3> As far as making installations easier, you can also check out Linode StackScripts: <http://www.linode.com/stackscripts/>

The LAMP and LEMP (nginx instead of apache) stacks are two of the most popular.

</comment></comment></comment></comment><comment><USER4> If you're looking at slicehost, then you must know they have step by step instructions to get you setup at <http://articles.slicehost.com/> This should get you pretty far.

You can always ask the community for help if you need and worse case turn to <http://www.admingeekz.com/> , <http://www.geniusweb.com/system_administration> , <http://www.supportpro.com/administration.php> or some other hourly/per case type of sysadmin service.

<comment><AUTHOR> Actually I didn't know about those articles. I browsed through the site rather casually and focused mostly on specs and prices first. I didn't think to check the "community" link (expecting it to be forums, which wasn't exactly what I wanted) until you prompted me to go look for your link.

The information there seems great to get started. Many appreciations to you.

</comment></comment><comment><USER5> Good question. I'm somewhat in the same boat as you, and I've found Linodes tutorials good.

Check them out here: <http://library.linode.com/beginners-guide/>

<comment><USER6> An offtopic question if you dont mind.When should we think of switching from a VPS to a fully dedicated server?I have a forum with around 3k members and vBullentin and the forum will grow further rather fast in next two months.

<comment><USER7> if you are buying your own hardware, you should consider it when you need 8GiB ram or spend more than $100/month, and absolutely jump when you need 32GiB ram or spend more than $500/month. (note, this changes if you only need the server for a month or two)

The thing is, hosting a small server is probably going to cost you around $100/month anyhow, so if you can get by with a vps that costs less than that, do so.

A small server with a core2duo and 8GiB ram is maybe $500 in parts. Considering that it'll last for at least three years, that's not much, if you think you'll have a server for a while.

If you are renting your dedicated server, then obviously, money doesn't matter to you, or you are planning on only keeping the server for a month or two, and you shouldn't listen to me, because I don't know what that is like.

</comment></comment></comment><comment><USER8> You're forgetting something. A shared host is inadequate for a bunch of applications not just because of the number of visitors. It might also be that it's too restricted for you.

If you need to run some form of daemon for example, or some custom app in the background. Anything that requires more control over the environment, you won't find in a shared host.

I use and like both the linode and slice host libraries.

<comment><AUTHOR> Very true.

I already have a shared host for my crappy little blog, so I was just going to develop this new thing in a restricted subdomain to see if I could get it to become what I want. I figured could create a minimum viable product there, maybe have a bit of a private beta to figure out if anyone wants to use the damn thing, then shove it on a VPS.

That said, I noticed after I made this post that both Slicehost and Linode are month-to-month no commitment type deals, so once the site/app (what qualifies to be called a "webapp" exactly anyway?) is sort of ready, I'll likely just throw $20 at the problem and start on the VPS and see where it goes.

</comment></comment><comment><USER9> Don't do that, if you are unexperienced with linux. Most people don't realize that, when running a VPS, they become an administrator with all the responsibilities. If your VPS gets hacked, it is a danger for the whole net.

My advice, go for a managed solution.

<comment><USER7> I sortof agree? if you don't know and /don't want to know/ how to be a SysAdmin, don't get an unmanaged VPS. use shared hosting if you don't have much money and fully managed VPSs or dedicated servers if you have a lot. (Note, /good/ fully managed servers should cost many times over what unmanaged solutions cost. that sort of thing is expensive to do well.)

but, if you want to learn, and are willing to put in the time, I think a VPS is a good place to start. Dealing with compromised hosts (at the very least, shutting them down) is priced in to unmanaged VPS prices.

<comment><AUTHOR> I wasn't really considering jumping directly to the VPS plan at first. I think as far as getting the site actually running, and proving itself as a concept, I can leave it on a relatively cheap shared host for a while.

My concern became that if I ever outgrew the shared host, which can happen for any number of reasons (bandwidth, needing to configure things in certain ways, etc.), I might not be able to afford to go full managed due to expense. I'm not expecting miracles for this thing financially, as it's just a minor itch I thought could do with some scratching, so full managed might never feel viable to me.

To be honest, becoming a sysadmin was never a big concern of mine, but I wouldn't go so far as to say I "don't want to know" how to do the job. I'm perfectly willing to learn, which is precisely why I created this post.

If I ever do get a VPS, it still won't be until at least a couple months from now, which gives me a reasonable amount of time to learn enough not to embarrass myself and to provide a decent foundation to learn more as I need to.

My top priority with this, and I hope I've made this clear in my comments here (I know I made it clear in my x-post to reddit) is that I want to be sure the system is secure. That is _the_ reason I'm asking for help here, as I never had a doubt that I could get the system to a working state, but I don't have the expertise yet to know when I've left something in an insecure state, and that's exactly why I asked this question: to close that gap before it becomes a real problem.

<comment><USER7> /nothing/ is completely secure.

I think off-site (and inaccessible) backups are the first thing you should think when you think about 'security' - after that, it's a relative thing.

the basics (after backups) are

1\. disable anything you don't need (firewalls are part of this... at the very least, the default RHEL firewall closes off almost everything. that way, if you have some poorly configured service running that you don't need, it's less of a big deal 'cause it's not accessible from the Internet.

2\. use reasonable passwords. My opinion is that if you can remember it, it's not a good password, but I'm pretty paranoid. at the very least avoid dictionary words (including 'leet' dictionary words) include mixed case and punctuation. If you can use keys instead of passwords, that's even better. Personally, I always disable remote root login with a password. use a key if you must remotely login with root, but most of the time logging in as you and using sudo or su is sufficient.

3\. stay on the security or announce mailing list for every bit of software you have exposed to the internet, and upgrade when there are holes.

3\. is where your distro comes in. if all the software you use is provided by your distro, and you check the security mailing list every day, you are ahead of most people.

With those three basics, well, you aren't 100% covered, but you have a good start.

<comment><AUTHOR> 2 and 3 seem relatively obvious to me. The mailing list part of 3 was new to me, as I wasn't really aware they existed, but keeping things up to date and upgrading when they're not seemed pretty common sensey.

Regarding #1 though: How do I know what I can and can't turn off? Obviously turning off Apache or something like that is wrong, but there could be less obvious things I may miss.

For the things that need to stay on (and I'm mainly focusing on the AMP in LAMP with this), are they generally good-to-go out of the box with minimal "extraordinary" configuration, or are there good resources to securing them that I should be reading? I guess what I'm asking is, beyond following the slicehost/linode tutorials, how much do I really need to know and where can I find it.

Beyond all of this, I'll address your first point regarding the inherent incomplete security of things: While you can't make anything 100% secure, you should still try your best to prove that statement wrong. Plugging all "known" holes in your security is still a lot better than being ignorant of them.

<comment><USER7> >Plugging all "known" holes in your security is still a lot better than being ignorant of them.

Know that the moment an advisory is out, the bad guys are using automated tools to scan for vulnerable hosts. Plugging known holes is the minimum standard; otherwise you will be compromised in days if not hours.

the vast majority of malicious activity is completely automated, each compromised system being used to compromise other systems. This means that there is a truly staggering number of attackers, and that you will be attacked even if you have nothing of value to take.

this is why watching the security mailing lists for your software is important; even a weekly upgrade schedule may not be enough.

The rest of the sysadmin jazz, eliminating unused programs and stuff like that are really shortcuts to reducing the number of programs who's security problems are your problems. There are holes we don't know about in everything, so the fewer programs you depend on not having holes, the better off you are.

It's good practice to sit there with 'ps' and google and figure out what every process does and how the system responds when a process is killed (especially important if you are on a linux box with an aggressive overcommit and not enough swap, and thus oom-killer issues.)

<comment><AUTHOR> This is all really good information. Thanks.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> Can anyone please give me tips on configuring Pure-FTPd? The thing I need at this stage is just to make a dedicated file hosting from my low-end VPS to relieve my existing project on a shared hosting. For this, I gather, I need to install (1) nginx (2) pure-ftpd and configure it to give write acess to some user to the root directory of nginx.

(1) I achieve by just doing 'yum install nginx' on CentOS. (2) installs the similar way, but whatever I do, I just can't log in with ftp. I guess I need to configure virtual users also, so that I won't have to make a separate unix user for each ftp user that I might need, and keep them ftp users in a separate ftp config file.

</comment><comment><USER11> A server on Amazon (dedicated) is only about 70$/month, is that an option as well? Pretty much no maintenance, just restart if it crashes.

<comment><USER12> You've been downvoted without an explanation as to why that's not a useful suggestion.

The problem is that if you take a "just restart it if it crashes" approach, the service will be very unreliable, and you're not allowing for analysing what went wrong. In fact, taking this approach, Amazon's EC2 images are a really bad option, because you lose any chance of gathering diagnostic info as soon as you switch them off - all the data vanishes at that point.

Secondly, if you're going for a long-running VM, Amazon's machines are _very_ expensive for what they are; I pay roughly a third of what Amazon charge for mine. If you're using them as base load rather than on-demand peak smoothing, you're doing it wrong.</comment></comment>


The NSA Is Building the Country's Biggest Spy Center (Watch What You Say) - <AUTHOR> http://www.wired.com/threatlevel/2012/03/ff_nsadatacenter/ <comment><USER2> Just started reading a history of the NSA [1], and it's very interesting. E.g., the execution of the Rosenbergs was a travesty of due process, but the US had secretly decrypted a message listing them as Soviet spies. Another example, a midlevel employee of US SIGINT efforts told the KGB that the US was capturing and decrypting basically all Russian communication, and the Russian response was to harden their protocols (far less radio traffic, much greater use of one-time pads, basically.) The traitor was never prosecuted, because reporting the evidence against him would have revealed a SIGINT source.

Cryptology became the poor stepchild of US SIGINT efforts after this, because it yielded so little useful intelligence regarding Russia. As a result, the North Korean invasion which started the Korean war took the US completely by surprise. The US was subsequently able to crush the invasion in part because the North Koreans transmitted all communications in the clear, so they often knew what NK military units were going to do before they knew themselves. It took the US about a month to spin this capability up, though, because non- Russian communications had been completely neglected.

This neglect burned the US again when China decided to enter the war. The US could not believe this was happening, despite mounting SIGINT evidence, so China again had the advantage of surprise. China actually was encrypting its military communications in a way that the US could not decrypt (at least initially; I haven't finished reading this section of the book) which gave them a huge advantage in the initial engagements with US forces.

[1] [http://books.google.com/books?id=x_K2rb- OShMC&printsec=f...](http://books.google.com/books?id=x_K2rb- OShMC&printsec=frontcover) (Currently only $3 for the e-book!)

<comment><USER3> I knew all about it, and much more. But not by reading that book - Last month I watched CNN's 1998 documentary about the Cold War. _ABSOLOUTELY AMAZING_. 24 episodes, each about 50 minutes. Tons of never-seen-before footage and interviews with many of the parties involved in the Cold War (Gorbachev, Castro, Kissinger, Reagan, H. W. Bush, and dozens of other well-informed ministers, ambassadors, spies, soldiers and citizens)

But more importantly, it's fair. It doesn't blame Russia while praising America or vice versa. Bot powers did dreadful things during the Cold War, and this documentary shows them all. After watching it, now I have a very deep respect for CNN and Ted Turner.

It's only available on VHS, and only on eBay (or used, at Amazon). If you don't have a VHS player anymore (who has?), contact me ( _edit: for download links, not for selling you a VHS player!_ ).

If you're interested in Cold War history and want to know more, watch this definitive series. You won't be disappointed.

<comment><USER4> I went to contact you but don't see contact information listed on your hn profile. I'm very interested...

<comment><USER3> Oops... firstname.lastname@example.com

Sorry - I thought emails are visible on HN profile.

<comment><USER5> There's a standing feature request to make this more apparent: <http://news.ycombinator.com/item?id=1017933> \- help it out with an upvote. :)

</comment></comment></comment></comment></comment><comment><USER6> _"According to another top official also involved with the program, the NSA made an enormous breakthrough several years ago in its ability to cryptanalyze, or break, unfathomably complex encryption systems employed by not only governments around the world but also many average computer users in the US. The upshot, according to this official: "Everybody's a target; everybody with communication is a target."_

What do people think this refers to? Somebody managed to compile sslsniff, or something more significant? Have they found a key weakness in RSA or similar? Are they just bruteforcing all those crappy ssl certs that are floating around? Does it refer to realtime decoding of GSM? Don't we all believe they can do that anyway? I guess we can only speculate.

Just because I'm paranoid, doesn't mean they're not out to get me...

<comment><USER7> From the article's excitement, I would almost guess that they have a working attack against AES, but that sounds extremely unlikely with the amount of scrutiny AES has received. Still, AES is known to have some very clean algebraic properties, and people have wondered since the AES competition whether those would translate into real attacks -- perhaps the NSA has found a way. At least, the discussions about saving data to decrypt later sounds very suggestive of a break on either Triple DES or AES.

But I should say that you wouldn't have to break AES to break HTTPS and read most of the encrypted conversations on the web. In late 2008 a group of academics broke HTTPS by lifting a digital signature from a legitimately- signed document which gave few HTTPS permissions, onto a document which gave them arbitrary permissions. They did this by breaking the MD5 algorithm, and it caused the community to finally excise the last of the MD5 certificates for SHA1 certificates. But the NSA could do the same with the SHA1 algorithm's known weakness, and could then listen in on any man-in-the-middle attack they wanted. How complex is this? Since 2008, we've had an attack which might work in 2^52 operations or so. For the NSA that's approximately nothing. The Cray computer (one which we know the US government has) does roughly 2 petaflops now, or 2^51 operations per second or 2^67 per day. So it's reasonable to believe that, if they move from eavesdropping to active communication, they can already break HTTPS. (There is a risk in this method, however: if someone catches you doing this "in the wild", then they might notice and raise a big stink about it.)

Their exaflop goal would then be 2^85/year, which would be enough to run publicly-known attacks against Triple DES and perhaps to factor known 1024-bit RSA moduli -- for example the Equifax Root CA is 1024 bit RSA. If you could compromise one of those just once, you could issue certificates of your own -- and it would be extremely difficult if not impossible to detect the intrusion. So with exaflop computing, they could seriously just spend a couple weeks breaking an RSA-1024 modulus and launch undetectable man-in-the-middle attacks against everyone.

It's also likely that they've got more efficient attacks than the public researchers have, since they have access not only to the public research but also to a set of well-paid brilliant minds who work on these problems every day, and have been for quite some time. (It would be nice to have some transparency and know just how far they have gotten, but of course they won't even tell us that. I guess that's a bit of a weird question anyway, like asking, "in the odd event that you might want to stab the Internet to death, we would like to know: how large is the largest knife you own?")

<comment><USER8> _It's also likely that they've got more efficient attacks than the public researchers have, since they have access not only to the public research but also to a set of well-paid brilliant minds who work on these problems every day, and have been for quite some time._

In case people aren't aware, this isn't just hyperbole.

The story of the DES S-Boxes[1] indicates the NSA (actually IBM working with NSA, but still) was roughly 15-20 years ahead of publicly known attack techniques in 1990. I'd imagine the public state of the art is a bit closer now, but there is little doubt they have a big lead.

[1] [http://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA.27...](http://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA.27s_involvement_in_the_design)

<comment><USER9> There were few reasons for mainstream adoption of cryptography in the early 90's. On-line commerce and communication barely existed. Thus little motive existed for public cryptography research and development. By comparison, militaries of the world had decades of experience. Battles had been won and lost because of cryptography.

The cypherpunk movement[1] of the 90's and gradual push towards mass adoption of cryptography for on-line commerce led to the NSA attempting to introduce key escrow via the clipper chip[2] (to enable backdoor access to crypto systems). This plan suffered a quick demise, hastened in part by a serious vulnerability in the scheme being identified by Matt Blaze in '94.

The rate of progress of this movement raised a lot of eyebrows. Crypto currencies were discussed and demonstrated. Julian Assange (and others) demonstrated Rubberhose FS (a deniable encryption system). And if that wasn't extreme enough, Jim Bell started a conversation about the application of cryptography to anonymous crowd-sourced political assassinations (!)...

It should be fairly obvious to see why the NSA (and more widely, the US government) had concerns. These concerns are still valid today with dual-use crypto-anarchy[3] technology such as Tor and Bitcoin being in common use. One side may be trying to prevent this technology being used by Mexican drug cartels, smugglers, etc. The other side sees greater merit in ensuring that populations in Syria, Iran, China, etc can bypass government censorship.

It's well worth reading about this era of computing history and all the well known names that were involved[4]. The insight gained will help with forming opinions on current topics, ensuring that both sides of arguments and all consequences are considered.

In summary, I think it'd be fair to say that mainstream reliance on strong cryptography has dwarfed military usage for a number of years now. The threat is also significantly higher to public/commercial entities because a failure of crypto systems in banking, stock exchange, news and on-line commerce could destroy economies. A break of AES, RSA, etc would primarily be kept secret to prevent economies from collapsing -- not so much to maintain an ability to decrypt meaningless chitter-chatter between millions of ordinary people.

[1] <https://en.wikipedia.org/wiki/Cypherpunk>

[2] <https://en.wikipedia.org/wiki/Clipper_chip>

[3] <https://en.wikipedia.org/wiki/Crypto-anarchism>

[4] [https://en.wikipedia.org/wiki/Cypherpunk#Noteworthy_cypherpu...](https://en.wikipedia.org/wiki/Cypherpunk#Noteworthy_cypherpunks)

</comment></comment></comment></comment><comment><USER7> Bruce Schneier at this year's RSA conference:

"I think in the coming decade, the real threats to the Internet don't come from the Bad Guys, they don't come from the criminals or the hackers, they come from politics and they come from economics, and that's really what I want to spend time talking about at RSA this year."

[http://365.rsaconference.com/community/connect/blog/2012/02/...](http://365.rsaconference.com/community/connect/blog/2012/02/24/rsac2012-podcast- exp-107-new-threats-to-the-internet-infrastructure)

<comment><USER10> And spoken not 50ft from the NSA/FBI/CIA booths attending the conference ..

</comment></comment><comment><USER11> NPR said they are building it there because Utah has the most linguistically talented population in the country due to Mormon missionary work. eBay is building a call center there for the same reason.

<comment><USER12> As a Mormon who attended BYU in Provo, Utah, I can attest that a very large percentage of the young male population is not only bilingual in common and uncommon languages, but there's a deep sense of patriotism. Universities in Utah are heavily recruited for law enforcement (FBI) and foreign service.

I agree that most of the reason for the Utah location is probably cost, but the demographics are also very unique (and yes, fairly homogeneous as well).

<comment><USER13> As with being pregnant, either unique or not.

<comment><USER12> I'm trying to decide if I should be insulted or not. Is the comment stating that the stereotype is that Mormon women are frequently pregnant? I'm not sure what point you're trying to make.

edit: Thanks for the clarifying comments, I didn't catch that the comment was referring to the grammer.

<comment><USER14> To quote an English comedy show: "One can not have gradations of uniqueness. A thing either is, or is not, unique". I believe he is commenting on your use of the term "very unique".

</comment></comment></comment></comment></comment><comment><USER15> HN best practice - link to the non-paginated "View All" page if available: [http://www.wired.com/threatlevel/2012/03/ff_nsadatacenter/al...](http://www.wired.com/threatlevel/2012/03/ff_nsadatacenter/all/1)

<comment><USER8> I strongly disagree with this.

Wired's articles are reasonably paged, and the complete article is very long. On many devices (eg phones) long pages don't always render well. Additionally, a publication like Wired deserves the page views for the good article.

It is different for publications that only have a paragraph per page.

TL;dr: there is no HN best practice.

<comment><USER16> If a site doesn't want to allow people to "view on one page," they can disable that feature.

I think going through multiple pages is a huge PITA, even in the case of Wired. And I think your "many devices" point is probably too much of a corner case to matter.

<comment><USER17> > If a site doesn't want to allow people to "view on one page," they can > disable that feature.

That's not something I'd want to encourage. Whenever the pagination isn't excessive, I'd link to the permalink the site gives, and let users fetch the full article if they so wish.

</comment></comment></comment></comment><comment><USER18> This is very dangerous, we know that there are few levels of separation between people: <http://en.wikipedia.org/wiki/Six_degrees_of_separation>

We also know that there is a very few people that connect people together, the social "hubs".

What totalitarian regimes(Mussolini, Hitler, Stalin, Pol Pot, Kim Jol Il) did was identify those hubs an exterminate them(at first they can't kill them so putting them in jail is enough), and replacing them with puppets, eventually changing society overnight.

It is too risky having someone storing every single communication between people(including cell phone calls). They will understand what you say(a la Siri) and text analyze it and search display it on graphs. With facebook and cell phone connections they have everything to know more about yourself that you know thyself.

When the US debt bubble explodes(that will happen in less than 5 years) and people loose a significant part of their savings and get angry about the status quo I don't know what is going to happen.

The US is becoming more and more of a totalitarian state day after day.

</comment><comment><USER19> I hear Yakov Smirnoff is going to return to Russia and tell jokes about how bad the police state is in the U.S.

</comment><comment><AUTHOR> > the NSA made an enormous breakthrough several years ago in its ability to > cryptanalyze, or break, unfathomably complex encryption systems

What does this entail?

<comment><USER20> From the article, and the premise that massive computing power is being created and required anyway, it sounds much more like a weakness at AES 128-bit that is only practical for a government agency.

It also sounds that they discovered it before 2008, due to the jump in resource timing, i.e. less than 10 years after AES.

<comment><USER21> Well, at least there's no doubt that they have unimaginably large computing power... You can also hear many scientists from national labs hinting to that effect in talks that are publicly available.

<comment><USER16> _hinting to that effect_

hinting to what affect? Having a way to brute force 128-bit AES, or just having large computing power?

<comment><USER21> I meant the large computing power part

</comment></comment></comment></comment></comment><comment><USER22> So the quickest way to cure cancer would be to come up with a new encryption scheme, where the byproduct of brute force cracking it would be simulating the effects of genomics mutations?

</comment><comment><USER23> People good at math, or data mining, or etc might enjoy working for GCHQ. I assume they'd enjoy working for NSA.

There's a bunch of very smart people, with interesting tech, and, uh, low pay.

I don't know about NSA but GCHQ is subject to a lot of oversight; breaking laws would be problematic. Laws get written with specific exclusions for GCHQ. And there are creative methods to evade other laws - US in theory cannot spy on its citizens so they team with UK and ask us to do it for them.

<comment><USER24> FYI: <http://www.nsa.gov/about/faqs/oversight.shtml#oversight5>

</comment></comment><comment><USER25> More pictures:

<http://www.cryptome.org/2012-info/nsa-utah/nsa-utah.htm>

</comment><comment><USER26> This new site doesn't just happen to be located near a couple of internet backbones?

</comment><comment><USER27> If this will be one of the most powerful encryption-cracking facility in the world, can we just set our key strength based on it's computing power? So if they end up being able to crack 1024 bit keys, can we just set our keys to 2048 and be ok? And then when they upgrade, everyone goes to 4096?

I'm not a security expert (obviously), so maybe I'm wrong, but in general I don't see how they'll be able to build new monster computing facilities as fast as consumer hardware can be upgraded to use slightly stronger encryption.

</comment><comment><USER28> If they are actively logging communications for future decryption due to predicted increased computational power, and the allegations of them leaking confidential communications to US firms to gain competitive advantage are true:

Then this is another argument against (foreign/multinational) businesses conducting anything sensitive in the cloud, even if it is encrypted end to end and stored encrypted. Particularly for information that the businesses want to keep indecipherable for many years.

</comment><comment><USER29> Submitting application.

<comment><USER30> haha. I hear they pay pretty well too.

edit: why the downvotes? I'm not trollin, they actually pay a percentage above the standard govt pay scale.

<comment><USER31> If they weren't using all that power to spy on US citizens, it might be a bit more palatable. You can make a case for being nosy when it comes to people who aren't covered by our own Constitutional guarantees, but when it comes to US citizens, due process is something I consider awfully important. (And no, "national security letters" are not what I consider due process.)

Obviously not everything the NSA does is a problem from a Constitutional standpoint, but still... the odds of being ordered to do something I would find grossly unethical are too high for me to want to work there.

Worse still, I could see myself modifying my own ethics over time for the sake of staying in my employer's good graces. How many people can honestly say they would never fall prey to that temptation?

A shame, too, because I'll bet they still have some of the coolest toys around, even in the present age of commoditized supercomputing.

<comment><USER32> The NSA is relatively careful not to do blanket spying on US citizens, at least not directly, outside of specific legally approved programs (the NSLs, combatants, those engaged in communications with a foreign power, etc.). I agree the NSA and military/intelligence overreaches, but the people within NSA do make some effort to obey the law. The right place to change this is with the legislature (and judiciary) -- if there were stronger laws against domestic spying, the NSA would follow them.

It's also quite reasonable (and I'd say honorable) to not work for them, if you think either they're doing something immoral, or it would negatively affect you. I support a lot of the NSA's mission (cyber defense for the US and USG, specific international activity against enemies of the US), but certainly would like to see greater privacy protections in the US, and to protect private citizens (vs. governments) globally.

<comment><USER33> The problem, Ryan, is that when you have a huge super-secretive military government organization whose people "make some effort to obey the law", there's absolutely nothing stopping them from, one day, with no fanfare, choosing to start ignoring the law when and where convenient.

There are no checks or balances on their power and the potential abuse thereof. They operate in a legal vacuum, with carte blanche to do whatever they decide is necessary. Even THEIR BUDGET is classified information. We're not even allowed to know how many tax dollars they're spending to do illegal shit they're not telling us about.

You can support their mission 100% (I do), and still think that they should be entirely disbanded for this reason alone.

Only criminals would operate in this sort of LEGAL environment.

<comment><USER34> You've obviously never worked for a government agency if you think anything could 'just happen' one day. It's hard enough to get things done that you ARE legally allowed to do, let alone anything remotely questionable.

<comment><USER33> I think you're confusing government agencies that have oversight of some kind with those that operate unchecked, like the military intelligence services (NSA, CIA, etc).

They have decades-long histories of doing illegal shit.

[http://en.wikipedia.org/wiki/NSA_warrantless_surveillance_co...](http://en.wikipedia.org/wiki/NSA_warrantless_surveillance_controversy)

<comment><USER34> At no point did I say they weren't doing anything illegal. Just that it doesn't 'suddenly happen'. They're huge, and very, very slow moving.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER35> Interesting historical comparison (865 days ago)

<http://news.ycombinator.com/item?id=915971>

</comment><comment><USER36> What does the NSA actually do?

<comment><USER37> Tap -> Acquire -> Store -> Manipulate -> Analyze -> Supply

</comment></comment><comment><USER38> Obligatory:

<http://xkcd.com/538/>

</comment><comment><USER39> This makes me sick inside. Like it is futilely depressing to my core. I've been trying to fight the government wiretapping and invading citizen privacy since I was a sophomore in highschool.

By time people give a fuck, it's going to be too late.

<comment><USER40> I'm older than you are, evidently. Over the years, as I've read literature from various eras and traveled to various places, I've learned that people can feel under more constant surveillance, and BE under more constant surveillance, in a small, isolated town or village than as citizens of a modern high-technology state. And yet in 1989 people in several parts of central Europe rose up for freedom--courageously doing so even after the Tian'anmen Square Massacre was a worldwide news story--and defeated the secret police organizations of totalitarian dictatorships. You can still fight for freedom. That takes courage, but you'll find the courage if freedom means that much to you. I'm wondering when the tens of thousands of local uprisings that China reports each year in its official press will coalesce into a national movement for freedom.

<comment><USER41> nonsense.

 _1989 people in several parts of central Europe rose up for freedom-- courageously_

there was no need to rise up in central Europe: the regime collapsed by itself, primarily for financial reasons. The countries were surveyed by the West years before, and given IMF loans. The rest in 89 was literally a show, albeit not in theatres but on screens. the regimes just morphed, like now in China.

</comment></comment></comment><comment><USER42> Good news. The more resource spent on electronical intelligence the less money spent on human intelligence. And since humint has proven to be far more efficient, praise the experts for taking the wrong decisions.

</comment><comment><USER43> Remember all those HN users that were deriding me for saying the US is becoming a fascist authoritarian regime... yeah I wasn't just making stuff up.

</comment><comment><USER44> Politicians can and do dictate the law these days, but they can't dictate economics. If the NSA/CIA/Government pulls too much shit the smart people and business will leave. Also, Mormonism is a cult.

<comment><AUTHOR> I think the govt has already broken quite a few of its own rules, yet smart people from around the world flock to Google, MIT, and the like. National security letters, the Patriot Act, illicit war.

I would love to live in Berlin, but my family is here in the states, and the NSA would still intercept my communications in Germany, anyway.

<comment><USER45> And your point is? anyone working in ML and AI knows where large amounts of funding comes from - this was true 30 years ago just as much so today.

</comment></comment></comment><comment><USER46> All your mails are belong to us.

</comment><comment><USER47> _sends virus to tap just opened NSA data center_

Because tapping the biggest tapper is ironic. (not that I will do that/can)</comment>


Website Performance Tutorials - <AUTHOR> http://code.google.com/speed/articles/

<comment><USER2> What I really would like to see is an independent third-party which cares nothing about data mining (maybe the w3c) host commonly used scripts (e.g. jquery) on Akamai and minified/compressed; all the parameters to their optimum instead of the myriad of options people use. They'd be so many browser cache hits.

<comment><USER3> For those who don't care about giving Google their traffic data and aren't already aware of this, Google offers the previously described service.

<http://code.google.com/apis/ajaxlibs/>

<comment><USER2> The jquery one only has a 1 year expiry time...

<comment><USER4> What does that mean?

<comment><USER5> When some server on the Internet gives your browser a file, it includes a metadata called an expiry header (actually, Expires:), which the browser is supposed to interpret as providing guidelines for caching. For example, if I tell you that this web page is good for until midnight tomorrow, and the user requests the same page later today, the browser can (but doesn't have to) serve the user the page out of the local cache, secure in the knowledge that I have told it I would not update the page until at least midnight tomorrow. Since this totally skips the HTTP request for the page the second time, it results in blazing bugs-in-your-teeth speed.

Saying JQuery's expiry time is 1 year in the future means that Google is telling browsers who get the JQuery script "Hey guys, you can rely on this being constant for a year, after that you'll probably want to ask for a new version." The poster above you apparently thinks this is suboptimal, because a user should be able to cache a particular version of JQuery for longer than one year. I think that it is irrelevant, since in actual practice almost no user agent will reliably persist a cache for a year, and 1 extra HTTP request a year isn't enough to worry about, anyway.

</comment></comment></comment></comment></comment><comment><USER6> Can someone post performance tips for Python? Either links or just suggestions. I've been coding in Python for a couple weeks and I'm not sure about what tools I have at my disposal for identifying bottlenecks and subsequently how to address those bottlenecks.

<comment><USER5> My suggestion: your bottleneck is highly unlikely to be Python. Most web applications get to wait on DB access, network latency, and then browser rendering. All the backend optimization in the world just gets you to these bottlenecks faster.

(It is also a whole lot of black magic compared to front-end optimization. See any of the presentations by the YSlow guys -- google [high performance web sites] and look for the slides or videos. They give simple, tested, repeatable "do this and it will work" best practices. Backend optimization, on the other hand, relies far too much on handwavy lore and near-useless-or-actually- harmful micro-optimizations. For example, "StringBuffers are sooooooo much faster than String concatenation!")

<comment><USER7> "your bottleneck is highly unlikely to be Python. Most web applications get to wait on DB access, network latency, and then browser rendering"

I second that. My experience is first look into the DB time and second browser rendering. I have thought Python was the cause for slowness many times and each time it again proved to be DB time. Also, don't run multiple selects to the database for a set of records, make it one select.

</comment></comment></comment><comment><USER8> I would expect something a lot more from google. All these ideas are way too elementary and some are just misguided. Advice like "crop your image"...come on. The misguided ones are things like "use single quotes instead of double quotes when printing in php since one does not look for variables in the string text". The is just misguided and is probably the last thing your should worry about. This is orders of magnitude from any useful optimization that is actually impacting your site performance.

<comment><USER9> Look through the rest also - the advice really varies. I found the part about avoiding browser reflow [1] very useful. Just last night, I was getting usability issues with a piece of JS which was executing with each keystroke and (I now realize) sometimes causing reflow. I fixed it, but now I know what was broken :)

1\. <http://code.google.com/speed/articles/reflow.html>

</comment></comment><comment><USER10> Good stuff, this must be a relatively new section.

I've also found Yahoo UI and performance section a great resource too. For better or worse, Yahoo! apps tend to be heavier on the design and graphics side so they have some good practices in place.

<http://developer.yahoo.com/yui/>

<comment><USER11> I can recommend to install Yahoo YSlow (<http://developer.yahoo.com/yslow/>), a Firebug extension for Firefox. next to the achieved performance test results of a specific page, it also shows how to improve the performance. I think it's a quite useful tool and perhaps a must-have extension for webdevelopers.</comment></comment>